Today there are close to 700 million mobile money accounts registered worldwide — a number that, if it were a population, would rank as the world’s third-largest country. East Africa continues to lead in digital financial innovations as well as account usage, with two-thirds of the combined adult populations of Kenya, Rwanda, Tanzania, and Uganda actively using mobile money. With the proliferation of mobile financial services, particularly among underserved populations, it is vital that users be treated fairly and with dignity. In the momentum to define responsible digital finance and recognize providers of high-quality financial services, the industry must not forget the consumer.
<h1>Client Voices: Why We Listened</h1>
<a href="/about/what-we-do/the-smart-campaign/">The Smart Campaign</a>, a global initiative to create an environment in which financial services are delivered safely and responsibly to low-income clients, has long recognized that client perspectives are often underrepresented in consumer protection discussions. With the Client Voices Project, the Campaign questions whether the industry’s assumptions about what constitutes problematic treatment rightly reflect what clients themselves worry about.

The dual objectives of the project are to solicit input from low-income clients about what they consider good and bad treatment in their interactions with financial service providers and to assess the prevalence of consumer protection problems among these clients, using quantitative surveys. The project is designed to act as a catalyst for financial service providers, regulators, industry associations, consumer advocacy groups, and others to improve client protection in ways that are grounded in client feedback.
<h1>Major Findings</h1>
Based on a survey of over 1,200 people in three districts in Rwanda, this report delves into the experiences of individuals who use digital financial services (DFS), the main client protection issues they are concerned about, and the impact and prevalence of negative experiences. We find that mobile money enjoys a high degree of satisfaction and trust from clients in Rwanda, even though 40 percent of clients report being targeted by fraudulent schemes, which have become increasingly sophisticated.
<blockquote>Customers report wising up to scams and fraud, but with a continuous influx of new mobile money users and fraudsters who innovate quickly, the threat is real and constant. Fraud represents the greatest potential to damage customer trust and engagement with mobile money in Rwanda.</blockquote>
However, there are many ways that DFS operations and practices can be improved to better protect clients and strengthen trust. Client recourse mechanisms, for example, represent an important area for improvement: many clients shared that they feel helpless and unsure about what to do after realizing they have been duped. Additionally, for business models that rely more on the mobile interface than on human interaction, clients increasingly rely on agents for information and guidance. This presents an opportunity to provide better service, as well as a risk for poor client treatment.

We hope that providers, industry associations, support organizations, regulators, consumer protection advocates, and clients can benefit from these findings to create a stronger, more inclusive client protection ecosystem. We offer specific recommendations for many of these stakeholders.

Client Voices: Rwandans Speak on Digital Financial Services

Laterite Ltd

Mastercard Foundation

The Smart Campaign

Rwanda

Sub-Saharan Africa

Keeping Clients First

Agent Banking

Appropriate Product Design and Delivery

Client Treatment

Complaint Resolution

Consumer Protection

Credit

Credit Provision

Delivery Channels

Digital Credit

Digital Financial Services

Financial Service Providers

Mobile Banking

Payments

Privacy

Telcos

Underserved Groups

Report

This post originally appeared on American Banker's <a href="https://www.americanbanker.com/opinion/consumer-harm-from-data-breaches-is-a-black-box">BankThink</a> page.

Data privacy and security concerns are red-hot right now, with near daily headlines about yet another breach. Often missing from the conversation, however, is information about the nature and prevalence of harms consumers actually experience as a result of poorly protected data. We appear to enjoy speculating about what might happen to consumers more than documenting what does and has happened. And yet, there is no better guide to prioritizing remedial action than clear documentation of the consequences of shortcomings, their frequency and their severity.

The Center for Financial Inclusion at Accion, an action-oriented think tank focused on financial inclusion, examines issues around data protection among financial service providers around the world, with an emphasis on those serving the base of the pyramid. From the financial inclusion point of view, we need to understand the financial losses that customers experience — primarily theft and fraud — when data breaches occur.

While we have been able to <a href="https://www.centerforfinancialinclusion.org/digital-finance-and-data-security-2">explore security vulnerabilities</a> by working with the computer scientist Patrick Traynor of the University of Florida, we have found it more difficult to find good data on the consumer side. How often do consumers experience theft and fraud, how harmful are these events to consumers and financial institutions when they do occur, and how do they relate to security lapses or poor policies among financial institutions and their regulators? Without this data, we as a sector can only view part of the problem. We are unable to analyze the link between security system measures and actual consumer harm. It’s as though we have lost the car keys but are only able to look for them under the streetlight.

It sounds overly simplistic to say that a data breach leads to negative consequences only when those who obtain personal information actually use it. But while the breach of data from millions of bank accounts makes front-page news, we know startlingly little about the number of uses of those identities or the amounts of money lost. One estimate of incidence comes from the Identity Theft Resource Center, a nonprofit dedicated to assisting victims. It cites 1.6 billion record breaches since 2005, but only 16.7 million identity theft victims. A quick hallway poll of my own colleagues revealed many experiences of fraud, generally through idiosyncratic events rather than massive ones, underlining the fact that hackers and fraudsters tend to rip people off quietly and often individually. When this happens, victims themselves may not know how or when their personal data was tapped. As an industry, we are short of information about the pathways hackers use to turn data breaches into monetary thefts.

Where could the industry begin to gather this information?

Cybercrimes units among law enforcement agencies undoubtedly have a great deal of information about the incidence of theft resulting from fraudulent uses of personal data. In theory, their financial forensics can work backward from a monetary theft to the data breach that made it possible. But we need to ensure that such units address losses by ordinary consumers and not just big ticket white collar crimes. We also need to ensure that law enforcement knowledge translates into useful advice for financial institutions and regulators.

Large banks and major card providers also have masses of relevant information and expertise. They have invested enormous resources over decades to identify and cope with fraud, creating fraud detection systems and workforces dedicated to assisting customers who are victims, and they still write off millions of faulty transactions. While it may be expensive, that very investment is a major source of their business success: It makes it possible for consumers to trust that when their credit card information is stolen, they will not be liable. But what about smaller financial institutions and new market entrants that cannot afford the sophistication of major card providers? They need to know more about how consumers experience fraud and theft. It would be valuable for the regulators, researchers and industry associations that monitor the financial sector and have a stake in its success to gather more systematic demand-side research to document these consumer experiences — and that information needs to be publicly available so that financial service providers and their consumers can benefit from it.

These recommendations are a starting point to better inform consumers and the financial services industry about the risks associated with data breaches, and how they can be prevented and addressed. Better information on the incidence and severity of consumer harms can enable financial service providers and policymakers to weigh trade-offs between data protection investments and the risks associated with incomplete protection. As a result, they can target remedial actions more effectively, avoiding both over-spending and running unacceptable risks — with better outcomes for consumers.

Consumer Harm from Data Breaches is a Black Box

From Beth's Desk

Fraud

Blog Post

The keynote speaker at a recent EU conference on data protection and privacy, Apple CEO Tim Cook s<a href="https://www.computerworld.com/article/3315623/security/complete-transcript-video-of-apple-ceo-tim-cooks-eu-privacy-speech.html">poke surprisingly bluntly</a> about the consequences of how data is being collected and used, and stressed an immediate need to enact data privacy regulation -- at least in Apple’s home country -- which would be on par with his host’s General Data Protection Regulation (GDPR) framework, enacted May 2018.

“Our own information, from the everyday to the deeply personal, is being weaponized against us with military efficiency,” he said. “Platforms and algorithms that promised to improve our lives can actually magnify our worst human tendencies. Rogue actors and even governments have taken advantage of user trust to deepen divisions, incite violence, and even undermine our shared sense of what is true and what is false.”

Cook reviewed the four rights that are articulated in the GDPR: First, the right to have personal data minimized; second, the right to knowledge; third, the right to access, that is, to make it easy for users to get a copy of, correct, and delete their personal data; and fourth, the right to security.

For those of us in the financial inclusion space, it was a pleasant surprise to see such a high-profile tech CEO speak so forthrightly on the topic. Data security has also very much consumed our discussions, both in an <a href="https://content.centerforfinancialinclusion.org/getting-data-right/">essay</a> and in a <a href="https://www.centerforfinancialinclusion.org/the-road-to-getting-inclusion-right-data-and-an-effective-ecosystem">speech</a> at our recent 10th anniversary symposium. We’re grappling with this technical and multi-faceted issue in order to make sure that we “get it right” as data enables greater financial inclusion in the developing world.

Furthermore, the recent “Banana Skins” report, “<a href="https://www.centerforfinancialinclusion.org/finance-for-all-wedded-to-fintech-for-better-or-worse">Finance for All: Wedded to Fintech for Better or Worse</a>,” published by the Center for the Study of Financial Innovation in conjunction with CFI, reveals that leaders in financial inclusion see technology’s risks as by far the biggest challenge they currently face.

Lofty words and alarms may be on message, but what matters is moving toward tangible steps to protect data. A recent working paper by <a href="https://www.dvara.com">Dvara Research</a>, a financial systems policy research institution in India, lays out a <a href="https://www.dvara.com/blog/2018/11/08/video-effective-enforcement-of-a-data-protection-regime/?utm_source=feedburner&amp;utm_medium=email&amp;utm_campaign=Feed%3A+dvara+%28Dvara+Blog%29">framework for a data protection regime</a> that could addresses both prevention of and response to data breaches. The authors provide a risk-based framework for “responsive regulation” in India, noting that the most regulations are created after a major data breach has occurred (such as the Aadhaar data breach in India about a year ago). The paper highlights principles – such as transparency, accountability, and proportionality – that should guide the regulators.

Speaking of regulation, The Economist Intelligence Unit’s <a href="https://www.centerforfinancialinclusion.org/global-microscope-2018">Global Microscope</a>, a ranking of the enabling environments in 55 countries carried out in partnership with CFI, has also taken a forward-looking digital approach in evaluating governments’ abilities to create smart, practical and deliverable regulation, including in data protection. Colombia (which tops the overall ranking) and South Africa, for example, have dedicated financial consumer protection frameworks and specialized enforcement capacity, along with government entities with a strong capacity to enforce data protection laws.

We at CFI couldn’t agree more with these intentions, and we’re also contributing our part toward making sure the need for data protection, transparency, and consumer knowledge are deeply ingrained in those operating in the financial inclusion space.

This is why the <a href="http://smartcampaign.org/">Smart Campaign</a> is strengthening its attention to data privacy and security in its standards for consumer protection certification for digital financial services. We are also sponsoring research, such as that from CFI Fellow Patrick Traynor, which showed how some digital financial service providers have <a href="https://www.centerforfinancialinclusion.org/digital-finance-and-data-security-2">gaps in their data security</a> protocols, and offered some easily actionable technical fixes (see also this <a href="http://www.cgap.org/blog/cybersecurity-mobile-financial-services-growing-problem?utm_source=CGAP+Reader+%2811.26.18%29&amp;utm_campaign=CGAP+Reader+%2811.26.18%29&amp;utm_medium=email">post and slide deck</a> from CGAP with challenges and best practices for digital financial service providers).

In 2019, CFI will continue to tackle this issue, to do our part as advocates of data protection for billions of vulnerable unbanked and underbanked consumers around the world.

&nbsp;

Apple CEO Sounds Right Notes on Data Protection and Privacy

Policy, Regulation and Government Initiatives

Mobile phones and networks are transforming the world of finance, creating opportunities  for widespread financial inclusion, especially among neglected regions and groups. Security and privacy should be among the most important considerations when building digital finance systems.
Credit decisions are often based on sensitive information and online finance offerings are no exception. The sensitivity of this information gives rise to a series of critical questions for customers:
<ul>
 	<li>To whom am I giving my data? And who else do they allow to access it? For what purposes?</li>
 	<li>How do the companies protect data so that people who do not have legitimate access cannot use or steal it?</li>
 	<li>What rights and options do I have if something does go wrong?</li>
</ul>
The goal of this research, conducted by CFI Fellow Patrick Traynor, is to examine how well digital lenders are responding to these questions.

