Kenya

Mobile money lending and AI: The right not to be subject to automated decision making

Introduction

The success of mobile money in Kenya changed lives and has created a good base for many mobile technology-based solutions. Among these solutions are mobile loan services which ride on the mobile system but also involve the use of artificial intelligence (AI).

For the purposes of this report, AI is defined broadly as computer systems designed to perform tasks in a way that is considered to be intelligent, including those that “learn” through the application of algorithms to large amounts of data.[1] Because of this, algorithmic decision making will be considered use of AI. Automated decision making is a decision made by automated means without any human involvement. Examples of this include an online decision to award a loan and a recruitment aptitude test which uses pre-programmed algorithms and criteria.[2]

In the mobile lending process, there are two instances where algorithms sift through data before making decisions. This is in the credit scoring stage and credit referencing stage. The decisions these algorithms make affect the lives of millions of Kenyans every day. In this report, I will highlight the rights enshrined in the Kenyan Bill of Rights that are being affected by the use of AI in mobile lending apps.

The rise of mobile loans in Kenya

Several factors led to the rise of mobile loans in Kenya. The first one is the success of M-PESA,[3] a mobile money service by telecommunications company Safaricom. M-PESA was launched on 7 March 2007 and by November that year it had one million active users. The first purely mobile loan product in Kenya was M-Shwari, which was launched in January 2013 in collaboration with the Commercial Bank of Africa.[4] Since then other banks and Silicon Valley-sponsored companies like Branch[5] have joined the market as service providers, all trying to replicate Safaricom’s M‑Shwari success in mobile lending.[6]

The second factor is a change in banking policy. In 2016, the Kenya Banking Act was amended to cap interest rates at four percentage points above the central bank rate. This policy change led many banks to reconsider their lending business model as it was now less profitable, and they became more cautious about lending to individuals and small businesses. Banks then got into financial technology by launching mobile money lending apps while others formed partnerships with existing telecommunications companies in the mobile money business.[7]

These initiatives gave the banks new customers and exposed more Kenyans to accessible credit facilities. While this bridged the financial inclusion gap, it also exposed many Kenyans to systems where the information in their phones was used to credit score them.

The mobile lending process

A borrower first downloads a mobile lending application onto his or her mobile phone. For those who want to get loans from institutions allied to their network service providers, the service is accessible from their SIM card menu. These USSD-based[8] services are usually available to users who do not own smartphones. For those who download the mobile applications onto their smartphones, the application will install and ask for permission to access their contacts, call logs, messages and in some cases, their social media accounts.

All this is done to enable the loan service providers to get data to enable them to create a profile of the borrower. These mobile lenders end up having access to a large volume of consumer data whose deployment is unregulated, and consumers are becoming concerned.[9]

After downloading the application, one usually feeds in personal identifiers such as your name, phone number and national identification number before the system “calculates” how you much can get as a loan. The money will then be deposited in your mobile money account, from which you can withdraw or use it anywhere, any time.

When one fails to repay a mobile loan, the service providers usually try to reach out to you to remind you to pay up. But not all do that. Some have automated systems that send out warning messages before sending the customer’s name to a credit reference bureau (CRB) as a loan defaulter, hence affecting their credit score.

The General Data Protection Regulation (GDPR)[10] came into force in May 2018 in the European Union. While it is foreign to Africa, it does have an impact on the continent as it applies to entities that process and hold the personal data of data subjects residing in the European Union, regardless of the company’s location. This includes any entity on the African continent that conducts business with European companies or deals with EU data subjects.

Those who do not comply with the regulations face legal fees or fines and these consequences do not just apply to businesses within the EU. Many countries like Kenya are trying to comply by enacting data protection laws that are modelled after the GDPR, which is deemed to be the global regulatory “gold standard” for the protection of personal data of consumers.

Article 22 of the GDPR restricts service providers from making solely automated decisions that have a legal or similarly significant effect on individuals. Applied to the Kenyan context of mobile loans, the algorithmic decision-making processes in the lending cycle, from the moment of credit scoring to after the possible default of payment by a borrower, including the listing of defaulters at CRBs, should have human intervention. This is especially the case in the latter part of the process, which affects a borrower's ability to borrow again.

