!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!September!2018!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!1!

!

FIAKS bespoke

Does Google Pay Violates User Privacy?

(Why only Paytm saying it? Why Banks& other players didn’t raise the concerns before tie-up with Google?) Discussion between Founders, Bankers & Fintech

professionals

Disclaimer The views and opinions expressed in this article are those of the authors in an individual capacity and do not necessarily reflect, in any manner, the views, opinions, policies or position of Forum of Industry Academic Knowledge Sharing(FIAKS) or Hrishanu Business Solutions LLP (“HBSL”) as well as they don’t reflect in any manner views, opinions, policies or position of author’s employers. FIAKS and/or HBSL do not take any responsibility or liability for accuracy of any information/ detail mentioned in this articles; or originality of thoughts, views, language or content of the article. Any examples or references to websites, people, entities, economies, institutions, authorities, etc. are only for informational purpose and by usage of the same, neither FIAKS and/or HBSL and nor the author intends to constitute any endorsements or bring disrepute, defame, derogate, incriminate. This article has been published for educational and knowledge sharing purpose

FIAKS community has 25,000+ years of experience consisting of 750+ CEO/CXO Bankers from MNC, Private & PSU banks, 500+ fintech professionals,400+ brands, 300+ CXO cooperative Banks and 100+ founders/co-founders from 24+ countries.

https://fiaks.com

!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!September!2018!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!2!

!

FIAKS bespoke

FIAKS community Question Paytm is raising concerns on Google Pay violation on user privacy and other players like Wallets, payment banks, universal Banks from the industry not so vocal on these concerns in Media. FIAKS Community raises several questions Question1 Are these arguments used by Paytm to restrict entry of these MNC Giants like Google, Facebook, Whats app? Or other players from industry are expecting Paytm to take a lead and fight this battle all-alone for them. Question 2 why Chief Digital Officer, Consumer banking heads, Executive Directors, CEO of the Private, MNC , PSU bank not vocal on such issues ? Question 3 What is the view of the various industry bodies who are suppose to protect the interest of the country and payment players on these issues? Question 4 - Why leading companies payment space not vocal on these issue? They want to avoid controversy? Question 5 - Is it that media is not covering their views? As Paytm ke naam pe paper bikta hai. Hence put only paytm name FIAKS Community Discussions Why community members were so concern on Aadhar privacy but reluctant to talk when it come to GAFA. It was said that this is one of the most controversial and tricky subjects especially when most have accepted and resigned to the fact that GAFA rules. As professionals most would not want to take position as we have jobs and future jobs to protect. As an Indian would love to see Indian entities funded by who ever to get benefit. Get GAFA to invest heavily in India to get access and get more of Indians jobs. Paytm wants to rule in payment or Digital finance space and they consider Google as the biggest competition. Paytm is going ballistic on all MNCs entering payments space! You can live without Aadhaar, not without GAFA. I think industry players are supportive of Aadhaar. It's the privacy conscious junta, which has issues. Also anything against any government will gather more steam Unless defined, what is private and what is not depends on individuals. For example, Google Map is an immensely popular and helpful application and it needs to store my location history to guide me in future. I personally don’t consider this as private information. People want to get the benefits of such apps but keep commenting on privacy issues. If one is so concerned, don’t use the apps or go to the setting and turn off the permissions. You can’t have your cake and eat it too.

!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!September!2018!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!3!

!

