FEBRUARY 15, 2025
The RBI defended the collection of financial data of banking users by credit rating companies to prepare credit scores and submitted before the Supreme Court that it was precisely the purpose behind Parliament enacting the Credit Information Companies (Regulation) Act, 2005 and companies do not need consent from the borrowers for this.
Petitioner Surya Prakash, a Bengaluru-based entrepreneur and educational trainee, had moved the top court accusing the Credit Information Companies (CICs) of “illegally” collecting people’s financial information “by forced consent” and “selling the data to their members”. The plea also accused the CICs of “blatant abuse and violation of right to privacy”.
The plea also said that the Centre and the RBI have an “unholy and unethical alliance” with the CICs to undermine citizens rights.
On May 6, 2024, the SC had issued notice on his plea and appointed Senior Advocate K Parameswar as amicus curiae. A bench, presided by Justice Surya Kant, will hear the matter next on February 17.
In a separate affidavit, the Indian Cyber Crime Coordination Centre (I4C), under the MHA, said, “in response to the averment made by the petitioner regarding data theft, I4C has requested the nodal officer of cybercrime units in all States/UTs vide letter… dated 14.08.2024 seeking information regarding FIR/case registered against credit information companies and fintech companies. However, the response is awaited.”
In its counter affidavit on December 23, 2024, the RBI said that the plea raises “baseless, unfounded and speculative issues in complete ignorance of the provisions of the CICR Act and regulations”.
The RBI said that the Act “was brought in as part of risk mitigating policy of the Government… to arrest accretion of fresh NPAs in the banking sector” and provides “for setting up the CICs for collecting, sharing, processing and collating as well as disseminating the credit information of clients/ borrowers/ prospective borrowers in the manner provided in the CIC (Regulation) Act so as to enable the lenders like banks and other financial institutions to take an informed decision while lending money to borrowers.”
The RBI said that the law “expressly empowers the credit information companies to collect, store and maintain as well as process the credit information of the borrowers and as such with the enactment of the CICR Act, the requirement of consent from the borrowers has been rendered otiose.”
The counter affidavit pointed out that RBI had given registration to four CICs — TransUnion CIBIL Ltd, Experian Credit Information Company of India Private Ltd, Equifax Credit Information Services Pvt Ltd, and CRIF High Mark Credit Information Services Pvt Ltd.
On apprehensions that the data might end up in the wrong hands, the affidavit said that under the Act, “every credit information company is bound to provide credit information to its specified user on receipt of a request from him and… the credit information cannot be disclosed by credit information companies to any person other than its specified user.’
The affidavit also referred to “security safeguards” that CICs are required to put in place “to ensure that the data relating to the credit information maintained by them is accurate, complete, duly protected against any loss or unauthorized access or use or unauthorised disclosure thereof.” Violation of guidelines can attract fines up to Rs 1 crore, it said.
The petitioner also contended that the CICs were retaining the data of citizens beyond the 7 years prescribed by the Act and this violated their privacy rights.
The affidavit explained that 7 years was the minimum period for which CICs are mandated to keep the data and the Act does not prescribe an upper limit for which the data can be stored.
The plea alleged that with the generation of Credit Scores & Credit history, the CICs “literally pass… judgments and convict citizens of this country” as “untouchables” and “discriminate them as credit worthy & not credit worthy”. The RBI termed the charge of financial discrimination as “frivolous… bereft of any merits and an outcome of misconception and misconstruction of the provisions of the CICR Act.”
The central bank said it “has not specified any minimum ‘credit score’ for sanctioning the loans…” and referred to instances when penalties have been imposed on CICs for violating the Act’s provisions.
Courtesy/Source: Indian Express / PTI
