Support Our Work

Subscribe to our bi-monthly newsletter for the latest blog posts, report releases, fellowship and research opportunities and CFI news.

Fellow Exec Ed

Blog Post

As the role of data in our lives continues to advance around the world, we’re increasingly seeing tensions between protecting personal data and the idea that data needs to flow freely to realize the benefits of the digital economy. One response to this tension is data localization. Data localization refers to a requirement that any entity that processes the data of a given country’s citizens must store that data on servers within that country’s borders.
<h2>Why Some Say We Need Data Localization</h2>
A recent Brookings report on the <a href="https://www.brookings.edu/research/regulating-for-a-digital-economy-understanding-the-importance-of-cross-border-data-flows-in-asia/">importance of cross-border data flows</a> discusses five reasons why governments want to localize data:
<ol>
 	<li>Protection of personal data;</li>
 	<li>Access to data by law enforcement;</li>
 	<li>Ensuring national security;</li>
 	<li>Advancing local economic competitiveness; and</li>
 	<li>Leveling the regulatory playing field.</li>
</ol>
In assessing each of these objectives, the report contends on all five counts that data localization measures actually have a negative impact and suggests other options for achieving these goals.
<blockquote>Refusing to allow data to cross borders often means keeping data from reaching those best equipped to protect it.</blockquote>
For instance, it points out that the technical and financial capacity of global cloud providers is more important to data security than whether data is stored locally. Refusing to allow data to cross borders often means keeping data from reaching those best equipped to protect it. And in terms of local economic competitiveness, it notes that restricting data flows to try to protect domestic companies from digital competitors can trigger other countries to retaliate, harming other local companies that seek to use data to conduct business globally.
<h2>“Digital Trade Barriers”</h2>
One recent study by Boston Consulting Group <a href="https://www.bcg.com/publications/2019/global-trade-goes-digital.aspx">noted challenges presented by data localization mandates</a>, saying that they “are a particularly powerful example of the emerging crop of digital trade barriers: since 2000, these measures have increased by a factor of four, with 33% falling into the ‘most restrictive’ category, including an outright ban on the cross-border transfer of data.” As one example of the impact that data localization policies can have, it described how PayPal was forced to cease operations in Turkey after losing its license due to new IT system localization regulations put in place by the financial regulator.

Most countries still have not implemented data localization laws, but a growing number of countries are adopting data localization requirements. There are some countries, such as China, Russia, Indonesia, Nigeria and Vietnam, that have implemented tough rules around data localization. However, most other countries that have gone down the data localization path have taken a softer and/or more piecemeal approach (see page 49 of <a href="https://cis-india.org/internet-governance/resources/the-localisation-gambit.pdf">this study</a> by the Centre for Internet &amp; Society for an analysis of 18 countries’ approaches to data localization).
<h2>Established Tech vs. Emerging Market Tech</h2>
During interviews conducted as part of the Credit Suisse Global Citizens data protection project mentioned in this <a href="https://www.centerforfinancialinclusion.org/data-protection-and-financial-inclusion-why-it-matters-introduction/" target="_blank" rel="noopener noreferrer">series’ introductory blog post</a>, interviewees in India showed consistent support for the government’s data localization efforts. For example, Dr. Anand Shrivastav, who is Chair of the Business Correspondent Federation of India and is a Member of the <a href="https://www.rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=49116">Reserve Bank of India’s Financial Inclusion Advisory Committee</a>, argued that “data is a sovereign right, and every country has a right to protect its citizens’ sensitive data.” He added that Indian fintechs support data localization because they view data as a vital asset that should be kept within Indian borders. Indeed, <a href="https://paytm.com/">Paytm</a> (which is also backed by Chinese tech giant, Alibaba) <a href="https://tech.economictimes.indiatimes.com/news/internet/indias-data-localisation-policy-will-benefit-the-startup-ecosystem-paytm/65881255">made a strong public stand</a> in favor of data localization, in part to ensure “a level playing field for the Indian startup ecosystem with respect to global tech giants.”