&nbsp;

&nbsp;

&nbsp;

Digital Finance and Data Security

CFI Research Fellows Program

Consumer Credit

Fintechs

Nano Loans

Given their rapid spread and growth, this question urgently needs answering. As part of its ongoing CFI Fellows Program, CFI asked <a href="http://www.centerforfinancialinclusion.org/people/patrick-traynor/">Patrick Traynor</a>, professor at the University of Florida’s Department of Computer Information Science &amp; Engineering (CISE) to find out.

Traynor and his team of computer science researchers looked at the security of online fintech applications using a collection of both automated and manual standard analysis techniques widely available in the computer science toolkit. They examined the apps and websites of 52 digital apps, mainly digital lenders, from all across the world to see how they handle user data. Additionally, after the technical analysis, Traynor’s team also evaluated the privacy policies for each application to see if they described how users’ data would be used and protected, and the recourse available to users in case of any misuse. <a href="http://www.centerforfinancialinclusion.org/digital-finance-and-data-security-2/">Read the full report</a>.

These tests allowed for a rapid assessment of the state of communications security between users’ mobile devices and each institution’s backend servers. The tests determined whether the mobile application properly determined the identity of the other end of communications, and whether the institutions’ backend servers were properly configured against the most up-to-date attacks against the SSL/TLS security suites. A thorough analysis of the apps’ public code included, among other things, a review of the process for registration and login, user authentication, money transfers and techniques used to isolate the website or application’s data from other potentially malicious) applications on the phone. Through such an analysis, the researchers were able to determine how easily an adversary could inject false transactions or alter legitimate transactions in the platform.

The results of the study were surprising. No company studied was perfect, some were good enough, and some had real vulnerabilities. The researchers found that the integrity of data gathered from mobile money applications varied dramatically across the sample. Interestingly, neither presence in a developed market nor company maturity predicted better security performance: similar security vulnerabilities were found in both early stage startups and more established providers and in institutions from all world regions in the sample. No company is immune from security gaps, and mobile fintechs are no exception.

In an effort to motivate and enable companies to address these vulnerabilities, CFI sent individual results to each of the companies reviewed in the study. Additionally, Traynor prepared a short guidebook with instructions on how to correct the most commonly identified security vulnerabilities uncovered by this study. The recommended changes will provide significant security improvements for a low time and monetary investment.

Through Accion’s Venture Lab, we organized a private webinar with Traynor for six companies in the sample. He walked participants through the tests and addressed questions on how to implement his recommended changes. We recognize and commend these companies for their dedication to address the issues this study encountered in their systems, and would like to encourage other companies in the study to do the same by reaching out to us directly. Our aim as CFI is to motivate better data security practices and we are available to support any company taking action on this matter.

Accion Venture Lab is also working to create and share resources for their portfolio companies and the broader industry. Focused on developing a set of practical resources to help early-stage fintech startups implement better information security and data privacy, their approach is to leverage insights from industry experts and portfolio companies to create actionable and accessible content. The tools they are building include:
<ul>
 	<li>Diagnostic: checks and tests that companies can use to identify major gaps in security and privacy</li>
 	<li>FAQ: resources to answer the most salient questions from companies about data protection</li>
 	<li>Data policy outline: key components of a quality data policy for financial services companies</li>
 	<li>Implementation guide: best practices to implement changes to data practices</li>
</ul>
Additionally, Venture Lab is working on relevant questions for due diligence. The goal is not to screen out a company based on these, but rather to identify areas where Venture Lab can help develop more robust policies and practices.

At both CFI and Venture Lab, we believe that integrity of client data gathered from mobile applications is important to secure. Companies don’t always dedicate the time and resources to understand their vulnerabilities and compromising incidents with data will damage the credibility and limit the reach of digital apps. By measuring the state of security in this space and providing targeted resources for digital fintechs, we can enable responsible digital financial services and greater financial inclusion.

&nbsp;

New Data Security Study of Fintech Apps Highlights Vulnerabilities

This post is one of five entries related to the report “<a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/1030-accelerating-financial-inclusion-with-new-data">Accelerating Financial Inclusion with New Data</a>,” a collaboration between CFI and the Institute of International Finance (IIF).

One might think that with the explosion of new types of data and advanced analytics there would be an abundance of low-hanging fruit for financial service providers to feast on. While the excitement about the potential of non-traditional data may be justifiable, the reality is that the hard work of building the networks to derive value from such data is just getting underway. Just as the invention of the automobile required the development of roads, signage, lighting, laws and regulations, so too will data need its own groundwork before it can bring transformative change to the financial system and society at large.

Any change of this magnitude also requires large-scale collaboration to ensure that the infrastructure and standards put in place are broadly applicable across technologies, data types, industries and countries. As such, alongside the many in-house and bilateral initiatives afoot across various providers and markets, there needs to be a much more holistic and collaborative approach to developing data ecosystems that can align principles, practices and standards to facilitate the flow of data through value chains and across geographies.
<blockquote>Complexity and fragmentation across a growing number of holders of data and in legal and regulatory environments makes it essential to work at an ecosystem level to allow data to flow more freely.</blockquote>
Our recently released report, <a href="https://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/1030-accelerating-financial-inclusion-with-new-data">Accelerating Financial Inclusion with New Data</a>, discusses various impediments to unlocking data’s potential, ranging from determining which types of data to leverage to how to access it, to where data can be stored and how to integrate it with existing data and systems. For example, mobile network operators are often reluctant to engage in agreements with third parties to share mobile phone data, known as call detail records, because of regulatory ambiguity about what can be shared – and to retain a competitive advantage. Social media companies restrict the data third parties can access, and some have policies that prohibit the use of their data for credit scoring. Other obstacles include varying regulation of cross-border data flows, a shortage of specialized expertise in data management and analytics, and a lack of standardization. All of this results in complexity and fragmentation across a growing number of holders of data and in legal and regulatory environments, making it essential to work at an ecosystem level to allow data to flow more freely.

Fortunately, a number of developments reflect this ecosystem-building approach. A recent Brookings Institution <a href="https://www.brookings.edu/research/regulating-for-a-digital-economy-understanding-the-importance-of-cross-border-data-flows-in-asia/">report</a> addressing cross-border data flows in Asia explained that despite the enormous economic benefits brought on by the global flow of data, governments are increasingly turning to what is referred to as data localization to restrict data flows. At the same time, however, the report provides some examples of solutions that facilitate the free flow of data among countries with different approaches to privacy. Citing the Cross-Border Privacy Rules developed by the Asia-Pacific Economic Cooperation (APEC) forum, it says, “A key benefit of the APEC regime is that it enables personal data to flow freely even in the absence of two governments having agreed to formally recognize each other’s privacy laws as equivalent. Instead, APEC relies on businesses to ensure that data collected and then sent to third parties either domestically or overseas continues to protect the data consistent with APEC privacy principles.” Various other frameworks of this nature have emerged as well, which are helping to build the connections needed for our increasingly data-driven economies to thrive.

In a new <a href="https://www.slideshare.net/slideshow/embed_code/key/mK7BOSft2scEUj">report</a> exploring trends in how data is being shared in emerging markets, Rafe Mazer, a consultant specializing in consumer protection and competition in financial services, addresses the emergence of a variety of public and private sector-led data sharing models and offers a set of considerations for assessing their fit for different country contexts. The report identifies the challenge posed by the concentration of data in “data silos” and says, “In these data silos the firm that generates or collects the data on the consumer defines the terms of use of the data up front in a way that limits the consumer’s right to access this data or share it, while giving wide-ranging and often ill-defined rights to the firm to share and sell consumers’ account data to third party service providers.” Mazer emphasizes the need for providers, policymakers and others to replace these silos with open data sharing models and concludes that “the single most important action to support data sharing in emerging markets is likely to be policy reforms, as experiences in other markets point to a need to compel certain minimum levels of data sharing for these models to reach a national scale.”
<blockquote>We hope to see more holistic and collaborative approaches to developing data ecosystems that can align principles, practices and standards to facilitate the flow of data.</blockquote>
While significant progress has already been made in finding innovative ways to leverage non-traditional data, much of what has taken place to date has been through internal experimentation or bilateral arrangements, such as <a href="https://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/872-how-financial-institutions-and-fintechs-are-partnering-for-inclusion">partnerships between financial institutions and fintechs</a>. Looking ahead, we hope to see an expansion of comprehensive multi-party arrangements that can help to channel the ever-increasing flows of new data into our broader efforts to advance financial inclusion.

Building Data Ecosystems for Financial Inclusion

Alternative Data

Data Analytics

Financial Technology

As digital credit providers have grown exponentially over the past few years, and as digital products and models have proliferated, so too have concerns around consumer protection. In the recently published report, <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/1036-responsible-digital-credit">Responsible Digital Credit</a>, I argue that ensuring that digital credit customers receive responsible treatment requires more than enhanced consumer protection laws and regulations. It also requires strong commitment from the digital credit industry. Finally, it needs consumers who are empowered to play a more proactive role in managing their digital credit responsibly.

Over the past year, I have interviewed digital credit industry associations, credit providers and their third-party data analytic providers, regulators, policy makers, and various consumer protection leaders. Many of these groups are working to develop responsible digital lending principles. With their input, my report proposes a guiding framework for responsible digital lending.  The framework uses the Smart Campaign <a href="https://www.smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">Client Protection Principles</a> as a basis for grouping the issues. In addition, I propose an eighth principle: security and fraud protection.

