Tech solutions exist to mitigate KYC data leakage risks

Today, more than half of all data breach incidents target personally identifiable information—tax identities, passport numbers, biometric data and the like.

- RAHUL MATTHAN

In most instances, this information was collected and stored to comply with know-your-customer (KYC) obligations. Could the regulations we put in place to prevent financial crime be the leading reason why identity theft has risen so dramatically? And has KYC insistence led regulated entities to create some of the most valuable and breach-prone datasets in India’s economy?

This does not have to be the case. Even though Section IIA of the Prevention of Money Laundering Act (PMLA), 2002, permits identity verification using either Aadhaar authentication or offline verification, regulated entities continue to require their customers to submit copies of their personal information. As a result, most companies find themselves in control of vast databases of identity information—scanned copies of Aadhaar cards, PAN cards, passports and the like. And, since money laundering is a “continuous offence,” this information ends up being retained indefinitely.

This practice conflicts with the minimalist philosophy that animates our data protection law. Under the Digital Personal Data Protection Act (DPDPA) of 2023, data processing must be limited to what is necessary for the specific purpose and personal data must be erased after that purpose has been served. Although the law permits verification, institutional practice has evolved to mandate permanent archiving. While the DPDPA does allow for exemptions to comply with existing laws, our current maximalist interpretation of KYC obligations is certainly not the most proportionate way to achieve these objectives.