Relevant constitutional rights in Kenya

Consumer protection rights
Article 46 of the Constitution of Kenya[11] provides for consumer protection rights. These rights require businesses to provide consumers with enough information that will enable them to protect their economic interests. These rights back up all the rights listed below and are fleshed out by the Consumer Protection Act, 2012.[12]

Right to access to information
This right is enshrined under Article 33 of the Constitution. This right may be used to defend the right to informed consent. The approach in Kenya since the enactment of the access to information law is that citizens have a right to information that affects them. This can be manifested via an entity providing the information and publishing it on its website or via individuals requesting specific information that affects them and their rights. In the case of mobile loan business entities, they are doing a poor job in consumer education and this has led to many complaints, which shows how uninformed their customers are.

Right to privacy
This right is found in Article 31 of the Constitution. Privacy and data protection issues arise in the mobile lending process because of the automated decision making which affects the borrowers. Many Kenyan borrowers have been listed as defaulters at CRBs for failing to pay KES 200 (USD 2) or less on time.

According to an industry insider who did not wish to be named, different companies have different processes. Some companies have purely automated processes, while others have instances where human beings intervene before a decision is made. These listings drastically affect the credit score of those listed.

The other issue that arises is the lack of informed consent. Many users of these applications do not really know what they are getting into.[13] Some mobile loan service providers inform third parties in their user contacts lists about cash owed especially when they are late with payment. This is after charging fees on the digital loans that range from 6% to 10% for a one-month loan (6% to 10% times 12 months – do the math). Despite the hue and cry, many app owners say that users should read the terms and conditions, which implies that many users of these apps do not know what they are getting into.

Right to dignity
This right is found in Article 28 of the Constitution of Kenya. When you download a mobile lending application onto your phone, the applications usually get access to your saved contacts. It is these contacts that some Kenyan mobile lenders have developed a habit of calling when they need to pressurise their customers to pay back their loans.

This debt shaming is embarrassing and against the right to dignity. Many whose close relatives and friends have been contacted by mobile lending firms to compel them to pay have found the experience to be embarrassing, while the company doing this seems to be unapologetic.

Conclusion

One can see that when it comes to mobile lending in Kenya, there is an algorithmic decision-making process that takes place without any human intervention. These decisions affect the lives of many people and households, and can be said to contravene several rights enshrined in the country’s constitution.

People agree to these automated processes without full disclosure from the mobile lending companies on what they will do with their data and how it will be processed. The decisions on the amount they are eligible for and whether their names should be listed by CRBs as loan defaulters have been left to algorithms.

While the Central Bank of Kenya has expressed concerns about how digital lenders are operating and has promised to crack the whip, policy reform is needed to ensure that the credit reference listing of defaulters is not automated and that there is human intervention. Their attempts at cracking the whip at digital lenders have not been successful because most digital lenders are not regulated by the Central Bank, hence they are unaffected by legislative reforms pushed by the regulator. Only an amendment to the Banking Act to include digital lenders will force them to comply with the set laws.

The Kenyan National Assembly has tabled a Data Protection Bill.[14] The draft law contains provisions that dictate that automated decision making cannot happen without human intervention. The exemptions to this rule include when it is consensual, necessary for performance of a contract,[15] and authorised by law.

An interesting clause under this provision requires a data controller to notify a person within a reasonable period of time that a decision has been made that may produce legal effects. The person may then request the data processor to reconsider the decision or to make a new decision not based on the automated processing. This provision is a life buoy to those who have had their credit score messed up by over-eager digital lenders. If passed, the digital lenders and CRBs will be forced to contact the person exhaustively before listing them for defaulting on their loan repayments. It will also deal with algorithmic decision making in the financial sector to complement existing financial sector laws.

Kenya’s neighbour, Uganda, recently passed a Data Protection and Privacy Act[16] which contains provisions on rights in relation to automated decision making. While the Act is similar to the Kenyan draft, Uganda has gone a step further to state that a data processor or controller should notify the person within 21 days, a move that removes ambiguity from the law.

The Constitution of Kenya allows for public participation during the development of legislation. These points on automated decision making need to be brought to the attention of legislators during this phase of consultation.

