'Entire Credit Score Outsourced To A Private Entity': Amicus To Supreme Court In Plea Alleging Data Privacy Violation By Foreign Companies

In a PIL alleging data privacy violations by foreign credit information companies, Senior Advocate K Parmeswar (Amicus Curiae) assailed before the Supreme Court today the outsourcing of "entire credit score" of persons to foreign private organization(s) and lack of statutory framework to regulate the duties of the organization(s).

A bench of Justices Surya Kant and Ujjal Bhuyan adjourned the matter, upon being informed that a copy of the Ministry of Home Affairs' affidavit did not reach the Amicus. It also gave 4 weeks' time to respondents, including Transunion CIBIL Ltd., Experian Credit Information Company of India Pvt. Ltd., Equifax Credit Information Services, CRIF High Mark Credit Information Services Pvt. Ltd., Bank Bazaar, Paisa Bazaar and My Loan Care, to file their affidavits.

During the hearing, claiming that there are 3 significant issues arising in the matter, the Amicus stressed on the importance of privacy and said that entire credit score is outsourced to a private organization. "There is no statutory framework so far as the duty of that organization is concerned" he added. It was further highlighted that any citizen of the country who wishes to obtain a bank loan gets it based on CIBIL score (credit information).

On the other hand, Senior Advocate Dr AM Singhvi (appearing for certain respondents) urged that it was a case of frivolous petition abusing the process of the Court, as since filing of the petition, the petitioner himself had not appeared but 4 intervention applications had been filed.

In response, Justice Kant told the senior counsel that the stage to raise the issue has passed, as now an Amicus has been appointed to assist the court.

It is worthwhile to mention that a person with the name of the petitioner joined the proceedings virtually, but could not address the court due to technical issues. He later appeared to raise a grievance to the Courtroom Administrator in the meeting chat box, but to no avail (as the matter was already over).

Background

The instant public interest litigation seeks directions to the Ministry of Finance, RBI, Ministry for Electronics & Information Technology and Ministry of Home Affairs to take appropriate steps against 4 foreign credit information companies for alleged financial data privacy violation of citizens.

As per the petitioner, the 4 private multinational companies with head offices and data storage systems located outside India, have been retrieving and storing sensitive financial information of banking customers without their consent and thereafter selling it further. These companies include Transunion CIBIL Limited, Experian Credit Information Company of India Pvt. Ltd., Equifax Credit Information Services and CRIF High Mark Credit Information Services Pvt. Ltd. It is contended by the petitioner that this constitutes a grave violation of the Right to Privacy as laid down in the landmark judgement of KS Puttaswamy v. UOI.

Further, it is claimed that the companies have been in breach of the 'Privacy Principles' of the CICR Act 2005 (Credit Information Companies Regulation Act), which regulates credit information companies (CICs) by ensuring that there is no breach of confidential information of the banking data and citizens.

In May this year, former CJI Dr DY Chandrachud-led bench agreed to consider the matter and appointed Parmeswar as Amicus Curiae.

Case Title: SURYA PRAKASH VS. UNION OF INDIA, DIARY NO. 23982/2023