But India is an enormous market. Restrictions in smaller countries could be problematic. For one thing, data centers require reliable infrastructure to keep the data physically in country that many developing countries may not yet be able to adequately ensure. And even where they could, the market context in smaller developing countries may not present sufficient incentives for leading cloud providers like Amazon Web Services, Microsoft Azure and Google Cloud to invest in building local data centers the way they have been willing to in India. For example, it was only last year that Microsoft and Amazon <a href="https://qz.com/africa/1576890/amazon-microsoft-huawei-building-south-africa-data-hubs/">opened their first African data centers in South Africa</a>. As a result, financial service providers in many developing countries need to look externally to find the most robust cloud computing solutions for managing and protecting their data.
<blockquote>Financial service providers in many developing countries need to look externally to find the most robust cloud computing.</blockquote>
In addition, as the geopolitics of data localization continue to play out, with large technology companies from the West pitted against large technology companies from India and China, countries such as Indonesia and Vietnam have yielded to pressure to <a href="https://thediplomat.com/2020/01/the-retreat-of-the-data-localization-brigade-india-indonesia-and-vietnam/">loosen certain data localization provisions</a>. Moreover, this past December the draft data protection bill in India that was first presented in 2018 was resubmitted to Parliament with a number of revisions, including a <a href="https://www.insideprivacy.com/india/india-proposes-updated-personal-data-protection-bill/">removal of restrictions on the transfer and storage of personal data outside of India</a>. However, the restrictions on both “sensitive” and “critical” personal data from the initial draft of the bill remain. This suggests that despite the growth of data localization measures around the world, proponents of softer regulations are succeeding in persuading various countries to loosen their existing and/or proposed data localization policies.
<h2>Where’s the Meeting Point?</h2>
For these and other reasons, such countries generally do not have data localization requirements built into their data protection laws, to the extent that they have any. This is the case for Ghana and Peru, where the cross-border transfer of personal data is permitted, as long as the recipients of such data are able to meet the same data protection standards required under Ghanaian or Peruvian law.

It’s easy to see why data localization has emerged as such a contentious issue. While there may be many legitimate reasons for putting up guardrails around the flow of data, the right solutions will vary from one country to the next and evolve over time. But in order to reap the benefits of our increasingly digitized economy, these solutions will need to tend toward openness through international cooperation and harmonization of rules. This need is not unique to data and has been true across a wide array sectors and technologies before, and it can be done: just look at the thousands of standards that have been developed by the <a href="https://www.iso.org/home.html">International Organization for Standardization</a>. The previously mentioned Brookings <a href="https://www.brookings.edu/research/regulating-for-a-digital-economy-understanding-the-importance-of-cross-border-data-flows-in-asia/">report</a> shared some good examples of frameworks that allow countries with different approaches to data protection to agree to sets of principles by which cross-border data transfers can occur. This kind of collaboration around data is in the early stages, but it is precisely what we need to see more of for the true potential of data to be seized.

Data Globalization vs. Data Localization

In January, I joined Caribou Digital’s immersive <a href="https://www.cariboudigital.net/live-learning/">Live Learning</a> program in Indonesia. The program included visits to all the major digital players in the country including ride hailing, e-commerce, digital payments, peer-to-peer platforms and digital value chain actors. One of the most interesting parts of the program was talking to the merchants, producers and gig workers who are using the new digital economy to make a living. Many of these digital platforms that are driving this new economy rely on a ubiquitous digital payment system that’s enabling transactions to take place between micro-merchants and gig workers and the buyers of their products and services. Ride and e-commerce platforms are not only serving as an important driver to bring people into the formal financial system, they’re creating new and more lucrative opportunities for work for millions of merchants, producers and service workers.

In the West, the rise of the gig economy and the platforms that enabler it has been viewed by some as contributing to the <a href="https://qz.com/1556194/the-gig-economy-is-quietly-undermining-a-century-of-worker-protections/">deterioration of stable jobs and an erosion of worker protections</a>. While the gig economy is recognized for offering workers flexibility and a chance to be their own bosses, there’s evidence that remuneration has not lived up to what many of the gig platforms promise, and workers are <a href="https://www.apc.org/en/blog/inside-digital-society-gig-economy">working longer hours for less</a>.
<blockquote>Most emerging economies never had the secure jobs that the gig economy is purportedly displacing.</blockquote>
This narrative in the West does not appear to translate to emerging economies, at least not what was evident from the market in Indonesia. For one thing, most emerging economies never had the secure jobs that the gig economy is purportedly displacing. Instead, the digital platforms are enabling a certain formalization of informal work that has thus far remained inferior to formal jobs. The new digital platforms are contributing to standardizing and organizing a set of workers who had previously been left to fend for themselves.

