October 2020

Data Protection & Privacy in the Insurance Sector

The digital revolution in India has disrupted the business environment in all industries and the insurance industry is no exception. Digitization enhances efficiency and reduces the cost of transacting business however there remain several challenges to the adoption of emerging technologies such as disruption to the traditional insurance ecosystem, uncertain consumer adoption, return on investment and data privacy and security.

Emerging technologies usually deal in customer data which can be used to drive insights related to historical health issues and behavioural patterns of customers. Increasing regulations related to customer personal data around the globe and in India will continue to pose additional challenges for insurers and insurance providers alike.

The Information Technology Act, 2000 (IT Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) set out the general framework with respect to data protection in India.

However, given the nature of the business of insurance companies and intermediaries, the Insurance Regulatory and Development Authority of India (IRDAI) has prescribed an additional framework for the protection of policyholder information and data, which is required to be followed in addition to the general framework under the IT Act.

Regulatory Framework Governing Insurance Companies

The IRDAI has made it mandatory for all the insurance companies to ensure the protection and maintenance of confidentiality of all the information that they have collected. Below are some of the relevant data protection regulations applicable to insurance companies:  

1. IRDAI (Maintenance of Insurance Records) Regulations, 2015 – Pursuant to Regulation 3(3)(b), 3(9) insurers are required to ensure that: The system in which the policy and claim records are maintained has adequate security features, and the records pertaining to policies issued and claims made in India (including the records held in electronic form) are held in data centres located and maintained in India.
2. IRDAI (Health Insurance Regulations), 2016 – Pursuant to Regulation 35(c) insurers, third party administrators (TPAs) and network providers (i.e., hospitals) are required to comply with data related matters as may be specified in guidelines prescribed by the IRDAI (if any).
3. IRDAI (Protection of Policyholders’ Interests) Regulations, 2017 – Pursuant to Regulation 19(5) insurers are required to maintain total confidentiality of policyholder information unless it is legally necessary to disclose the same to statutory authorities.
4. IRDAI (Outsourcing of Activities by Indian Insurers) Regulations, 2017 – Pursuant to Regulation 12 insurers are required to ensure that the:
   • The outsourcing service provider has adequate security policies to protect the confidentiality and security of policyholder information;
   • Information and data parted to outsourcing service providers remain confidential; and
   • Customer data is retrieved with no further use of the same by the service provider once the outsourcing agreement is terminated.

Regulatory Framework Governing Insurance Intermediaries

Intermediaries in the insurance sector such as – brokers, individual agents, corporate agents, third party administrators (TPAs), surveyors, loss assessors, and web aggregators – serve as a bridge between customers and insurance companies, by facilitating the process for selection and purchase of insurance products and assisting in the servicing of policies and assessment of claims.

Therefore, intermediaries are also bearers of confidential information and thus are subject to obligations relating to data protection and preservation of confidentiality prescribed by the IRDAI.

Whilst each intermediary is subject to its own regulations and code of conduct as set out in the table hereinbelow, the provisions in relation to data protection of the policyholder are common for all intermediaries. Inter alia, they prescribe that insurance intermediaries – 

• Treat all information supplied to them by prospective clients as completely confidential to themselves and to the insurer(s) to which the business is being offered
• Take appropriate steps to maintain the security of confidential documents in their possession, including by way of restricting access to such information, execution of confidentiality undertakings, etc. 

While a similar regime has been prescribed for insurance surveyors and loss assessors, the extant regulations permit surveyors and loss assessors, as an exception, to disclose information pertaining to a client, employer or policyholder to any third party, only where necessary consent has been obtained from the interested party.

It is however clear that the surveyors and loss assessors are prohibited from using (or appearing to use) any confidential information to their personal advantage or to the advantage of a third party.

Specifically, in relation to TPAs, the IRDAI (Third Party Administrators – Health Services) Regulations, 2016 (TPA Regulations) requires the TPAs to not share the data and personal information of customers received by them for servicing insurance policies or claims.

