Delhi Police issued a notice to Razorpay under Section 91 of the Criminal Procedure Code, 1973 (“Section 91”) while it was investigating Mr Mohammad Zubair, a fact-checker and founder of Alt-News. In compliance with the notice, Razorpay shared the personal information of donors of Alt-News without informing Alt-News or the donors. In this #Privacyofthepeople post, we explain the scope of Section 91 notices, how they may impact your right to privacy and what remedies you have under law. Since IFF uses Razorpay to receive donations, we also explain the steps we are taking to protect donor privacy.
Why should you care?
Most people make several payments using the internet every day. These include the payments we make for travelling or buying groceries or ordering lunch. These also include the donations we make to the causes we support. All these transactions, individually and in aggregate, reveal a trove of information about us such as our name, age, and address but could also indicate our political affiliation or sexual orientation or who we spend time with. We engage in these transactions because we trust that your personal information will remain with those whom we share it with. But Section 91 allows the police to access this information. They can ask Google for your search history, Uber about where you travelled, or Razorpay, whom you donated to. Concerned? Read on to find out what Section 91 is and if there are any limitations to it.
What is Section 91?
Section 91 empowers any officer in charge of a police station to issue a written order to any person for the production of any document that is ‘necessary or desirable’ for the purposes of any investigation, inquiry, trial or other proceedings. When a person receives an order under this provision, they can either choose to comply and provide the information they have or decide against complying by simply refusing or by challenging the order before the appropriate Court of Law. If they choose to not comply, they may be prosecuted under provisions of the Indian Penal Code (175, 186 and 187) for obstructing the investigation.
Mr. Abhinav Sekhri, a criminal trial lawyer and Of-Counsel at IFF, has explained that such prosecution may be ‘far off in the future’ but the police, perhaps with a questionable basis, could take coercive measures against the person that has not complied with the Section 91 order. In his blog post, he detailed the case of Alibaba Cloud Services which did not adequately respond to a Section 91 order because of which the police issued an order to a bank to freeze all their transactions.
Delhi Police’s notice to Razorpay under Section 91
On June 27, 2022, the Delhi Police arrested Mohmmad Zubair over a tweet from 2018. Later they claimed that he may have violated provisions of the Foreign Contribution (Regulation) Act, 2010. In response, Alt-News stated that they only take donations from Indian bank accounts. This led to Delhi Police issuing a Section 91 order to Razorpay. According to public statements by Alt-News and Razorpay, the order asked Razorpay to provide ‘transaction data’ which would include personal details of the individuals who made donations to Alt-News through the Razorpay platform.
Razorpay, after seeking legal advice, complied with the request and shared the information which was sought. This understandably led to outrage amongst donors of Alt-News who were concerned about the breach of their privacy. To assuage the concerns, the CEO and Co-Founder of Razorpay issued a statement claiming that Razorpay had not shared the PAN, address or pin code of users as the scope of the notice was limited to whether Alt-News received any foreign donation or not. The statement also mentioned that Alt-News was enabled to receive only domestic payments. Notably, the statement did not clarify the nature of the data which was shared.
Can Section 91 orders be challenged?
- Section 91 orders cannot unlawfully restrict the right to privacy: The Supreme Court in District Registrar and Collector, Hyderabad v. Canara Bank and Ors., (2005) 1 SCC 496 has held that the ‘right to privacy deals with persons and not places, the documents or copies of documents of the customer which are in Bank, must continue to remain confidential vis-à-vis the person, even if they are no longer at the customer's house and have been voluntarily sent to a Bank.’ Thus, even when you have shared personal information with third parties, such as Razorpay, you have a right to ensure that the information remains confidential. The right to privacy can be restricted by the State only in accordance with the Supreme Court’s decision in K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1 which requires that any restriction must be lawful, necessary, proportionate and least restrictive.
- Cannot engage in roving and fishing inquiries: Section 91 requires that the information the police have sought is related to the investigation they are conducting. As we have pointed out before, these orders cannot be unduly broad and cannot definitely be used to censor speech.
