(ATF) China is considering new rules that require large internet companies such as Alibaba, Tencent and JD.com to set up “independent” agencies comprised of “external members” to supervise their handling of personal data in a continuing push to expand privacy protection.
Alibaba’s fintech affiliate Ant Group, which collects data from more than two-thirds of China’s 1.4 billion people, may become one of the first with such an agency. The company will likely set up a credit information and rating agency that serves not only itself but also banks and other lenders, to meet Beijing’s requirements of breaking its monopoly and avoiding systemic financial risks, analysts said.
A draft of the country’s first Personal Information Protection Law was submitted Monday to the Standing Committee of the National People’s Congress, China’s top legislature, for a second of three reviews, the Xinhua News Agency said. Compared with a previous version released in October, the new draft outlines more detailed requirements for internet companies’ protection of users’ data.
The draft law requires that personal information handlers that provide basic internet platform services, and have large numbers of users and complex businesses, should establish “independent” agencies that are comprised of “external members” to supervise the management of personal information, the Xinhua report said.
In addition, these companies are required to regularly release a social responsibility report on personal information protection.
The long-awaited personal information protection law comes as Chinese tech giants process massive user data as they offer various services ranging from online shopping to wealth management.
Some of them, such as Jack Ma’s Ant Group, has such a large and good command of users’ shopping data from the popular Alipay, Taobao and Tmall apps that even commercial banks rely on them to make micro-loans.
In some co-lending deals, Ant Group was able to use their advantages in traffic and risk models to earn a larger portion of online lending revenue with only 1-2% of funding contribution. On the other hand, banks, often small and local ones, not only had to provide most of the funding and bear the risks of loss, but also earned less revenue.
To prevent excess borrowing and fraud, the government has not only released new rules that require the tech giants to increase their share of the funding for joint loans to 30%, but is also tightening the control of personal credit data.
Treasure trove of data
Hiving off the treasure trove of data on more than 1 billion people is a key part of Ant’s business overhaul in response to a regulatory crackdown that resulted in the abrupt suspension of its $37-billion initial public offering (IPO), which would have been the world’s biggest.
Reuters reported in January, citing sources with knowledge of the matter, that tech giants including Ant Group, Tencent and JD.com would be forced to pass their loan data to nationwide credit agencies such as the Credit Reference Center and Baihang Credit. These agencies, which are run or backed by the People’s Bank of China (PBOC), would share the data more widely with banks and other lenders to adequately evaluate risks and prevent over-borrowing, the report said.
But instead of sharing loan data for free, a more likely model is for Ant Group to be able to charge fees to banks, analysts from Zhongtai Securities said.
China’s central bank and the regulators overseeing banking, insurance, securities, and foreign exchange announced a restructuring plan for Ant Group on 12 April. While the fintech mammoth will be required to convert itself into a more strictly regulated financial holding company, it will also be required to obtain a license for “operating a personal credit service” in a bid to “break the monopoly of information”, Pan Gongsheng, deputy governor of the PBoC, said.
“The two personal credit rating companies that have been given licenses are both state-backed, [so] it is unlikely that Ant Group will obtain a license on its own. We expect that Ant Group will establish a personal credit rating agency jointly with a [state-owned] commercial bank... Once this part of Ant’s business becomes compliant with laws, the company can provide it as a service to banks and charge the banks based on the volume of inquiries. It will be a compliant model that the banks run their own risk management while Ant provides credit data service to them,” Dai Zhifeng and Lu Jie, analysts from Zhongtai Securities said.
Ant Group was among eight Chinese companies - that also included Tencent and Ping An - that applied for a credit rating license back in 2015. But instead of obtaining licenses, the eight companies were each given an 8% stake in Baihang Credit, while the National Internet Finance Association of China owns its majority stake of 36%.
Ant’s mega-app Alipay collects data from about 1 billion people, many of them young and without credit cards or sufficient credit records with banks, as well as from 80 million merchants, according to the company’s prospectus and analysts.
Ant runs Zhima Credit - the name means “Sesame” - one of China’s biggest private credit-rating platforms, with proprietary algorithms to score people and small businesses based on their use of Ant-linked services.
Compared with Ant, rivals Tencent and JD.com run relatively smaller consumer-credit business.