I was taking a close look at my latest credit card statement from Citibank and it had a most curious clause:
"The Credit Information Bureau India Ltd. (CIBIL), is an initiative of the Government of India and the Reserve Bank of India (RBI) to improve the functionality and stability of the Indian financial system. This is in line with their efforts to provide an effective mechanism for exchange of information between banks and financial institutions, thereby enabling customers to avail of better credit terms from various institutions. All banks and financial institutions participating in this initiative are required to share customer data with CIBIL. In view of the above, we wish to inform you that we shall now be reporting the data pertaining to your account with us (including Additional Card on your account) to CIBIL. This data will be updated on a regular basis for all our customers. We thank you for your continuing support and co-operation in this matter."
I understand the reason that a Credit Rating Agencies exist, ostensibly to assess the Credit Score for both induviduals and corporations which it turn is used to determine applicable interest rates based on a risk based pricing giving due weightage to expected costs of the borrower. That's hardly what I have a problem with.
What I want to know is under what specific RBI Notification or Guideline this is being done as I feel it amounts to an invasion of my financial history and privacy. Further, there seems to be no method for me to "opt-out" of such a reporting mechanism. Neither have I chosen to "opt-in" to such third-party disclosures.
I am also curious as to what information, or data as so mentioned, they will disclose to CBIL and what the terms of such disclosure are with the rights and liabilities of Citibank NA and CBIL. As it is my financial data, I maintain a right to know as such. Lastly, I am worried as to the safety issues related to a common pool of such sensitive financial information being held at one location. How can they assure me as to the veracity of the safety mechanisms in place and how will they indemnify me against any losses that might arise from an unauthorized leak or disclosure of the "reported" data to CBIL?
In the United States, such disclosures to and the functioning of Credit Rating Agencies are regulated by the Fair Credit Reporting Act which lays down obligations such as "providing a consumer with information about him or her in the agency's files and to take steps to verify the accuracy of information disputed by a consumer. Companies that provide information to consumer reporting agencies also have specific legal obligations, including the duty to investigate disputed information. Also, users of the information for credit, insurance, or employment purposes must notify the consumer when an adverse action is taken on the basis of such reports. Further, users must identify the company that provided the report, so that the accuracy and completeness of the report may be verified or contested by the consumer. It has been recently amended to guard against Identity Theft" (from
Wikipedia) Do similar obligations exist as regards CBIL?
On to
CBIL. From their website, one gathers that the shareholders are primarily banks that operate in India,
Dun & Bradstreet and
Trans Union International, who are one of the largest Credit Rating Agencies in the United States. Their current shareholding pattern is as shown below:
Right, so we've established that this is a closed eco-system of banks that essentially share financial information related to the credit-worthiness of their customers. Whether the customers agree or not. How well do they protect our data ought to be the next pertinent question. The answer is not
very comforting. Among other common sense measures (access control and anti-virus software) they employ:
- 128-bit SSL encryption for all Web-based transactions including FTP.
- Cryptographic solutions for all information sent or received through any physical media i.e. CD, DAT and DLT.
Comforting? I'll leave that to the crypto expert who reads this blog. Apart from the fact that such agencies are apparently
very easy to lie to. Lastly, there seems to be no privacy policy posted on their website.
Citibank in their reply to me state, most pithily, that "...CIBIL is an initiative driven based on RBI's guidelines and all banks are required to share their customer information with them... the details shared would be the credit limit assignment and the payment pattern of a customer and the information will not be of transactionary details. We are not aware of the email address of CIBIL to be shared with public."
All in all, not a very happy situation.