In a bid to make transactions through e-wallets safer and strengthen the grievance redressal mechanism for consumers, government has released a set of guidelines for wallet firms.The draft Information Technology (Security of Prepaid Payment Instruments) Rules 2017 which have been released for public consultation by the ministry of electronics and IT cover an entire spectrum such as protecting consumer information, especially financial data.
The Rules mandate that each Prepaid Payment Instruments (PPI) company or wallet firm will have a privacy policy posted on its website. It will also have to appoint a chief grievance officer, the contact details of whom will have to be prominently displayed on the website.
The grievance officer will have to "act upon" any complaint within 36 hours and "close" it in a month's time. The draft also mandate that companies have enough safeguards in place to avoid any hacking attacks and if there is one, it is to be swiftly reported to the government agencies.
“Every e-PPI issuer shall have in place and publish on its website and mobile applications the privacy policy and the terms and conditions for use of the payment systems operated by it in simple language, capable of being understood by a reasonable person,” said the draft.
It added that the policy should include details such as consumer information collected, its uses, period of retention of information, purposes for which information can be disclosed and to whom especially with law enforcement agencies.
It should also have details on security practices and procedures, name and contact details of the grievance redressal officer along with mechanism for grievance redressal.
Vineet Singh, chief business officer of Mobikwik said that the company’s response time is well within what has been prescribed in the guidelines.
“We have a 17 hour call centre and any complain can be filed through the app or the website. The turnaround time which is anywhere between 24 to 48 hours depends on the nature of the complaint,” said Singh.
The country’s largest wallet firm Paytm did not comment on the draft guidelines.
Ajay Kumar, additional secretary, ministry of electronics and IT said that the draft rules will ensure that the personal information of the consumers is secure. “Also, there needs to be adequate data security and grievance redressal,” Kumar added.
The guidelines say that the personal information of the customers will be treated under Section 72A of the Information Technology Act, and the financial data of the customer shall be deemed to be sensitive personal data under the “Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and every e-PPI issuer shall maintain and implement the practices and procedures prescribed in those rules.”
Every wallet shall ensure that end-to-end encryption is applied to safeguard the data exchanged and shall retain data relating to electronic payments only till necessary.
The guideline also mandate that CERT-In (Indian Computer Emergency Response Team) shall notify the categories of incidents and breaches that are required to be reported to it mandatorily.
“CERT-In may require e-PPI issuers to notify customers of cyber security incidents or breaches if the incident or breach is likely to result in harm to the customers,” added the draft.
The ministry has invited comments on the draft till March 20, post which it will start the process to finalise them.
0 comments:
Post a Comment