However, any decision to challenge Section 91 orders comes with its own difficulties.
First, the provision is extremely broadly worded which limits the chances of success before the Court of Law. The police can direct the production of anything that is ‘desirable’ for investigations. As Mr. Sekhri puts it, ‘anything can be desirable for the investigation.’
And second, the limited circumstances where Courts have interfered with Section 91 orders are those situations in which there wasn’t even an ongoing investigation, proceeding, trial or inquiry and yet the order was issued by the police.
It is also worth noting that in our research, we did not come across cases where third parties have challenged Section 91 orders. The orders are challenged by those who are issued the order.
Does the Data Protection Bill, 2021, protect your financial data from law enforcement agencies?
The Data Protection Bill, 2021 (‘DPB, 2021’) defines financial data as sensitive personal data which is a subset of personal data. Clause 11 imposes an obligation on data fiduciaries which includes the law enforcement agencies (‘LEAs’), to not process any personal data except with the free, informed, and specific consent of the data principal. However, Clause 12 permits LEAs to process personal data without the consent of data principals if it is permitted by any law made by the Parliament or the State Legislature. Thus, even after the enactment of data protection legislation, LEAs can continue to issue Section 91 orders seeking personal data. But as stated above, the constitutional limitation of lawfulness, necessity and proportionality, as recognised by Puttaswamy, will continue to apply.
Separately, Clause 8(3) of DPB, 2021 requires data fiduciaries such as Razorpay to notify individuals when they share their personal data with third parties including LEAs. The Joint Parliamentary Committee has recommended that this obligation to notify does not apply when such a notification can prejudice any function of the state authorised by law. In Razorpay’s case, in our opinion, such notification would not have caused prejudice to the ongoing investigation.
In any case, the existing law also does not prevent data fiduciaries from notifying individuals when their personal data is shared with the Government or third parties. Such notification is necessary because it will enable data principals to take appropriate action and it should be made an industry practice.
In addition to the above, it is also important to note that the Union Government is conducting a comprehensive review of the Indian Penal Code, 1860 and Code of Criminal Procedure, 1973. We hope that the limitations upon the power of LEAs to issue a notice under Section 91, as recognised in Puttaswamy, are codified through the proposed amendments.
What is IFF doing to protect donor data?
Delhi police’s Section 91 order to Razorpay has worried us. Maintaining the privacy of our donors is a priority. We are taking the following steps to protect your personal information:
- We started accepting donations as a publicly registered non-profit in 2019. Since then, we have used Razorpay for processing payments. Now, we are offering you a choice to give to us through either Cashfree or Razorpay. This step diversifies the servers where the data of our donors is stored.
- All our donor data is stored with ERPNext which is built on open-source software that stores data with the highest standards of security. We have two-factor authentication and access controls to the platform.
- We have sent emails to Razorpay and Cashfee providing them details of a point of contact at IFF (Executive Director and Chief of Staff) and urging them to inform us and our donors in the event they are compelled to share data of our donors with law enforcement agencies. As stated above, existing law does not prevent them from informing us when they share data.
The order to Razorpay highlights existing gaps in the law. Law enforcement agencies have been conferred extraordinary power without sufficient independent oversight. Ultimately, irrespective of the steps we take as an organisation, the privacy of Indians and our donors can only be guaranteed when there is a law regulating government collection of data.
We believe that the current iteration of the Data Protection Bill is not sufficient to address these concerns. It does provide safeguards to prevent abuse by law enforcement agencies. That is why we will continue with the #Privacyofthepeople series which highlights our concerns with the Bill and advocates for legislation which protects the privacy of Indian citizens.
- Previous blog post titled ‘IFF questions the legality of Tripura Police’s direction to block accounts on Twitter’ (link)
- Notice to Twitter Inc under Section 91 of the Code of Criminal Procedure (link)
- IFF’s representation to West Agartala Police dated November 8, 2021 (link)