Digital credit, and especially the use of mobile phones, significantly alters interactions between borrowers and lenders. Lenders utilizing the mobile channel to advertise, acquire and transact with customers must pay particular attention to the limitations of mobile interaction with customers and follow industry <a href="http://onlinelendersalliance.org/wp-content/uploads/2016/03/Best-Practices-2016-1.pdf">mobile best practices</a>. While many of the standard consumer protection practices continue to apply, new concerns, or more accurately, new faces on older concerns, have emerged. In this post, I want to highlight several of the considerations I found most important and relevant for the digital lending industry.
<h2>Responsible Algorithms</h2>
Many digital credit models rely on algorithms to process data about clients and make credit decisions. Because most lenders consider their algorithms proprietary, it is difficult for observers to know on what basis credit decisions are actually made. This opaque situation raises the spectre of discrimination. Attributes that are considered inappropriate bases for differentiation, such as religion, language, gender, or ethnic origin, are areas of particular concern with regard to algorithm-based lending practices. As highlighted by a Smart Campaign <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/916-smart-brief-tiny-loans-big-questions">report</a>, while credit offers may differ based on risk analysis, such differentiation should be consistently applied, stated in advance, and made with the goal of benefitting clients. To prevent discriminatory digital credit practices, some recommendations include:
<ul>
 	<li><a href="https://www.whitecase.com/publications/insight/algorithms-and-bias-what-lenders-need-know">Pretest, test and retest for potential bias</a>. Digital credit providers and third-party data analytics providers should continuously monitor the outcomes of their algorithmic programs to identify potential problems. Such testing could involve running scenarios to identify unwanted outcomes and developing and building controls that prevent adverse outcomes.</li>
 	<li><a href="http://www.ijmo.org/papers/43-A10212.pdf">Document the rationale for algorithmic features</a>. Digital credit providers should be able to provide visualization and a decision tree for the factors their algorithms analyze, as well as the justification for relying on these factors. The rationale should address how borrower debt capacity is assessed, given the importance of this concept in traditional underwriting.</li>
 	<li>Independent review of companies' proposed data sets and/or algorithms.</li>
</ul>
A self-regulatory approach could be used to develop best practices guidelines for data inputs and the development of nondiscriminatory artificial intelligence systems, following the model that has been successful for the Payment Card Industry Security Standards Council.
<h2>Indebtedness Monitoring</h2>
Because digital lending is often based on non-traditional underwriting criteria, to prevent over-indebtedness among digital borrowers it may be relatively more important to monitor outcomes at the portfolio level. Some of the ways to do this include:
<ul>
 	<li>Avoidance of debt traps by ensuring that clients are not forced into automated repeat loans.</li>
 	<li><a href="http://www.responsiblebusinesslending.org/">Responsible credit reporting</a> – Better compliance with reporting strengthens markets and leads to better client protection practices.</li>
 	<li><a href="http://www.centerforfinancialinclusion.org/storage/documents/Smart_Brief_Tiny_Loans_Big_Questions_Final_092617.pdf">Monitoring digital credit provider’s portfolio quality</a> – Industry benchmarks for portfolio quality can help to advance the understanding of risks and avoid business models that rely for their success on high default rates.</li>
</ul>
<h2>Digital Transparency </h2>
Digital credit platforms allow for 24/7 communications with clients that, if harnessed properly, can assist them with immediate technical support, remind them about upcoming payments and even identify counselors or resources for clients in financial stress. However, when communication is totally digital, there are heightened concerns about ensuring that clients really know what they are signing up for. Disclosure must lead to client understanding. Borrower disclosure standards should address:
<ul>
 	<li>Standards for honest advertising and penalties for misleading marketing materials of credit products. Furthermore, providers should advertise the name of the financial regulator they report to in all advertising materials.</li>
 	<li>Readability and format – Disclosures need to be easy to comprehend, available in the customer’s local language, and provided in print and digital formats.</li>
 	<li>Comparative tools – Standard summary disclosure documents would allow borrowers to compare credit offers, both digital and traditional.</li>
 	<li>Adequate notice periods – Consumers should be notified in advance of changes to interest rates, fees or terms and conditions.</li>
</ul>
A somewhat different but related and relevant concern, often overlooked in this context, is the vulnerability of individual investors who put their money into pure peer-to-peer (P2P) lending platforms. Protections need to be extended to them as well, with a focus on ensuring that they receive the information they need to evaluate risks and that they have recourse channels when something goes amiss.
<h2>Data Privacy and Usage Standards</h2>
While many regulators and most industry groups agree that it is important to protect the confidentiality and security of customers’ information, data use and the level of disclosure about its use are challenging topics. In the <a href="http://ec.europa.eu/justice/data-protection/reform/index_en.htm">EU</a> and in countries such as <a href="https://www.pc.gov.au/inquiries/completed/data-access/thedraft">Australia</a>, regulators are enacting rules mandating that individuals be notified about the use of their personal data and allowed to opt out. Opt-out rules should be considered as a potential requirement for all digital credit providers, especially in markets where mobile push-marketing has become problematic.

Over the next several years it will be important for laws or regulations to be put in place to protect consumer data privacy and guide information sharing. The rules need to:
<ul>
 	<li>Provide for informed consent, such that customers explicitly permit electronic data collection prior to its collection and use, and are given the option to consent or not.</li>
 	<li>Require providers to have a clear data collection and handling policy which limits the amount of data collected as well as the timeframe it is stored.</li>
 	<li>Inform clients about their data trails and credit histories, including the ability to ensure accuracy and correct for any errors or discrepancies.</li>
 	<li>Give regulators the power to discipline providers who repeatedly allow personal data to be misused.</li>
</ul>
<h2>Fraud Prevention and Security </h2>
New security vulnerabilities arising from digital credit strongly point to fraud and cyber-security as consumer protection concerns. It is increasingly urgent for digital credit providers to adopt standard security compliance measures and then to regularly test and update them. Providers must also be responsible for ensuring that the third-parties they use, including lead generators, brokers, agents, and data analytics providers, also have adequate security in place. Ultimately, providers need to be responsible for the actions of their third-parties (e.g., agents, contractors, lead generators, brokers and collectors).

Consumers should be made aware of the potential for fraud and encouraged to report suspected fraud cases or security breaches. Consumer awareness campaigns on the most common incidents of fraud (via the internet, SMS alerts, signage at agent kiosks, etc.) can help with this.

While the recommendations just listed do not apply in all markets, they do point to the urgent need for regulators, industry bodies, individual providers and consumers to work together to construct the ground rules for responsible digital credit that will ensure that consumers are adequately protected.

Editor's Note: This research was made possible by support from Mastercard Foundation and other partners.

&nbsp;

A Framework for Responsible Digital Credit

Over-indebtedness

Responsible Digital Finance

Transparency

Never before have issues of data privacy and security been more top of mind. In the United States this attention was on <a href="https://cfi-blog.org/2018/04/11/financial-inclusion-responds-to-the-zuckerberg-moment/">full display</a> a few weeks ago when every media outlet was glued to Facebook’s CEO Mark Zuckerberg as he fielded questions from Congress on how his company handles, and has mishandled, user data.

Europe begins a new era for data protection today as the General Data Protection Regulation (<a href="https://gdpr-info.eu/">GDPR</a>) goes into effect, following its passage roughly two years ago. The law is being celebrated widely for its robust customer-centricity. The degree to which it succeeds, in Europe and globally, in enforcing a business environment that provides adequate safeguards for consumer data management remains to be seen. One thing is certain, however: it has the potential to change the way we all interact with businesses, from internet platforms to banks.

First, a quick overview of the law.

The regulation <a href="https://www.youtube.com/watch?v=j6wwBqfSk-o">tightens rules</a> on what companies can and can’t do with customers’ personal data. Data qualifies as “personal” if it can identify the user, which includes names, phone numbers, usernames, and even GPS data and IP addresses.

The law strives to put customers in control of their data. It requires providers to attain explicit consent from users on data that will be gathered and how it will be used. Instead of users automatically opting in to data sharing, providers must configure their systems with no pre-checked boxes. Users must actively opt in. Providers are compelled to use simple, accessible language communicating what’s in their user data agreements.

The regulation significantly strengthens individuals’ abilities to access their data, and even to erase it. An individual can ask a company for the data in their personal file and the company must comply within a month. If the user believes that a company should correct data, or delete data altogether, the company must comply in most cases.

Punishment for noncompliance is steep, with delinquent companies facing fines up to €20 million or 4 percent of the company’s total revenues, whichever is higher. It’s <a href="https://www.theverge.com/2018/5/24/17388206/microsoft-expand-data-privacy-tools-gdpr-eu">reported</a> that Microsoft has had more than 1,600 engineers working on GDPR-related projects.

Even though the regulation only pertains to citizens of the European Union and companies operating there, in today’s global business landscape, where there is no shortage of cross-border business, we’re likely to see providers all over the world adopting stricter data practices to ensure compliance with the GDPR.

What does the new regulation mean for financial services?

We’re likely to see providers throughout the financial services ecosystem reconfiguring their digital products and the related data systems to align with the new standards. For example, a bank might only do 2 percent of its total global business in the EU, but if it fails to comply with the GDPR, it could still be subject to penalties – a strong incentive, indeed. Not all financial services providers will be affected equally. Larger institutions that have had the resources over the past two years to allot product designers, compliance lawyers, and the like to GDPR are better positioned than startups and small providers to take these regulatory changes in stride. Moreover, not all financial services providers use data in the same way. Institutions that use “alternative” data sources to underwrite credit decisions might be faced with a bigger barrier than financers whose business models aren’t contingent on customers opting to share personal information.

Of course, there’s a difference between the letter of the law and business practices. As Richard Waters of The Financial Times <a href="https://www.ft.com/content/bbbce328-5f64-11e8-9334-2218e7146b04">put it</a>, “The principles behind the regulation are laudable, but it is likely to take an onslaught of official complaints from privacy activists to test the parameters of this new regime.”

We’ll be curious to see the degree to which the new law improves users’ engagement with their data. When many of us are faced with a new user agreement, we just click and carry on. Would the requirement to click opt in boxes make a difference in whether we actually read the agreements? Will we take the time to sort out what data we are willing to share and with whom? Perhaps not, but the GDPR works to offer every opportunity for us to do so.

Have you read?

<a href="https://cfi-blog.org/2017/04/07/internet-data-and-banking-data-should-the-same-rules-apply/">Internet Data and Banking Data - Should the Same Rules Apply?</a>

<a href="https://cfi-blog.org/2015/10/07/addressing-customer-needs-off-to-the-data-mines/">Addressing Customer Needs? Off to the Data Mines</a>

<a href="https://cfi-blog.org/2017/05/01/how-secure-is-data-used-in-digital-credit/">How Secure Is Data Used in Digital Credit?</a>

&nbsp;

How Will Europe’s General Data Protection Regulation Affect Us?

Europe and Central Asia

Enabling Environment

Mark Zuckerberg <a href="https://www.nytimes.com/2018/04/10/us/politics/mark-zuckerberg-testimony.html">defended</a> Facebook’s handling of customer data yesterday before the U.S. Senate, and many of us at Accion and the Center for Financial Inclusion were riveted. Not that the testimony was especially compelling as television spectacle, but because the issues at stake are so important both for our own lives and for our work.

I did a quick scan of the staff here in our Washington, D.C. office, and would like to share some of their thoughts.

Many of us identified with the widespread shock toward Facebook for using our data (or allowing others to use it) in ways we don’t like and without our clear consent. “It’s hard to separate the relevance for our work [in financial inclusion] from my anger at the relevance of these events for my life,” said <a href="http://www.centerforfinancialinclusion.org/about/staff/675-sonja-kelly">Sonja Kelly</a>. For <a href="http://www.centerforfinancialinclusion.org/about/staff/733-Allyse-McGrath">Allyse McGrath</a>, the first thought was a sense of relief that policy makers are “actually doing something about protecting our data” which she quickly amended to “at least starting to explore how to do so.” Other folks are more skeptical and wondering whether legislators will do anything once the furor dies down.

Data privacy and data security are central to the success of financial inclusion. As <a href="http://smartcampaign.org/">Smart Campaign</a> director <a href="http://www.centerforfinancialinclusion.org/about/staff/124-isabelle-barres">Isabelle Barres</a> pointed out, the Campaign enshrined data privacy as one of the seven <a href="http://smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">Client Protection Principles</a> from the very beginning. Through the years we have seen a somewhat peripheral principle become increasingly prominent, as customer data became more digital and more abundant. “There are absolutely some data abuses, and regulators need to step in,” she said. “And perhaps there is hope that the focus on Facebook will be a trigger to force companies to think about consumer data more carefully.” More broadly, our staff are concerned that the proliferation of data collected without much regulation can lead to the kinds of aggressive push marketing we are beginning to see with digital credit delivery in some countries.

<img class="alignright wp-image-25420" style="border: 0 solid #000000" src="https://centerforfinancialinclusionblog.files.wordpress.com/2018/04/quote-1-real1.png" alt="" width="340" height="102" />Senators asked Zuckerberg a lot of questions about Terms and Conditions (T&amp;C). Long and legalistic, people do not read the Facebook T&amp;Cs, and if they did, they would not likely understand them. In such a situation, does consent really exist? This problem is exactly the same in financial inclusion. On many mobile money platforms, for example, T&amp;Cs cannot be read on the phone when the customer is actually using the service. Customers have to log on to an internet-connected computer to download the T&amp;Cs – and we know almost none of them do. What have these customers given away? They do not know.

The solution proposed in the hearing today was to ask customers to opt-in to data sharing rather than setting sharing as the default and asking them to opt out. This choice is just as relevant for payment and credit apps as it is for Facebook. The presumption should always be in favor of privacy and the customers’ right to choose how their data is used.

