Vice President, Research and Consulting Group, Credit Suisse

Ethan Loufield

Shweta Vashisht

Factoring capacity constraints into the design and implementation of data protection laws is the topic of the final post in the “Data Protection and Financial Inclusion: Why It Matters” series.

Blog Post

New data protection legislation in many countries has gotten a lot of attention in recent years. But we hear less about what happens after these laws are passed. Although the substance of new data protection laws is important, implementation is where the rubber meets the road. Any new law is only as good as the implementing capabilities of regulators and providers, so it’s important to take those capabilities into consideration when developing the law’s provisions, subsequent rules and institutional structures that must be put in place to bring it to life.

This point was underscored in a recent <a href="https://www.dvara.com/research/wp-content/uploads/2019/10/Policy-Brief-Implementing-the-Personal-Data-Protection-Bill-in-India.pdf">policy brief</a> issued by the <a href="https://www.dvara.com/research/future-of-finance/">Future of Finance Initiative at Dvara Research</a> that provides a blueprint for actions that will need to be taken by India’s central government and the new Data Protection Authority (DPA) that will be created after passage of the <a href="https://prsindia.org/billtrack/personal-data-protection-bill-2019">Personal Data Protection Bill</a>. In total, the government and the DPA will need to address <a href="https://www.bloombergquint.com/opinion/a-blueprint-for-implementing-indias-personal-data-protection-law">at least 82 action points</a> to implement the new law. This observation begs the question: will regulators have the capacity needed to implement and enforce this new law?
<h2>Bridging a Gap of Understanding and Interpretation</h2>
As mentioned in the <a href="https://centerforfinancialinclusion.org/data-protection-and-financial-inclusion-why-it-matters-introduction/">introductory blog post</a> to this series, a common theme that surfaced during interviews we conducted last year with various data protection stakeholders in India, Ghana and Peru (as part of a <a href="https://www.credit-suisse.com/careers/en/articles/careers/sharing-expertise-201712.html">Credit Suisse Global Citizens volunteer project</a>) is that there is a gap that needs to be bridged between governments and providers on the issue of data protection.

For example, in Ghana, which has had a data protection law in place since 2012, any entity that handles personal data must register with the country’s Data Protection Commission as either a data controller or a data processor. However, according to Elorm Allavi, founder of<a href="https://syecomp.com/"> SyeComp</a>, an agricultural intelligence tech startup, it’s not necessarily clear which classification to register under and what the implications may be for the registration fees to be paid. He also described the data protection requirements as being “very one sided” and expressed a desire for the Bank of Ghana and data protection regulators to take steps to better comprehend the changing digital landscape and how fintechs use data. He felt that their lack of understanding limits their ability to assess the risks and can lead to unwarranted regulations.

On the government side, we’re grateful to Clarissa Kudowor at the Bank of Ghana (BoG) for providing a written response to some of the questions we had submitted regarding the overall legal and regulatory environment around data, as well as the BoG’s new <a href="https://www.bog.gov.gh/wp-content/uploads/2019/09/CYBER-AND-INFORMATION-SECURITY-DIRECTIVE.pdf">Cyber &amp; Information Security Directive</a>. In her response, she recognized the need for innovation in financial services and the role of proportionate regulations and regulatory sandboxes in helping to create an enabling regulatory environment. But despite this enabling spirit, there was also a clear undertone throughout her remarks that compliance with the provisions of the law is paramount, though there was no mention of any specific engagement with providers that would help to facilitate that compliance. Moreover, Ms. Kudowor had to refer some of our questions to the Data Protection Commission, which sits within the Ministry of Communications. This was understandable, since Ghana’s data protection law applies to all sectors and not just the financial sector, but our efforts to get a response from the commission weren’t successful. This perhaps was indicative of the kinds of concerns providers often express about having multiple regulators to answer to.

