Perspectives on the harms of unregulated fintech

According to findings by FMA, the main target appear to be Android phone users between 21 and 40 years of age, most likely due to their income-earning potential. While specific procedures and requirements may vary between lenders, the overall process is made up mostly of common features. For example, many lending entities use social media sites and apps like TikTok, Facebook, and Google to promote their services.

Lending Apps and Privacy

The research conducted by CIPIT and FMA indicates that lending Apps collect information from the applicant’s phone as part of the process to assess that applicant’s suitability for a loan. Part of the information collected by these Apps includes calls, text messages, top-up pattern, data use, mobile money transactions and other digital payments, GPS data, social media use, Wi-Fi network use, battery level, and contact lists.

In some instances, other sources of digital footprints like the applicant’s use of cloud-based services, banking transactions, internet browsing, shipping activities, loan management, payables, and online recordkeeping are also considered.

Text messages, in particular, are sometimes analyzed to see if the user has already obtained loans from other lenders. Granting the loan App access to text messages makes it possible to look through text messages on the phone for this purpose. For some companies, the number of loan Apps and contacts they find in a phone helps make accurate credit risk evaluations.

Contacts have also been proved to be useful when it is time to coerce people to pay back their loans. In Kenya, at least seven different lending Apps have either sent texts, or even called a loan defaulter’s contacts in a bid to influence the borrower to make payment.

The research by CIPIT revealed that lending Apps require access to location data as well as network connectivity data. This could be for purposes of geo-locating the loans to Kenya. However, the apps have continuous access to location data, making it possible to track a borrowers’ movements.

For example, Okash, a Kenyan service provider, requires an extra location permission - ‘access extra location provider commands’. Coupled with the fact that the apps run at start-up and prevent the phone from sleeping, this raises issues from a data protection perspective, for example, informed consent, transparency and data minimisation, amongst others.

Another Kenyan service provider, Branch, requires access to the borrower’s phone microphone which enables it to record audio. Okash requires access to the calendar, which includes the permission to add or modify calendar events and email guests without the user’s knowledge.

The two research reports also show a number of other problematic issues relating to the use of these lending Apps. These common issues are discussed in detail below.

Lack of regulation

In the Philippines, online lending platforms are regulated primarily by the Securities and Exchange Commission (SEC). However, lax enforcement of the regulations means that many lending entities do not bother with registration and licensing requirements, opting to operate in a regulatory grey zone. This makes it extremely difficult for authorities to monitor their operations. Another factor that encourages non-compliance with existing regulations is the lack of strong penalties for companies that are caught operating outside the law.

According to the FMA report, in 2019, the SEC issued cease-and-desist orders (CDOs) against 48 lending entities that did not have the necessary permit. As of 14 December 2020, the SEC lists only 75 registered lending entities, some of which were operating multiple apps.

Comparatively, Indonesia blocked 1,369 illegal lending platforms in 2019. Meanwhile in India, at least 60 loan apps featured in the Google Play Store were also found to be unregistered.

In Kenya 3 of the 7 Apps studied as part of CIPIT’s research did not fall under the regulation of the Central Bank of Kenya (‘CBA’). This is because the 3 Apps did not take any cash deposits meaning that their activites do not fall under the purview of the CBA.

Kenya’s 2019 Data Protection Act applies to the processing of personal information, including in scenarios such as the processing of such information by loan Apps. Ineffective implementation of this law may give these loan Apps room to continue operating as if they are without any regulations.

The narrow regulatory approach taken by countries such as Kenya, that only focuses on regulating the activities of traditional financial service providers and lenders means that loan Apps along with other emerging technology based service providers are left to operate largely unregulated.

In some instances for example, the Philippines, the legislation properly applies to the operations of loan Apps, but the oversight mechanisms are poor and companies exploit that.

Lack of transparency

According to FMA, the underwriting process of lending entities is very opaque, as are their digital and mobile marketing operations. Although most people who use such services are aware that they process data using algorithms and proprietary lending models, very few — even among their employees — know exactly how they work. This, too, makes oversight difficult (if not impossible).

As the FMA report points out, the lack of transparency on how lending Apps process applications make it hard to determine if specific groups are discriminated against, or are being unfairly targeted with predatory lending.

What passes off as transparency efforts are the loan app’s privacy notices and terms of use. Unfortunately, many of these documents are just as problematic. Some are run-of-the-mill replicas of other policies; others are inaccurate or patently deceptive. In India, research revealed that a number of loan Apps did not have any websites, while some had their privacy policies written in a Google Doc.

Unlawful, unethical, or questionable debt collection practices.

Many complaints against lending entities revolve around their debt collection practices. Collection agents have been known to employ verbal abuse, harassment, and public shaming in going after defaulting debtors.

There have also been reports of lenders posting a borrower’s selfies on Facebook, changing the borrower’s profile picture on the social media platform, and using the borrower’s account to post a threat.

The experience of other countries paints an even grimmer picture. In 2016, the Chinese government dealt with “loans for nude scams”, which involved lending entities demanding nude photos from female college students as loan collateral. They would threaten to release the images should the students fail to pay up. Such tactics led to untold anxiety, depression, job loss, unemployability, and damaged reputations.

The above examples, highlight how unhibited access to the user’s information allows these Apps to affect other parts of the user’s social life for example. This is a huge cause for concern that should not be allowed to continue unchecked.

Solutions

There is need for changes to be made to counter the current predatory practices of mobile lending Apps.

The restriction of existing regulatory frameworks to traditional lending service providers contributes a certain extent, to the proliferation of lending Apps.

Policy changes are needed to ensure that the processing of personal information is in line with universally accepted data protection principles.

In our report, we noted that protecting the human right to privacy should be an essential element of fintech.

One way to achieve this is by restricting the amount of data collected by these Apps to what is necessary for the purpose of determining the outcomes of loan applications.

Additionally, any data collected by the Apps should only be collected with the full and informed consent of the person using the App. Informed consent is only possible in instances when there is transparency in the type of data that is collected accompanied by clear information on why that data is collected and the circumstances under which it will be processed and subsequently stored or erased.

There is a need to put in place accountability measures that apply when the service providers that run these loan Apps contravene data protection laws and policies. Accountability means that service providers are held liable for any negligent abuse of a data subject’s privacy and data protection rights.

These Apps should only be allowed to process data when such processing is attended by fairness. Fairness requires that the data subject’s right to dignity be at the forefront of decisions to access data or to use that data in a certain way—for example, during the debt or loan recovery stage of the process.

Moreover, apart from the data protection component of how these Apps operate, there is also need to ensure that current national and international privacy regulations are applicable to fintech.