Domestic Regulation of Data Industry in the Developing Asia-Pacific - PowerPoint PPT Presentation

• SMU Classification: Restricted Domestic Regulation of Data Industry in the Developing Asia-Pacific Economies Jinchang Lai Lead Financial Sector Specialist, and Lead for Financial Infrastructure, East Asia & Pacific, IFC Singapore, June 20, 2018

• SMU Classification: Restricted Demands Beyond Credit Reporting • In the past 15 years or so, nearly all developing Asia- Pacific Economies have managed to establish a credit reporting system with a law, regulations, a credit reporting regulator, and multiple players • Most of these efforts were assisted by IFC • Lenders are getting used to using credit reporting data and services, with highly positive impacts on financial inclusion • However, consumer and small business finance have transformed significantly over the past decade (in coverage, products, delivery channels) , requiring digital delivery, remote KYC, context-sensitive and instantaneous decisions, smart anti-fraud solutions, etc.

• SMU Classification: Restricted Demands Beyond Credit Reporting • It has not been possible for the foundational credit reporting services to meet all these demands • Thus, in the more matured markets, increasingly more personal lenders are using one or more credit bureaus, a few specialized credit reporters and at least several data and analytics firms at the same time • Yet, do the developing Asia-Pacific Economies have the necessary legal and regulatory framework on their expanding data and analytics industry?  NB: The focus of this discussion in APEC is about personal data beyond the space of credit reporting

• SMU Classification: Restricted Credit Reporting vs. Data/Analytics Business Credit Reporting Market Data/Analytics Market • “Membership” based with pre -agreed • No “members”, and not a sharing concept • For broader use, with less stringent data governance structure; reciprocity principle • Sharing/pooling of data among mainly quality/timeliness/completeness creditors, mainly for credit (broadly requirements; big share of unstructured defined) underwriting/monitoring purpose data • Data relevant, accurate, timely and • Data sources are mix of varied complete reliable/known channels and “alternatives”; • Data template and data dictionary collect, buy, exchange, mine, crawl, etc. • Data furnishers known/reliable; often, • Basically for any paying clients mandatory/regular submission • No mandatory submission; no mandatory • Collection purposes limited; use members; lower need for regulatory limitations; often, regulatory oversight approval/review of membership, product, • Some data/analytics firms are created by pricing, management, etc. credit reporting companies as separate • Strong consumer rights with rigorous subsidiaries complaint, correction/dispute provisions • Consumer rights? Complaint, • Seen as a core pillar for preventing over- correction/dispute resolution mechanisms? indebtedness and financial instability • Seen as good means to financial inclusion

• SMU Classification: Restricted The State of Play • Mixed level of development in the “regulation” of personal “data/analytics industry” in the Region:  Sophisticated: comprehensive Personal Data Protection Law (PDPL); general regulator  Developing: comprehensive PDPL approved not long ago; general regulator set up; awareness low, and implementation capacity being built up  Nascent: no comprehensive PDPL; no general regulator; some segmented provisions in other laws and/or sectoral regulations exist; low awareness, and low willingness to set up a framework

• SMU Classification: Restricted The State of Play • How large is the industry?  One example: According to a survey of CAICT, in 2017, “big data industry” in China has a market size of RMB 470 billion (USD 75 billion), with an annual growth rate of 30%. Two thirds of surveyed firms already have data & analytics department. 40% of firms have already used “big data”. NB: For both personal and commercial data under the big data concept; market size includes the related hardware/software business. Source: China Big Data Development Survey Report, CAICT 2018.

• SMU Classification: Restricted What Are the Challenges? • The data/analytics industry is larger than that of conventional credit reporting, and is growing • An unregulated data industry poses higher risk for consumers, businesses and the governments • Challenges of building up a comprehensive “data regime” in those “nascent” Economies:  Developing any modern legislations and setting up any new agencies are very hard in these economies  Almost impossible to find an existing lead agency to champion the course  Mixed public perceptions about data protection -- can be an emotional subject  Lack of knowledge, understanding and willingness by the government institutions  International consensus are not yet strong

• SMU Classification: Restricted What May be Needed? • A “Data Regime” should be lighter than that for credit reporting. The key will be to balance the support for “new economy” vis -a-vis the protection of consumer interests • A comprehensive data regime covers all data/analytics businesses and all data life cycles, not just for financial services or credit life cycle • Good financial regulators look at their regulated institutions’ compliance with both credit reporting requirements and general data protection requirements • Difficulties mainly concern the 3 rd categories of Economies in this Region

• SMU Classification: Restricted What May be Needed? • A data regime can include:  A comprehensive and dedicated law and/or over-arching regulation on personal data protection, with a right philosophy and approach  A general personal data regulator with enforcement power and the required capacities  An independent industry association, and practice codes of conduct  Efficient and low cost complaint, correction and dispute resolution mechanisms, particularly out-of-court means  Cross-border data cooperation/flow rules  Some specific regulations/guidelines for those involving financial services by the financial regulator(s)  Public data to be made available for business purposes conveniently

• SMU Classification: Restricted What May be Needed? • Financial services players should have active interest in how the overall data regime is being shaped up, in addition to the rules coming from the financial regulators • Uncertainties created by lack of regulation or uncoordinated/segmented provisions are harmful for realizing the full potentials of financial inclusion • Before a comprehensive regime is in place, in the interim, financial regulators can still do something:  Example: CFPB Consumer Protection Principles on Consumer- Authorized Financial Data Sharing and Aggregation (Oct. 2017)  Example: CFPB Policy on No-Action Letters (Feb. 2016)

• SMU Classification: Restricted Than ank k Yo You ! The views and judgments of this presentation are those of the author. The conclusions and judgments contained herein should not be attributed to and do not necessarily reflect the views of the World Bank Group or IFC, or their management and Board of Directors, or the countries they represent. The author, by means of this document, is not rendering any professional advice or service, and shall not be responsible for any loss sustained by any person who relies on this presentation as a substitute for professional advice or service.