DATA PROFILING IN BANKING & CONSUMER RIGHTS - Complete Legal Analysis

Data Profiling means banks using your transactional data, CIBIL history, location, device ID, social behaviour to create a 360-degree financial profile to predict your credit risk, spending capacity, and to cross-sell products. This is legal only with informed consent.

1. What Constitutes Illegal Profiling?

Under RBI Digital Lending Guidelines 2022, RBI Master Direction on Outsourcing of IT Services 2023, and DPDP Act 2023, following is illegal:

• Consent-less profiling: Creating risk score using SMS, contacts, location without explicit opt-in.
• Purpose Limitation Violation: Using data collected for KYC to sell insurance / mutual funds.
• Cross-selling without opt-out: Pre-approved loans based on savings account balance profiling.
• Algorithmic Discrimination: Denying loan based on profiling of caste, location, profession.
• Secondary Data Sharing: Bank sharing profile with NBFC partners / CICs in wrong format.

2. Legal Framework for Banking Consumer

3. Consumer Rights Against Data Profiling

1. Right to be Informed: Bank must disclose what data is profiled, why, and who it is shared with - DPDP Sec 6(3)
2. Right to Consent & Withdraw: Consent must be free, specific, informed. You can withdraw anytime.
3. Right to Correction & Erasure: Under Sec 12 of DPDP and Sec 21 of CICRA, you can demand correction of wrongly profiled data within 21-30 days.
4. Right to Not be Subject to Automated Decision: RBI says borrower must be given reason for rejection if done by automated profiling algorithm.
5. Right to Compensation: Rs. 100/day compensation if credit information not corrected beyond 30 days + Consumer Commission compensation for mental agony.

4. Landmark Case Laws

A. FOUNDATIONAL PRIVACY CASES

1. Justice K.S. Puttaswamy (Retd.) v. Union of India - Supreme Court 2017 - 9 Judge Bench
This is the base of all data profiling cases. Supreme Court declared Right to Privacy as Fundamental Right under Article 21. It held:

State and private entities cannot profile individuals without law, legitimate aim, and proportionality. Informational privacy is part of it.
Any banking profiling case today starts with this citation.

2. Karmanya Singh Sareen v. Union of India - Delhi HC / SC WhatsApp Privacy Case 2016-2017
Users challenged WhatsApp sharing data with Facebook for profiling. Court held that data sharing for profiling beyond original purpose needs specific opt-in consent. Same principle applied to Banks sharing data with group insurance companies.

B. BANKING PROFILING & DATA SHARING CASES

3. ICICI Bank Ltd. v. Prakash Kaur & Ors. - Supreme Court 2007 - AIR 2007 SC 1343
Bank gave borrower's data to recovery agents who harassed. SC held bank is liable for acts of its agents, sharing of personal data for coercive recovery is deficiency of service. Laid foundation for bank liability for third-party profiling.

4. Canara Bank v. Haridas - Kerala State Consumer Disputes Redressal Commission
Bank used customer's account profile data to market third-party insurance without consent. Commission held it as Unfair Trade Practice + Deficiency under Consumer Protection Act. Awarded Rs. 50,000 compensation.

5. HDFC Bank Ltd. v. Shailesh B. Singh - NCDRC 2022
HDFC shared customer's CIBIL profile and transaction pattern with its securities arm for demat account opening. Customer never consented. NCDRC held bank violated confidentiality clause under Banker-Customer relationship and RBI Fair Practices Code. Ordered to delete profile and pay compensation.

6. Axis Bank Data Profiling Case - Maharashtra SCDRC
Bank created internal "High Risk Customer" profile based on location profiling (customer residing in high-default area) and denied loan despite good CIBIL. Commission held denial based on discriminatory profiling without intimation violates Right to Reasoned Order under RBI Master Directions on Fair Practices.

C. CREDIT PROFILING & CIBIL CASES

7. Sri Motilal Das v. CIBIL & SBI - Consumer Court Kolkata 2019
Bank furnished wrong DPD in wrong format leading to customer being profiled as defaulter. Court held Bank and CIBIL jointly liable. Principle: Data Furnisher is primarily liable for profiling error.

8. Anoop K Raghupathy v. CIBIL & Citibank - Bangalore Consumer Court 2018
Error in furnishing format caused wrong credit profiling causing loan rejections. Forum directed CIBIL to rectify within 30 days and bank to pay Rs. 1.5 lakhs for loss of financial reputation.

9. Vikram Raj Singh v. HDFC Bank - Consumer Forum 2016
Held: Credit information reflecting in report is as provided by member banks. It is responsibility of credit institution to submit updated, accurate and complete information. Cannot take defence of "system error".

D. NEW AGE - DPDP & DIGITAL LENDING

10. RBI v. Digital Lending Apps - suo moto guidelines 2022
RBI banned 1300+ lending apps that were profiling borrowers by accessing contact list, gallery, and using it for harassment. RBI mandated:

• No access to file system, media, contact list
• Profiling only with explicit consent and audit log
• Borrower must be told factors used in credit decision

11. Google Pay / Paytm - Sharing of UPI Transaction Data for Profiling - RBI Advisory 2021
RBI clarified that payment data can be used for profiling only for purpose of payment, not for cross-selling loans without consent.

5. How to File Case for Illegal Banking Profiling

Step 1 - Right to Information: Send email to Bank's Nodal Officer + CIBIL:

"Under DPDP Act 2023 Sec 6 & 11 and CICRA Sec 21, provide me complete data profile you maintain about me, purpose, and third parties shared with."

Bank must reply in 30 days.

Step 2 - RBI Ombudsman Complaint: File on CMS Portal - Ground: "Non-adherence to Fair Practices Code / Digital Lending Guidelines / Unauthorized data sharing".

Step 3 - Consumer Commission: Under CPA 2019 Sec 34 - Deficiency of Service and Unfair Trade Practice. Ask for:

• Deletion of illegal profile
• Correction of CIBIL
• Compensation for mental harassment [Rs. 2-10 Lakhs granted in above cases]
• Litigation cost

Draft Plea Points to use:

1. Violation of Puttaswamy judgment - Informational Privacy
2. Violation of DPDP Act 2023 Sec 8(2) - Purpose Limitation
3. Violation of RBI Master Direction 2025 - Inaccurate furnishing
4. Deficiency under CPA 2019 Sec 2(11)