A limited exception to this rule has been carved out for disclosure of confidential information to any court of law, tribunal, government or the IRDAI in the event of any investigation being carried out (or proposed to be carried out) against the insurer, TPA or any other person or for any other reason.

The aforesaid exception is similar to the carve-out under Rule 6 of the SPDI Rules, which permits government agencies mandated under law to obtain information (including sensitive personal data or information) for specified purposes, without obtaining the prior permission of the provider of such information.

Insurance Regulatory Sandbox

A ‘Regulatory Sandbox’ is a testing environment created by the relevant regulatory authority to provide market players with an opportunity to safely and securely execute and test their innovative products, services, business models and delivery mechanisms, in an orderly manner, which aims at protecting the customers and at the same time safeguarding the interest of the stakeholders.

Shortly after the issuance of the RBI Regulatory Sandbox, on 18th May 2019, the IRDAI issued the “Draft Insurance Regulatory and Development Authority of India (Regulatory Sandbox) Regulations, 2019” (IRDAI Regulatory Sandbox).

The objective of the IRDAI Regulatory Sandbox is to create a balance between the orderly development of the insurance sector on one hand and protection of interests of policyholders on the other, while at the same time facilitating technological innovation by way of relaxing provisions of any existing regulations framed by the IRDAI, for a limited scope and limited duration.

On approval of an application, the IRDAI chair may relax the applicability of one or more provisions of any regulations, guidelines or circulars requested in the application, subject to the conditions for approving the application or any other conditions which the chair deems necessary.

The Regulatory Sandbox Regulations expressly state that no relaxation will be granted in relation to the Insurance Act 1938 or the Insurance Regulatory and Development Authority (IRDA) Act 1999.

Conclusion

The underlying objective of the regulation is to encourage good data practices and retain customer trust in the insurance businesses. Instead of treating it as a mere compliance task, companies should welcome the newly introduced regulations as a great opportunity for them to win customer trust and gain competitive advantages.

Though insurers may be acutely impacted by the regulation, their path to compliance is similar to any other impacted sector: revisiting systems and processes to assess readiness for this regulation and investing in filling gaps.

Tags: Data Protection, information technology act 2000, insurance industry, personal data protection, data protection act india, information technology act, sensitive personal data, data subject rights, insurance sector, data protection act, data privacy act, personal data protection act, data protection law, data privacy, data security

Transformation in The Hospitality Sector

The magnitude of devastation attributed to events like 9/11 and the ‘Great recession of 2008’ seem bleak in comparison to the havoc wreaked by the COVID19 pandemic. The pandemic-induced lockdown has disrupted supply chains, closedown of businesses, and mass unemployment.

But the government’s decision to reopen the country in a phased manner brings a breath of fresh air and a hope for a gradual but steady ascent. However, the ascent is contingent upon the hospitality industry’s adaptability to the virus-induced irreversible transformational effect at large. 

With canceled flights, empty hotel rooms, and deserted restaurants, this pandemic has taken a toll on the hospitality industry. The industry’s dependence on the airline, tourism and travel industry makes recovery agonizingly difficult during these unprecedented times.

However, as the industry strives to get back up on its feet, stringent rules applicable to hotels in the MMR region, including Mumbai, Pune and Nashik must be followed. Therefore, the hospitality industry is in metamorphosis as they gear up for the post-COVID era. 

At the outset, the entire guest experience from check-in until check-out is likely to be redefined to cater to the current requirements of social distancing and hygiene. Zero-maintenance buildings, contactless interactions, and technology-based sanitization will emerge as the “new normal” for hotels and restaurants at large. Specifically, hotels outside containment zones will be allowed to operate at 33% capacity subject to adherence of social distancing and hygiene guidelines.

