Yandex: there is everything … about users
Yandex and the two largest Russian credit bureaus have launched a new project for evaluating individual borrowers: their scoring score can be estimated, including using data collected by Yandex. The company said that anonymized data will be processed by algorithms automatically and exclusively in a closed Yandex circuit. The credit bureau will send Yandex a hashed email address and mobile phone to the user. Based on these data, the system will build a model and issue a solvency indicator.
Vladimir Ozherelyev, lawyer at the Center for Digital Rights, tells how this will affect the security of user data and whether it is consistent with the law “On Personal Data”.
Will user data be protected?
Without a full understanding of internal algorithms, it is difficult to assess how much user data will be protected. If an unauthorized access to the database with information about borrowers is obtained, the technical capabilities of attackers can allow you to establish a specific person according to the data set even if they are anonymized – it all depends on the level of algorithms used. Despite the great attention of banks to the protection of information, its transfer to Yandex creates an additional threat. But given the technical capabilities and competence of Yandex, there is no reason to believe that the data of borrowers will certainly be in danger. Such projects are inevitable due to the continuous development of information technology and generally carry socially useful functions.
What about the law on personal data?
Another aspect is the legitimacy of such transmission and processing. The Federal Law “On Personal Data” contains mechanisms that ensure compliance with the law in such operations. Banks can easily get the borrower's consent for data processing, but Yandex will need to make efforts to ensure that all Yandex users agree that their data can subsequently be used to assess solvency. It is likely that data collection and preparation for the purpose of solvency assessment will be carried out by Yandex in advance, so that at the time of receiving a request from the bank, it will be possible to give an estimate based on existing data. Thus, data collection for the purpose of solvency assessment can be carried out regardless of the desire of the user to carry out such an analysis. Unfortunately, the Federal Law “On Personal Data” contains many gaps that allow abusing the right to processing. A small amount of fines allows you to look at the risks of breaking the law through your fingers.
How to find a compromise between users and companies that want to use their data?
It would be optimal for users to create a separate Yandex user service that allows you to select data types and the processing time for credit scoring purposes and send them to banks at will. After all, the more information a bank can get to evaluate a borrower, the faster it will be able to make a decision on a loan, and based on the additional information provided by Yandex, the credit rating can be increased, which would be relevant for borrowers who do not have a credit history.
