Lawful grounds, the exemption for enforcing a legal claim, the duties of a data fiduciary and practical steps for creditors and agencies.
Debt recovery involves personal data: names, addresses, telephone numbers, financial histories, and sometimes the data of relatives and guarantors. The Digital Personal Data Protection Act, 2023 sets rules for how it is handled, and a creditor, a lender or a collection agency is likely to be a data fiduciary under it. The Act is being brought into force in stages by notification, and a reader should confirm the current position of each provision. This note outlines the points that matter in recovery. It is general information, not advice on a particular business.
The basic framework
The Act applies to the processing of digital personal data in India, and to personal data collected in non-digital form that is then digitised. A data fiduciary is a person who determines the purpose and means of processing, and a data principal is the individual to whom the data relates. A creditor determining how it uses a debtor's data is a data fiduciary, and the debtor is a data principal.
Lawful grounds
Section 4 allows processing for a lawful purpose, either with the data principal's consent or for certain legitimate uses. Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and it must be asked for through a notice that describes the personal data and the purpose (Section 5). A borrower who provides data when taking a loan may be taken to have consented to its use for that loan. Section 7 lists legitimate uses, including where the data principal has voluntarily provided the data and has not indicated that it should not be used, and where processing is for compliance with a judgment, decree or order under any law.
Enforcing a claim
Section 17(1) exempts certain processing from parts of the Act, including processing that is necessary for enforcing a legal right or claim. This is of practical importance for recovery: a creditor may use the data it holds to pursue a claim without being obliged to give effect to every right the Act gives the data principal, such as erasure, during that period. The exemption is limited to what is necessary for the purpose. It does not permit the creditor to collect or use data for unrelated purposes, or to retain it without a reason.
Duties of a data fiduciary in recovery
- Notice. Tell the person what data is processed and why, and how to exercise the rights under the Act.
- Accuracy. Under Section 8, take reasonable steps to ensure that data is complete, accurate and consistent where it is used to make a decision about the person or is disclosed to another fiduciary.
- Security. Take reasonable security safeguards to prevent a personal data breach. The Act allows heavy financial penalties for failure.
- Breach reporting. Notify the Data Protection Board and the affected individuals of a breach, in the form and manner the rules prescribe.
- Erasure. Erase the data when the purpose has been served and retention is not required by law, subject to the exemption above for pending claims.
- Processors. Where a collection agency or a tracing vendor processes data on the creditor's behalf, engage it under a valid contract, since the fiduciary remains responsible.
Data principals' rights
An individual may request information about the data processed, ask for correction and erasure, seek redress of grievances and nominate a person to exercise rights in the event of death or incapacity. A debtor may therefore ask what the creditor holds, and the creditor should be prepared to answer, or to explain what exemption it relies upon.
Practical steps for a creditor
- Map the data that comes in with the loan or the contract, where it is held and who has access to it.
- Use a notice and consent form that mentions recovery as a purpose.
- Limit the sharing of debtors' data with agents and vendors to what they need, under written terms that require security and deletion.
- Do not disclose the debt, or the debtor's data, to relatives, employers or neighbours.
- Set a retention period and a procedure for deletion when the claim ends.
- Prepare a response to a request from a data principal, and a procedure for reporting a breach.
The Act does not stand in the way of lawful recovery. It requires care in what is collected, where it is kept and who sees it, which is how a creditor ought to treat the debtor's information in any case.
This note is general information on the law at the date of publication. It is not legal advice, and it should not be relied on without advice on the facts of a particular matter.
