Thread by @logic

#CashlessConsumer Following up on consent-less auto fetch privacy violations in #BBPS

#NPCI's own data shows the practice of building credit profiles continue rampantly completely disregarding user consent & NPCI notice.

medium.com/cashlessconsum…

In Oct 2018, #CashlessConsumer complained to RBI/NPCI and top fintechs/banks about the privacy abuse in #BBPS for building credit profile database without the consent of individual medium.com/cashlessconsum…

NPCI responded on Nov 1, 2018 with a circular mandating all BBPS ecosystem participants to ensure customer consent for bill fetch and provide opt out of auto fetch provisions and comply with circular in 60 days

bharatbillpay.com/download.php?f…

14 months after the circular has to be complied, we see the trend of non-consented bill fetch only growing. It is evident from the data NPCI itself publishes. There is 5x bill fetch to bill payment transactions.

Every bill payment made via 3rd party app/gateway has to be by regulation mandatorily through BBPS & RBI licensed NPCI as a regulated monopoly for BBPS. #BBPS aggregates household data & it is that is getting accessed by (1/2)

#CashlessConsumer in a followup letter to Board for Regulation and Supervision of Payment and Settlement Systems & CGM DPSS in
RBI as well as CEO, NPCI and Chief of BBPS, NPCI has made the following demands

NPCI to provide list of entities it had imposed penalties for defying the circular and continuing to perform bill fetch / not providing opt out option.

NPCI to put forth a detailed public report on this matter including details related to top entities / agents performing bill fetch requests disproportionate to the payment requests made by them

RBI to make more granular payment systems data publicly available to help improve supervision of payment systems & identify abuse / unacceptable market conduct such as this & regulate the industry better as well as a Zero Tolerance policy on abuse

Provides a brief overview of #BBPS - blog.50p.in/97da8dbf1a91

Given this brazen privacy harm (damage of data hoarding / profile building that has already happened) as well as #NUELicensing , it might be right time to redesign #BBPS regulatory / system architecture.

Also, timely reminder that #PDPBill is yet to become real and this is yet another example of your data being made available by systems to enable private profiteering. Your consent doesn't matter.