Millions of Kenyans Still Unaware of Fintech Data Breach

Millions at Risk as Their Mobile Money Transaction Data is Breached

By David Indeje / Published December 1, 2017 | 11:54 am

Financial inclusion in Kenya currently stands at 75.3 percent with internet penetration at 88 percent has allowed the efficient adaptability of mobile banking services.

However, according to a new Privacy International report says the financial industry is helping itself to consumers’ personal data without any checks or monitoring from governments.

The Privacy International report outlines how fintech threatens privacy and other fundamental rights by focusing on two case studies.

Using research that analyses the India Stack initiative, built upon the Aadhaar identification number in India, and credit scoring apps and services in Kenya, the report shows how information that is traditionally considered irrelevant to the financial sector, such as social media usage and smartphone habits underpin credit rating strategies.

According to the report, consumers’ social media behaviour is not only monitored by employers, but also by credit ratings financial institutions, such as banks and insurance companies.

The information gathering has now expanded to include call logs, text messages, and social networks. What is being evaluated is no longer individual decisions and behaviour, but who individuals are and with whom they interact, and how.

The report features Tala, Branch and M-Kopa operations to illustrate the tradeoffs Kenyans are making between Privacy and credit access.

Tala App

Tala, previously known as Mkopo Rahisi, started operating in Kenya in 2014.

“This app asks for a wide range of permissions, including access to installed apps, contacts, precise location via GPS, the content of SMS messages, and the call log. The Tala app uploads data to Tala’s US-based servers every 24 hours, whether the user has even opened the app or not.. Customers are encouraged to keep the app on their phone, even if they have been rejected: the app will continue to send their data back to Tala.”

Tala analyses call logs: their analysis has found that people who make regular calls to family are 4 percent more likely to repay their loan. To do this analysis, they need to know who your family is: from the content of text messages that call someone “mama”, and the pattern of calls.

Branch App

Branch: is a California-based startup with operations in Kenya but looking to expand elsewhere in developing markets.

Branch also makes use of Facebook for authentication; as discussed below, this is allowed under Facebook’s terms and conditions. Another factor that Branch uses for its decision-making is the behaviour of your friends and their repayment patterns for Branch loans.

The app gains access to permissions including the content of the user’s call log, contacts, SMS messages, and precise location via GPS.

M-kopa solar

M-Kopa: differs from Branch and Tala, in the sense that it does not use a mobile app but rather is a fintech that offers loans for its solar panel system, as well as other goods.

The devices that M-Kopa sells contain a 2G SIM card, the main purpose of which is for billing. According to Chad Larson, one of the founders and current Finance Director, the data transmitted from the device is used for further analysis. Even though a side effect, they are taking advantage of this: they have a team of data scientists based in Nairobi.

M-Kopa’s website states that “After completing payments, customers own the product outright.” However, the customer does not own their data. The terms and conditions of a M-Kopa loan make the company’s position on data clear: “M-KOPA shall have absolute and sole ownership of … the data which is obtained by the Customer’s use of the Device.”

Kenya is yet to enact the Data Protection Bill 2013 which seeks to provide for protection of personal information and hereby give effect to the constitutional right of a person not to have information relating to their family or private affairs unnecessarily required or revealed as enshrined in Article 31 of the Constitution of Kenya and Article 17 of the 1948 Universal Declaration of Human Rights; which Kenya is among the more than 160 signatories.

Read:

Data protection framework with global standards, opportunities for Kenya

We are open to innovations, but conscious of potential risks – Central Bank

“The fintech sector is using vast sources of our personal information to create our financial identity – data from our spending, our social networks, our phones. The sector must begin to recognise the risks and harms are emerging from its work, particularly in parts of the world with limited or non-existent data protection legislation. We need governments and regulators to ensure that advancements in fintech do not violate privacy,” PI Research Officer Dr. Tom Fisher says.

“The fintech sector is using vast sources of our personal information to create our financial identity – data from our spending, our social networks, our phones.

“The sector must begin to recognise the risks and harms that are emerging from its work, particularly in parts of the world with limited or non-existent data protection legislation. We need governments and regulators to ensure that advancements in fintech do not violate privacy,” he said.

About David Indeje

David Indeje is a writer and editor, with interests on how technology is changing journalism, government, Health, and Gender Development stories are his passion. Follow on Twitter @David_IndejeDavid can be reached on: (020) 528 0222 / Email: info@sokodirectory.com

View other posts by David Indeje