PIL in Karnataka High Court claims Canara Bank tender for procuring EMV cards ignores data protection laws

A Public Interest Litigation (PIL) has been filed before the Karnataka High Court challenging a recent tender invitation issued by the state-run Canara Bank for procuring credit, debit and pre-paid (EMV) cards.

The tender has been challenged citing the Bank's failure to fix any accountability on the bidders for protecting sensitive personal and financial data of its customers.

The PIL filed by lawyer Ramaditya Tiwari was mentioned by Senior Counsel Dhyan Chinnappa on Wednesday before a bench of Chief Justice NV Anjaria and Justice K Aravind seeking an urgent hearing.

Chinnappa told the Court that a recent Request for Proposal (RFP) by Canara Bank had been prepared in undue haste, without considering the laws and responsibility to protect personal and financial data of millions of customers.

The Senior Counsel further submitted that while banks mandatorily need to ask bidders to comply with provisions of the Information Technology (IT) Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules (SPDI Rules), Canara Bank in the present has wrongly sought compliance with the Digital Personal Data Protection (DPDP) Act that is yet to come into force.

“The respondent Bank wrongly mandates compliance of DPDP Act which is yet to come into force. The RFP is entirely silent on the obligations required to be met by the successful bidder in line with the prevalent law to ensure protection of the customers of the respondent bank,” the petition claimed.

Such error will leave sensitive personal and financial data of millions of customers of the Bank vulnerable to leaks and misuse, it was contended.

The Court heard Chinnappa briefly before deferring the matter for further consideration on October 25.