<a href="https://www.accion.org/content/venture-lab-team">Coryell Stout</a> of the <a href="https://www.accion.org/venturelab">Accion Venture Lab</a> team noted that fintech start-ups often do collect enormous amounts of data. Venture Lab vets the founders and managers of their investee companies thoroughly, with an eye toward social mission. They also review data use and management policies. They do not invest until satisfied that the data is used to benefit customers. However,  the potential for misuse exists, if data is in the hands of people with other motivations. “We know that companies are collecting a lot of data. It needs to be secure, and we need more clarity about who controls the data fintechs collect.” Governments may need to help create that clarity.

<img class="alignright wp-image-25422" style="border: 0 solid #000000" src="https://centerforfinancialinclusionblog.files.wordpress.com/2018/04/quote-1.png" alt="" width="339" height="130" />The landmark European law on data privacy, the <a href="https://www.eugdpr.org/">General Data Protection Regulation</a>, which goes into effect next month, comes down solidly on the side of consumer ownership and control of data. Yesterday’s hearings suggest that the U.S., which has until now had a much more pro-company perspective, may become somewhat more sympathetic to the European approach. Regulators in the emerging and frontier markets in which we work are just starting to come to grips with the issue, and may forge their own path, as <a href="http://www.mondaq.com/india/x/655034/data+protection/Data+Protection+Laws+in+India">India</a> and <a href="https://www.economist.com/news/china/21735613-will-impede-governments-snooping-china-consumers-are-becoming-more-anxious-about-data">China</a> are doing.

The consequences of misuse of consumers’ social media data can be significant – not just annoying ads, but election meddling and more. But the consequences of misuse of financial data can be even more direct: money lost to scams, theft and mis-selling. As we watch the public conversation play out over the broad questions of data ownership, we need to ensure that a similar conversation is moving forward to ensure that the highly sensitive data financial service providers handle – whether they are banks, microfinance institutions, telcos or fintechs – is secure and properly used.

Featured image credit: Alessio Jacona via <a href="https://www.flickr.com/photos/10296406@N00/25140171161">Flickr Creative Commons</a>

Have you read?

<a href="https://cfi-blog.org/2014/04/16/facebook-to-provide-remittances-the-news-and-the-bigger-picture/">Facebook to Provide Remittances? The News and the Big Picture</a>

<a href="https://cfi-blog.org/2015/09/24/discrimination-and-credit-underwriting-in-the-age-of-social-media/">Discrimination and Credit Underwriting in the Age of Social Media</a>

<a href="https://cfi-blog.org/2017/11/20/choosing-a-payday-lender-can-online-reviews-help/" target="_blank" rel="noopener">What Global Bankers Are Worried About</a>

&nbsp;

&nbsp;

&nbsp;

&nbsp;

Financial Inclusion Responds to the Zuckerberg Moment

The recent <a href="https://www.nbcnews.com/tech/security/massive-equifax-data-breach-could-impact-half-u-s-population-n799686">security breach of credit reporting agency Equifax</a> exposed birth dates, social security numbers and credit card information of up to 143 million consumers. The hackers will likely sell this personal information which could result in financial and medical identity left, and fraudulent credit card activity and tax reporting, along with a slew of other activities. Earlier this week <a href="https://www.nytimes.com/2017/09/26/business/equifax-ceo.html?mcubz=3">Equifax announced</a> their CEO, Richard Smith will be retiring and could walk away with $18 million in pension benefits. The Massachusetts Attorney General, Maura Healey <a href="http://www.npr.org/2017/09/14/550949718/after-equifax-data-breach-consumers-are-largely-on-their-own">called it</a> “the most brazen failure to protect consumer data we have ever seen.” As a result, the Federal Trade Commission, members of Congress and multiple states’ authorities are looking into criminal investigations. However, the burden of this breach will fall primarily on individual consumers to ensure they are protected, and only <a href="https://qz.com/1079138/whats-the-worst-that-can-happen-with-the-equifax-breach-a-lot-especially-if-youre-poor/">10 percent</a> of the potential 143 million affected have even checked the Equifax site to see if their information was compromised. (You can check to see if you may have been impacted <a href="https://www.equifaxsecurity2017.com/am-i-impacted/">here</a>.)

The precautionary recommendations put forth have been to: 1. Check your credit score regularly (which can only be done for free once a year); 2. Freeze your credit; and 3. Purchase credit monitoring services. (Freezing your credit means establishing a “lock” that prevents opening new forms of credit in your name, while monitoring your credit is the process of periodically reviewing your credit reports for accuracy and changes that might be the result of fraudulent activity.) The irony of these suggestions is that you have to rely on the three major credit bureaus (Equifax, Experian and TransUnion) to perform these consumer protection activities. How can we know we are safe from fraud when our recourse requires trusting the entities that have been compromised? What’s more, why should we pay additional fees to correct the credit bureau’s mistake?

The Equifax breach affects consumers at all levels of the socioeconomic landscape, and unfortunately those with fewer financial resources and capability will be affected the most. Correcting identity theft can be a time consuming and financially burdensome endeavor. For many it is challenging to come up with emergency cash to cover legal fees to prove identity theft or restore credit, recover stolen assets and pay for additional credit monitoring services. And sadly, we haven’t seen strong consumer protection support on behalf of the credit bureaus and formal financial service providers in the wake of this breach -- support like educating the public about monitoring credit, providing more than one free credit report annually or offering free/discounted credit monitoring for more than one year. Thomas Hinton, CEO of the consumer advocacy non-profit American Consumer Council, <a href="https://qz.com/1079138/whats-the-worst-that-can-happen-with-the-equifax-breach-a-lot-especially-if-youre-poor/">said</a> he “is deeply concerned that Equifax – and all credit reporting companies – are not doing enough in a timely manner to protect under-served consumers who have been victimized by this data breach and stand to suffer the most.”

Such massive security breaches erode the public’s trust in the financial system, particularly among the unbanked already skeptical of entering the formal financial fold. The <a href="http://www.usfinancialdiaries.org/issue">U.S. Financial Dairies</a> showed that many Americans don’t trust the financial system because of unexpected bank fees – like overdraft fees – and because banks provide little or no social support, which many people get with informal group lending and savings options.

This isn’t the first major data breach in U.S. history and it won’t be the last. Last year when Yahoo was in negotiations to be bought by Verizon, it came out that <a href="https://www.csoonline.com/article/2130877/data-breach/the-16-biggest-data-breaches-of-the-21st-century.html">1.5 billion</a> user accounts were compromised between 2013 and 2014. And we can’t forget the 2013 Target breach that compromised credit/debit card and contact information of up to <a href="https://www.csoonline.com/article/2130877/data-breach/the-16-biggest-data-breaches-of-the-21st-century.html">110 million</a> customers.

So, what can be done? How can anyone feel comfortable about the protection of personal information?

Financial service providers are looking to biometric data as a secure identification source for financial services. Over the past seven years, <a href="https://uidai.gov.in/about-uidai/about-uidai.html">the Unique Identification Authority of India (UIDAI)</a> has issued over <a href="https://uidai.gov.in/about-uidai/about-uidai.html">one billion</a> Unique Identification Numbers (UID), also known as Aadhaar numbers, which are verified and authenticated with biometric data via finger prints or iris scans. This identification system is a part of <a href="http://indiastack.org/about/">India Stack</a> that uses four distinct technology layers – including simplified payments addressing and interoperability – to provide digital financial services across governments and businesses in India.

The technology already exists to use finger print and facial scans to unlock our phones or log into personal banking apps, and there is even the potential of using <a href="https://www.wired.com/2016/03/biometrics-coming-along-serious-security-concerns/">ear scans and heart beat identification</a> as biometric identification sources. But so far biometric identification is fairly unregulated, some consider the security to not yet be airtight and there are additional privacy concerns with using bodily identifiers. Hackers are already finding ways to spoof biometric identification. Recently, the security firm Vkansee was able to <a href="https://www.wired.com/2016/03/biometrics-coming-along-serious-security-concerns/">break into Apple’s Touch ID system</a> with a small piece of play doh. But we will see rapid improvements in Apple’s security, particularly with the new iPhone X Face ID technology.

In the case of India’s Aadhaar scheme, there is robust opposition to the program, with concerns including the perceived ease of forging fingerprints, the program’s potentially inadequate digital security, and its ubiquity. Some opponents of the program believe that if the Aadhaar numbers are widely integrated and linked between previously-siloed databases, it expands the opportunity for citizen profiling and surveillance. In August, India’s Supreme Court <a href="https://www.theatlantic.com/technology/archive/2017/09/aadhaar-worlds-largest-biometric-database/538845/">issued a ruling</a> enshrining the fundamental right to privacy. The anti-Aadhaar movement in the country celebrated the ruling, asserting that the program is in conflict with this fundamental right. Soon the Supreme Court will indeed assess if Aadhaar does violate Indian citizen’s privacy rights.

Regardless of how our information is authenticated, it is becoming increasingly important for consumers to protect and regularly track their financial information. Consumers should be concerned about the potential threats and take appropriate action by checking their credit score and monitoring credit card activity. But we can also realize that, at least as of now, security breaches are mostly out of our hands.

Have you read?

<a href="https://cfi-blog.org/2017/05/01/how-secure-is-data-used-in-digital-credit/">How Secure Is Data Used in Digital Credit?</a>

<a href="https://cfi-blog.org/2017/05/05/demonetization-brought-out-the-best-in-indian-microfinance-clients/">Demonetization Brought Out the Best in Indian Microfinance Clients</a>

<a href="https://cfi-blog.org/2017/06/28/why-do-privacy-policies-matter-for-digital-credit/">Why Do Privacy Policies Matter for Digital Credit?</a>

&nbsp;

In the Wake of the Equifax Breach, Are Biometrics the Answer?

India

North America

South Asia

United States

Challenges and Crises

Alexandra Rizzi

Senior Director, The Smart Campaign 

Isabelle Barrès

Vice President, Smart Campaign

Daniel Balson

Danielle Piskadlo

Elisabeth Rhyne

Ethan Loufield

Ezra Mannix

Haset Solomon

Jeffrey Riecke

John Owens

Lizzy Bolze

Pablo Anton-Diaz

Patrick Traynor

Sergio Guzmán

Somen Saha

Sonja Kelly

Susy Cheston

Azerbaijan

Bolivia

Chile

Haiti

Iraq

Jordan

Kenya

Latin America and The Caribbean

Lebanon

Middle East and North Africa

Philippines

Syrian Arab Republic

Uganda

Crowdfunding

Financial Health

P2P Lending

Product Pricing

Refugees and Migrants

Social Performance

Trends

Underwriting

India is a global leader in financial inclusion. For over a decade, Accion has worked with and learned from India’s innovators, investors, and policymakers to expand economic opportunity for its people and businesses.

Hannah McCandless

&gt; Posted by Dr. Katharine Kemp, Research Fellow, UNSW Digital Financial Services Regulation Project

The following post was <a href="http://www.ifmr.co.in/blog/2017/08/22/big-data-financial-inclusion-and-privacy-for-the-poor/">originally published</a> on the IFMR blog. 

<img class="alignright wp-image-24028" src="https://centerforfinancialinclusionblog.files.wordpress.com/2017/08/thumb_a98e715cf75d4c2ca7eea8e88847d4ba.jpg" alt="" width="365" height="243" />Financial inclusion is not good in itself.

We value financial inclusion as a means to an end. We value financial inclusion because we believe it will increase the well-being, dignity and freedom of poor people and people living in remote areas, who have never had access to savings, insurance, credit and payment services.

