Paytm, a digital wallet used by more than 230 million people in India to make cashless payments, shared with the Indian government the personal data of users in a geopolitically sensitive region, according to a report published by Cobrapost, an Indian investigative news agency.
On Friday, the news agency released a video where a reporter went undercover and recorded Paytm’s vice president, Ajay Shekhar Sharma, saying how the company had handed over personal data of users in the state of Jammu and Kashmir after Sharma personally received a call from the prime minister’s office following incidents of stone-pelting by Kashmiri Muslims against India’s armed forces, something that happens frequently in the region.
“They told us to give them data, saying maybe some of the stone-pelters are Paytm users,” Sharma says in the video. He also talks about his close ties to the Rashtriya Swayamsevak Sangh, a right-wing Hindu nationalist organization known for being the ideological front of India’s ruling Bharatiya Janata Party.
Paytm, an $8 billion company which counts Japanese conglomerate SoftBank and China’s Alibaba Group among its largest investors, was founded in 2010 by Vijay Shekhar Sharma, Ajay Shekhar Sharma’s older brother. Paytm’s growth, especially in the wake of “demonetization,” when Indian Prime Minister Narendra Modi banned most high-value currency notes overnight, made Vijay Shekhar Sharma India’s youngest billionaire at 44.
On Friday evening, the company responded to the controversy by tweeting that it had never shared user data except with law enforcement agencies “on request.”
The statement prompted backlash from Indians who questioned why the company was giving away user data to law enforcement agencies simply “on request” without any legal precedent.
Contacted for comment, a Paytm spokesperson pointed BuzzFeed News to a blog post published by the company.
“Our policy allows ONLY legally compliant data requests through a thorough process from law of the land to get access to data for necessary investigations,” the post said. “To further clarify, in the past, we have neither received requests nor shared any data without a legally compliant request from a bonafide agency and through proper process and channels.”
When asked to explain the discrepancy between the tweet and the blog post, the spokesperson told BuzzFeed News: “Blog carried detailed view of our immediate tweet on the matter. It is clear that we have never got any request nor shared any data.”
The Paytm data-sharing controversy is a moment of reckoning for India’s startup ecosystem as users demand more transparency about how the country’s startups share users’ personal data with the government and law enforcement agencies, especially since India doesn’t have a privacy law for its citizens.
BuzzFeed News reached out to more than half a dozen of India’s largest startups seeking comment about their data-sharing policies with India’s government and law enforcement agencies. Those contacted included Paytm’s largest competitors, MobiKwik and FreeCharge; India’s largest travel websites, MakeMyTrip and Cleartrip; Uber’s biggest Indian rival, Ola; Walmart-owned Flipkart; and India’s biggest food delivery startups, Zomato and Swiggy.
“We do not share any of our customers’ personal information with anyone including other individuals, organisations, corporations, authorities, or governing bodies,” said MobiKwik in a statement issued to BuzzFeed News. “The only exception in sharing customers’ personal information is when any law enforcement agencies or court needs it with respect to a specific case.”
None of the other startups responded to BuzzFeed News’ request for comment at the time of publication.