eges started using a model for admissions in 1908 and it was trained mostly on white Christian men who were also rich when this model was put into action the number of Jews the Jews are a religious minority in the U.S. about 1% of the population they suddenly skyrocketed in college because for various cultural reasons Jews study really hard like studying the religious text is a major part of the culture at this point what the colleges did is they dropped the model and instead put humans back in the loop at the time this happened again keep in mind this is 1922 nobody liked Jews called it a crisis he dropped the model and then after they went back to having humans do it they got the number of Jews back down quite a bit which in my mind is not particularly fair but at that time their ethics said you should not have so many Jews so fundamentally like a lot of what you read about AI is in a sense it relates to this quote it relates to George Bernard Shaw so he was in Ireland and in Ireland there were a lot of religious conflicts between Catholics and Protestants who are two slightly different varieties of Christians an old man asked him once can you tell me are you Catholic or Protestant and George Bernard Shaw is like I'm an atheist I don't believe in any God and then the old man who lives in Ireland asked him but is it the Catholic or the Protestant God you don't believe this old man had probably never left Ireland he didn't know anything of the world other than Catholic versus Protestant so what he had to do to make sense of this atheist was to just bring it back to this world of Catholic versus Protestant a lot of people talking about AI they don't understand how a random forest works they try to bring everything back to how would a human behave humans are born with a lot of intrinsic like we've evolved to be tribal creatures we like the people who look the same as us we dislike people who look different whereas a random forest or just a spreadsheet that sorts by a column doesn't have these same issues so here's the unpleasant tradeoff and I found one paper that has two graphs that illustrate it very nicely so what this graph illustrates is the percentage of people of different groups that have a certain FICO score so in the US FICO is a risk score the higher it is the less likely you are to default on the law so imagine we want to choose a fixed cutoff and we want to we basically want to say we're not going to lend to anyone below this cutoff if you were to choose a FICO of 600 which is this relatively arbitrary because there's a tick on the graph there you would be rejecting 75% of blacks which is this and 25% of Asians and then about 30% of whites would be rejected and something like 50% of Hispanics would be so if you choose one cutoff for everyone you will be individually fair but you'll be violating the principle of group fairness and if you choose different cutoffs what you could do is you could choose a cutoff of 600 for Asians and then slide over to identify the point on the black people graph where it matches the same number of rejections which is about 4, 10, 4, 20 based on eyeballing it this is now individually unfair but it will give you the group fairness and you can't have both the other graph shows the default rate as a function of FICO score so the x-axis is FICO score and the y-axis is a non-default rate so we discover at a FICO score of 600 about 80% of Asians will repay alone whereas about 60% of blacks will repay alone so this shows that the FICO score is actually biased in favor of blacks one thing we could do is we could charge both groups a 43% interest rate and that will just allow us to break even so if we want to make a profit we have to up it to 45, 46 something like that this is individually fair but it's non-utilitarian because there's one group that's predictably just like blacks in this example they're going to predictably get more money out than they put in and the Asians are going to be putting more in than they get out on the flip side we could charge them different interest rates but now we're violating individual fairness but we're being more utilitarian like loans are being allocated more accurately and it's also violating the virtue of not noticing because we've noticed something that makes a lot of people uncomfortable like this is something we wish wasn't true but it does seem to be there in the data key point is there's no choice of cut off, no choice of interest rate which can satisfy all of our principles whatever we do something we're going to have to make some unpleasant choice so all we're left with from this analysis is some uncomfortable question how many bad loans should we issue in the interest of fairness how much individual fairness should we sacrifice like how much should I actively discriminate against one group in order to make the group treatment fair I don't have any answers for you in San Francisco they tend to prefer two of these principles and they tend to ignore the other two but the question is but I don't know if that's right so ultimately like this talk sort of comes out of the fact that over here I don't know what to do about fairness I kind of see the trade off but I don't know what Bangalore ethics are and this is sort of something I'm hoping I'm hoping to start a discussion here I'm hoping to find out what have people here help decide what Bangalore ethics are so that I can actually follow that's all Thanks Chris, that was very interesting I've never thought about things quite that way before we are up for lunch break unless somebody has a question we'll have two minutes we're going to have two very short questions or one long question I'm just curious why do you think your linear regression model generalizes to like or you are like linear models they are very different from very common models right so the basic idea is that linear models are able to find one type of pattern now in principle the reason one can also always imagine other kinds of patterns for instance you can imagine a bank manager who is biased against Gujaratis unless their income is above one lakh a month in which case he stops being biased in that way now that sort of bias is not something that a linear regression model would capture but that is something that a random parser or neural network would capture so the basic idea is that whatever the bias is looked like the model can learn the biases as long as the model has features that represent the biases so if the bias or the features you want to discover look like something a random parser is adapted to a random parser will match it because ultimately it's just a matter of finding the features that are there the key reason it's going to generalize is because these algorithms are trying to maximize accuracy they are not trying to maximize they are not trying to do what a human would do so what I'm assuming is that you've done your statistics well now that is not always true like there's a world out there and I don't believe currently our statistical models have captured everything the point is the ethical issues are not the issues of my algorithm is not accurate enough like here's the fact I've got simple people sitting over here some of them are on my team they come to me tomorrow and say I've made accuracy go up there's no ethical question here I'll just be like okay put it into production and then we make more money so the point is everyone's incentive are aligned to make accuracy go up so once you've made accuracy go up as much as you're able the trade-offs come into play so the point is we may not capture everything there may be biases that we can't detect but the point is whenever we whenever our models get good enough they will detect these things because these things help us predict the world better and that's ultimately what the model tries to optimize does that make sense hi could you throw some light on