It is therefore important to ensure that the way in which financial services are delivered to these people does not ultimately diminish their well-being, dignity and freedom. We already do this in a number of ways – for example, by ensuring providers do not make misrepresentations to consumers, or charge exploitative or hidden rates or fees. Consumers should also be protected from harms that result from data practices, which are tied to the provision of financial services.

Benefits of Big Data and Data-Driven Innovations for Financial Inclusion

“Big data” has become a fixture in any future-focused discussion. It refers to data captured in very large quantities, very rapidly, from numerous sources, where that data is of sufficient quality to be useful. The collected data is analysed, using increasingly sophisticated algorithms, in the hope of revealing new correlations and insights.

There is no doubt that big data analytics and other data-driven innovations can be a critical means of <a href="http://www.pc.gov.au/inquiries/completed/data-access/report" target="_blank" rel="noopener noreferrer">improving the health, prosperity and security of our societies</a>. In financial services, new data practices have allowed providers to serve customers who are poor and those living in remote areas in new and better ways, including by permitting providers to:
<ul>
 	<li>Extend credit to consumers who previously had to rely on expensive and sometimes exploitative informal credit, if any, because they had no formal credit history;</li>
 	<li>Identify customers who lack formal identification documents;</li>
 	<li>Design new products to fit the actual needs and realities of consumers, based on their behaviour and demographic information; and</li>
 	<li>Enter new markets, increasing competition on price, quality and innovation.</li>
</ul>
But the collection, analysis and use of enormous pools of consumer data has also given rise to concerns for the protection of financial consumers’ data and privacy rights.

Potential Harms from Data-Driven Innovations

Providers now not only collect more information directly from customers, but may also track customers physically (using geo-location data from their mobile phones); track customers’ online browsing and purchases; and engage third parties to combine the provider’s detailed information on each customer with aggregated data from other sources about that customer, including their employment history, income, lifestyle, online and offline purchases, and social media activities.

Data-driven innovations create the risk of serious harms both for individuals and for society as a whole. At the individual level, these risks increase as more data is collected, linked, shared, and kept for longer periods, including the risk of:
<ul>
 	<li>Inaccurate and discriminatory conclusions about a person’s creditworthiness based on insufficiently tested or inappropriate algorithms;</li>
 	<li>Unanticipated aggregation of a person’s data from various sources to draw conclusions which may be used to manipulate that person’s behaviour, or adversely affect their prospects of obtaining employment or credit;</li>
 	<li>Identity theft and other fraudulent use of biometric data and other personal information;</li>
 	<li>Disclosure of personal and sensitive information to governments without transparent process and/or to governments which act without regard to the rule of law; and</li>
 	<li>Harassment and public humiliation through the publication of loan defaults and other personal information.</li>
</ul>
Many of these <a href="http://www.cgap.org/blog/making-case-privacy-poor" target="_blank" rel="noopener noreferrer">harms are known to have occurred</a> in various jurisdictions. The reality is that data practices can sometimes lead to the erosion of trust in new financial services and the exclusion of vulnerable consumers.

Even relatively well-meaning and law-abiding providers can cause harm. Firms may “segment” customers and “personalise” the prices or interest rates a particular consumer is charged, based on their location, movements, purchase history, friends and online habits. A person could, for example, be charged higher prices or rates based on the behaviour of their friends on social media.

Data practices may also increase the risk of harm to society as a whole. Decisions may be made to the detriment of entire groups or segments of people based on inferences drawn from big data, without the knowledge or consent of these groups. Pervasive surveillance, even the awareness of <a href="https://www.jstor.org/stable/23252125?seq=1#page_scan_tab_contents" target="_blank" rel="noopener noreferrer">surveillance, is known to pose threats</a> to freedom of thought, political activity and democracy itself, as individuals are denied the space to create, test and experiment unobserved.

These risks highlight the need for perspective and caution in the adoption of data-driven innovations, and the need for appropriate data protection regulation.

The Prevailing “Informed Consent” Approach to Data Privacy

Internationally, many data privacy standards and regulations are based, at least in part, on the <a href="https://www.priv.gc.ca/en/opc-actions-and-decisions/research/explore-privacy-research/2016/consent_201605/" target="_blank" rel="noopener noreferrer">“informed consent”</a> – or “notice” and “choice” – approach to informational privacy. This approach can be seen in the Fair Information Practice Principles that originated in the U.S. in the 1970s; the 1980 OECD Privacy Guidelines; the 1995 E.U. Data Protection Directive; and the Council of Europe Convention 108.

Each of these instruments recognise consumer consent as a justification for the collection, use, processing and sharing of personal data. The underlying rationale for this approach is based on principles of <a href="http://scholarship.law.gwu.edu/cgi/viewcontent.cgi?article=2093&amp;context=faculty_publications" target="_blank" rel="noopener noreferrer">individual freedom and autonomy</a>. Each individual should be free to decide how much or how little of their information they wish to share in exchange for a given “price” or benefit. The data collector gives notice of how an individual’s data will be treated and the individual chooses whether to consent to that treatment.

This approach has been <a href="https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2533057" target="_blank" rel="noopener noreferrer">increasingly criticised</a> as artificial and ineffectual. The central criticisms are that, for consumers, there is no real notice and there is no real choice.

In today’s world of invisible and pervasive data collection and surveillance capabilities, data aggregation, complex data analytics and indefinite storage, <a href="https://www.priv.gc.ca/en/opc-actions-and-decisions/research/explore-privacy-research/2016/consent_201605/" target="_blank" rel="noopener noreferrer">consumers no longer know or understand</a> when data is collected, what data is collected, by whom and for what purposes, let alone how it is then linked and shared. Consumers do not read the dense and opaque privacy notices that supposedly explain these matters, and could not read them, given the hundreds of hours this would take. Nor can they understand, compare, or negotiate on, these privacy terms.

These problems are exacerbated for poor consumers who often have more limited literacy, even less experience with modern uses of data, and less ability to negotiate, object or seek redress. Yet we still rely on firms to give notice to consumers of their broad, and often open-ended, plans for the use of consumer data and on the fact that consumers supposedly consented, either by ticking “I agree” or proceeding with a certain product.

The <a href="https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2784123" target="_blank" rel="noopener noreferrer">premises of existing regulation are therefore doubtful</a>. At the same time, some commentators question the relevance and priority of data privacy in developing countries and emerging markets.

Is data privacy regulation a “Western” concept that has less relevance in developing countries and emerging markets?

Some have argued that the individualistic philosophy inherent in concepts of privacy has less relevance in countries that favour a <a href="http://www.tandfonline.com/doi/abs/10.1080/10572317.2007.10762729" target="_blank" rel="noopener noreferrer">“communitarian” philosophy of life</a>. For example, in a number of African countries, “ubuntu” is a guiding philosophy. According to ubuntu, “a person is a person through other persons”. This philosophy values openness, sharing, group identity and solidarity. Is privacy relevant in the context of such a worldview?

Privacy, and data privacy, serve values beyond individual autonomy and control. Data privacy serve values which are at the very heart of “communitarian” philosophies, including compassion, inclusion, face-saving, dignity, and the humane treatment of family and neighbours. The protection of financial consumers’ personal data is entirely consistent with, and frequently critical to, upholding values such as these, particularly in light of the alternative risks and harms.

Should consumer data protection be given a low priority in light of the more pressing need for financial inclusion?

Some have argued that, while consumer data protection is the ideal, this protection should not have priority over more pressing goals, such as financial inclusion. Providers should not be overburdened with data protection compliance costs that might dissuade them from introducing innovative products to under-served and un-served consumers.

Here it is important to remember how we began: financial inclusion is not an end in itself but a means to other ends, including permitting poor and those living in remote areas to support their families, prosper, gain control over their financial destinies, and feel a sense of pride and belonging in their broader communities. The harms caused by unregulated data practices work against each of these goals.

If we are in fact permanently jeopardising these goals by permitting providers to collect personal data at will, financial inclusion is not serving its purpose.

Solutions

There will be no panacea, no simple answer to the question of how to regulate for data protection. A good starting place is recognising that consumers’ “informed consent” is most often fictional. Sensible solutions will need to draw on the full “toolkit” of privacy governance tools (Bennett and Raab, 2006), such as appropriate regulators, advocacy groups, self-regulation and regulation (including substantive rules and privacy by design). The solution in any given jurisdiction will require a combination of tools best suited to the context of that jurisdiction and the values at stake in that society.

Contrary to the approach advocated by some, it will not be sufficient to regulate only the use and sharing of data. Limitations on the collection of data must be a key focus, especially in light of new data storage capabilities, the likelihood that de-identified data will be re-identified, and the growing opportunities for harmful and unauthorised access the more data is collected and the longer it is kept.

Big data offers undoubted and important benefits in serving those who have never had access to financial services. But it is not a harmless curiosity to be mined and manipulated at the will of those who collect and share it. Personal information should be treated with restraint and respect, and protected, in keeping with the fundamental values of the relevant society.

Image credit: Accion

Have you read?

<a href="https://cfi-blog.org/2017/06/28/why-do-privacy-policies-matter-for-digital-credit/">Why Do Privacy Policies Matter for Digital Credit?</a>

<a href="https://cfi-blog.org/2017/05/01/how-secure-is-data-used-in-digital-credit/">How Secure Is Data Used in Digital Credit?</a>

<a href="https://cfi-blog.org/2017/05/15/data-are-not-neutral-part-1-of-2/">Data Are Not Neutral (Part 1 of 2)</a>

Big Data, Financial Inclusion and Privacy for the Poor

CFI Fellow Patrick Traynor, an Associate Professor in the Department of Computer and Information Science and Engineering (CISE) at the University of Florida, explains the second part of his research effort on the security and privacy of data in digital lending applications. Patrick’s previous post, explaining the first part of his research on evaluating the privacy policies of digital lending applications, can be found <a href="https://cfi-blog.org/2017/06/28/why-do-privacy-policies-matter-for-digital-credit/">here</a>.

“I’m sorry, but we are just not interested in providing security for our customers.”

Here is a phrase that you are unlikely to see from any company, at least if they want to stay in business. In fact, you are far more likely to see statements to the opposite. Yet time and again, the same services that tout security as something they care about prove to be tremendously vulnerable. Think about it – when was the last week that you didn’t hear about stolen Bitcoins, ransomware attacks, or data breaches?

If companies care so much about security, what is going on?
<h2>What Does "Secure" Mean?</h2>
Security is one of the least well-defined terms I know. By itself, it completely lacks context. Secure against what? Against whom? Under what conditions? Based on what assumptions?

As an analog, think about a restaurant that claims to care about “consumer health.” Is this statement regarding ingredients in their meals? Calories? What about cleanliness? How is the food prepared? Do employees really wash their hands after using the restroom? Most would agree that it is insufficient to simply trust such claims, and we rely on external entities (e.g., health department ratings, government regulations for calorie counts on menus, etc.) to give “consumer health” more measurable meaning.

The answers to my above “security in context” questions become deeply technical very quickly. In fairness, it is debatable whether it is realistic for the general public to understand these details. Regardless, this gap between specificity and understanding often permits real security considerations to end at exceedingly broad public statements. If nobody checks or bothers to define what security means, the thinking often goes, why bother to go further?

That’s where my team comes in – think of us as the health department for the security of online credit systems.