FIAKS bespoke

FIAKS Community expert said banks are openly partnering GAFA. We have sold our digital souls to GAFA.. So banks are unable to think outside it. Banks & NPCI tie-up with Google/ what’s app/Facebook means Chief Digital Officers, CISO’s Product Heads have extensively studied privacy issues. And they have cleared GAFA tie-ups. Government / RBI should put moratorium on product launches by these entities if violation of Privacy identified at a later date Another member said why limit this argument to GAFA? Why not Alibaba and Tencent? FIAKS Agreed that it should be for every one. Why no one has raised it so far? Are there any concerns from Alibaba & Tebcent too? Member said what's the concern with GAFA? Why do we believe it's detrimental to us as clients? I think the Cambridge Analytica incident was unusual. He said using and not sharing, customer information for personalized marketing is perfectly alright. Your personal data is mined by them but not shared. On each of these platforms under Ad settings you can switch personalization off. Kindly note a bank (before GAFA) looked at your portfolio to cross sell to you. This isn't any different But what about anyone searching TV on Google and company start showing TV brands to him. When you search properties on Google they start showing HL loan, HL insurance product next time. Isn’t this data sharing with companies? Please understand what's not acceptable is them sharing your data with their clients. What illustrations you gave is not data sharing. As a marketing platform they don't share this info. This is achieved when businesses invest in a DMP (data management platform). They track your behavior and then use digital media platforms to render personalized ads. The fear largely is that Google already knows so much about you and will share this info across it's various platforms. E.g. if it knows your energy service provider is Adani, if you're googling electricity bill payment deals they'll be able to show you a Google pay ad. Their plan all along has to be to monetize consumer data. The other example is they will use payment behavior to partner with lenders who then offer loans to Google pay customers Ok then what is privacy concern Paytm raising? To me Paytm fears that there's someone who has more data than the consumer than them Every digital company thrives on data and mining which is the core essence of future profitability take any example Google, FB etc. Here issue seems to be of True small fish vs big fish fear. They're scared they'll get beaten by Google with much lesser investments on Google's part The questions why is it that banks are not worried?? Shouldn’t all industry players be under threat by GAFA. It was said not till they can do everything banks can. For banks they're partners who can help you sell your products. Of course we as a bank ensure that we abide by DND even when we reach out to our customers on these platforms. i.e. if a customer has opted out from marketing communication, we will exclude them from such channels as well

!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!September!2018!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!4!

!

FIAKS bespoke

Another member said anyone collecting consumer behavior pattern from multiple data points across a consumers daily lifestyle is in a far better way position to predict his behavior and sell more. The key difference between Financial Services players/Paytm and Google is that Google touches almost every aspect of a person's daily life and is clearly likely to be the winner. The future will belong to those players who can aggregate multiple services under one umbrella right from the time the consumer wakes up till he sleeps. Jio with its Telcom, Broadlands, DTH, Ecom, Video content, Jio Money and many other business is poised to give even Google a run for its money in the future. Given a choice Paytm would do the same if they had access to ride sharing, Video content and other platforms. So it looks more like sour grapes than a utopian moral high ground. Someone should ask Paytm or anyone raising privacy concerns on why they are using Android phone which is allowed only after logging in to their free Gmail account? Privacy concerns about data sharing has remained always and has been periodically addressed by laws in different countries. Why target Google pay, they should target Android and Google itself Competition is getting tougher for the payment players .I wonder why similar concern is not raised for PhonePe. They are also sharing data with parent flipkart. So protection is what Paytm is trying to seek. Let us take a banking example. ICICI bank for example. You open a retail account and suddenly ICICI pru life ICICI Lombard ICICI cards ICICI brokerage everyone is after you. How? Why is the company sharing the data with the others? You open a Paytm wallet and you start getting offers from Paytm mall. Why? Big data and analytics is the new normal when it comes to ways of doing business. And people who aren't as good as GAFA are crying foul. There have been incidents outside of the ethical realm but it's not a new issue. If these are not concerns I fail to see how sharing data with parent company is a concern in case of Google pay. Response to be purely from privacy angle. Is it violated or not? What one can do in future is not being debated. Currently does Paytm state privacy concerns on Google as in press. Is it Correct or Incorrect? Let’s not discuss other examples. Response provided was Yes it would be a regulatory violation if the data goes out of the country and this is the mandate from RBI not to do so Competition is getting tougher and hence protection from big brother government. Like ola went against Uber to the government and flipkart went to the government against amazon flaunting their desi credentials, conveniently forgetting their shareholding.. Let Paytm answer why they converted my wallet into Paytm payment bank account. This is also a violation of the data privacy. For which they went door to door to complete the kyc and get approval almost coercively to get payment bank accounts. So pot calling the kettle black. Anyway I admire Paytm and Ola and flipkart on how they have actually taken a PayPal and

!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!September!2018!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!5!

!