could you throw some light on how the regulations especially in the US because you have federal as well as state laws then there's an ending act how these are adapting to address biases in models here so that's a complicated question and the short answer is you have I believe 535 congresspeople who don't understand any math making broadly written laws that sound good this is then interpreted by a bunch of agencies who are more technical but have less leeway to make changes and then they essentially will try to they generally just sort of gesture in the direction of doing the right thing the answer is there's sort of some mix of both group rights and individual rights and you can never quite know in the US you can never really know if you're on the right side of the law I mean I'm not joking about this so once I was working on I was consulting with a project helping some guys copy some Python code over to Scala which by the way was not a good thing to do as a technical matter at least for this kind of statistical code so at some point I observed that I could improve their model by using certain traits which were correlated with ethnicity but were not ethnicity it was things like location so I went to them and I'm like hey guys I'm the consultant but I just noticed you can make your model much more accurate so then they told me oh but that would never pass regulators then I asked what the regulation was because I was hoping I could take my original idea and then do the maximization but subject to a constraint that satisfied whatever the regulator's demand so a constrained optimization problem instead of an unconstrained optimization problem but then they said yeah no one knows what that constraint is it's just sort of as long as you look good the regulators won't hurt you too hard unless you get on lock I think you have office hours today I think I believe they're right about now two to four I have written down so you have time for lunch maybe that's a place where you can get your question what are Bangalore ethics answered if anybody wants to go and talk to Chris on one ask some questions he'll be upstairs in room one from two to four and possibly available during lunchtime if you are hot to ask some questions thanks so much Chris before we break for lunch I have an announcement for anybody who's going to the UPI workshop this afternoon you will have received an email with a link to a form you need to fill that form in otherwise you won't be able to actually run the dummy account during the workshop so please do fill in that form if you haven't enjoy your lunch we'll be back here at two o'clock with a talk on data protection followed by a panel on regulation for innovation welcome back to Audi 2 I hope you all had a nice lunch this afternoon we have a talk and a panel before we get started I want to make two short announcements one is that Epicor is giving away a Kindle today so go over there and have your badge scanned it's just a lucky draw you want to win the Kindle and the other is that we don't have any signups for flash talks which means you're going to have to hear me sing and I wrote a song at lunchtime that is a Gregorian chant about bit points now I really don't want to have to sing it so I would very much like for some of you to sign up for flash talks you can see me at any time between now and 3.40 when the talks begin well with those announcements out of the way I'd like to introduce our next speaker who is old school and has no slides so that's kind of cool and definitely I believe he's the only person in the entire conference who's not using slides Sunil Abraham is the executive director of CIS when you're an executive director you don't use slides he's going to be talking about five different models of intermediaries in data protection do any of you read the Deccan Herald? okay you told me nobody would if you did you would have seen his article about this topic last month so if you want something to look at while he's speaking you just go ahead and see if that's online you can read along while he talks Sunil it's all yours thank you so it's a thousand word article in the Deccan Herald and the title of the article is data protection colon we can innovate comma leapfrog and all I'm really doing at this talk is taking you through the article with one modification the article has four models I'm going to introduce the fifth one which I left out when I wrote the article thank you for coming for this talk this is a policy talk not a technical talk and it's immediately after lunch with most policy talks we have the me go syndrome which is my eyes are glazing over and with the lunch demanding blood in your tummy your eyes are going to glaze over so my apologies for doing this to you I'm basically talking about privacy enhancing technologies and perhaps the best way to think about it is the introduction of digital cameras in Korea and Japan 20 years ago and with the introduction of the technology came the phenomena of upskirt photography and then you have lawmakers in both these countries respond to the social harm by requiring the principle of notice to be implemented in the digital camera so they said you must go out and make an MP3 recording of an analog shutter and every time the noiseless digital shutter moves you have to play the MP3 file of the manual shutter and that is the implementation of the principle of notice within a device and it is the requirement by law to turn it off or if the manufacturer gave you the option to turn it off that would be illegal in those two markets in India we see that legal innovation at play but we don't really know the 20 year history behind that so that is what we are dealing with privacy enhancing technologies and the unique proposal we are making at least in the Indian context is that even that about 27% of our population is illiterate and only 10% of the population can read and write English and even within that 10% of the population most of us are unfamiliar with legal vocabulary so therefore even though we know English we might read a privacy notice so we might read the terms of use and we may not understand its import completely so how much are we supposed to read my friend Pat Walsh looked at the video game Tetris and he found out that behind Tetris there exists 123 ad networks 13 online analytics companies 62 mobile advertising networks and 14 mobile analytics companies and if you put the privacy policies of all these corporations together which is what you are signing up when you sign up to play Tetris then it comes up to 4,7,000 words which compares with Lord of the Rings which is 4,50,000 words so it is not something that most of us are going to read and therefore in order to protect those of us who don't have the ability to read or cannot read in the right language or are unfamiliar with legal terminology the proposal in India from a variety of sources is that we should have intermediaries in the data protection regime Justice Sri Krishna and his committee after doing a series of open house discussions are now working on what this draft law should look like so it is a high probability that one of these ideas might enter the draft that Justice Sri Krishna produces so the first bunch of people that started thinking about intermediaries where the folk at iSpirit and when iSpirit thought about intermediaries they called them Consent Collector and the Depper team at iSpirit has published the specification for a Consent Collector what does iSpirit hope that there is a data consumer and the data provider so they are not really thinking about the data subject which is the individual they are thinking about a bank which is an institution that can provide data and they are thinking about a FinTech company that could potentially consume the data that is provided by the bank that is the the map that they are looking at if the data subject provides consent