Before I go into further details, let’s make something clear. “Security” is hard. Even if you answer all of the context questions above, ensuring that you get it right all of the time in every location is something that nobody seems to know how to do well. Unlike most other engineering, where major assumptions remain within a predictable range (e.g., when building a bridge, winds, currents and the pull of gravity are all accounted for in the design), security faces the problem of constantly evolving adversaries. That means that what worked perfectly well yesterday may do very little to protect systems tomorrow. That said, we cannot write off security as an inevitable failure just because it is hard. Moreover, there are many tried and true techniques that absolutely should be in place for anyone to begin tossing around the word security. Our job is to ensure that we see these techniques in place and working correctly.
<h2>What Are We Measuring?</h2>
If we are specific about what we claim is secure, it is possible to understand the ways in which systems are likely to be strong. For my <a href="http://www.centerforfinancialinclusion.org/programs-a-projects/cfi-fellows-program">CFI Fellowship research</a> on the security of online credit applications, I am measuring the characteristics of the connection between mobile devices and the server within the application provider’s network. While it possible to measure the security of many parts of an online credit system, the most critical is ensuring that connections between mobile devices and the service provider’s servers is secure. Accordingly, we focus our attention here. The figure below shows this in more detail.

[caption id="attachment_23960" align="aligncenter" width="616"]<a href="https://centerforfinancialinclusionblog.files.wordpress.com/2017/08/patrick-traynor-graphic.png"><img class="wp-image-23960" src="https://centerforfinancialinclusionblog.files.wordpress.com/2017/08/patrick-traynor-graphic.png" alt="" width="616" height="215" /></a> A high-level overview of our security analysis[/caption]

Why is this the right thing to measure? Simply, if a user cannot communicate securely with a company’s server, nothing else matters. An adversary need not bother to try to breach other security if this portion is poorly executed. Think of it this way – if the online credit provider’s system were a castle, we are most interested in the protections around the drawbridge over the moat. If nobody is watching who and what comes across that drawbridge, it does not matter how high the castle walls may be. Said differently, systems that do not get this part of security correct might as well be saying that quotation from the beginning of this post.

My team will characterize security with regards to the following metrics. First, we will look to see whether or not the mobile device uses strong encryption algorithms to protect the confidentiality (i.e., the secrecy) and integrity of all communications. Mobile platforms contain many different encryption algorithms, but even the best algorithms can be used in dangerous ways. Accordingly, we will reverse engineer mobile applications (where available) and determine which algorithms their developers have chosen.

Second, we will measure how mobile devices confirm the identity of the server. This is critical – when done poorly, a mobile device is happy to divulge any and all secrets to an adversary on the other end of a connection. There are some standard ways that an expert would expect this step to be done, and our previous published work on mobile money (<a href="http://www.cise.ufl.edu/~traynor/papers/reaves-usenix15a.pdf">Reaves, et al., Mo(bile) Money, Mo(bile) Problems: Analysis of Branchless Banking Applications in the Developing World, Proceedings of the USENIX Security Symposium (SECURITY), 2015</a>) showed that approximately 50 percent of applications analyzed in that space did so incorrectly.

Finally, we will measure the configuration of the servers with which a mobile device communicates. Poor configuration here could again render the connection vulnerable as an adversary may be able to force the selection of weak/no cryptographic algorithms encrypting communications.

One major advantage to this analysis is that fixes to these problems can also be achieved at relatively low cost. Specifically, any faults that we find will not require impacted companies to spend hundreds of thousands of dollars to deploy advanced detection systems. Rather, a combination of changes by their development team and administrators can potentially address these issues in short order. We intend to alert all of the impacted companies prior to the release of our final report.

As a final note, finding no faults in this portion of a system does not mean that everything is secure. Moreover, this kind of analysis requires significant resources and time to carry out. It is our hope that each of the companies we study see these results as a first step, and use them to start a broader internal discussion about what they are doing to ensure security inside their company (e.g., creating policies about software updates and patching machines, establishing mechanisms for researchers who discover vulnerabilities to provide responsible disclosure of vulnerabilities, deployment of mechanisms for the secure storage of sensitive data, etc.).

No single analysis can measure all aspects of security. However, we look forward to sharing our results with the general public and the financial inclusion community in the near future. Together, we can ensure the transformative power of these systems while minimizing risks to users.

Have you read?

<a href="https://cfi-blog.org/2017/05/01/how-secure-is-data-used-in-digital-credit/">How Secure Is Data Used in Digital Credit?</a>

<a href="https://cfi-blog.org/2017/05/15/data-are-not-neutral-part-1-of-2/">Data Are Not Neutral (Part 1 of 2)</a>

<a href="https://cfi-blog.org/2017/06/28/why-do-privacy-policies-matter-for-digital-credit/">Why Do Privacy Policies Matter for Digital Credit?</a>

&nbsp;

How Secure Are Emerging Digital Credit Services?

Hi there. I would love your help as we select topics for our 2018 CFI Fellows research.
<div class="getty embed image">

CFI is getting ready to launch the request for proposals for our 2018 Fellows cohort (a lot of you have been asking when it’s coming out, and the answer is SOON!). The <a href="http://www.centerforfinancialinclusion.org/programs-a-projects/cfi-fellows-program">CFI Fellows Program</a> is designed to respond to questions we think are critical to the future of financial inclusion. Fellows come from many perspectives, including both relatively junior and senior well-known researchers, and including researchers who have been in the financial inclusion community for a long time and some who are perceptive outsiders. We share a set of topics for study, and ask interested researchers to submit research proposals that address the topic of their interest.

Our semi-final list of questions is long, and we ask for your help refining or prioritizing them – or adding new ones. We’ve enabled comments at the bottom of this post for your feedback. Alternatively, feel free to email me at <a href="mailto:skelly@accion.org">skelly@accion.org</a>.

Here are the questions we are currently considering:

<ul>
 	<li>Traditional financial service providers often wish to benefit from the advances fintechs are making, but creating effective links between them can be difficult. How do different ways of connecting financial service providers with fintechs, such as open APIs, custom APIs, or bespoke partnerships, compare? What other elements need to be in place to support partnerships enabled through APIs?</li>
</ul>
As <a href="http://bit.ly/PartneringFintechs">recent research from CFI</a> has highlighted, partnerships between small to mid-sized FSPs and fintechs can create value for both parties – and serve customers better. We would like to see research that evaluates one key aspect of partnerships – the APIs that are needed to make connections work. The key research question is when or whether it is useful for APIs to be available openly to multiple partnerships versus bespoke APIs, and custom partnerships, recognizing that there are opportunities and challenges associated with each. Examples of various approaches could be studied and analyzed, with success factors identified.
<ul>
 	<li>How can formalization of invoicing and other record keeping increase financial inclusion for MSMEs? </li>
</ul>
Governments, especially in Latin America are increasingly requiring micro, small, and medium-sized businesses to move to electronic invoicing (<a href="https://assets.kpmg.com/content/dam/kpmg/us/pdf/2017/10/mandate-for-e-invoicing-adoption-kpmg.pdf">KPMG, 2017</a>). Other formalized record keeping systems are emerging as well, leaving data trails that can be used for credit analysis, as a number of fintech companies are starting to do. We want to assess whether and how e-invoicing is leading to increased financial inclusion for MSMEs, and with what benefits.
<ul>
 	<li>Tech superplatforms and financial inclusion: Big tech platforms like Google, Facebook, Amazon and Alibaba are increasingly moving into payments and credit. What are the implications of their moves for competitor FSPs and/or the target customers of financial inclusion?</li>
</ul>
The entry of the tech behemoths into financial services raises many questions across the financial inclusion community (and elsewhere). Some incumbents see the entrance as an opportunity to reach specific market segments (<a href="https://www.bloomberg.com/news/articles/2018-03-05/amazon-in-talks-with-jpmorgan-over-checking-accounts-wsj-says">link</a>). Others see profound changes in the structure of the financial services industry and the nature of competition. To what extent do the tech superplatforms include the underserved in access to financial services? What are implications for these customers? For incumbent FSPs and fintechs?
<ul>
 	<li>Data privacy policy: Several main approaches to data privacy have been emerging globally. How are regulators and FSPs in emerging and frontier markets responding to these approaches? What paths would be most appropriate and beneficial? </li>
</ul>
Starting with the regulatory approaches that key markets like Europe, China, India, and the U.S. take to data collection, use, management, and ownership, this research will examine how relatively unregulated markets are responding to these models (are they adopting similar protocols, going their own way, or postponing action?). In turn, how are institutions focused on financial inclusion responding—and what are some best practices to consider? One or several markets could be considered.
<ul>
 	<li>Employment and the changing nature of work</li>
</ul>
How will <a href="http://www.worldbank.org/en/publication/wdr2019#1">the changing nature of work</a> affect financial services needs in developing countries? Consider especially income volatility and informality in employment. While we’re seeing a trend towards increasing economic formalization, even for self-employment, we suspect that there hasn’t necessarily been a corresponding decrease in income volatility for those living in developing countries (as evidenced by recent research conducted by <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/807-beyond-financial-inclusion-financial-health-as-a-global-framework">CFI</a> and <a href="https://cfsinnovation.org/research/us-financial-diaries/">others</a>). How might financial services providers—traditional financial institutions, fintechs, and others alike—better equip current and potential customers to smooth their incomes, weather financial shocks, and navigate their financial lives?

Employers and financial health: How can employers support the financial health of their employees? This fellowship will explore: 1) the research on financial stress and employment to better articulate why employers in emerging markets should care about financial health; 2) what are existing ways that employers engage in the financial health of their employees; and, 3) what are tools or resources that employers need to be able to take action in this area.
<ul>
 	<li>Financial inclusion for lifecycle needs: How are financial services being leveraged to address critical life needs (including, but not limited to: education, shelter/housing, building a business, retirement, paying for health needs). Choose specific case examples.</li>
</ul>
In the financial inclusion community, we often neglect to pause and ask why we are pursuing financial inclusion. This fellowship will build the case for understanding financial inclusion in the context of the positive life changes that it enables for customers--or it will reveal that financial inclusion actually does a poor job of meeting needs across the life course. Successful proposals will have a solid and actionable proposed methodology, which can range from quantitative analysis of existing data to qualitative data collection from individuals/households and everywhere in between.

Which topics would you most want to see researched? Looking forward to hearing from you, and thank you in advance!

Have you read?

<a href="https://cfi-blog.org/2016/07/14/rental-properties-a-popular-pension-plan-for-aging-entrepreneurs/">Rental Properties: A Popular Pension Plan for Aging Entrepreneurs?</a>

<a href="https://cfi-blog.org/2017/12/18/how-successful-are-banking-agents-in-bringing-digital-financial-services-to-new-customers-in-india/">How Successful Are Banking Agents in Bringing Digital Services to New Customers in India?</a>

<a href="https://cfi-blog.org/2017/07/06/what-does-effective-human-touch-look-like-in-kenyas-digital-age/">What Does Effective Digital Touch Look Like in Kenya's Digital Age?</a>

</div>






&nbsp;

&nbsp;

Help Us Shape Our Fellows Program Research Agenda!

We have all seen privacy policies before: sign up for a credit card and you receive a pamphlet with tiny print detailing your bank’s particular policy. Create an account at an online service and you will get a link to something similar from it, too.  These policies are supposed to provide consumers with detailed information about which pieces of their data will be stored, how they might be used, with whom they can be shared, and how they will be protected. Privacy policies are now mandatory for financial institutions in developed nations, and here in the United States we are provided protection by laws such as the “Gramm-Leach-Bliley Act” (also known as the Financial Services Modernization Act of 1999).

Unfortunately, the reality of such policies is often not so clear. Many of these policies are written by attorneys with the sole intention of being consumed later on by other attorneys. That means that, in some cases, even highly educated individuals without a degree in law may not be able to fully understand what they are reading. What chance does the common consumer have to understand such policies?

You would think that consumers would be up in arms. But, let’s be honest – most people have never actually read these privacy policies, yet alone tried to understand them. Have you?

So then why is it important to examine the state of privacy policies?

Let me offer first an insight into the role of studies like ours and then some comments on why privacy policies for digital credit matter.