The rationale behind this is not only to avoid overcrowding but also to convert the remaining 67% capacity into a quarantine facility, as and when required by the government. Reduced operational capacity and increasing costs of running a hotel or restaurant will compel the industry to look for unconventional avenues to keep business afloat during a depressionary phase. 

Moreover, several other guidelines ensuring hygiene and social distancing such as mandatory thermal screening, protective glass at reception tables, sanitizers to all hotel staff and guests, and contactless digital payments, etc. will change the entire guest servicing experience. This goes without saying that only asymptomatic guests will be allowed entry in hotels.

As an additional measure, hotels are required to keep each room empty for minimum 24 hours post guest check-out and sanitize the room. Many of the facilities, like bars, buffet, spas and swimming pools, will have to stay shut for now and even though restaurants can open, they will only serve hotel guests for now. The State-mandated guidelines will propel the hospitality industry to provide a safe, contact-less experience from the pick up at the airport to the check-in, entire stay and until check-out. 

State-mandated guidelines although necessary for the health and safety of individuals, it is likely to have catastrophic consequences for alternate accommodation such as Bed & Breakfast, Guest Houses and unbranded budget hotels which constitute 95% of the hotel industry. On the other hand, implementation of these guidelines is easier for chain and luxury hotels with deep pockets, however high maintenance costs coupled with less customers may pose as a challenge.

In light of this, the low-priced sector on the country can ride on India’s large domestic tourism to kick start the industry. Also, the alternate accommodation industry offers potential entrepreneurial opportunities to small-scale business owners. Seeking out entrepreneurial opportunities is especially important as revival projections do not look promising as on date.

Corporate travel will perhaps revive the chain hotels though the lock down has shown that corporate travel can be limited with the emergence of work-from-home concept. As per FHRAI, hotels are seeing about 15-20 percent occupancy at present. For restaurants, limited number of working hours coupled with restrictions on the sale of alcohol makes business unviable, thereby hurling several small restaurants, bars and hotels towards an empty treasury.

Moreso, inbound traffic is bound to be slow due to travel restrictions and recessionary conditions limiting disposable income. Clearly, the prolonged impact of the COVID-19 crisis, even after the lockdown has been relaxed, is likely to have a long-term impact on the sector on account of burdensome guidelines and recessionary conditions limiting disposable incomes of customers.

Driving up sales requires a culmination of strategies including – continuous and effective marketing strategies that communicate with loyal guests through digital and social media during and post the lockdown. In doing so, hotels and restaurants can showcase their contributions and safety measures in wake of the pandemic for its customers. Secondly, it is imperative for hotels and restaurants to maintain adequate liquidity for working capital.

This can be achieved through a combination of renegotiation and extension of payment cycles with vendors, adopt RBI’s 3-month moratorium period for existing interest and principal payments to banks, and enforce rigid cost-control measures while supporting the salaries of its staff members. Consequently, a higher budget will be allocated to technology; minimum human interaction is maintained while providing a safe, hygiene and comfortable stay. 

The Finance Ministry’s economic package disappointed the hospitality industry, which came to a screeching halt on account of the COVID-19 outbreak. Unfortunately, the survival of this industry is interlaced with the situation of the aviation, hospitality and tourism sectors, thereby making survival and recovery of hoteliers challenging across leisure, heritage, adventure and niche verticals.

The industry is starved relaxations from the government, but more importantly for customers to feel at ease to visit hotels and restaurants once again. It goes without saying that a resumption of economic activity is essential, but the vigil on the virus must remain and in doing so Indians are likely to witness decades of unprecedented transformation in near future. 

Tags: mass unemployment, sectors of hospitality industry, tourism and hospitality sector, sectors of tourism and hospitality industry, hospitality sector, mass unemployment pandemic, mass unemployment for employers, hospitality industry

National Education Policy

The National Education Policy 2020 may provide a runway for the education sector to take off despite challenges posed on account of the pandemic. Announcement of the NEP attracted criticism from industry experts, but it may place India on the global map for sought-after educational haven of the world. The National Education Policy 2020 replaces the old education policy which was framed in 1986 and ushering in an era of new educational reforms.