FIAKS bespoke

Uber and Amazon idea and indianized it to give the originals a good run for their money. Along with a lot of desi innovative ideas. But I feel these concerns are being raised as protection and unfair competition measures Responding to the debate FIAKS community expert said every one knows what is right & what is wrong? The said companies are transnationals’ & they own the Governments whether we like it or not? Hence over a period of time all of us will be subject to this transnational companies hegemony & threat. Happy that Paytm has taken on this massive task & hopefully come out the winner. Were possible all of us should be fighting together with Paytm to limit the access the transnational have & make them work Subject to the laws of India & not impose theirs on to us? RBI & NPCI should not have been in a hurry to allow these companies access to Indian Banking environment so easily! Will Paytm be allowed in USA so easily? I know what struggle a cross border remittances company had in USA to get each state license to do cross border remittance business. Whereas Western Union & others being local had their license. Finally Indian remittances company got out of this business. Responding to this another expert said Yes foreign companies should be under more stringent conditions. But what is foreign is a confusing status. Are any of flipkart, Paytm or anyone else really indian? Banks have lost ground on payments to tech companies only because banks are forced to play the game out of profits they generate whilst tech companies play the game out of capital so there never was a level playing field. But banks have taken it stoically not running around asking for protection. People have to learn from them on how to go back to the drawing board and dig deeper to stay relevant to customers. One member said that I thought banks enjoy the biggest protection from RBI/Government. Has any depositor lost his/her money? Are Foreign Bank allowed entering into India by RBI? Are banks allowed to fail? Protection works only upto 1lac per person for consumers as far as I know. Agree but has anyone lost money in the bank. Global Trust Bank (GTB) went burst but depositor money was protected by Government /RBI FIAKS community expert said Shareholding is one aspect, the sentiment, behavior, origin is another. That way all companies have shareholding from foreign entities. Even ICICI / HDFC are classified as foreign entities. A venture is known by its founder. Vijay and One97 are as Indian as one can get. Banks also do not play the game out of profit but capital. If that was so many PSU banks would have been shut by now, The NEW banks are also playing on capital only. But going back to FIAKS Community Question on Privacy, I think we have made a fundamental mistake of opening up the market early to these entities. I think I said on this forum. Like mines, spectrum, etc have been national resources in the current world customer data is the national resource and needs to be protected, monitored. And would increase with increasing geo-political stress on trade so an eye for eye would make whole world blind. Great. Welcome to future world. Nehru was the PM when India was socialist. We are in 2018. Modi is the PM in the capitalist India.

!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!September!2018!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!6!

!

FIAKS bespoke

Question raised by community is on Privacy violations by Google in Press Release. What are these violations? The FIAKS Community expert said that If a consumer is giving express confirmation, why is it a violation of consumer privacy? Another member said who reads these terms & conditions Btw even most apps in India share consumer data with third party. The clause “third party” has been kept to include and not limited to:

• banks • payment acquirers • back office service providers where this data is processed etc.

Another member said I think all are sharing. Some add in T&C and share other don’t write and still share as no formal mechanism to check this unless something goes terribly wrong. The FIAKS community expert said that that data is of a bank and bank aren’t allowed to share data. Yes but if they wish to and share and use who would know till or at all if something goes wrong When a SBI Visa card consumer swipes his card on a POS machine of Mswipe which processes for Corporation bank (acquirer), the transaction might go thru a FSS platform, a ACI switch and then have a back office owned by Genpact. The data has moved across many companies. Third party in payment transaction is used to cover such institution. Yes not shared for marketing. Not true. The data belongs to the consumer, the txn bank, the scheme, which is processing, the merchant. Responding to the question an expert said we process for banks now across various channels / terminals & interchanges. But we do not retain any information with us & even if we do; we do not have direct access to info as banks use their security keys at our location to protect their data. And we are subject each bank audit minimum twice a year, and in addition PCI PADSS RBI/NPCI VISA MCI etc on behalf of our Banks. Please tell me if any of the AWS Google FB & Other agencies are subject to this? And what about VISA MCI AMEX who Audits them? The banks & companies like FSS , PAYU give business to these companies? Do they have the right to audit them for compliance? Answer is big NO. We pay thru our nose to get audited but they get away as they are dominantly present in India & across the world! Member said PSP partner banks of Google Pay will most likely have the rights to audit the UPI related systems of Google. It was said that policies are not connected/questioned here of any particular company. Under the privacy laws which are being practiced by most European countries and US, it is still obligatory for them to let the consumer know that “third party” will have access to the data. Hence the reference to third party

!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!September!2018!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!7!

!