Protection by a Community of Experts

Outside of some minor fixes (e.g., replacing windshield wipers, changing the oil, etc.), I have never performed major repair work on my car. There are good reasons for this. First, modern cars contain literally thousands of moving parts and as many as 100 computer processors. I simply do not own the tools, nor do I possess the expertise necessary to diagnose and fix problems in a modern vehicle. On all but the rarest of occasions, I also have not read the owners’ manual. So how has my vehicle stayed in such excellent running condition for years?

Quite simply, we all rely on an army of experts so that we do not have to worry about the details of our cars’ operations. That army encompasses dealerships and independent mechanics, insurance regulators, and the National Transportation Safety Board (NTSB) in the United States, all working to ensure both the correct operation of all car components, and the safest possible failure modes (i.e., when things go wrong, manufacturers select options that protect passengers).

The same holds true for privacy policies. Like my car, the ideal state would be for such policies to be constructed so that everyone could easily understand them and make informed decisions based on their contents. But the reality is that, in their current state, it takes an army of experts to look through such policies to determine if they are reasonable or not.

Does that mean that privacy policies should be written without the consumer in mind? Absolutely not. Ultimately, we believe that privacy policies should be accessible to all – after all, the information they provide need not be as complicated as the inner workings of my car. The good news is that privacy policy readability has dramatically improved across industries over the past 20 years in the United States. The question remains whether the spate of online credit entities will build on these lessons, or once again repeat past mistakes. That’s one part of what our research project is trying to measure.

Importance of Sound and Transparent Privacy Policies and Security Practices

Privacy policies have become particularly salient for financial inclusion because of the promise held out by innovative lenders that creditworthiness assessments using data from new sources (e.g., historical location information, the applications running on the customer’s phone, spending habits on a mobile money account, etc.), can potentially open access to credit to ‘thin file’ customers lacking a traditional credit score. Thus, as electronic activities generate new data trails, it is important that this potentially powerful information be handled appropriately.

Many companies providing online credit decline to say which data they use or how they make credit decisions, arguing that such processes are their intellectual property and require protection against competitors. Such behavior carries a great potential risk to consumers. For instance, if the online credit provider is the victim of a data breach, consumers may have little idea about the extent to which their data (including their everyday behavior) may be exposed. Any insight into these behind-the-scenes decisions is therefore helpful to users trying to make informed data-related decisions.

A thorough privacy policy may also serve as an indirect indicator of an institution’s security practices. Because data storage is inexpensive, there exists great temptation to record as much data about customers as possible and keep it for the entire life of the business. However, such behavior dramatically increases the data security risks for consumers over time. Having a detailed privacy policy provides evidence that the online credit provider has thought specifically about what type of data is necessary to keep, and how it intends to store the data to minimize risks for its clients. Moreover, explicit policies about data retention, how and with whom such data can be shared, and methods for user choice (i.e., “opting out”) make clearer to customers (and experts alike) the protections a provider intentionally puts in place to guard information.

So, how clear are online credit providers about how they protect data? Do they typically discuss such information with their prospective clients? These are features we intend to measure in this project by conducting close analyses of privacy policies throughout the digital lending sector.

And with the steady influx of online credit providers in recent years, this research is increasingly pertinent. My University of Florida research team’s recent findings, encapsulated in our upcoming paper, entitled “Regulators, Mount Up! Analysis of Privacy Policies for Mobile Money Services” (to be published at the 2017 USENIX Symposium on Usable Privacy and Security (SOUPS)), shows that privacy policies are woefully inadequate in the mobile money space. Examples include policies as short as 68 words and documents not written in the language spoken by those they are intended to serve. Clearly, there is work to be done.

Regardless of our future findings in this space, I want to reiterate our research team’s core belief in the transformative power of online credit. We believe that such beneficial services can and should be delivered with security and privacy considerations that are at least as good as those in the traditional financial space.

The final report of this research will go into detail about the findings in this space, together with a list of policy recommendations on how to improve privacy policies. Learn more <a href="http://www.centerforfinancialinclusion.org/programs-a-projects/cfi-fellows-program/">here</a>.

Image credit: Accion

Have you read?

<a href="https://cfi-blog.org/2017/05/01/how-secure-is-data-used-in-digital-credit/">How Secure Is Data Used in Digital Credit?</a>

<a href="https://cfi-blog.org/2017/05/15/data-are-not-neutral-part-1-of-2/">Data Are Not Neutral (Part 1 of 2)</a>

<a href="https://cfi-blog.org/2017/02/22/10-things-ive-learned-from-the-cfi-fellows-program/">10 Things I've Learned from the CFI Fellows Program</a>

&nbsp;

Why Do Privacy Policies Matter for Digital Credit?

CFI Fellow Patrick Traynor, an Associate Professor in the Department of Computer and Information Science and Engineering (CISE) at the University of Florida, is launching his research effort on the security of data in mobile lending applications.

Mobile phones and networks are transforming the world of financial inclusion. However, we know that we cannot simply “copy and paste” traditional financing mechanisms into this mobile context and expect widespread inclusion. For example, the traditionally-excluded often lack the standard data lenders use to underwrite credit decisions (such as government audited tax forms, formal pay stubs, property deeds, and so forth). A plethora of companies are attempting to measure creditworthiness using alternative data – including the data trail created through mobile money applications. Alternative data for underwriting holds the potential to dramatically expand access to credit if successful, but it also poses new challenges.

For instance, how secure is data used in digital credit?

In my CFI Fellowship, I will measure the state of data security in the mobile money space and provide both a goal and a path towards responsible online credit.

My team and I are performing an extensive teardown of mobile applications including those offering online credit. After a technical analysis of these applications and how they handle user data, we plan to evaluate the privacy policies for each application to see if they describe how the data will be protected, how it will be used, and the recourse available to users should it be incorrect.

It is only by having deeply characterized the behaviors of the industry that we can begin to offer recommendations for what responsible online credit looks like and how far the industry is from achieving it. We expect to find that the integrity of data gathered from mobile money applications will vary dramatically and that the lack of a process to verify and/or challenge such information will limit the reach of alternative efforts to establish creditworthiness.

Methodological approach:

My past research looked at the security of mobile money applications for the Android mobile platform. Through that work, I was able to demonstrate that much of the industry fails to adhere to security best practices. Moreover, the terms of service dictated by companies in this space hold users liable for all fraud. These findings have called the industry to attention and provoked corrective efforts. Under the CFI Fellowship, I will conduct a similar analysis targeting specifically online credit applications for mobile money users.
<ul>
 	<li>App Identification and Gathering: The first step is to work with stakeholders throughout the community to identify candidates for analysis. This process will allow to identify the most relevant players in this space (i.e., those with the largest potential market and impact), and ensure a geographically representative sample.</li>
 	<li>App Teardown and Analysis: Analysis of the collected mobile applications will involve automated techniques. The tools that allow rapid assessment of the state of communications security between the mobile device and the online credit provider’s back end servers. This analysis will include not only a determination of whether or not the mobile application properly determines identity at the other end of communications, but also whether the back end servers are properly configured against the most up-to-date attacks against the SSL/TLS security suites.</li>
 	<li>Policy Analysis: Each application comes with a terms of service document. My past experience demonstrated that such documents place the consequences of fraud solely upon the user regardless of the technical soundness of the application. Accordingly, in this round, I will analyze terms of service documents for online credit providers, looking specifically for language that indicates 1) which data will be targeted by the provider, 2) how it will be used to determine creditworthiness, 3) how users can challenge or confirm the validity of such data, and 4) if such data can be resold to other parties without further explicit notification to the user.</li>
</ul>
All technical advances made as part of this work will be offered to the public as free, open-source projects. One broad objective of the work is that these tools will enable students from universities across the world to be trained in the security analysis of applications, and that the companies in this industry will recreate the methodology and apply it to future offerings of their products to improve security.

Have you read?

<a href="https://cfi-blog.org/2017/03/01/mobile-money-in-myanmar-going-directly-from-cash-to-digital/">Mobile Money in Myanmar: Going Directly from Cash to Digital</a>

<a href="https://cfi-blog.org/2017/02/07/modelo-peru-whats-next-for-the-groundbreaking-mobile-money-platform/">Modelo Peru: What’s Next for the Groundbreaking Mobile Money Platform?</a>

<a href="https://cfi-blog.org/2016/02/01/why-do-we-so-often-get-the-mobile-money-agent-value-proposition-wrong/">Why Do We So Often Get the Mobile Money Proposition Wrong?</a>

&nbsp;

How Secure Is Data Used in Digital Credit?

&nbsp;

Internet privacy rules have just been overturned in the U.S. by Congress and the Administration, and at the same time, struggles over banking privacy are taking place. There are striking similarities as well as crucial differences. As a consumer protection advocate, I am struck by how the narrative about these kinds of conflicts primarily centers on where competitive advantage lies, and which company or industry is made the winner or loser, rather than about the rights of consumers.

The <a href="https://www.nytimes.com/2017/03/23/technology/congress-moves-to-strike-internet-privacy-rules-from-obama-era.html">internet case</a> pits telecoms and cable companies, like AT&amp;T, Verizon and Comcast, against internet companies, like Google and Facebook. The Obama-era rules that were just overturned required broadband providers to ask customer permission before tracking, sharing and/or selling their data. These companies complain that the rules disadvantage them relative to internet-based companies, which can collect data without such rules.

The <a href="https://nyti.ms/2mThf5x">banking case</a>, as reported in The New York Times, pits major banks against fintechs and data aggregators. The question is whether banks will transfer consumer data – at the consumer’s request – to companies that provide personal financial management tools, like Mint, Betterment, and Digit (or to data aggregators that facilitate the transfer – like Plaid and Yodlee). Without this data the financial management apps cannot build the complete portrait of a person’s financial life they need to provide analysis and advice. But banks are reluctant, even after specific consumer requests. You might think this reluctance is to protect their customers or because of data privacy rules for banking, but actually, according to The Times, it’s because the customer data reveals details about banks’ own business models – like pricing and products. The banks fear, probably correctly, that the personal financial management companies will use the information to undercut bank products with their own offerings.

These two examples reveal the importance of data in business today and the urgency of getting data privacy right. But what hits me between the eyes is that both cases play out primarily over competitive advantage between an older generation of companies and newer companies rather than as consumer rights issues. Companies fight it out and appeal to government regulators to side with them. In both cases, traditional companies argue that newer generation companies gain a competitive advantage by having freer rein with consumer data. The regulatory considerations appear to be focused on leveling the playing field between competing commercial interests. Consumers sit by like civilians in a war zone hoping peace arrives before they become collateral damage.

In both examples, an astonishing range of data types are involved: personal identification data, including passwords and account numbers; financial account balances and transactions; internet browsing history; phone and text meta-data; location history; social media profile, posts and contacts. In defining policy, each of these types of data could and should be treated differently, depending on how private it is deemed it to be and whether in the wrong hands it could harm consumers. Traditionally, financial information held in banks has been especially protected, and this makes sense as the potential for harm from internet data is not as great, or at least not as obvious. Data involved in financial account security would be heavily protected, as misuse could facilitate theft, an obviously serious harm. The same level of protection would not be afforded to social media information which is inherently public, to some degree. Discussions about privacy protection for internet users often appear to assume that the harm in question is simply the advertisements and sales pitches they enable. Unwelcome, and annoying, but generally not actually harmful. That’s why some regulations distinguish between <a href="http://www.ifmr.co.in/blog/2017/03/27/comments-on-the-ministry-of-electronics-information-technologys-draft-rules-for-security-of-prepaid-payment-instruments/">‘personal information’ and ‘sensitive personal data and information’</a>. The latter must be guarded more closely, but where is the line between the two? And how should a lender like Kabbage be treated? Its CEO <a href="http://www.lendit.com/usa/2017/videos/alternative-lending-dead-long-live-data">recently boasted</a> that the company hoards every scrap of information about its customers, because those scraps could turn out to be valuable for marketing or credit underwriting.