We encountered similar concerns in Peru, where Mariano Fuentes, a Legal Advisor with <a href="https://www.asbanc.com.pe/">ASBANC</a>, the association of private financial institutions in Peru, told us about five member banks that were appealing sanctions by the National Data Protection Authority (NDPA) over differences in interpretation of consent requirements, suggesting a lack of regulatory clarity. Raising a separate concern, Elias Vargas, Head of Market Conduct Supervision at SBS (the Peruvian banking superintendent), spoke about overlaps in the mandates of the SBS and the NDPA and suggested that in some cases the SBS may be better positioned than the NDPA, which resides in the Ministry of Justice, to provide oversight of the financial sector on certain data protection issues. And in India, where the new data protection bill is looming large, Tejamoy Gosh, Head of Data Science and Artificial Intelligence with Aye Finance, also emphasized the need for regulatory clarity when he said that he would like to see “a list of ‘don’ts’ rather than a list of ‘dos,’ so we can be sure of what not to do absolutely.”
<h2>Provider and Other Stakeholder Capacity Needed, Too</h2>
All of the above issues are reflective of the enormous complexity of data, which brings us full circle to the need for policymakers and regulators to take capacity into account when designing and implementing new data protection frameworks. This doesn’t mean just regulatory capacity, but also provider capacity. In order to do this, it’s important for those doing the regulating to consult with those who will be regulated throughout the policymaking process so that all data protection stakeholders can be set up for success. Based on the feedback we obtained through the interviews described above, it appears that much more deliberate action is needed to make this happen.
<blockquote>It’s important for those doing the regulating to consult with those who will be regulated.</blockquote>
As <a href="https://www.bloombergquint.com/opinion/a-blueprint-for-implementing-indias-personal-data-protection-law">noted</a> by the team at the Future of Finance Initiative at Dvara Research, “Developing robust and timeless regulation will require collaboration between regulators, entities processing data, civil society, researchers and technologists.” We couldn’t agree more. As our interviews showed, there’s a divide between regulators and providers that intentional and ongoing collaboration can help to bridge. They also suggest that governments need to do more to ensure that regulatory bodies not only have the technical expertise to deal with data issues writ large, but also the sectoral expertise to be able to effectively deal with data issues that are specific to each sector. Designing and implementing data protection frameworks is no small task, and governments should do all they can to enlist the support of external stakeholders to develop frameworks that truly set everyone up for success.

Avoiding Capacity Overload in Data Protection Frameworks

The flow of data across borders is a contentious issue countries encounter when developing data protection laws and regulations. How should policy stakeholders in financial inclusion approach this issue?

As the role of data in our lives continues to advance around the world, we’re increasingly seeing tensions between protecting personal data and the idea that data needs to flow freely to realize the benefits of the digital economy. One response to this tension is data localization. Data localization refers to a requirement that any entity that processes the data of a given country’s citizens must store that data on servers within that country’s borders.
<h2>Why Some Say We Need Data Localization</h2>
A recent Brookings report on the <a href="https://www.brookings.edu/research/regulating-for-a-digital-economy-understanding-the-importance-of-cross-border-data-flows-in-asia/">importance of cross-border data flows</a> discusses five reasons why governments want to localize data:
<ol>
 	<li>Protection of personal data;</li>
 	<li>Access to data by law enforcement;</li>
 	<li>Ensuring national security;</li>
 	<li>Advancing local economic competitiveness; and</li>
 	<li>Leveling the regulatory playing field.</li>
</ol>
In assessing each of these objectives, the report contends on all five counts that data localization measures actually have a negative impact and suggests other options for achieving these goals.
<blockquote>Refusing to allow data to cross borders often means keeping data from reaching those best equipped to protect it.</blockquote>
For instance, it points out that the technical and financial capacity of global cloud providers is more important to data security than whether data is stored locally. Refusing to allow data to cross borders often means keeping data from reaching those best equipped to protect it. And in terms of local economic competitiveness, it notes that restricting data flows to try to protect domestic companies from digital competitors can trigger other countries to retaliate, harming other local companies that seek to use data to conduct business globally.
<h2>“Digital Trade Barriers”</h2>
One recent study by Boston Consulting Group <a href="https://www.bcg.com/publications/2019/global-trade-goes-digital.aspx">noted challenges presented by data localization mandates</a>, saying that they “are a particularly powerful example of the emerging crop of digital trade barriers: since 2000, these measures have increased by a factor of four, with 33% falling into the ‘most restrictive’ category, including an outright ban on the cross-border transfer of data.” As one example of the impact that data localization policies can have, it described how PayPal was forced to cease operations in Turkey after losing its license due to new IT system localization regulations put in place by the financial regulator.