then the consent artifact can be collected by somebody called a Consent Collector in their view the Consent Collector can either be the bank which is the data provider or it can be the data consumer the Consent Collector could be the FinTech company as long as the Consent Collector collects the consent which has a particular data structure and can be represented in XML then those transactions are kosher and fine and that is the scheme that iSpirit proposed the first version and the iSpirit version is called Consent Collector you move on to the next bunch of people that take the iSpirit idea forward so the first implementation Consent Collector idea happens by the Reserve Bank of India and the Reserve Bank of India instead of calling them Consent Collector now calls them Account Aggregator there is a slightly different name and what RBI does is it publishes non banking financial company account aggregator directions that is the rule that RBI publishes which gives these entities legal foundation and this is published in September 2016 the schema is in these rules so it is identity, optional contact information, nature of the financial information request, purpose identity of the recipients if any URL address for notifications whenever the Consent artifact is used Consent artifact creation date, expiry date identity signature and digital signature of the account aggregator so each Consent artifact is doubly signed it is signed first by the data subject using the eSign infrastructure and then there is the second signature provided by the account aggregator and any other attribute that may be prescribed by the RBI that is like most employment contracts final clause which says that everything else is booked so this is interesting addition to the work that was already done in iSpirit how this is different from iSpirit is in the original iSpirit vision they didn't really think of the account aggregator actually holding on to your personal data so here there is some amount of personal data that financial information in particular that the account aggregator can hold on to again there is no prohibition who you can make money from or who can be an account aggregator but what RBI has done is they have introduced another key concept which is they have said that this should be a competitive oligopoly just like the telecom sector if you are unhappy with one telco there is a finite number of players in the market and you can churn and you can take your business to another telco so that's very much part of the RBI idea which wasn't there in the iSpirit idea as far as iSpirit was concerned you could have infinite number of consent collectors so that was the second version of the idea the third idea doesn't build on idea one and two it's an idea from a legal scholar based in Bangalore his name is Navi or Na Vijay Shankar he has a blog which is navi.org and you can see most of his research on this blog what Navi does is he builds upon the idea of an escrow agency in cryptography and I'm assuming some of you at least have followed the cryptography debates especially the first phase of the crypto war in the US escrow for people who talk about cryptography is always a bad idea but here this is not key escrow that we are discussing what we are discussing here is PI or personal information escrow so you give all your PI to the data trust your data trust again there can be infinite number of data trust and whenever the data controller whenever the fintech company the bank wants your personal information you instruct your data trust to give that information on to the data controller so that's the model so it's a real time system and in his proposal he believes that we should be firms with enough computing and storage power to be able to in real time process requests from the data subject to send data to the data controller so that is Navi's idea very interesting idea Navi says that there should be 3 requirements these data trusts must have public performance reviews so that people can choose the right data trust they want to deal with they should have audits by the regulator and an arms length relationship with data controller that means data controller they shouldn't be able to make money from the fintech company and they shouldn't be able to make money from the bank they should have some other revenue stream though Navi does not tell us exactly what that should be Navi sees them playing other roles as well such as translating privacy notices into local languages canada for example or just making them accessible and issuing tokens or pseudonymous identifiers these are all the roles that Navi sees for these data trusts so that's perhaps the most recently proposed idea because Navi did this a day before jashashree krishna came to Bangalore for his open house discussion an earlier idea that has been put together by the Thakshashila institution or published by the Thakshashila institution more accurately but authored by a Bangalore based lawyer called Rahul Matan who is the founder partner of one of India's most well known technology law firms Trilogy I'm not sure maybe they would like to characterize themselves differently but one of their one of the things they are known about or known of is their technology practice so Rahul is not so much concerned with the privacy harm that might emerge in the ecosystem he is looking very particularly at the discrimination harm that is what he is particularly worried about that big data and artificial intelligence can be used to discriminate against certain vulnerable populations so he thinks that learned intermediaries will be able to solve these discrimination harms by raising the amount of awareness that the customer has so it is very much like caveat emeter in many parts of regulation the government will not do anything the government will say all we expect the regulated parties to do for example tobacco company is to put warnings on their labels or food companies to tell you how much sodium or sugar is in their products and a knowledgeable customer will be able to choose in the marketplace so that is what Rahul is aiming at fixing according to his problem statement there is an information asymmetry and the best way to deal with the information asymmetry is to make these black boxes and these corporations more transparent the practice is more transparent so there are three stages of review for both big data and AI products the first is a database query review all of you are technologists I want you to think how feasible this might be the second are black box audits without knowing what is in the box you tested from outside and the third is algorithm review which for me was even harder to fully understand because there is many a slip between the algorithm and the code implementation the same algorithm could be implemented in many different ways algorithm gives us amount of abstraction which when you finally do the implementation you might have flexibility there so this is what he hopes will happen and he hopes that these intermediaries will be certified by the regulator so there will be a finite number of them not but anybody who meets the certification requirements will of course become learned intermediary so finally my own model which I have been cooking up at the center for internet in society building of the work done at iSpirit and what I am really doing is and the RBI really because that is one historical trajectory what I am trying to do is just make two fixes the first fix is I want to borrow from Nabi's idea that there should be an arms length distance so in my fix there will be a clear prohibition the consent collector or the account aggregator cannot make money from data controllers they can only make money from the data subject of the citizen that is fix number one and fix number two is what RBI has already done which is you have a competitive oligopoly you have only 50 consent