Domestic Regulation of Data Industry in the Developing Asia-Pacific - - PowerPoint PPT Presentation

• SMU Classification: Restricted

Domestic Regulation of Data Industry in the Developing Asia-Pacific Economies

Jinchang Lai Lead Financial Sector Specialist, and Lead for Financial Infrastructure, East Asia & Pacific, IFC

Singapore, June 20, 2018

• SMU Classification: Restricted

Demands Beyond Credit Reporting

• In the past 15 years or so, nearly all developing Asia-

Pacific Economies have managed to establish a credit reporting system with a law, regulations, a credit reporting regulator, and multiple players

• Most of these efforts were assisted by IFC
• Lenders are getting used to using credit reporting data and

services, with highly positive impacts on financial inclusion

• However, consumer and small business finance have

transformed significantly over the past decade (in coverage, products, delivery channels), requiring digital delivery, remote KYC, context-sensitive and instantaneous decisions, smart anti-fraud solutions, etc.

• SMU Classification: Restricted

Demands Beyond Credit Reporting

• It has not been possible for the foundational credit

reporting services to meet all these demands

• Thus, in the more matured markets, increasingly more

personal lenders are using one or more credit bureaus, a few specialized credit reporters and at least several data and analytics firms at the same time

• Yet, do the developing Asia-Pacific Economies have the

necessary legal and regulatory framework on their expanding data and analytics industry?

• NB: The focus of this discussion in APEC is about personal data

beyond the space of credit reporting

• SMU Classification: Restricted

Credit Reporting vs. Data/Analytics Business

• “Membership” based with pre-agreed

governance structure; reciprocity principle

• Sharing/pooling of data among mainly

creditors, mainly for credit (broadly defined) underwriting/monitoring purpose

• Data relevant, accurate, timely and

complete

• Data template and data dictionary
• Data furnishers known/reliable; often,

mandatory/regular submission

• Collection purposes limited; use

limitations; often, regulatory approval/review of membership, product, pricing, management, etc.

• Strong consumer rights with rigorous

complaint, correction/dispute provisions

• Seen as a core pillar for preventing over-

indebtedness and financial instability

• No “members”, and not a sharing concept
• For broader use, with less stringent data

quality/timeliness/completeness requirements; big share of unstructured data

• Data sources are mix of varied

reliable/known channels and “alternatives”; collect, buy, exchange, mine, crawl, etc.

• Basically for any paying clients
• No mandatory submission; no mandatory

members; lower need for regulatory

• versight
• Some data/analytics firms are created by

credit reporting companies as separate subsidiaries

• Consumer rights? Complaint,

correction/dispute resolution mechanisms?

• Seen as good means to financial inclusion

Credit Reporting Market Data/Analytics Market

• SMU Classification: Restricted

The State of Play

• Mixed level of development in the “regulation” of

personal “data/analytics industry” in the Region:

 Sophisticated: comprehensive Personal Data Protection Law (PDPL); general regulator  Developing: comprehensive PDPL approved not long ago; general regulator set up; awareness low, and implementation capacity being built up  Nascent: no comprehensive PDPL; no general regulator; some segmented provisions in other laws and/or sectoral regulations exist; low awareness, and low willingness to set up a framework

• SMU Classification: Restricted

The State of Play

• How large is the industry?

 One example: According to a survey of CAICT, in 2017, “big data industry” in China has a market size of RMB 470 billion (USD 75 billion), with an annual growth rate of 30%. Two thirds of surveyed firms already have data & analytics department. 40% of firms have already used “big data”. NB: For both personal and commercial data under the big data concept; market size includes the related hardware/software business.

Source: China Big Data Development Survey Report, CAICT 2018.

• SMU Classification: Restricted

What Are the Challenges?

• The data/analytics industry is larger than that of

conventional credit reporting, and is growing

• An unregulated data industry poses higher risk for

consumers, businesses and the governments

• Challenges of building up a comprehensive “data

regime” in those “nascent” Economies:

 Developing any modern legislations and setting up any new agencies are very hard in these economies  Almost impossible to find an existing lead agency to champion the course  Mixed public perceptions about data protection -- can be an emotional subject  Lack of knowledge, understanding and willingness by the government institutions  International consensus are not yet strong

• SMU Classification: Restricted

What May be Needed?

• A “Data Regime” should be lighter than that for credit
• reporting. The key will be to balance the support for

“new economy” vis-a-vis the protection of consumer interests

• A comprehensive data regime covers all data/analytics

businesses and all data life cycles, not just for financial services or credit life cycle

• Good financial regulators look at their regulated

institutions’ compliance with both credit reporting requirements and general data protection requirements

• Difficulties mainly concern the 3rd categories of

Economies in this Region

• SMU Classification: Restricted

What May be Needed?

• A data regime can include:

 A comprehensive and dedicated law and/or over-arching regulation

• n personal data protection, with a right philosophy and approach

 A general personal data regulator with enforcement power and the required capacities  An independent industry association, and practice codes of conduct  Efficient and low cost complaint, correction and dispute resolution mechanisms, particularly out-of-court means  Cross-border data cooperation/flow rules  Some specific regulations/guidelines for those involving financial services by the financial regulator(s)  Public data to be made available for business purposes conveniently

• SMU Classification: Restricted

What May be Needed?

• Financial services players should have active interest

in how the overall data regime is being shaped up, in addition to the rules coming from the financial regulators

• Uncertainties created by lack of regulation or

uncoordinated/segmented provisions are harmful for realizing the full potentials of financial inclusion

• Before a comprehensive regime is in place, in the

interim, financial regulators can still do something:

 Example: CFPB Consumer Protection Principles on Consumer- Authorized Financial Data Sharing and Aggregation (Oct. 2017)  Example: CFPB Policy on No-Action Letters (Feb. 2016)

• SMU Classification: Restricted

Than ank k Yo You !

The views and judgments of this presentation are those of the author. The conclusions and judgments contained herein should not be attributed to and do not necessarily reflect the views of the World Bank Group or IFC, or their management and Board of Directors, or the countries they represent. The author, by means of this document, is not rendering any professional advice or service, and shall not be responsible for any loss sustained by any person who relies on this presentation as a substitute for professional advice or service.