Most countries still have not implemented data localization laws, but a growing number of countries are adopting data localization requirements. There are some countries, such as China, Russia, Indonesia, Nigeria and Vietnam, that have implemented tough rules around data localization. However, most other countries that have gone down the data localization path have taken a softer and/or more piecemeal approach (see page 49 of <a href="https://cis-india.org/internet-governance/resources/the-localisation-gambit.pdf">this study</a> by the Centre for Internet &amp; Society for an analysis of 18 countries’ approaches to data localization).
<h2>Established Tech vs. Emerging Market Tech</h2>
During interviews conducted as part of the Credit Suisse Global Citizens data protection project mentioned in this <a href="https://www.centerforfinancialinclusion.org/data-protection-and-financial-inclusion-why-it-matters-introduction/" target="_blank" rel="noopener noreferrer">series’ introductory blog post</a>, interviewees in India showed consistent support for the government’s data localization efforts. For example, Dr. Anand Shrivastav, who is Chair of the Business Correspondent Federation of India and is a Member of the <a href="https://www.rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=49116">Reserve Bank of India’s Financial Inclusion Advisory Committee</a>, argued that “data is a sovereign right, and every country has a right to protect its citizens’ sensitive data.” He added that Indian fintechs support data localization because they view data as a vital asset that should be kept within Indian borders. Indeed, <a href="https://paytm.com/">Paytm</a> (which is also backed by Chinese tech giant, Alibaba) <a href="https://tech.economictimes.indiatimes.com/news/internet/indias-data-localisation-policy-will-benefit-the-startup-ecosystem-paytm/65881255">made a strong public stand</a> in favor of data localization, in part to ensure “a level playing field for the Indian startup ecosystem with respect to global tech giants.”

But India is an enormous market. Restrictions in smaller countries could be problematic. For one thing, data centers require reliable infrastructure to keep the data physically in country that many developing countries may not yet be able to adequately ensure. And even where they could, the market context in smaller developing countries may not present sufficient incentives for leading cloud providers like Amazon Web Services, Microsoft Azure and Google Cloud to invest in building local data centers the way they have been willing to in India. For example, it was only last year that Microsoft and Amazon <a href="https://qz.com/africa/1576890/amazon-microsoft-huawei-building-south-africa-data-hubs/">opened their first African data centers in South Africa</a>. As a result, financial service providers in many developing countries need to look externally to find the most robust cloud computing solutions for managing and protecting their data.
<blockquote>Financial service providers in many developing countries need to look externally to find the most robust cloud computing.</blockquote>
In addition, as the geopolitics of data localization continue to play out, with large technology companies from the West pitted against large technology companies from India and China, countries such as Indonesia and Vietnam have yielded to pressure to <a href="https://thediplomat.com/2020/01/the-retreat-of-the-data-localization-brigade-india-indonesia-and-vietnam/">loosen certain data localization provisions</a>. Moreover, this past December the draft data protection bill in India that was first presented in 2018 was resubmitted to Parliament with a number of revisions, including a <a href="https://www.insideprivacy.com/india/india-proposes-updated-personal-data-protection-bill/">removal of restrictions on the transfer and storage of personal data outside of India</a>. However, the restrictions on both “sensitive” and “critical” personal data from the initial draft of the bill remain. This suggests that despite the growth of data localization measures around the world, proponents of softer regulations are succeeding in persuading various countries to loosen their existing and/or proposed data localization policies.
<h2>Where’s the Meeting Point?</h2>
For these and other reasons, such countries generally do not have data localization requirements built into their data protection laws, to the extent that they have any. This is the case for Ghana and Peru, where the cross-border transfer of personal data is permitted, as long as the recipients of such data are able to meet the same data protection standards required under Ghanaian or Peruvian law.

It’s easy to see why data localization has emerged as such a contentious issue. While there may be many legitimate reasons for putting up guardrails around the flow of data, the right solutions will vary from one country to the next and evolve over time. But in order to reap the benefits of our increasingly digitized economy, these solutions will need to tend toward openness through international cooperation and harmonization of rules. This need is not unique to data and has been true across a wide array sectors and technologies before, and it can be done: just look at the thousands of standards that have been developed by the <a href="https://www.iso.org/home.html">International Organization for Standardization</a>. The previously mentioned Brookings <a href="https://www.brookings.edu/research/regulating-for-a-digital-economy-understanding-the-importance-of-cross-border-data-flows-in-asia/">report</a> shared some good examples of frameworks that allow countries with different approaches to data protection to agree to sets of principles by which cross-border data transfers can occur. This kind of collaboration around data is in the early stages, but it is precisely what we need to see more of for the true potential of data to be seized.