There are three important contributions that platforms are making toward the lives of merchants and gig workers in Indonesia:
<h2>1 Investing in Skills</h2>
It was striking to see the type of investment that many of the platforms in Indonesia are making in training the merchants or the gig workers on their platforms. For example, Indonesia’s main e-commerce platforms, <a href="https://en.wikipedia.org/wiki/Tokopedia">Tokopedia</a> and <a href="https://www.crunchbase.com/organization/bukalapak#section-overview">Bukalapak</a>, both offer many learning opportunities for their merchants including in person events and video streaming “tips” that cover topics such as taking appealing pictures of their products and getting halal certification to expand the appeal of their products among religious Muslim customers.
<h2>2 Putting in Place Social Protections</h2>
<a href="https://en.wikipedia.org/wiki/Gojek">Gojek</a>, one of Indonesia’s super apps that began in ride hailing but has expanded to other lifestyle services, currently offers a form of social protection to its drivers, something they call Swadaya. The rationale for the company is that this improves the loyalty of its drivers in a fiercely competitive market. The benefits to the drivers are clear: health insurance and unemployment benefits if they fall ill.
<h2>3 Facilitating Access to Financial Services</h2>
Nearly all the platforms are layering multiple financial services for their merchants and gig workers. Digital credit, insurance, and investment products such as e-gold and mutual funds are all currently available in the market. This is enabling merchants and gig workers to grow their businesses and to have access to financial services that improve their resilience to shocks.

Financial Inclusion and Future Jobs: What the Market in Indonesia Tells Us

Last year was a huge milestone in my life. I got a scholarship to study at a prestigious graduate school in the U.S. I earned a promotion from a big four consulting firm in my home country. I felt like nothing could stop me.

Although I’m equipped with skills and knowledge to determine my financial future and work in the financial services field, my spouse managed our finances. We used a single credit card to make household purchases even though I participated in making payments on it. I had an excellent credit in my home country, but delayed establishing my own credit line in the U.S. because it was convenient to use a single credit card with a better APR. When my spouse and I decided to part ways, I realized that I underestimated the impact of not having a credit history in the U.S., so I had no access to affordable credit.

“We absorb a way of perceiving the world from parents and neighbors. We mimic the behavior around us. Only at the end of the process is there self-conscious oversight,” wrote David Brooks in a 2008 New York Times <a href="https://www.nytimes.com/2008/07/22/opinion/22brooks.html">opinion</a> piece. This was the case for me – and likely is for many immigrant women of different cultures – when it came to management of household economics. Contrary to the teachings of my debt-averse and underleveraged family back home, the “pursuit of happiness” in the U.S. is usually linked to one’s ability to borrow to pay for <a href="https://www.cnn.com/2019/04/02/health/health-care-costs-borrowing/index.html">healthcare</a>, education, a mortgage, or building a business. When the system doesn’t “trust” you, rebuilding a life isn’t easy.

So I went back to square one in this new country. It’s not hard to imagine that the impact would've been more dramatic if I had limited financial literacy, education or resources.
<h2>Is Trusting the “Credit Invisible” Possible? Enter Alternative Data.</h2>
The traditional credit scoring system excludes 26 million consumers with non-existent or short credit histories in the U.S. The <a href="https://www.americanbanker.com/news/fintechs-find-another-untapped-market-new-immigrants-needing-credit">gap</a> will likely increase with the growing trend in the demographics of the immigrant population in the United States, so alternative data has emerged as a way to rethink the indicators of credit worthiness to expand credit to the “credit invisible.” As the world becomes more interconnected and migration flows increase, several financial technology startups are seeking innovative solutions to tap into this market. Examples of this are a <a href="https://www.creditstacks.com/">credit card that doesn’t require a credit history</a> in the U.S., and <a href="http://www.novacredit.com">connecting international credit bureaus</a> with domestic institutions that enable expats to apply for products and services as well as helping them build a credit score.

Alternative data mainly includes unorthodox information such as consumer-permissioned financial data, online activities and rental payments. With the evolution of analysis, management and storage of big data, extremely large information sets that can be analyzed to reveal patterns, trends, and associations – especially relating to human behavior and interactions – startups, like the examples above, have started to develop and license automated scoring methodologies based on alternative data.