brokers in the country and this I hope will solve the problem that the account aggregators face today so we have I think 18 or so account aggregators that have been given the license all of them are not sure at all what their revenue models should be and as far as I have heard as far as I have heard none of them have broken even none of them have revenue streams that they are happy with so with the consent broker we could potentially start off with the other ecosystem so there is direct benefits transfer to vulnerable populations it is basically a reinvention of our welfare state previously welfare was provided in products and services and now we are shifting to a regime where welfare will be provided as cash in your bank account directly put into your account using cashless mechanism so everybody that gets 100 rupees of welfare from the state they would have to necessarily give away 1 rupee to the consent broker so overnight the 50 consent brokers that exist in the market will all have revenue streams at least from the bottom of the pyramid because they are now dealing with these people as paying customers then they can start doing the innovation I'd like to see which I never hear at FinTech conferences and conversations usually the innovation at a FinTech conference is the innovation where a firm will make more money and that's why everybody is excited about these innovations I'm interested in the innovations that result in firms making less money that's the kind of innovation I'm interested in for example I have borrowed 12 years ago from a bank and I'm still paying my bank loan and I'm certain that my bank is gouging me as far as they can for various interest rates I have never met in my lifetime a single person who has taken a loan from a bank and is happy with the way the bank is treating this person so I would love if all the 5000 people who are upset with my bank in Bangalore come together thanks to our consent broker and the consent broker on my behalf and on the behalf of the 5000 or 10,000 people agreed customers of this bank what the bank can say we want the historical interest rates if you ask your bank to give you this piece of information which is directly connected to what you're doing it's very difficult to get this information what was the interest rate at each point across the 12 years of paying the interest back to the bank and then the banks can say we noticed that the bank is treating the following customers badly we can as a block take your business to another bank so it's raising the collective negotiating power of the consumer so I believe there can be a whole range of innovations that are possible if the intermediary thanks to their bottom line has to first pledge their allegiance to the data subject and not to the data controllers so that is how I'm trying to reorganize the incentives within the proposal that iSpirit and the RBI have made the incentives work to ensure revenue streams for these intermediaries and so on so that is my final addition there are some other proposals that people at internet democracy project there is a woman in Bangalore called Nayantara she's at least at the Shri Krishna Justice Shri Krishna committee meeting she made a proposal that we should have collective redressal systems so the scenario that she's painting is there is a bunch of citizens that have been wrong either discrimination harms or privacy harms and once they have been wronged they should be able to approach the regulator or the court as a collective and then get redressed for their for the harms that they have suffered when we introduce an intermediary it's not a post factor measure really they're not trying to deal with the problems after they've happened with an intermediary what is really going on is you're trying to empower the customer or the citizen on a daily basis so suppose there is a particular data controller and they have managed to compromise your accounts then a consent broker should be able to proactively protect my interest by requesting for my data to be deleted or my account credentials to be changed and so on so that is the vision that we have why is it that we are talking of such strange ideas in India because we have an advantage unlike the European Union which has a 37 year history behind its data protection regime from its very first data protection law we are starting with what you could call tabula rasa or blank slate so therefore there is an opportunity to leapfrog ideally what we need as a nation is a data protection regime that is considered adequate by the regulators in the European Union but the European Union has gotten there through some really heavy and onerous regulation that type of onerous regulation may be inappropriate in a jurisdiction where data protection regulation has just begun so therefore there are some creative approaches that we should explore here what I would call regulatory innovations because as long as we can demonstrate to the European regulators that in spite of taking a different route the customer has similar protections or the data subject has similar protections I am almost certain that the European regulators will consider us data adequate and then the trade in personal information personal information flowing from Europe to Indian BPO's KPO's and other types of ITES organizations will continue so that's the goal to take a different path than the path taken in the European Union so that's my talk I think I'm even shorter than what I thought I would take my apologies but this is perhaps an opportunity for you to ask any questions that can be connected to intermediaries and if you don't have questions I'm also happy to get out of your way looks like we already have some questions Hi Suryanth so you mentioned the EU if you look at the general data protection regulations what do you think are the main challenges India will face implementing something that's close to what the EU has in mind which is I believe coming into force in a few months that's a big question I think the best way to respond to your question is again to go back to the historical trajectory that I drew they have 37 years of history so when they decide to take punitive measures against data controllers the data controllers have had 37 years to be prepared for those punitive measures so big fines etc are wholly justified in that jurisdiction in India we've had almost no data protection law we've had 43A of the IT Act which is really data security law which was doubling up as our data protection law and therefore most data controllers in India have no experience of being under the regulatory hammer if we start from day one with all the teeth that the European regulator has investigations, audits corrections to design and so on the and fines etc the trouble is the regulator will get overwhelmed because immediately anybody who has any punitive action from the regulator will start to go through the appeals process and that always will get the regulator in trouble so what I have also proposed and what we have proposed in our submission to the committees that they should have something called an orchestrated sunrise so for the first one or two years of the regulation they must be merely awareness raising activities and then followed by certain incentives then nudges to these firms asking them to shift in the right direction encouraging them to come up with bottom-up standards which in the European market has greater maturity bottom-up self-regulation standards that have entered a co-regulatory regime so that we should give each sector the fintech sector must be given time to come up with its bottom-up security standards, privacy standards and so on and only five years from now should the first punitive action by the regulator be taken because only then will we have a sustainable long-term life for the regulator if the regulator uses all its firepower too early we might