Data Globalization vs. Data Localization

Our fast-changing digital times and the lack of clarity on the interpretation of current regulations mean that informed consent is hard to come by in financial inclusion. This is the second in the "Data Protection and Financial Inclusion: Why It Matters" blog series. 

As more people are connecting to more financial services digitally, we’re seeing growing calls for individuals to have greater control over how their data is being used and by whom. At the heart of consumers’ ability to control their data is the notion of consent, but what consent means in practice can vary considerably and can often be difficult for providers to ascertain in a meaningful way from a consumer standpoint.

In the EU, the GDPR has <a href="https://gdpr.eu/gdpr-consent-requirements/">defined consent</a> as being free, informed, specific and unambiguous. It also necessitates an opt-out option for data subjects, allowing for the partial or complete withdrawal of any previously given consent, and for the removal of all gathered personal data. But while these requirements may be good for consumers, they’re also tough for providers to implement. Just ask Google, which was <a href="https://www.reuters.com/article/us-google-privacy-france/france-fines-google-57-million-for-european-privacy-rule-breach-idUSKCN1PF208">fined 50 million euros</a> last year after the French data protection authority concluded that it “lacked transparency and clarity in the way it informs users about its handling of personal data and failed to properly obtain their consent for personalized ads.”
<h2>Flexibility Needed for Smaller Providers</h2>
So, if a tech giant, operating in Europe with all the resources and expertise at their disposal, can run afoul of these new consent requirements, does it make sense for governments in developing countries to try to adopt similar rules? India’s response for now has been yes. The current version of its pending data protection bill incorporates the same consent principles as GDPR. However, one legal observer we spoke to expressed concerns that the bill says nothing about what this consent architecture will look like and the ways in which consent will be sought. For smaller providers like microfinance institutions, fintechs and small finance banks that are trying to reach underserved segments with higher levels of illiteracy, obtaining consent as currently defined in the bill would pose a significant challenge, as elaborated below. Moreover, providers leveraging digital technologies to serve customers who might not be that digitally literate or understand the ways their data can be used may find it nearly impossible to meet such high standards of consent. The likes of Google might be able to figure it out over time, but smaller providers would need more flexible rules and support to comply.
<blockquote>Google might be able to figure out high-standard consent, but smaller providers would need more flexible rules and support.</blockquote>
For further evidence on how providers are already coming up short on consent, a recent <a href="http://documents.worldbank.org/curated/en/677281542207403561/Financial-Consumer-Protection-and-New-Forms-of-Data-Processing-Beyond-Credit-Reporting">World Bank report on new forms of data processing</a> laid out many limitations of practices around consent, such as lengthy and complex consent forms, incomplete information, and standardized, inflexible terms offered on a “take it or leave it” basis. As a result, providers are often seen to be doing the bare minimum to comply with existing data protection requirements. In recounting the deficiencies identified in a study by the Centre for Internet and Society on fintech privacy policies in India, a <a href="https://cis-india.org/internet-governance/blog/the-wire-shweta-mohandas-july-30-2019-in-india-privacy-policies-of-fintech-companies-pay-lip-service-to-user-rights">recent article</a> noted that one rule “requires a fintech company to provide an option to withdraw consent. Twenty-three percent of the companies allowed the user to opt out or withdraw from certain services such as mailing list, direct marketing and in app public forums, but they did not allow the user to withdraw their consent completely.” Such findings have led various observers to rightly question <a href="https://www.cgap.org/blog/data-protection-and-financial-inclusion-why-consent-not-enough">how effective consent really is</a> in practice and to propose <a href="https://www.cgap.org/research/publication/making-data-work-poor">other approaches</a> to give consumers more meaningful control over their data.
<h2>The Futility of Trying to Keep Up with New Approaches to Consent</h2>
This all stands to reason, but it again begs the question as to how providers who are already having a hard time complying at a minimal level could ever keep up with these new approaches. Indeed, in discussing the variety of data protection principles and standards that already exist around the world, the previously mentioned World Bank report also hastened to point out that “such principles may often be difficult to implement, particularly in low-capacity environments and/or where changes in the financial sector are fast paced.” As our interviewees attested, low-capacity environments and fast-paced changes are very much the rule, not the exception, and the path from principles to implementation is littered with landmines.
<blockquote>Low-capacity environments and fast-paced changes are very much the rule, not the exception.</blockquote>
One case we encountered centered around the issue of informed consent. Last year, the Reserve Bank of India <a href="https://economictimes.indiatimes.com/industry/banking/finance/banking/rbi-slaps-rs-5-crore-penalty-on-airtel-payments-bank-for-violation-of-norms/articleshow/63235308.cms">fined Airtel Payments Bank</a> the equivalent of roughly $700,000 for “contravening the Operating Guidelines for Payments Banks and directions issued by RBI on Know Your Customer (KYC) norms.” Airtel Payments Bank is majority owned by Bharti Airtel, one of the largest mobile operators in India, and in 2017 complaints started to emerge among mobile subscribers that Airtel Payments Bank had opened new bank accounts without their consent. According to <a href="https://www.financialexpress.com/economy/uidai-airtel-payments-bank-case-company-claims-no-wrongdoing-heres-how-you-can-avoid-the-trap/979401/">reports</a>, when new Airtel mobile subscribers first opened their Airtel mobile app, a pre-ticked consent box would appear on the welcome screen which, unless unchecked, would authorize the use of the same <a href="https://uidai.gov.in/what-is-aadhaar.html">Aadhaar</a>-based eKYC verification required to open the mobile account to also open an Airtel Payments Bank account. Over 2.3 million customers reportedly had new bank accounts created that they did not realize had been opened. Further complicating the matter was the fact that government subsidies would automatically be sent as direct benefit transfers to each beneficiary’s most recent Aadhaar-linked bank account, resulting in the equivalent of about $6.6 million in subsidies being deposited into these accounts. Airtel Payments Bank maintained that it had properly obtained consent to open these accounts but committed to working with the government to ensure compliance. We spoke with Akhil Verma, the current Chief Information Security Officer of Airtel Payments Bank, and he said the bank’s failure to notify customers of this caveat and obtain their explicit permission before allowing this was considered grounds for insufficient consent.
<h2>Out of Step With Modern Digital Reality</h2>
Another concern we heard from the other side of the globe was that some consent requirements are out of step with modern realities. According to Mariano Fuentes, Legal Advisor with ASBANC, the banking association in Peru, its data protection law (which was originally passed in 2011) is outdated for the digital times we now live in and does not do a thorough job of clarifying the ways consent can be obtained. Banks in Peru can obtain consent for personal data digitally, but “sensitive” personal data, which not only includes data on things like race or health, but also biometric data and data pertaining to “personal habits” that could come from things like mobile phone usage patterns, still requires written consent. Since Peru’s data protection law was passed in 2011, it would not have been able to fully anticipate the ways in which people’s lives have been digitized and the new types of data that would emerge, so it’s not surprising that it was reported last June that the National Authority for the Protection of Personal Data in Peru had issued <a href="https://elcomercio.pe/economia/negocios/tres-anos-han-puesto-1-246-sanciones-faltas-proteger-datos-noticia-646513-noticia/">1,246 sanctions within three years</a> (across all sectors).  A scan of the sanctions imposed by the data protection authority also reveals that a significant share of these violations resulted from failures to properly obtain consent.