The use of alternative data considerably expands the universe of information available to lenders and CRAs (credit reporting agencies), enabling them to achieve a <a href="http://images.go.experian.com/Web/ExperianInformationSolutionsInc/%7B15855ffe-926b-4c59-a5a6-52fb5ed79cff%7D_2019StateofCreditData_whitepaper_web_01.pdf">holistic view</a> of their current and future customers, identify and prevent fraud, and assess a customer’s repayment capacity more efficiently. But is this always good for the consumer?

The promise to increase underserved individuals’ access to credit comes at a cost. The <a href="https://www.internetsociety.org/tutorials/your-digital-footprint-matters/">Internet Society</a> notes that every day, whether we mean to or not, we “contribute to a growing portrait of who we are online; a portrait that is probably more public than we assume” without knowing what kind of trail we’re leaving, and what the possible effects can be.

Recently, various consumer advocacy groups and the United States Government Accountability Office (GAO) have expressed concerns about data accuracy and privacy issues arising from the <a href="https://www.gao.gov/assets/700/696149.pdf">amount and sensitivity of the alternative data</a> collected and used by financial technology companies. The lack of transparency in the models, data sources and data analytics technologies are also criticized. Credit scoring companies treat their <a href="https://digitalcommons.law.yale.edu/cgi/viewcontent.cgi?article=1122&amp;context=yjolt">data sources as proprietary trade secrets</a>. If consumers are not aware of what specific information the credit scoring systems use and how it impacts their credit score, their ability to dispute unfavorable credit decisions, identify inaccuracies in the lender’s files and take remedial steps to improve their credit score is significantly limited.
<blockquote>How can consumers dispute credit scores if they don't know what data is in them?</blockquote>
Furthermore, credit scoring models are based on class attributes and underlying assumptions built into them by the developers, which remain undisclosed, and failure to use <a href="https://www.nytimes.com/2016/06/26/opinion/sunday/artificial-intelligences-white-guy-problem.html?mcubz=1">inclusive datasets</a> to facilitate the machine learning process may <a href="https://www.consumercomplianceoutlook.org/2017/second-issue/keeping-fintech-fair-thinking-about-fair-lending-and-udap-risks/">amplify and perpetuate existing social inequalities</a>.

In order to achieve meaningful access to financial services using alternative data, industry stakeholders need more guidance and regulations on data privacy, transparency and clarification of the scope of data that may be used for credit scoring purposes. Currently, <a href="https://www.federalreserve.gov/boarddocs/supmanual/cch/fair_lend_over.pdf">fair lending laws and regulations</a> prohibit the use of certain information such as race, color, religion and national origin that may result in lending discrimination. However, it’s unclear to what extent these regulations capture alternative data, as discrimination may occur indirectly or even in an unintended way depending on the type of data is being used and how the scoring model works. For example, even though data initially collected from consumers doesn’t infringe upon protected classes, aggregation of data may be <a href="https://financialservices.house.gov/calendar/eventsingle.aspx?EventID=404003">used as a proxy</a> for a given protected class a consumer may fall under. This also increases the risk of vulnerable populations, such as the elderly in financial distress, being targeted for <a href="https://www.govinfo.gov/content/pkg/CHRG-113shrg95838/pdf/CHRG-113shrg95838.pdf">predatory marketing pitches</a> to sell financial products with unfavorable terms.
<h2>Current Legislative and Policy Efforts on Alternative Data</h2>
Although federal agencies have taken some <a href="https://files.consumerfinance.gov/f/documents/cfpb_interagency-statement_alternative-data.pdf">steps</a> to monitor the use of alternative data and encourage well-designed compliance management programs, existing guidance remains to be limited, according to the GOA. In 2019, there have been a few legislative efforts in Congress for regulating the use of alternative data in lending. However, the programmatic focus and the scope of alternative data that may be used in credit scoring were criticized to be narrow given the variety of use cases and the types of alternative data available to credit scorers and lenders.
Recently, Rep. Josh Gottheimer of New Jersey introduced a bill titled “<a href="https://financialservices.house.gov/uploadedfiles/bills-116hr____ih-accesstocredit.pdf">Accurate Access to Credit Information Act of 2019</a>” which amends the <a href="https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf">Fair Credit Reporting Act</a> to ensure that CRAs are providing fair and accurate information reporting in consumer reports, and for other purposes. Similar to the previous bills that sought to expand access to credit through alternative data, the proposed amendments permit the CRAs to use rent or utility payment information, subject to certain limitations. The proposed legislation emphasizes finding a better way to create a big picture view of a consumer’s creditworthiness and new consumer habits. That makes sense in 2020: millennials, for example, are prone to being credit invisible because they prefer to rent instead of owning a house, use mobile ride hailing apps rather than leasing a car, and use mobile payment apps.