This is the first policy that seeks to unshackle students from the tyranny of administrative constraints with multiple-choice, multidisciplinary learning, and multiple chances. However, the policy has been scrutinized and dissected by industry experts and thus have witnessed conflicting views. 

The policy aims to create a robust digital infrastructure in the education sector that ensures uninterrupted learning even during unprecedented circumstances. The National Education Technology Forum (NETF) will be established for ensuring that the technology is integrated adequately and efficiently in the education process and ensuring the enhancement of the access of education to all sections of the society even in these tumultuous times.

Various contours of this policy aim to radically improve the Gross Enrolment Ratio in higher education and to achieve the objective of 100% youth literacy. Moreover, the said policy has also been predicted to reduce social and economic gap between students, which has magnified in wake of the pandemic.

A system that promotes meritocracy, equal opportunity and equity is good, but there lies a gap between theory and practice. In addition to this, the NEP elucidates the need of homeschooling and multi-language learning whereby until the 5^th grade and in exceptional circumstances, no later than 8^th grade, the mode of education shall be in the mother tongue/local language of the student.

Despite the all-encompassing façade of the new policy, its success shall be put through a sceptical lens with rising concerns for the students during higher education and in their professional journeys. It is particularly problematic in light of the right of the people to move from one state to another since the inter-state movement shall result in the change of the local language and the mode of education. 

The policy has also been criticised due to the legal complexities surrounding the applicability of two operative policies namely The Right to Education Act, 2009 and the New Education Policy, 2020. Certain provisions such as the age of starting schooling will need to be deliberated upon, in order to resolve any conundrum between the statute and the recently introduced policy in the longer run.

Against this backdrop, it is pertinent to note that past attempts at parliamentary legislations under the erstwhile regulatory set up have not been successful. The failure can be attributed to the role of regulators and the intended legislative changes being out of alignment, as in the case of Foreign Educational Institutions (Regulation of Entry and Operations) Bill, 2010, which lapsed; and the proposed Higher Education Commission of India (Repeal of University Grants Commission Act) Act, 2018 which remained did not reach the Parliament. 

The contours of NEP is expected to revise the regulatory avatar of the Higher Education Commission of India (“HECI”) being set up with a wide role in Indian higher education. The HECI is likely to have four verticals under its umbrella, including:

a) National Higher Education Regulatory Council, intended to be a single point regulator for the higher education sector;

b) National Accreditation Council, which will deal with accreditation of institutions;

c) Higher Education Grants Council, which will be tasked with carrying out funding and financing of higher education; and

d) General Education Council, the final vertical, is expected to have a more academic based-role, as it will frame expected learning outcomes for higher education programmes.

Foreign universities coming into the country will also fall under the purview of this framework. While the Universities Grants Commission and the All India Council for Technical Education have played a major role in this direction until now, questions pertaining to the role of the UGC and AICTE remain unanswered under the new policy. 

It is evident that NEP 2020 provides a fresh canvas to paint on and opens up avenues for home-schooling and foreign universities alike, in India. For the new policy to succeed a combination of a staunch intent to move out of comfortable doldrums and facilitate increased involvement of foreign universities and increased literacy levels is a must.

While this objective is expected to see significant regulatory overhaul for its successful implementation, it would lay a successful path ahead for institutions as well as the student community and place India on the map of an educational haven.

Tags: indian education policy, indian education policy 2020, education policy, education sector, new education policy 2020, new education policy, National Education Policy, national education policy 2020, education policy 2020

Analyzing Individual Borrowers’ Creditworthiness

Financial institutions are focused on risk, now more than ever before. Circumstances such as the present pandemic have compelled the country and its business to pivot or risk being perished in this country-wide overhaul. The virus-induced lockdown has raised “Liquidity” and Non-Performing Assets (“NPA”) issues popularizing the buzzwords in financial circles and beyond.