Whether these cases amount to violations is often a matter of interpretation. Mariano Fuentes of ASBANC underscored this by pointing out that five member banks are currently appealing their penalties because they disagree with the arguments made by the data protection authority. “The complete idea of consent is not represented by any technology, which is damaging in today’s times and is used against us to levy sanctions,” he added. Despite these challenges, Peru consistently ranks as one of the top country-wide regulatory environments for financial inclusion in the Economist Intelligence Unit’s <a href="https://www.centerforfinancialinclusion.org/global-microscope-2019">Global Microscope</a> assessment. In the 2019 version, it came in second partly because it “showed the greatest improvement in the consumer protection domain—specifically, for its data protection framework for financial customers.”
<h2>So How Are Consumers Supposed to Understand?</h2>
Given all the shortcomings with current consent practices around the world, it’s simply unfair to expect consumers to be able to fully understand what can and cannot happen with their data right at the point when they are about to access a new service or download an app. But at the same time, placing the burden on providers, especially those that are on the frontlines of underserved areas, to understand and apply high standards of consent is also proving to be a challenge. The reality is that this is a burden that both consumers and providers need to share, but not on their own. They need the right mix of policy and technology to help them get there. There are some emerging regulatory technology – or “regtech” – solutions providers in developed markets (like <a href="https://www.trunomi.com/">Trunomi</a>) that enable consent-based data sharing, for example.
<blockquote>This is a burden that both consumers and providers need to share, but not on their own.</blockquote>
As these solutions continue to advance, perhaps governments in developing countries could seek to attract such providers to adapt these solutions for their markets. It’s this type of innovation and collaboration that is needed to make consent work. The burden should be broadly shared.