Action steps

Civil society organisations need to:

• Engage legislators on the human rights implications of mobile lending apps in Kenya. Push for sector-specific laws that govern and limit the application of automated decision making in mobile lending processes.
• Create awareness-raising material to build financial literacy and to support the consumer's right to information. This could be done in collaboration with service providers and the regulators. The regulators, led by the Central Bank of Kenya Governor, have shown interest in enforcing consumer protection in the sector.[17] The service providers are aware of the chaos in the industry and some have expressed a willingness to engage in consumer protection efforts, which gives civil society a good chance to collaborate in ensuring consumers are informed.
• Call on the relevant government bodies and relevant regulators to hold players in this industry to account in processes that deploy automated decision making so that they do not violate consumer rights. Simply creating legislation is not enough – the implementation of laws needs to be proactive.

 Footnotes

[1] https://www.giswatch.org/giswatch-2019-call-proposals-artificial-intelligence-human-rights-social-justice-and-development

[2] https://www.ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/rights-related-to-automated-decision-making-including-profiling

[3] https://www.safaricom.co.ke/personal/m-pesa

[4] FSD Africa. (2016). The Growth of M-Shwari in Kenya – A Market Development Story. https://s3-eu-central-1.amazonaws.com/fsd-circle/wp-content/uploads/2016/11/26122759/M-Shwari_Briefing-final_digital.pdf-9.pdf

[5] https://www.branch.co.ke

[6] Sunday, F., & Kamau, M. (2019, 25 June). Mobile loans: The new gold rush minting billions from the poor. Standard Digital. https://www.standardmedia.co.ke/article/2001331308/mobile-loans-the-new-gold-rush-minting-billions-from-the-poor

[7] The general result was that many banks closed their branches and created an agency model similar to the M-PESA model where you could deposit and withdraw money from your account from an agent who doubled up as a grocery seller (M-PESA agents are usually shopkeepers who sell other things as well). Banks started teaming up with telcos which had the reach they wanted and it was cheaper to use their mobile money infrastructure compared to running branches. With this system in place, banks could introduce new credit products with low operating costs.

[8] Unstructured supplementary service data (USSD) is a global system for mobile (GSM) communication technology that is used to send text between a mobile phone and an application program in the network. Applications may include prepaid roaming or mobile chatting. https://searchnetworking.techtarget.com/definition/USSD 

[9] Mwaniki, C. (2019, 24 June). Mobile loan borrowers shun betting. Business Daily. https://www.businessdailyafrica.com/datahub/Mobile-loan-borrowers-shun-betting/3815418-5169438-qcivc3/index.html

[10] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN

[11] www.kenyalaw.org:8181/exist/kenyalex/actview.xql?actid=Const2010

[12] www.kenyalaw.org:8181/exist/kenyalex/actview.xql?actid=No.%2046%20of%202012

[13] Ondieki, E. (2019, 19 May). Outcry as mobile lenders use ‘cruel’ tactics to recover loans. Daily Nation. https://www.nation.co.ke/news/Outcry-as-mobile-lenders-use--cruel--tactics-/1056-5121620-s2dh87z/index.html

[14] www.parliament.go.ke/sites/default/files/2019-07/The%20Data%20Protection%20Bill%2C%202019.pdf

[15] “Necessary for the performance of a contract” in this context is where automated decision making is used for a process like credit scoring which is key to determining how much a borrower should get. This is usually stated in the contracts.

[16] www.ulii.org/ug/legislation/act/2019/1

[17] Leting, T, (2019, 1 April). CBK raises alert on Mobile lending. East African Business Times. https://www.eabusinesstimes.com/cbk-raises-concern-on-mobile-lending

Notes:
This report was originally published as part of a larger compilation: “Global Information Society Watch 2019: Artificial intelligence: Human rights, social justice and development"
Creative Commons Attribution 4.0 International (CC BY 4.0) - Some rights reserved.
ISBN 978-92-95113-12-1
APC Serial: APC-201910-CIPP-R-EN-P-301
978-92-95113-13-8
ISBN APC Serial: APC-201910-CIPP-R-EN-DIGITAL-302