This isn’t just a pressing topic in the U.S., of course. The World Bank and CGAP have published a detailed <a href="https://www.gpfi.org/sites/gpfi/files/documents/Data_Protection_and_Privacy_for_Alternative_Data_WBG.pdf">discussion paper</a> on data protection and privacy for alternative data, identifying transparency, data privacy and discrimination risks to be addressed through policy guidance. Looking across our southern border, similar risks were spelled out by Banco de Mexico, who emphasized the potential reliance of lenders on reports obtained from alternative data providers as a substitute of credit reports. Mexico, which adopted a <a href="https://www.acc.com/resource-library/fintech-regulation-mexico-1">landmark piece of legislation</a> regarding financial technology, requires alternative data providers to comply with <a href="https://www.dlapiperdataprotection.com/index.html?t=law&amp;c=MX">data protection regulations</a>.

In Europe, information used by credit scorers such as social media data, app usage data and location intelligence will likely be captured by the General Data Protection Regulation, which regulates data permissions and lawfulness of the use as well as requiring robust IT security and safeguards, to the extent an individual can be identified based on alternative data (including identification with reverse engineering and the combination of various datasets).
<blockquote>Without data integrity, alternative data may not expand access to credit.</blockquote>
In the United States, efforts to regulate use of alternative data promise to increase consumer protection and facilitate financial inclusion. Because people develop technology and algorithms, they may also learn and reflect biases of their makers. To minimize the risk of discrimination and unfair outcomes, more transparency is needed from the credit scorers. Furthermore, without ensuring data integrity, it’s not realistic to expect alternative data to miraculously expand access to credit. In the absence of sound and uniform regulations on data privacy and laws on the fair use of alternative data, consumer protection risks outweigh benefits.

Alternative Data in America: Policy and Concerns

With the deadline for the 2020 <a href="https://www.centerforfinancialinclusion.org/about/what-we-do/hbs-accion-program-on-strategic-leadership-in-inclusive-finance">HBS-Accion Program on Strategic Leadership in Inclusive Finance</a> rapidly approaching -- applications are due Tuesday, January 21 -- we thought it would be helpful for the admissions team to offer some insights on crafting the best possible program and scholarship application to raise your chances of acceptance.
<h2>1   Be specific</h2>
A lot of times, applicants answer the questions generally, which makes it hard for us to judge their application against other candidates or how useful the program would be to them in their work. A few of our prompts ask for an example or to list three challenges they face, and often people just list one challenge, or don’t answer the entire question, which is a pretty easy way to eliminate applicants right away.
<h2>2   Stay on topic</h2>
This is similar to the above. Applicants to the HBS-Accion Program have unique and deep experiences, and we look forward to learning more about them in reading their applications. However, this program is fairly specific – both in terms of the course content and the profile of applicants and their respective institutions – so to level the playing field, we encourage you to review the questions/prompts closely to make sure you answer them directly. This will help us better equally compare the merits of each application.
<h2>3   Be concise</h2>
We also have word limits on the short answer questions, and they are often ignored, or applicants use the additional information box to write an entire essay when, often, it’s not necessary. When there’s too much information, it’s sometimes challenging for us to decipher what’s the actual answer to the question and what’s just extra information.
<h2>4   Reach out with questions</h2>
In general, most of the people who have emailed us with questions this year have ended up submitting stronger applications. Clarifying is a good way to make sure you provide a relevant answer to a question that otherwise might be confusing. This happens a lot with the scholarship question in particular.
<h2>5   Answer all the questions</h2>
We understand the application is long (we want to be thorough!), but each required question must have a response associated with it. We think your application is a reflection of how you might perform during the course, so please take the time to complete it in full and with special care.
<h2>6   Answer in complete sentences and check spelling and grammar</h2>
We understand that English isn’t the first language of a sizable percentage of our applicants. We don’t expect applicants to be world-class writers in English – after all, this isn’t a scholarly degree program. But there is a fair amount of reading and writing involved, and being able to share your unique perspectives in a clear and cogent manner is important to getting the most out of the program. This is why we encourage you or a friend to proofread your application and use your word processor’s spelling and grammar check function.

