Case: PhonePe Private Limited v. State of Karnataka & Anr. Date of Judgment: 29 April 2025

Background

In a significant judgment affecting digital intermediaries, the Karnataka High Court has clarified the powers of police authorities under Section 91 of the Code of Criminal Procedure, 1973 (CrPC), in relation to the disclosure of data held by payment platforms like PhonePe.

The case arose from a complaint which alleged that certain merchants were using digital platforms to facilitate illegal gambling transactions. The investigating officer issued a Section 91 CrPC notice directing PhonePe to furnish sensitive data including merchant details, KYC, IP logs, and transactional records.

PhonePe challenged the notice, asserting that it was merely an intermediary under the Information Technology Act, and a system provider regulated under the Payment and Settlement Systems Act, 2007. It further relied on confidentiality provisions under that Act as well as the Bankers’ Books Evidence Act, 1891, arguing that disclosure could be made only pursuant to a court order and not on the basis of a unilateral police notice.

Issues

The Court examined:

• Whether police officers can issue notices under Section 91 CrPC to intermediaries for confidential financial and user data
• Whether special laws like the Payment and Settlement Systems Act, 2007, and the Bankers’ Books Evidence Act, 1891, override general procedural powers of the police
• How to balance the need for privacy with the requirements of lawful investigation

Key Observations

The Court undertook a detailed analysis of the applicable statutory framework:

• Section 91 CrPC allows courts or investigating officers to summon documents necessary for investigation, but is expressly made subject to special laws like the Bankers’ Books Evidence Act
• Section 22 of the 2007 Act mandates confidentiality of payment system records, but permits disclosure if ordered by a court or demanded by a statutory authority
• Section 6 of the 1891 Act restricts inspection of banking records, generally requiring a court order
• Rule 3(1)(j) of the IT Intermediary Guidelines, 2021, requires intermediaries to respond to law enforcement requests within 72 hours, provided such requests are in writing and specify the purpose

The Court harmonised these provisions, holding that:

• Investigating officers under CrPC are statutory authorities for the purposes of Section 22 of the 2007 Act
• The confidentiality obligations under both the 2007 Act and the 1891 Act are not absolute and must yield to statutory processes
• Section 91 notices are not per se illegal, especially when linked to a legitimate investigation into money trails and digital fraud
• There is no need to insist on a court order in every case, provided the request is issued by a competent authority

The Court relied on precedents from the High Courts of Bombay, Madras, and Kerala, which have held that institutions cannot claim immunity from investigatory summons merely on the ground that the data is confidential.

Conclusion

The Karnataka High Court dismissed PhonePe’s petition and upheld the legality of the Section 91 CrPC notice. It ruled that:

• Intermediaries such as PhonePe cannot rely on data confidentiality as a ground to deny information sought in a lawful investigation
• While consumer privacy is important, it cannot be used as a shield to obstruct legitimate criminal proceedings
• Confidentiality must coexist with accountability

Although this judgment arose in the context of the Bankers’ Books Evidence Act and was focused on a digital payments platform, the reasoning adopted by the Court can have broader implications for other intermediaries, including those operating in e-commerce, telecom, and social media, especially in the context of compliance with investigatory summons and data production requests.

Compliance Note

Entities functioning as intermediaries or system providers are advised to revisit their internal standard operating procedures (SOPs) for responding to police notices and information requests. Clear documentation, legal vetting, and timely response mechanisms are essential in the present regulatory environment.