India's Data Protection Law Challenges Digital Lenders

“The industry is seeking relief to let the lenders continue accessing and using specified borrower data for the entire duration of a live loan, even if the borrower tries to withdraw consent mid-tenure.”

“RBI… has told digital lenders they can’t look into the photographs on your phone… and you can’t contact other people on the contact list… because those were egregious behaviours… so the RBI blocked it.”

“When lenders start sourcing a customer, device-intelligence signals also come into play such as metadata and behavioral biometrics that feed into models to gauge whether the applicant looks legitimate.”

“But…the industry will have to really distinguish between what is a mandatory regulated use case requirement… versus something…where they have option to withdraw the consent.”

“If there’s a law which sort of requires retention of data for a longer period, then that law will supersede (user consent).”

“As per the digital lending guidelines, a lender cannot continuously access phone memory or the phone storage data.”

“A third use case that has emerged is lenders proactively ask consumers for their consent to monitor their balance, not transactions, but just the balance.”

“Lenders increasingly request post-loan data to monitor the deposit account once they make a loan.”

“That is now being replaced by a fully-digital process, where the users journey during the loan application transfers to OneMoney… and once the user provides consent, it becomes a consent artefact. OneMoney will then present this signed consent artefact to the bank in an encrypted format.”

“India now has about 17 operational AAs, covering data from roughly 240 crore accounts. The system processes about two crore consents a month, resulting in roughly 40 crore monthly data deliveries.”