just end up with a dysfunctional regulator because everybody will go out to get the regulator so look at the competition commission today and google that took some time commission to actually enter that space and carefully and I haven't read the order yet but I hope it's a good one yes so I have a quick question about so you mentioned this proposal about these data brokers not being able to make money of companies so one quick that I had about it is the fact that the guys who are a data agent or a broker that you're talking about the incentive for them to be able to make more money from by selling of this data to other companies is significantly higher than probably the money that many of these people the data subjects would probably pay them because most people don't really realize the value of the data in nominal terms in reality second is the other one is that so do you think it would make probably more sense especially with the way with the way profiling works generally or with the way big data is this one is that when you have larger heaps of data sets drawn from multiple sources that is far more powerful than having smaller data chunks so do you think it would be wise for these data brokers to be limited to very certain sectors or maybe certain number of people that they can probably deal with sorry sorry I forgot to explain one other key part of my fix my apology I want only a one on one relationship between a data broker and a data subject so let's go back to the iSpirit vision of account aggregators so you have insurance portal that helps you get the best from multiple insurance companies you have a education portal that helps you get admission in the right university for the best price and so on and so forth so each of these portals could potentially be account aggregators or consent collectors in the iSpirit vocabulary and what I saw the problem there is one you will lose track of how many consent collectors or account aggregators you are dealing with so what I wanted as part of the fix the third fix which I didn't mention is that there should be only one on one relationship that at any given point of time as a citizen you can have only one consent broker so whenever you want to solve your problems you go only to one person they will solve your problems across all so the point you are making is absolutely valid the bigger part of money lies elsewhere and the bigger part of money lies elsewhere in many other types of transactions as well so suppose you are my wealth management advisor then the bigger part of money lies on the other side from the funds in which you are putting your wealth in the Netherlands for example if you want to be a wealth management advisor you cannot make money from those institutions where you advise people to invest you can only make money from the investor so obviously if the market is unregulated people will just choose economic behavior that suits the bottom line and then you may not protect the rights of citizens if the proposal is being introduced to protect the rights of citizens then we have an alternative business model for them maybe if there are 50 companies they will only make 2 or 3 million dollars a year maybe that is all their revenues are but I know funds of SMEs in Bangalore they had those kind of revenues and as they take it up the next notch with helping you renegotiate loans or get better deals from other types of data controllers they could get additional revenues so it is not a vision where the data brokers or consent brokers have massive revenues like the data giants it is a different vision and therefore with different expectation levels I hope the response makes some sense what do you think about the other the fact that if you think it makes sense to limit a data worker to only a no because I want a one is one relationship it should not matter who I am having the problem with whenever I need my right to privacy defended I call only one number from a usability perspective it is a much simpler proposal and then if my consent collector treats me badly then I churn and I hurt the consent collector or broker by taking my business to the competition so we need competition also to work within that scheme otherwise again the incentives are wrong hello hi my name is Amul I am from Cuts so you talk about collective action from consumers what do you think that this is possible now because the company is at 2013 talks about for the first time last section suits and as I was reading the provision section 245 says that depositors in a company are authorized to 5 class section suits if they can come together so have you thought about implementability of your proposal so again the proposal all 5 proposals they do not envisage a world with class action suits a look in the audience a look will be the best person to comment here as far as I understand as a non lawyer the history in India for damages and class action is nonexistent so to have class action especially where the harm has no financial component your HIV AIDS status was in a database the database is breached the only harm is to your reputation there is no financial dimension to the harm then courts maybe consumer courts have acted differently but regular courts apparently there is no history of this so instead of trying and again what I am worried about is if everything has to go to the regulator and if everything has to go to court what we will have is a distributed denial of service attack on the regulator and on the courts that is what we really have in India so to avoid that we want the market to punish data controllers that do not behave properly and for the privacy needs of data subject to be articulated through these intermediaries maybe the data subject is not as hawkish about their privacy as people like me believe so then these intermediaries they can reflect that position that is what I am hoping so I am fully unfamiliar with the section of law that you just quoted though I only focus on I think look here we may have run out of time though very very very quickly just on the point of class action class action requires a certain set of procedural rules it is not just about allowing 1% of file on behalf of like 100, 500 or 1000 we do not have those procedural rules in India and I do not think it can be put in place only for case-independent privacy unless our general civil procedure reforms class action is not a thing in India for a moment but to just come back to what I had sort of thought and I actually just before coming here I read that competition commission Google judgment it is actually a data protection judgment Google has been held to be in violation of the competition act for using its search engine to collect data in a manner that it can squelch any rival possible so even though they accept I just realized and I thought I just point this out that at some point even if you have a one to one and that is the thing that the competition commission points out even if you have a one to one relationship with the data broker because Google is a search engine it will have a relationship with all of them so for instance if I search on maps I will get to Google maps if I search for flights I will get to Google flights in that way Google perhaps poses a kind of challenge or maybe Facebook does possibly this particular model is sort of what I just wanted to see the what the competition commission has done right is it has not looked purely at the question of at the question of maximization of consumer welfare right and it is not trying to look at other tests that have evolved in competition law like predatory pricing and so on that what I am saying is there is this common infrastructure that multiple advertisers are using and because this is common infrastructure it should abide with common career obligations I do not know if they actually used that type of language at all because that is what