Anticipating a domino effect on loan defaults amongst small to medium-sized businesses, the Finance Ministry in conjoined efforts with Regulators and the Reserve Bank of India (RBI), introduced numerous measures for the maintenance of equilibrium between the market forces of demand and supply during the pandemic.

With the widespread prevalence of COVID-19 pandemic, they are increasingly recognizing that the rebuilding phase offers a unique opportunity to encourage action on the agenda of survival until the COVID-19 dust settles.

The acute phase of COVID-19 has drawn central banks’ attention towards from a crisis that was earlier restricted to some states and regions, to a global economic crisis riddled with challenges. The nature of the crisis has revealed basic vulnerabilities around the world, most importantly those surrounding individual borrowers. 

The Finance Ministry directed Banks to roll out a loan resolution framework with the Loan Moratorium period ending on August 31st and the festive season round the corner. In doing that the Supreme Court directed that while Banks are free to restructure loans, they cannot penalize individual borrowers availing moratorium benefit.

The apex court held that charging interest on deferred EMI payments under the moratorium scheme during the COVID-19 pandemic would amount to paying interest on interest which is against “the basic canons of finance” and unfair to those who repaid loans as per schedule.

RBI’s move to restructure personal loans accord this benefit to consumer credit, education loans, loans for creation or housing loans pursuant to a central bank notification. Specifically, the relief may include “rescheduling of payments, conversion of any interest accrued, or to be accrued, into another credit facility, or, granting of moratorium, based on an assessment of income streams of the borrower, subject to a maximum of two years”; however the exact contours of the resolution plan have not been clearly laid out and remain undecided.

The primary objective of this move at helping borrowers as on the pretext of mass unemployment, pay cuts and lay-offs in light of the world’s strictest lockdown, thereby paralyzing economic activity. So a 2-year moratorium that RBI has now permitted under such restructuring proves to be a blessing in disguise for people experiencing cash crunch during the pandemic.

Clearly, it will boost households facing a cash crunch — especially those who lost their jobs or small businesses who are on the verge of a shutdown. RBI has moved consistently and quickly since the start of the pandemic to calm markets, to provide liquidity and, now, these steps should go some distance in giving relief to the distressed liquidity-starved household.

However, each household should be wary of using this facility. At the outset, a loan moratorium was aimed at helping those in distress and not meant to be used as an opportunity for the pre-existing defaulters of loan payments. At the other end of the spectrum, the moratorium extension is likely to provide a negative credit outlook for financial intermediaries in the shadow financing industry like Housing Finance Companies and Non-Banking Financial Companies.

Invariably, the deferment of EMIs will have an adverse impact on the cash flows of these financial institutions and test their resilience during depressionary forces emanating from the COVID-19 pandemic.

Despite the slew of measures announced by the RBI and government to alleviate liquidity woes of financial institutions, these measures may have less impact in the short to medium term, but the operative word being “defer” of loan installments, and not a complete waiver or discount thereof should be of prime importance in the personal finance industry and be availed only if absolutely required.

A growing number of central banks and banking supervisors are starting to work together to progress a global approach and agenda. In doing so, the central banks need to develop a clear strategy on the way forward. Monetary policy needs to be forward-looking.

Given the slowdown in the economy and that the transmission of rate cuts takes time, there is a need for further monetary policy easing. This will also be helpful as uncertainty remains over COVID-19 having a deflationary or inflationary impact on the Indian economy in the medium run.

While the temptation to adopt aggressive measures may be high, crossing the traditional boundaries between fiscal and monetary policies, but are feasible for central banks in advanced economies with high credibility stemming from a long track record of stability-oriented policies. Thus this strong medicine should only be taken with extreme care.

Tags: creditworthiness, credit worthy, individual borrowers, credit worthiness of a customer, credit worthiness of borrower, credit worthiness of a company