Recently, the Supreme Court addressed a Public Interest Litigation (PIL) alleging financial data privacy violations by foreign credit information companies. The Court while deliberating on the outsourcing of citizens' credit scores to private entities, observed the absence of a statutory framework to regulate such organizations’ duties and granted respondents four weeks to submit their affidavits.
The PIL seeks directions to various ministries, including the Ministry of Finance, RBI, Ministry for Electronics & Information Technology, and Ministry of Home Affairs, to take action against four foreign credit information companies accused of violating citizens' financial data privacy. According to the petitioner, multinational companies such as Transunion CIBIL Ltd., Experian Credit Information Company of India Pvt. Ltd., Equifax Credit Information Services, and CRIF High Mark Credit Information Services Pvt. Ltd. have been storing sensitive banking data without consent and selling it further. The petitioner contends that this violates the Right to Privacy as articulated in the landmark KS Puttaswamy v. Union of India case and breaches the privacy principles enshrined in the Credit Information Companies Regulation Act (CICR Act), 2005.
Senior Advocate K. Parmeswar, appointed as Amicus Curiae, highlighted three significant issues in the case, emphasizing the importance of privacy. He argued that the outsourcing of citizens' entire credit scores to private organizations, without a statutory framework governing their duties, poses a grave risk to financial data privacy. He also noted that any citizen seeking a loan relies on their CIBIL score, which is managed by these organizations.
Conversely, Senior Advocate Dr. A.M. Singhvi, representing certain respondents, dismissed the petition as frivolous, claiming it abused the court's process. He pointed out that the petitioner had not appeared since the filing, though multiple intervention applications were submitted. Justice Surya Kant, however, remarked that such procedural objections were no longer pertinent as the Court had appointed an Amicus to assist in the matter.
The bench comprising Justice Surya Kant and Justice Ujjal Bhuyan, noted the significant concerns surrounding financial data privacy and the outsourcing of sensitive information to private entities. Justice Kant observed, “While private organizations are integral to managing credit scores, the absence of a comprehensive regulatory framework poses a substantial threat to individuals' privacy rights. Citizens should not have to compromise their financial security due to the lack of oversight.” The Court further noted procedural gaps, such as the failure to provide the Amicus with a copy of the Ministry of Home Affairs' affidavit. Justice Bhuyan emphasized that privacy violations involving foreign entities handling critical financial data necessitate stringent judicial scrutiny and regulatory intervention.
The Court directed the respondents, including Transunion CIBIL Ltd., Experian, Equifax, and CRIF High Mark, to submit their affidavits within four weeks. It also instructed that a copy of the Ministry of Home Affairs' affidavit be made available to the Amicus Curiae. Recognizing the gravity of the issue, the Court adjourned the matter, underscoring the imperative need for a balanced approach to technological progress and the protection of fundamental privacy rights.
~Siddharth Raghuvanshi
Picture Source :