Data Consent: Let’s Share the Burden for Effective Consumer Protection

A new CFI Blog series delves into the complicated world of enacting and enforcing data protection regulations and legislation that protects consumers. 

In response to the seemingly <a href="https://www.centerforfinancialinclusion.org/infographic-75-records-compromised-every-second">endless flow</a> of data breaches and misuses of personal data, governments are increasingly responding with <a href="https://www.ironmountain.com/resources/general-articles/t/the-legal-ramifications-of-a-data-breach">penalties</a>, hearings and new laws and regulations. Perhaps the most widely known is the European Union’s General Data Protection Regulation (GDPR), which <a href="https://www.wired.co.uk/article/what-is-gdpr-uk-eu-legislation-compliance-summary-fines-2018">went into effect</a> in May 2018 and has quickly become a global benchmark, as many of the data protection regimes emerging around the world appear to embrace the same <a href="https://gdpr-info.eu/art-5-gdpr/">basic principles</a> that are at the core of GDPR.

As the growth of the digital economy continues to fuel the expansion of consumers’ data footprints, we’re also hearing calls for new approaches to data protection that advances in digital technologies should be making increasingly possible, at least in theory. But in the recent research and interviews we conducted on the current state of data protection in India, Ghana and Peru (thanks to a collaboration made possible through the <a href="https://www.credit-suisse.com/careers/en/articles/careers/sharing-expertise-201712.html">Credit Suisse Global Citizens</a> volunteer program), we encountered a divide between governments and providers that surfaces when you get beyond principles and into the specifics of their application.

As usual, the devil is in the details.

For example, in responding to a question about how data protection laws and regulations in Ghana may be impacting the extent of data sharing among providers seeking to reach underserved segments, Clarissa Kudowor, Deputy Chief Manager of the Payment Systems Department, Bank of Ghana, wrote, “Whatever the arrangements/partnerships, we expect them to apply the universally accepted principles of data protection under Section 17 through to Section 34 of the Data Protection Act, 2012.” But achieving alignment between policymakers and providers on how best to apply these principles may be easier said than done.
<blockquote>Achieving alignment between policymakers and providers may be easier said than done.</blockquote>
For instance, in talking about data protection seminars offered by the Ghanaian government, Elorm Allavi, the CEO of <a href="https://syecomp.com/">SyeComp</a>, a fintech which uses data from smallholder farmers for its mfarmPay credit product, said, “Seminars are for awareness creation, but in terms of the technical side, they’re not there yet. They don’t understand how we use data.” This is but one example of the gap that exists between governments and providers in advancing data protection in their countries. But where there are problems, there are also opportunities.

Recognizing how vast of a topic this is, we have chosen to focus on three key aspects of data protection that surfaced during our research.
<ul>
 	<li>
<h4><strong>Consent</strong></h4>
</li>
 	<li>
<h4><strong>Localization</strong></h4>
</li>
 	<li>
<h4><strong>Regulatory capacity and fragmentation</strong></h4>
</li>
</ul>
We will dedicate one blog post to each of these issues, starting next week with consent. Over the coming weeks, we will explore these topics – plus <strong>alternative data</strong> legislation and vulnerable populations in the U.S. – in a CFI Blog series, “Data Protection and Financial Inclusion: Why It Matters Now.” Join us as we dive in to these issues from a financial inclusion perspective and our unique position as an industry engager.

&nbsp;

&nbsp;

&nbsp;

&nbsp;

&nbsp;

&nbsp;

&nbsp;

&nbsp;

&nbsp;

Shweta Vashisht

Latest by Shweta Vashisht

Stay informed. Subscribe to our newsletter.