6 Tips for a Stronger Application: HBS-Accion Program on Strategic Leadership in Inclusive Finance

As more people are connecting to more financial services digitally, we’re seeing growing calls for individuals to have greater control over how their data is being used and by whom. At the heart of consumers’ ability to control their data is the notion of consent, but what consent means in practice can vary considerably and can often be difficult for providers to ascertain in a meaningful way from a consumer standpoint.

In the EU, the GDPR has <a href="https://gdpr.eu/gdpr-consent-requirements/">defined consent</a> as being free, informed, specific and unambiguous. It also necessitates an opt-out option for data subjects, allowing for the partial or complete withdrawal of any previously given consent, and for the removal of all gathered personal data. But while these requirements may be good for consumers, they’re also tough for providers to implement. Just ask Google, which was <a href="https://www.reuters.com/article/us-google-privacy-france/france-fines-google-57-million-for-european-privacy-rule-breach-idUSKCN1PF208">fined 50 million euros</a> last year after the French data protection authority concluded that it “lacked transparency and clarity in the way it informs users about its handling of personal data and failed to properly obtain their consent for personalized ads.”
<h2>Flexibility Needed for Smaller Providers</h2>
So, if a tech giant, operating in Europe with all the resources and expertise at their disposal, can run afoul of these new consent requirements, does it make sense for governments in developing countries to try to adopt similar rules? India’s response for now has been yes. The current version of its pending data protection bill incorporates the same consent principles as GDPR. However, one legal observer we spoke to expressed concerns that the bill says nothing about what this consent architecture will look like and the ways in which consent will be sought. For smaller providers like microfinance institutions, fintechs and small finance banks that are trying to reach underserved segments with higher levels of illiteracy, obtaining consent as currently defined in the bill would pose a significant challenge, as elaborated below. Moreover, providers leveraging digital technologies to serve customers who might not be that digitally literate or understand the ways their data can be used may find it nearly impossible to meet such high standards of consent. The likes of Google might be able to figure it out over time, but smaller providers would need more flexible rules and support to comply.
<blockquote>Google might be able to figure out high-standard consent, but smaller providers would need more flexible rules and support.</blockquote>
For further evidence on how providers are already coming up short on consent, a recent <a href="http://documents.worldbank.org/curated/en/677281542207403561/Financial-Consumer-Protection-and-New-Forms-of-Data-Processing-Beyond-Credit-Reporting">World Bank report on new forms of data processing</a> laid out many limitations of practices around consent, such as lengthy and complex consent forms, incomplete information, and standardized, inflexible terms offered on a “take it or leave it” basis. As a result, providers are often seen to be doing the bare minimum to comply with existing data protection requirements. In recounting the deficiencies identified in a study by the Centre for Internet and Society on fintech privacy policies in India, a <a href="https://cis-india.org/internet-governance/blog/the-wire-shweta-mohandas-july-30-2019-in-india-privacy-policies-of-fintech-companies-pay-lip-service-to-user-rights">recent article</a> noted that one rule “requires a fintech company to provide an option to withdraw consent. Twenty-three percent of the companies allowed the user to opt out or withdraw from certain services such as mailing list, direct marketing and in app public forums, but they did not allow the user to withdraw their consent completely.” Such findings have led various observers to rightly question <a href="https://www.cgap.org/blog/data-protection-and-financial-inclusion-why-consent-not-enough">how effective consent really is</a> in practice and to propose <a href="https://www.cgap.org/research/publication/making-data-work-poor">other approaches</a> to give consumers more meaningful control over their data.
<h2>The Futility of Trying to Keep Up with New Approaches to Consent</h2>
This all stands to reason, but it again begs the question as to how providers who are already having a hard time complying at a minimal level could ever keep up with these new approaches. Indeed, in discussing the variety of data protection principles and standards that already exist around the world, the previously mentioned World Bank report also hastened to point out that “such principles may often be difficult to implement, particularly in low-capacity environments and/or where changes in the financial sector are fast paced.” As our interviewees attested, low-capacity environments and fast-paced changes are very much the rule, not the exception, and the path from principles to implementation is littered with landmines.
<blockquote>Low-capacity environments and fast-paced changes are very much the rule, not the exception.</blockquote>
One case we encountered centered around the issue of informed consent. Last year, the Reserve Bank of India <a href="https://economictimes.indiatimes.com/industry/banking/finance/banking/rbi-slaps-rs-5-crore-penalty-on-airtel-payments-bank-for-violation-of-norms/articleshow/63235308.cms">fined Airtel Payments Bank</a> the equivalent of roughly $700,000 for “contravening the Operating Guidelines for Payments Banks and directions issued by RBI on Know Your Customer (KYC) norms.” Airtel Payments Bank is majority owned by Bharti Airtel, one of the largest mobile operators in India, and in 2017 complaints started to emerge among mobile subscribers that Airtel Payments Bank had opened new bank accounts without their consent. According to <a href="https://www.financialexpress.com/economy/uidai-airtel-payments-bank-case-company-claims-no-wrongdoing-heres-how-you-can-avoid-the-trap/979401/">reports</a>, when new Airtel mobile subscribers first opened their Airtel mobile app, a pre-ticked consent box would appear on the welcome screen which, unless unchecked, would authorize the use of the same <a href="https://uidai.gov.in/what-is-aadhaar.html">Aadhaar</a>-based eKYC verification required to open the mobile account to also open an Airtel Payments Bank account. Over 2.3 million customers reportedly had new bank accounts created that they did not realize had been opened. Further complicating the matter was the fact that government subsidies would automatically be sent as direct benefit transfers to each beneficiary’s most recent Aadhaar-linked bank account, resulting in the equivalent of about $6.6 million in subsidies being deposited into these accounts. Airtel Payments Bank maintained that it had properly obtained consent to open these accounts but committed to working with the government to ensure compliance. We spoke with Akhil Verma, the current Chief Information Security Officer of Airtel Payments Bank, and he said the bank’s failure to notify customers of this caveat and obtain their explicit permission before allowing this was considered grounds for insufficient consent.
<h2>Out of Step With Modern Digital Reality</h2>
Another concern we heard from the other side of the globe was that some consent requirements are out of step with modern realities. According to Mariano Fuentes, Legal Advisor with ASBANC, the banking association in Peru, its data protection law (which was originally passed in 2011) is outdated for the digital times we now live in and does not do a thorough job of clarifying the ways consent can be obtained. Banks in Peru can obtain consent for personal data digitally, but “sensitive” personal data, which not only includes data on things like race or health, but also biometric data and data pertaining to “personal habits” that could come from things like mobile phone usage patterns, still requires written consent. Since Peru’s data protection law was passed in 2011, it would not have been able to fully anticipate the ways in which people’s lives have been digitized and the new types of data that would emerge, so it’s not surprising that it was reported last June that the National Authority for the Protection of Personal Data in Peru had issued <a href="https://elcomercio.pe/economia/negocios/tres-anos-han-puesto-1-246-sanciones-faltas-proteger-datos-noticia-646513-noticia/">1,246 sanctions within three years</a> (across all sectors).  A scan of the sanctions imposed by the data protection authority also reveals that a significant share of these violations resulted from failures to properly obtain consent.