American competition law is going towards so that is why vertical integration becomes a problem and here the vertical integration is compounded by the PI that they are able to harvest so that is so even though it looks like data protection order I still feel that where competition commission decided to act is because of the harm that those actions are doing to competition I am hoping at least that if there is a bunch of children that have grown up and their parents have uploaded their photographs on Facebook without their consent then one of the consent brokers in order to get more market from the young people will say if you come to us we will go and make sure that Google deletes all the pictures that your parents have uploaded of you you know so all sorts of value added services will emerge where the power of Facebook Google could be tempered but you are absolutely right the reason why we need the hard law and the regulator is because those kind of transnational giants will be unresponsive to this kind of collective action through intermediaries so therefore we do need but for everyday punishing of one factor we should not have to go to courts and regulators to propose yes sir hi so just a quick query on your perspective on things so currently for the telecom industry the regulators like department of telecom and tri they are not fully independent from the clutches of the executive regime like the government you have appellate authorities on top of them so at least pay them off and then you have the judiciary coming on top what is your perspective on where the regulatory position should be and how independent they should be from the executive clutches because currently we see that our own current government is mostly targeting towards you know a position towards privacy and they say it's a statutory right and not a fundamental right they actually filed an effort of it and which triggered the whole commotion here so what is your personal perspective should the government and rightful should these regulators be and who should they be reporting to actually on our submission we ducked those questions because we haven't spent a lot of time on regulatory design if there was anybody here from NIPFP they would have given a full answer to your question I am looking at when he took to see in their response they commented did you all comment on regulatory design at all somebody give the lady a microphone please is this better so in terms of the regulatory design that we proposed we believe that there should be sufficient dialogue between the regulated entity and the regulator fourth incident and sorry pre-incidence and fourth incident also there should be a set of rules we come from a financial sector perspective and there have been draft laws and the FSLRC which has actually set out proper procedures as to how investigations should happen and how cases should be escalated and I think we have sufficient guidance existing in the Indian jurisdiction that can guide us when it comes to escalation of regulatory standards itself but generally we are more pro responsive regulatory kind of posture where you have all the enforcement tools available to the regulator beginning from collaborations to punishment and penalty so I think the board elements that you are looking for is one appointment how are these regulators appointed the second is what their what the provisions in law are that guarantee their autonomy or independence that is perhaps the second element that has to be actually configured their revenue streams how they because if you do not have money you cannot be autonomous or independent so where do they get money and how much money do they get so that is another aspect that you might want to focus on we have not thought about all of that very carefully so we did not do any of that the other thing is really try if perhaps the gold standard for regulation the development of regulation at least so when the regulator the privacy regulator privacy commissioner decides to issue sectoral rules or bless a fintech privacy standard that has emerged from a self regulatory organization at that point consultation paper submissions uploading the submissions to the website inviting counter submissions organizing open house discussions then giving the final regulation with a reason the arguments why certain submissions were ignored and other submissions were accepted you understand so then the regulator has to demonstrate almost in a public fashion why they are taking one regulatory option over the other and you can see the regulated entities and non-regulated entities what views they are presenting so you get a sense of how conflicted the regulator is when they are regulating a particular industry so but the kind of holy grail we will never have 100% independent autonomous regulators it depends on the personality of the gentleman or woman that has been given the job so I think it is a work in progress there is no secret sauce that you can put in the law and say here now you have an autonomous and independent regulator just to add a comment on what you said and by the way I am from NITFP oh please sir you should explain your submission I guess there is a secret sauce and yes so one of the things which we do not understand or we have not yet come to grips with India is the balance of independence and accountability and the distinction between the two and that is where things get murky so any question on the regulator sometimes it is treated as a question on the independence whereas it is really about the accountability putting that balance is what is one of the pillar of regulation design is and the FSLRC report is one of the works which sort of has put out a draft model law which is has its genesis in the financial sector any increasingly that anybody who is interested in lawmaking can take pieces of that and implement across sectors and actually it is happening in some way or the other for instance in the banking side like UCHD amendments related to the monetary policy committee there is a bit of accountability that has come in which is fairly new as far as the law related to banking are concerned maybe it is not enough thank you so much think that is the end of the question are there any questions we still have four minutes ask a question or I will get on stage Mark Person actually I am Ramesh actually you had told that we have problems with banks and interest rates all those things actually we have come up with the idea how we can work on this and for this there may be some requirement of some regulation that we need somebody to review and get us approval I will show you this particular material I have and maybe later on you can help us yes ma'am ma'am sorry just wanted to get your perspective here so how would you characterize the trade-off that say China has made in terms of filling a distribution gap when it comes to core access to services and especially in financial services with the kind of data aggregation consent issues that they did the trade-off between which competing imperatives so the imperative of access to basic services which is effectively what India is debating today right in justifying certain breaches on security and privacy with what they were able to achieve in terms of solving a distribution gap which certain two or three internet companies you can argue took that proactive and went far with it but how would you kind of make that comparison with India what is your view of perspective so I am not totally sure if you have two questions there maybe one of the questions has to do with the protectionist stance that China took to ensure that domestic giants arose which didn't happen in many other geographies I mean if I were to answer that question purely from my training that sounds like a bad idea but in retrospect you are always wiser in hindsight it looks like China did the right thing protectionist to