Can law or regulation help by clarifying consumer ‘ownership’? The Times points out that the Dodd-Frank requirements give consumers the right to access their data, but leave many questions unanswered. By contrast, the European Union’s <a href="http://www.eugdpr.org/">General Data Protection Regulation</a> (GDPR) defines ownership rights more fully, as including the right to access, the right to be forgotten and data portability (the consumer’s ability to request that data be provided to a third party, exactly what’s at issue with Mint and Betterment). A complicating factor is that in the U.S. – as possibly in many other countries – there are conflicting jurisdictions. In the internet case, the Federal Communications Commission regulates broadband providers, while it’s the Federal Trade Commission that has responsibility for consumer protection. The banking side is also complicated. Given the Trump Administration’s approach – directing regulators broadly to lighten up on business but not specifying how – the U.S. may be living with confusion for some time.

Should data that has been stripped of personal identification still be subject to restrictions? Data aggregators make money from selling huge swaths of anonymized data for those who want to analyze it to discern consumer trends. If identifying information is not included, would consumers care whether their data is analyzed by hedge fund managers or marketing gurus? It’s a little like the story of <a href="https://en.wikipedia.org/wiki/Henrietta_Lacks">Henrietta Lacks</a>, whose cancer cells were cultured, multiplied and used by medical researchers around the world. Her family argued that they should receive some compensation, given the millions of dollars made from medicines developed with her cells. The analogous argument for customer data is a stretch, in my view, but what if a savvy data cruncher could combine anonymized data with other data to identify individuals? Is that just the stuff of conspiracy theory, or is it a significant risk?

Incidentally-collected third-party information creates knotty problems. The U.S. news this month has asked whether the Obama Administration surveilled Trump campaign officials’ contact with Russian officials intentionally or merely collected information incidentally while observing other targets. Banks claim that fintech companies will, as a by-product, obtain the details of their banking models from the data customers provide. There are undoubtedly many other examples: any data on one person that involves interaction with another party also conveys information about the second party.

Agreements between companies can reduce or solve such problems, through, for example, limitations on data handling, use or pricing. The consumer voice in such agreements may be hard to hear, however.

Data privacy policy calls out for thoughtful analysis with a consumer interest lens, but too often the voices on behalf of consumers are shrill. For a cool-headed and well-organized look at data privacy in India and beyond, I recommend <a href="http://www.ifmr.co.in/blog/2017/03/27/comments-on-the-ministry-of-electronics-information-technologys-draft-rules-for-security-of-prepaid-payment-instruments/">this IFMR blog post</a>.

Have you read?

<a href="https://cfi-blog.org/2017/03/03/when-the-data-is-not-enough/">When the Data Is Not Enough</a>

<a href="https://cfi-blog.org/2015/10/07/addressing-customer-needs-off-to-the-data-mines/">Addressing Customer Needs? Off to the Data Mines</a>

<a href="https://cfi-blog.org/2015/10/19/financial-inclusion-data-taking-stock/">Financial Inclusion Data: Taking Stock</a>

&nbsp;

&nbsp;

Internet Data and Banking Data – Should the Same Rules Apply?

Data privacy is officially dead. The U.S. House of Representatives’ vote to overturn the Federal Communications Commission’s (FCC) <a href="https://www.washingtonpost.com/news/the-switch/wp/2017/03/28/the-house-just-voted-to-wipe-out-the-fccs-landmark-internet-privacy-protections/?utm_term=.2b2bf5bab2af">internet privacy rules</a> was yet another nail in the coffin, making data privacy a thing of the past.

In previous generations, banking may have been based on personal relationships and a handshake. More recently, it was based on your banking history and financial flows. But for future generations, access to financial products and services will almost undoubtedly be decided by big data algorithms, gobbling-up whatever digitized information, financial or otherwise, the corporate tentacles can seize.

We know what you’re thinking. Won’t this help underwrite previously-underbanked individuals? Of course. And what does data-sharing matter so long as you don’t have anything to hide? Won’t ultra-targeted ads make the consumer experience better? All definitely true. Well, actually there are inherent problems with these lines of thinking, but honestly what’s the point of resisting? The notion of being “data rich” has never been more powerful. And what are negative social externalities in 2017? After all, the U.S. political system breathed new life into the fallacy of “clean coal” earlier this week in the name of making a few bucks.

Given this approaching reality, facts, alternative facts, and all, the financial inclusion industry needs to get with the program. These are the rules. We need to get better at playing the game. First order of business? Perhaps the biggest opportunity is working to build the profiles of what is currently a very digitally thin-file client segment: children.

We know that bringing youth into the financial fold early on is critical to achieving our mission of a fully financially inclusive world. Building financial capability at a young age helps to cement a strong money management foundation. Even before our digital alter was hardwired, we knew that it was important for children to start building their financial profiles early. And for their part, children make great borrowers. Why else would credit card companies so vigorously target first year college students?

I believe, with the proper parental permissions, there are currently missed opportunities in children having minimal digital footprints and in financial service providers (FSPs) not better mining and analyzing the online behavior of children to better meet their financial needs, now, or when the time comes.

For instance, by tracking the (limited, I swear) time my 3 year old spends on our iPad, FSPs would see from the YouTube videos he selects that he will someday be a hockey player and will therefore need excellent dental insurance. When my 1 year old wakes at 2am and manages to wrestle our phones from us, after awkwardly “liking” a few Facebook posts, he inevitably starts calling our work contacts. Making work calls at 2am? That type of work ethic should position him well for an entrepreneurial small business loan. And for that matter, what about targeted financial products and services for our pup? He is only 5 years old but, in dog years, an FSP should be talking to him soon about retirement products. Though I guess he isn’t doing himself any favors in choosing to play with balls and Frisbees instead of with tablets and laptops.

In any case, parents should embrace the fact that data privacy is no more and focus on building up the amount of data available to FSPs about their children. And possibly pets! FSPs and other industry stakeholders, we need to embrace this critical client segment and start vying for their data. Everyone else… have a happy April’s Fools Day!

Of course the Center for Financial Inclusion won’t roll over and accept consumer harms – in whatever form, however shiny and futuristic, they may be. To this end, stay tuned for an upcoming blog post from CFI Director Elisabeth Rhyne examining and comparing data privacy in both the banking and internet provider industries.

Have you read?

<a href="https://cfi-blog.org/2015/10/13/the-data-story-in-the-fi2020-progress-report-on-credit-reporting/">The Data Story in the FI2020 Progress Report on Credit Reporting</a>

<a href="https://cfi-blog.org/2014/03/12/helping-consumers-understand-their-digital-data-initial-experiences-from-tanzania/">Helping Consumers Understand Their Digital Data: Initial Experiences from Tanzania</a>

<a href="https://cfi-blog.org/2014/04/07/is-bigger-data-better/">Is Bigger [Data] Better?</a>

&nbsp;

&nbsp;

Smile and Accept the Inevitable

<h2>Background &amp; Research Questions</h2>
More and more online credit providers have started to offer loans to not only consumers but also to SMEs around the world.

Outside of digital banking platforms, new alternative online and digital platforms that target consumers and small SMEs include:
<ul>
 	<li>Peer-to-peer (P2P) SME lenders</li>
 	<li>Online balance sheet lenders</li>
 	<li>Loan aggregator portals</li>
 	<li>Tech and e-commerce giants</li>
 	<li>Mobile data-based lending models</li>
</ul>
While the rise of alternative data-based lending has opened new and innovative credit opportunities for individuals and SMEs, these new technologies and providers also come with several consumer protection challenges. These can be categorized into seven main areas:
<ul>
 	<li>Data privacy and opt-in vs. opt-out challenges</li>
 	<li>Underwriting practices</li>
 	<li>Potential for exclusion of certain categories of clients</li>
 	<li>Cyber security and individual data protection</li>
 	<li>Clear and effective disclosure over pricing and terms</li>
 	<li>Customer recourse, complaint management and dispute resolution</li>
 	<li>Collection practices</li>
</ul>
To address these issues, both regulators and online lenders are analyzing various actions and standards to better protect online borrowers. In the U.S., the Department of Treasury, the Small Business Administration, the Federal Reserve Bank, and the Consumer Financial Protection Bureau have all started to focus on consumer protection issues related to online lending providers.

While online lenders targeting consumers are regulated to a certain extent by U.S. consumer financial protection practices, this is not the case for those targeting SMEs. To address some of these concerns, online and alternative lenders have started to develop consumer protection principles for small businesses under the <a href="http://www.responsiblefinance.com/code-of-ethics-and-best-practices/">Coalition for Responsible Business Finance (CRBF)</a>. In addition, they have supported a proactive <a href="http://www.responsiblebusinesslending.org/">Small Business Borrowers’ Bill of Rights</a> focused on transparent pricing and terms, non-abusive products, responsible underwriting, fair treatment from brokers, inclusive credit access, and fair collection practices, suggesting this can be done without adding undue burden or cost to this emerging industry. Other groups and alliances have also formed with various different competing versions of responsible online lending including the Innovate Lending Platform Association and its <a href="http://innovativelending.org/smart-box-model-disclosure-depth/">Smart Box Capital Comparison Tool</a>. In addition, the Online Lenders Alliance has also issued their <a href="http://onlinelendersalliance.org/wp-content/uploads/2016/04/Best-Practices-2016.pdf">Best Practice</a> guidelines.

Outside of the U.S., regulators and online lenders in jurisdictions like the U.K. and Singapore are proactively engaging with each other to discuss new consumer protection standards. Based on challenges within the growing P2P lending industry, Chinese regulators are now <a href="http://www.wsj.com/articles/chinas-online-lenders-face-peer-to-peer-pressure-1472123683">implementing strict guidelines</a> while Indonesia’s financial regulator is just releasing new c<a href="https://e27.co/level-playing-field-consumer-protection-to-be-the-center-of-upcoming-fintech-industry-guideline-indonesias-ojk-20160824/">onsumer protection guidelines</a> to address P2P lending practices. On the other hand, in most other markets, online lenders outside of the banks are lightly regulated or not regulated at all. International organizations like the World Bank, the Consultative Group to Assist the Poor (CGAP), the Alliance for Financial Inclusion (AFI), the G20, and groups like Consumer International have all proposed various consumer protection principles which apply to online lenders. While online lenders are still outside of most regulatory and supervisory frameworks in many emerging markets, there are proactive approaches and standards that can be proposed.
<h2>Overall Objective &amp; Hypotheses</h2>
Online lending for consumers and especially SMEs is highly relevant and important to expand access to finance and overall financial inclusion. However, trust, confidence and responsible lending practices need to be in place in order to ensure that this industry is able to continue to offer access to credit. Under a research grant from the Center for Financial Inclusion at Accion's <a href="http://www.centerforfinancialinclusion.org/programs-a-projects/cfi-fellows-program">Fellows Program</a>, this study will examine the various customer risks proposed by online lenders, what standards and practices are being proposed in some key jurisdictions, both by industry groups as well as regulators/policymakers, and what best practices can be recommended for setting consumer protection and risk mitigation standards for the emerging online financial services industry.
<h2>Study Design &amp; Methodological Approach</h2>
The research study design will follow a systematic review of literature on the topic of responsible online lending practices including research studies, guidelines, policy notes, as well as standards that are being used to address consumer protection and risk mitigation practices in online lending across various jurisdictions. The study will especially focus on online lending practices not only of supervised financial service providers but also of new financial service providers, which may be lightly regulated or not regulated at all. Interviews with financial consumer protection agencies/associations, regulators and online credit industry players from several key markets, as well as discussions with key researchers and thought leaders from this industry will also be conducted.

&nbsp;

What Does Responsible Online and Digital Credit Look Like?