“My Data Or Yours?” Unravelling Multi-Party Privacy (MPP) Among Consumers Of Digital Credit In India

In the wake of India’s unprecedented surge in digital financial services, IIIT-Bangalore and CUTS International hosted an important workshop in Bangalore to discuss the complexity of Multi-Party Privacy (MPP) within the country’s evolving digital lending sector. At this hybrid event, project findings were presented which have been conducted by the two institutions, with funding from the Centre for Effective Global Action (CEGA) at the University of California, Berkeley, USA.

The research led by Profs. Janaki Srinivasan, V. Sridhar, and T.K. Srikanth from IIIT-Bangalore, along with Amol Kulkarni and Asheef Iqubbal from CUTS, provided insights into privacy and consent challenges in digital lending. The study emphasised that while co-owned data is important for expanding access to credit, users ideally expect consent from all parties involved. However, due to practical reasons many users feel constrained by app designs that lack mechanisms for seeking permission before sharing co-owned data. The study also highlighted that Digital Lending Providers frequently use alternative data sources, such as e-commerce transactions and telecom records, to assess creditworthiness for collateral free loans and it raises multi-party privacy concerns for the consumers. Regulations addressing these concerns in digital lending are still evolving.

The workshop comes at a critical juncture in India’s digital financial expansion, particularly in digital lending. The previous financial year saw an unprecedented 154 billion transactions through the Unified Payment Interface (UPI), accounting for approximately 80% of all payments in the country. Building on this success, the Reserve Bank of India (RBI) has announced plans to launch the Unified Lending Interface (ULI), aiming to revolutionise access to digital lending much as UPI transformed digital payments.

The workshop featured insights from leading voices in the digital finance sector. Rakesh Maheshwari, Former Sr. Director and Group Coordinator of Cyber Laws and Data Governance at MeitY, expressed the view that the existing digital lending guidelines released by the RBI and the provisions on consent, data retention, and purpose as outlined in the Digital Personal Data Protection (DPDP) Act 2023 cover most aspects of privacy applicable to digital lending.

Jatinder Handoo, CEO of the Digital Lenders Association of India (DLAI), provided details on the steps taken by digital lending platforms (DLPs) to comply with privacy and data protection regulations. He highlighted the Self-Regulating Organisation (SRO) model initiated by the RBI as a positive step towards better management of consumer and business interests of DLPs. He also mentioned DLAI's initiatives in creating an open financial fraud repository to facilitate knowledge exchange among DLPs.

Ranjeet Rane, Research Head at the Reserve Bank Innovation Hub, stressed the need to balance regulatory interventions with promoting innovation in the digital lending space. He advocated for both process and product innovation, emphasising the importance of leveraging technological advancements in digital financial services while addressing potential privacy and security concerns of users.

Misha Sharma, Head of Household Finance at Dvara Research, while appreciating the research team's methodology, highlighted the need for benchmark studies to compare DLPs and educate consumers. She also noted that current regulations focus on “consumer verification” and should shift towards “consumer protection.”

Sumit Ghoshal, Senior Partner at AZB & Partners, discussed the high costs incurred by DLPs in complying with multiple regulations (e.g., DPDP Act, Consumer Protection Act, Digital Lending guidelines). He stressed the need for integrating all rules and regulations into a unified framework.

Garima Agarwal, Researcher at the Centre for Internet and Society, emphasised the importance of understanding differential privacy needs for different data segments by DLPs. She also commended the grievance redressal process established by the RBI as a step in the right direction.

The workshop concluded with a number of takeaways for consumers, DLPs, and regulatory organisations. The PIs indicated that the report shall be made available soon in open repository for public use.

About IIIT-Bangalore 

IIIT-Bangalore is a premier institute dedicated to undergraduate and postgraduate programs specializing in Computer Science and Engineering (CSE), Electronics and Communication Engineering (ECE), Data Science and Artificial Intelligence (DSAI), IT for Society, and broader fields of IT and research. Situated in the heart of Electronic City, Bangalore, it holds a prominent position in the academic landscape. IIIT-Bangalore is graded A+ by National Assessment and Accreditation Council (NAAC). IIIT-Bangalore secured the 74th position in the National Institutional Ranking Framework (NIRF) rankings for the second consecutive year, 2024 reflecting its commitment to academic excellence. The institute was ranked number 9 among India's Best Technical Universities (Private) by India Today. IIIT-Bangalore contains state-of-the-art infrastructure, eminently qualified faculty, a vibrant alumni community, cutting-edge research facilities, and close industry collaborations.

The institute’s specially designed courses make the students’ cognizant of the current technologies. Experiential learning and practices followed in the institute equip them with the tools and knowledge to solve contemporary real problems. IIIT-Bangalore has consistently achieved excellent placement records every year since its establishment in 1998, thanks to the unwavering support of the industry and the expanding pool of highly skilled alumni.

For more information about IIIT-Bangalore, visit www.iiitb.ac.in