FIAKS bespoke

In general they are not subject to Audit! That was my point. Some mechanism to check how they use / misuse the data should be there even if consent is given by consumer? But they do it after taking the consumer permission. That is not considered as violation of privacy. Your Point is valid. But customer doesn’t know what consent he /she is giving. As no one is reading T&C. Will anyone agree it they are made to understand the specific clauses of T&C . Another Question is should companies participating in the banking payment be allowed to share data by putting some T&C in font size 8 and some clause on page 10. Google is not regulated. Banks are regulated. Obligation is for the banks not to share data. An expert said In law you aren’t pardoned for being ignorant. Sorry. Responding to this member said telling the consumer or taking "explicit" approval from customer does not address it. In any case the approval is buried in terms. It also does not say what the approval is for. Its a blanket approval, We are discussing more on principles to say that (if you were regulator / govt), would you not have to treat everyone equal? Would you not either allow everyone to take customer consent and build businesses on that or not allow anyone to do it or monitor it since you are now creating security risk? A level playing field is a must. Another member said People are using Andriod App without knowing what all consent they are giving. We trust banks and let it not happen this way in banking and payment. Check these links: 1. Google reportedly bought Mastercard data to link online ads with offline purchases-TheVerge https://www.google.co.in/amp/s/www.theverge.com/platform/amp/2018/8/30/17801880/google-mastercard-data-online-ads-offline-purchase-history-privacy 2. PayPal reveals it shares customers' data with more than 600 companies https://www.telegraph.co.uk/technology/2018/04/27/paypal-reveals-shares-customers-data-600-companies/amp/

Member made recommendations that

• Riding on bank license is excellent proposition for GAFA and has ensured no regulation headaches to them. Hence make these companies come under some regulations. Like PPI and not leave this responsibility to the banks to check them. We all have faced bank audits.

• Let third party companies like E&Y etc also submit an independent audit report to regulators quarterly

• These companies to have Local office & staff • Call centre / email support 24x7. Check any one can easily locate call centre

numbers of Google. • Data localization

!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!September!2018!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!8!

!

FIAKS bespoke

Those terms and conditions apply to the highest levels of consumer privacy. You can check with your lawyers. When such practices finally come up before court it will always be struck down enough history of practices, which are on the borderline of ethics being struck down. Member said completely agree. credit card terms also allowed bankers to charge the rates they charged, but was not accepted. Even large corporates got away on as complex a product as derivatives which their CFOs signed and made money but denied and said they did not understand when markets tanked and bankers had to take the brunt. Oriental law does not follow the US view - whats written is law. Our law goes by the essence of transaction and power equation. This though is a separate discussion. None is arguing from customer viewpoint here. Member posted various T& C of Google and marked the objectionable once below:

!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!September!2018!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!9!

!

FIAKS bespoke

The debate concluded with FIAKS Community expert saying the kind of clauses they have put in Google Pay gives them virtually full control over what they can do with your data. Permissions given to any app is now meaningless as the data they collect and use goes far beyond what app permissions seek to control. So, for most unsuspecting users the app permissions (esp on Android) gives them a false sense of security and privacy. 99.99% don't read and don't understand T&C. Shocked to see that they can even share your address with third parties. "Payment instrument details" is also suitably vague and could potentially include bank account number, card number, etc.

Conclusion

Ms Anuradha Panditrao, Founder, Forum of Industry & Academic Knowledge sharing (FIAKS) acknowledged the contributions of the FIAKS Community members in creating intellectual pull by participating in the discussions. She said after reading Google Pay T&C, the concerns raised by Paytm seem to be valid. As to why others are not raising their voice, I guess it takes one big guy to lead the charge and then others would follow.

!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!September!2018!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!10!

!

FIAKS bespoke

FIAKS Community Experts (participated in the discussions): • Mr Nabunkar Sen, Former SVP & CISO, Axis Bank • Mr Ruchit Jangid, Vice President – eBusiness , Thomas Cook India Ltd • Mr Rana Sinha Ray, Head Technology, TimesofMoney

• Mr Manish Khera, Former Founder, MD & CEO, FINO • Mr Nagaraj Mylandla, Chairman & Managing Director, FSS • Mr Bipin Preet Singh, Founder & CEO MobiKwik • Mr Naveen Surya, Chairman Emeritus, Payment Council of India • Mr P N Vasudevan, Managing Director & CEO, Equitas Small Finance Bank • Mr Ravi Shankar, Co founder & CEO, Active Intelligence Pte Ltd

• Mr Riaz Maniyar, Founder & CEO at easy2lend.com • Mr Shashank Kumar, Co- Founder at Razorpay • Mr Sony Joy, CEO Chillr • Mr Sandeep Todi, Co-Founder & CMO, Remitr

• Mr Dhruv Shankar, Head Digital, Standard Chartered Bank

• Mr Vijay Shekhar Sharma, Founder One97 & Paytm

• Mr Amrish Rau, CEO PayU India, Naspers Group

• Mr Abhishek Arun, Vice President, Paytm

• Several other CEO/CXO Bankers & Fintech professional on FIAKS Forum

To join the FIAKS community. Visit https://fiaks.com