some degree so that is perhaps part of the question the second question is in a polity like China the citizens were used to that level of coercion by the state and therefore maybe citizens see that trade-off as an acceptable trade-off in India it's a very different world and Indians are not used to be coerced by the state like that so all we really need to do is ensure different types of access to the very same services if possible so if there is a fintech company and they are willing to loan to me at 1% higher just because I am not willing to give the data I should basically have that choice that is the point I am making and if the legal framework allows for such choices to emerge then it is fine that many other people decide to give large amounts of personal data in order to get access to cheap credit so I think it's a trade-off that individual customers should make rather than the nation state and it is the opportunity really once there is a choice for a variety of business models to emerge so why does WhatsApp have customers because the USP in WhatsApp is that the payload is end to end encrypted so similarly in financial services if I don't know if everybody knows I mean in Karnataka there is this idea of dodmane chikmane that means if I have two wives first wife is in the dodmane and my chikmane is for the small wife so suppose there is a bank that is willing to give me a service that allow to mask all my transactions in the chikmane the privacy enhancing service then I am sure customers will be there for that particular type of service so the vision that we seem to have is perhaps homogenized because we don't have wiggled room in the regulation ideally when we have the regulation there should be enough wiggled room for a variety of creative business models apologies if that was not very politically correct I think we are out of time that was fantastic you guys sustained a 25 minute Q&A which means you are probably awake and ready for our panel I am going to ask the my grinders to bring down some chairs and get the panel to come up so we can get their microphones to them and I want to make sure you truly are awake so stand up please you know I love making you move we are going to play a movement game called 5 4 3 2 1 so we are going to do 5 motions and then 4 and then 3 and then 2 and then 1 and it is going to speed up as we go so we are going to start really slow so that you can get the motions the first motion is 5 jumps so in place 1 2 3 4 5 that is not so hard right the next one is 4 waves 1 2 3 4 and then we are going to move our hips 1 2 then we are going to punch the person in front of us 1 and then we are going to turn around 1 alright do you remember that 5 is 4 is 3 2 1 so we are going to do it a little faster now we are not going to stop, I will count the numbers you guys do the motions 5 I think you guys can go faster ready 5 that is probably enough our chairs are here our panelists are over there you guys ready to come up? come on up the panel isn't quite like a bop like we did yesterday where it is open free discussion the panelists are going to have things to say you can ask questions this is live streamed so please make sure you have a microphone before you ask a question thank you Tink earlier in the day Tink and I we had no way that I don't really enjoy running panels which is that I will give the introduction to all my panelists that's purely in the interest of editorial choices had to be made because we have a lot of meat on the panel so quickly my innovation and it's interesting that who can be resolved and should be resolved as finance is more human right and it's interesting for someone who has been an economist all her life to come into a room full of techies and pretend that she gets half of it the reason that I am doing all of this is because financial space is now increasingly getting tech led way we have seen it happening all along actually that's the point we as consumers haven't really interacted with technology until very recently it was something that banks did in their backyards that kept the system going there was some reporting that was happening to the regulators but as consumers our interfaces were usually managers people whom they had come to know and trust and that's what the mediation really was but increasingly there is a disintermediation of banking services as the court goes much of banking is happening outside of banks today more and more technology led companies are providing efficient solutions which are reducing transaction costs which are helping scaling up the delivery of financial services as well as also impacting the distribution of finance itself many people who were formerly excluded can now get credit even if they don't have sufficient financial history or records simply because alternative lending is now happening and is now bringing the excluded into the regulatory perimeter as well as the perimeter of formal finance a lot of both on the regulator's end because now financial regulators have to regulate technology in a way that they never have and there is also a lot of unfamiliarity end of entities a they don't know if they are regulated or not and b should they be regulated or not and how should a financial regulator respond to someone who is driving on algorithms who is providing payment systems is really not a part of the risks of the payment system but is a crucial gateway so there is this warming up that still needs to happen and many of the regulatory stances which earlier accounted only for financial risks now also have to account for the impact it may have on innovation and therefore the panel today Regulation for Innovation I actually am in the company of giants as I understand so I have with me Amol Kulkarni he is from Cuts, Cuts are consumer unity and trust society they work on the issues of consumer protection with a special focus on competition and the adverse impact when markets are inadequately competitive I hope I have done justice I have with me also Ashish Agarwal from NIPFP thanks to Sunil we all know NIPFP now so particular interest to this audience I think is Ashish was also one of the big contributors to the VATAL committee and we will pick his brains as we go along on the visions and implementation of VATAL as well I also have with me Rohit who is basically a payment service provider into the application of social payments and he is the provider on the panel therefore his views are going to be very interesting I have already overshot my time so I will hurry up so before I actually begin about what regulation has looked like, what it should look like, what are the big barriers I just want to start with asking what should be the principles for a financial sector regulator are there any core non-negotiables that each financial sector regulator has to look out for regardless of the entity that they are regulating and I think Amol we will start with you we will start with you, what do you think should guide a regulator generally and more so a financial sector regulator I think I am audible ok thank you for that introduction and for keeping of the panel so beautifully I think the question that you have posed is right at the heart of how policy making and regulation should happen while you have talked about or you in your question have mentioned regulation I think we should ask we should take a step back and look at the policy or the law itself before talking about regulation just for clarity purposes a policy or a law is made by the parliament regulation is a delegated legislation so to speak and is made by the regulator so a regulation by RBI would be a regulation per se but a payments and system settlement act or some act would be a law and a policy would be say national compensation policy or some other policy while some policies would be framed at the regulator level itself so it should be the basic principles or the first