Karnataka High Court : Section 91 CrPC Empowers Police To Seek User Data | Payment Platforms Must Assist Criminal And Cybercrime Probes | Confidentiality Cannot Override Lawful Investigation
Isabella Mariam
The High Court of Karnataka Single Bench of Justice M. Nagaprasanna held that digital payment intermediaries are not immune from investigatory summons under Section 91 of the Criminal Procedure Code. The Court dismissed the plea challenging the legality of a police notice issued to a digital payment platform for furnishing transaction data in an online fraud investigation. The Court held that the statutory powers of the Investigating Officer override the platform’s claims of confidentiality, and that the company is bound to comply with lawful requisitions issued during the course of investigation.
The petitioner, a digital payments company registered under the Companies Act, 2013, sought issuance of a writ of mandamus against the Police, specifically the Central Crime Branch (CEN) Police Station of Bengaluru Rural District. The relief sought was for a direction mandating the Police to conduct the investigation in Crime No. 193/2022 strictly in accordance with the Payment and Settlement Systems Act, 2007, the Bankers’ Books Evidence Act, 1891, and relevant RBI guidelines applicable to third-party application providers.
The dispute originated from a police notice dated 07.12.2022, issued under Section 91 of the Cr.P.C., directing the petitioner to provide confidential transaction data relating to a registered user accused of engaging in illegal financial transactions through the petitioner’s platform. The police cited alleged involvement in online gambling transactions facilitated via the petitioner’s payment gateway.
The petitioner company contended that it functioned solely as a system provider within the Unified Payments Interface (UPI) framework, regulated by the National Payments Corporation of India (NPCI) and governed by the Payment and Settlement Systems Act, 2007. It argued that neither the company nor its personnel were accused in the crime and that it had no role in the disputed transactions. It further asserted that under Section 22 of the 2007 Act and the provisions of the Bankers’ Books Evidence Act, any request for confidential data must be based on a court order, not by a unilateral notice issued by a police officer.
The petitioner also submitted that Section 91 of the Cr.P.C., while empowering courts and police officers to summon documents, is restricted where special laws such as the Bankers’ Books Evidence Act apply. The counsel relied on the argument that these special statutes override the general provision under Section 91 due to their specificity and confidentiality clauses.
In response, the State argued that digital crimes are on the rise and necessitate robust investigatory measures. It asserted that the petitioner, functioning as a payment intermediary, was under statutory obligation to cooperate with law enforcement agencies, especially when fraud is suspected. It maintained that the power conferred under Section 91 of the Cr.P.C. includes authority to summon necessary documents, and the Police, as a statutory body, acted within the scope of its jurisdiction.
The Court heard the matter and reserved the judgment on 04.03.2025, before delivering its verdict on 29.04.2025.
Justice M. Nagaprasanna stated: “The fulcrum of the lis rests on a delicate interplay between multiple enactments.”
The Court examined the relevant statutory framework including the Payment and Settlement Systems Act, 2007, the Bankers’ Books Evidence Act, 1891, the Information Technology Act, 2000, and Rule 3(1)(j) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2011.
Regarding Section 91 of the Cr.P.C., the Court stated: “Section 91 of the Cr.P.C., a general procedural provision permitting summoning of documents during investigation… is not absolute as Sub-section (3) of Section 91… expressly protects the sanctity of the 1891 Act and other statutes.”
On the obligation of system providers under the 2007 Act, the Court recorded: “Section 22 mandates that the payment gateway or any entity regulated under the 2007 Act has a duty to keep the documents in the payment system confidential except, where such disclosure is required under the provisions of this Act and the disclosure is made with the express or implied consent of the system participant concerned or where such disclosure is in obedience to the orders passed by a Court or a statutory authority in exercise of powers conferred by a statute.”
In reference to Rule 3(1)(j) of the 2011 Rules, the Court noted: “The intermediary shall, as soon as possible, but not later than seventy two hours… provide information… to the Government agency which is lawfully authorised for investigative… activities.”
On harmonising the various statutes, the Court stated: “The issue now would be harmonizing the interplay between all the enactments… confidentiality of system data must be adhered, except when statutory authority acting within the confines of its conferred jurisdiction calls for disclosure.”
The Court made the following assessment of the petitioner’s argument: “The petitioner cannot contend being a digital system payment gateway that it will not divulge any information as sought by the Investigating Officer… the provision on which heavy reliance is placed itself permits that all information should be divulged when sought for by a statutory authority under the statute.”
In response to the argument that only a court order could compel disclosure, the Court stated: “Even if it is construed that 2007 Act has overriding effect, the Act itself permits that the information should be furnished.”
Citing prior judgments, the Court stated: “I am in respectful agreement with the elucidation of the High Courts of Bombay, Madras and Kerala, which affirms statutory safeguards under 1891 Act, would not immunise institutions from investigatory summons when criminality suspected.”
Finally, the Court concluded: “Confidentiality must coexist with accountability.”
The Court held that the petitioner’s claim of absolute immunity from disclosure under the Payment and Settlement Systems Act, 2007 and the Bankers’ Books Evidence Act, 1891 cannot be sustained.
It stated that the notice issued under Section 91 of the Cr.P.C. is not illegal per se and is permissible in circumstances where there is suspicion of a money trail involving multiple accounts.
The Court clarified that the power of the Investigating Officer to issue such notice under Section 91 of the Cr.P.C. is within the bounds of law and in conformity with statutory provisions.
It concluded that the production of information by an intermediary during the course of an investigation is not only lawful but necessary for securing evidence related to suspected criminal activity.
Finding no merit in the petition, the Court rejected the petitioner’s contentions, except to the limited extent of observations made during the course of the order. The writ petition was accordingly dismissed.
Advocates Representing the Parties
For the Petitioner: Sri Nitin Ramesh, Advocate
For the Respondents: Sri Mohammed Jaffar Shah, Additional Government Advocate
Case Title: PhonePe Private Limited v. State of Karnataka and Another
Case Number: Writ Petition No. 3757 of 2023
Bench: Justice M. Nagaprasanna
[Read/Download order]