Whether these cases amount to violations is often a matter of interpretation. Mariano Fuentes of ASBANC underscored this by pointing out that five member banks are currently appealing their penalties because they disagree with the arguments made by the data protection authority. “The complete idea of consent is not represented by any technology, which is damaging in today’s times and is used against us to levy sanctions,” he added. Despite these challenges, Peru consistently ranks as one of the top country-wide regulatory environments for financial inclusion in the Economist Intelligence Unit’s <a href="https://www.centerforfinancialinclusion.org/global-microscope-2019">Global Microscope</a> assessment. In the 2019 version, it came in second partly because it “showed the greatest improvement in the consumer protection domain—specifically, for its data protection framework for financial customers.”
<h2>So How Are Consumers Supposed to Understand?</h2>
Given all the shortcomings with current consent practices around the world, it’s simply unfair to expect consumers to be able to fully understand what can and cannot happen with their data right at the point when they are about to access a new service or download an app. But at the same time, placing the burden on providers, especially those that are on the frontlines of underserved areas, to understand and apply high standards of consent is also proving to be a challenge. The reality is that this is a burden that both consumers and providers need to share, but not on their own. They need the right mix of policy and technology to help them get there. There are some emerging regulatory technology – or “regtech” – solutions providers in developed markets (like <a href="https://www.trunomi.com/">Trunomi</a>) that enable consent-based data sharing, for example.
<blockquote>This is a burden that both consumers and providers need to share, but not on their own.</blockquote>
As these solutions continue to advance, perhaps governments in developing countries could seek to attract such providers to adapt these solutions for their markets. It’s this type of innovation and collaboration that is needed to make consent work. The burden should be broadly shared.

