RBI's Role as Data Regulator: Expanding or Limiting Banking Privacy

Abstract:

In the contemporary landscape of digitized banking and fintech innovation, customer data has become essential to financial services. The Reserve Bank of India (RBI), through its statutory powers, functions as a de facto data regulator for the banking sector, setting directives for the collection, processing, and sharing of personal financial information, including KYC (Know Your Customer) and credit data. This role requires the RBI to reconcile its regulatory objectives with the constitutional right to informational privacy, affirmed by the Supreme Court's Puttaswamy judgment.This report explores whether the RBI's regulatory approach is expanding the protection of banking privacy or inadvertently constraining it. The analysis examines the legal framework—from constitutional principles to the new Digital Personal Data Protection (DPDP) Act, 2023—and critiques key RBI policies, such as KYC norms, the Account Aggregator framework, and credit information sharing rules. The discussion evaluates where RBI's regulations enhance privacy (e.g., through confidentiality and consent-based systems) and where they limit it (e.g., through extensive data collection and broad sharing mandates). Ultimately, the study aims to determine if the RBI’s evolving role bolsters or erodes the privacy of bank customers.