Data Consent: Let’s Share the Burden for Effective Consumer Protection

Board effectiveness executive education for social enterprise leaders

Board Leadership for Impact Program

We provide management and leadership training to executives shaping the financial inclusion industry.

HBS-Accion Program on Strategic Leadership in Inclusive Finance

Become a fellow to pursue the big, unanswered questions facing the financial inclusion community.

CFI Research Fellows Program

Fellowships and Executive Education

Industry Engagement

For equity investors committed to financial inclusion and seeking at least a double bottom line

Financial Inclusion Equity Council

For researchers, financial services providers and policymakers to advance the conversation and toolset on financial health

Financial Health Community

For CEOs of MFIs committed to accelerating repsonsible financial inclusion

Partnership for Responsible Financial Inclusion

For fintechs and digital financial service providers committed to consumer protection

Fintech Protects Community of Practice

Institutional partnerships make our work possible. 

Partner With Us

As a non-profit organization, your donations help us achieve our mission.

Donate

Building practical knowledge and human capacity, we work to deepen and sustain financial inclusion.

We support, convene and engage industry stakeholders to help make financial inclusion a lasting reality.

Ethan Loufield

Shweta Vashisht

The flow of data across borders is a contentious issue countries encounter when developing data protection laws and regulations. How should policy stakeholders in financial inclusion approach this issue?

Mayada El-Zoghbi

<p>The impact of these platforms on the Indonesian economy are being noticed. In 2018, <a href="https://kr-asia.com/tokopedia-projects-to-contribute-usd-12-billion-to-the-indonesian-economy-this-year">Tokopedia generated 10.3 percent of all new jobs</a> (in the form of merchants) in Indonesia. <a href="https://www.wired.com/story/ubers-grab-on-the-developing-world/">Grab</a>, the other major ride hailing platform, currently has 2.6 million agents which serve 46 million end users. Incomes of agents increased by 30 percent last year.</p>
<p>These benefits were evident when we met with individual agents, merchants and gig workers. One merchant we met who sells skull caps made from bamboo on three e-commerce sites was able to add an important livelihood to his normal construction job when he discovered he could buy from local producers and market on these e-commerce sites himself. He only had a primary school education, but he was able to get the hang of these e-commerce sites on his own. Another woman who works as a masseuse on the GoMassage platform hosted on Gojek had nearly doubled her income as the platform has expanded her market substantially. We heard similar stories from agents, drivers, and cleaners who deliver their services on these platforms.</p>
<blockquote><p>We need to focus attention on research and documenting the impact of these new jobs in emerging markets.</p></blockquote>
<p>Undoubtedly the individuals we met were not representative of the entire universe of merchants and gig workers in Indonesia. To better understand whether these anecdotal experiences are exceptions or the norm, we need to focus some attention on doing research and documenting the impact of these new jobs of the future in emerging markets. This will certainly be an area of focus for CFI in the future. Stay tuned.</p>


The gig economy is sometimes viewed as an adversary of job security and worker protections. In Indonesia, it's a different story.  

Sezgi Guler-Fuechec

Successful in their home countries, many skilled migrants in the U.S. need to start over when it comes to their credit files. Is alternative data the way forward for them and for Americans on the credit margins? This is the third in the “Data Protection and Financial Inclusion: Why It Matters” blog series. 

Tess Johnson

Madeleine Longwell

Being to the point, on topic, and not being shy about reaching out with questions are good tactics. 

Our fast-changing digital times and the lack of clarity on the interpretation of current regulations mean that informed consent is hard to come by in financial inclusion. This is the second in the "Data Protection and Financial Inclusion: Why It Matters" blog series. 

Get Involved

Partner With Us

Donate

Fellowships and Executive Education

Industry Engagement

Support Our Work

Quick Links

Partner With Us

Donate to the Center for Financial Inclusion at Accion

Quick Links

CFI Inclusions + Blog Digest Newsletter

Fellowships and Executive Education

Board Leadership for Impact Program

HBS-Accion Program on Strategic Leadership in Inclusive Finance

CFI Research Fellows Program

Industry Engagement

Financial Inclusion Equity Council

Financial Health Community

Partnership for Responsible Financial Inclusion

Fintech Protects Community of Practice

Stay informed. Subscribe to our newsletter.