principles of law making or regulation I think we can start from where Sunil had left in his last panel while he talked about the construction of regulator and who should man the regulator it is also important to think about not only why what should the law look like or what should the regulation look like the first question is why there is a need for law or why there is a need for regulation so therefore what we are essentially asking is that what is the problem that is being targeted as what is the defining the problem is most crucial aspect of starting with law making or starting with regulation making if there is lack of financial access if we want to have financial inclusion or if delivery of basic services is not happening through modes which is which it is envisaged currently the problem is what is wrong with the current system and perhaps not what could a new system will look like so the first question is what is the problem that we are trying to solve the second question when we are clear about the problem and when we have defined the problem I think the most important question is what are the possible mechanisms to solve the problem and are these the cost of these mechanisms outweighed by the benefits of these Amul can I request you to hold that thought Ashish so what really determines if there should be an intervention either legislative or regulatory one one feature of the payments market is the network effect right so if you allow the network effects to kick in such a manner that you end up with monopolies in certain manner then that's not going to be official another thing which is not peculiar to financial services is the fact that there is information asymmetry in many markets and you have that in the banking and payments market also so you need to intervene then consumer protection is the purpose all laws are made competition is also a subset of consumer protection so essentially it boils down to this another thing unique about payments is that the faster and better and the efficient payments for them to move it depends on the payment systems on which they ride on and I am talking about payment systems like the RTGS and EFT and so on and so forth therefore how do you make sure that these are running to the optimum level is an important consideration so this is the basic problem and if you permit can I talk about the existing situation actually I just want to weigh in one question so coming back to Amol's point is financial inclusion a cause enough for regulation okay as I think we should not mix up purposes so regulation is an independent function which has to be done for the market failures which exist or market failures which should not result in various kinds of problems now development is a great goal and agenda we should have development but that's not a regulator's agenda that's not the industry's agenda so the development is a state agenda so when state when the government wants to do development they should do so and that should happen in such a manner that the provider of those services are able to be paid for those services so ideally a market led development model is a good model otherwise what you end up doing is that you mix up regulation and development and then you have a kind of a murky world where you don't really know whether we are having efficient and effective outcomes and we can go in detail but that's Rohit coming to you as a service provider do you see the role of a regulator as that of a developer of a market Rashi I think I agree with you on the front that you mentioned mostly what we have seen again being a fintech founder the industry that we have seen and the way industry is evolving has evolved in the past and is evolving at the present financial inclusion or even in general market development and reaching out to the masses is unstoppable like it's not the role of the regulator to do financial inclusion that's the way I see it and I have very strong views on these on these fronts the way I see it I think technology in itself is such a powerful force that there's no way you can stop financial inclusion from happening no way the only thing is you can probably delay it for sure and actually regulations might actually end up delaying it if the regulations are not suitable for that market so I think financial inclusion or market development will happen no matter what irrespective of whatever regulations we have the regulations might end up delaying or speeding it for sure but they won't stop coming back to the point of regulation can either delay or encourage a market so what are the current mechanisms that we have for regulation and how do you think they are playing out so I think you have made a very important point that yes regulations can actually delay achieving regulatory outcomes and I think that is what is happening to a large extent currently as we see payments regulation it is it has been largely a bank-led model and the genesis of this is because banks for a very long period of time have been a provider of a store value as well as payments and credit so all the functions were into one entity and if you thought of bank you thought of everything which is good financial system but as you pointed out that now we are looking at this demodularization of financial services deposit is a different entity different activity payments or transferring money is a different activity and credit is a different activity so perhaps because of legacy issues regulator has not been able to come out of its original mold of bank being good for the society non-banks or other players which are not regulated at the level of banks are not regulated properly so they are still stuck with their old mold of entity-led regulation rather than looking at the brave new world of activity based or risk based regulation. is that there is a bias towards regulating institutions versus regulating functions so maybe there should be a higher and higher move towards functional regulation. Does the current landscape actually show any signs of functional regulation are we missing some big points or what are the big lacunae in the current regulatory landscape? let's take a step back you guys are all technical people right so but I am still going to ask this question how many of you have read the PSS Act or ever opened it and browsed through it the payment and settlement system act? so it has all of less than 40 sections it's a thin book just like this so I think it's important we should look at the law and if you the law came in 2007 this is the first law in India which set up the ground for a payment regulation specifically now what did this law intend to do it intended to just achieve three main things one it gave a legal basis for settlement and netting procedures which are otherwise coming out through some procedures guidelines of RBI so legal second it provided a legal basis for regulation of non-bank entities because RBI was a banking regulator so it did not really have a mandate for non-bank so that was the second purpose the third purpose it provided a legal basis for regulation of clearing houses and setting a ground for regulation of NPCI because again a non-bank entity these were the three things now if you think of a payments law and we think of broadly these three things of course it has 30 or sections and there are other items so one immediate assertion is that this is a very basic foundation so it's like okay let's get going let's put something together so that is great now we have something sitting in 2017 and 18 10 years so we have passed not just 10 years but in terms of technology I think we have leapfrog generation and sitting in 2018 this does not work so we need to reimagine this second when you think of the regulator RBI so now RBI juggles many stuff so RBI is the regulator it is also the settlement institution it is also the payment system operator and it is also a participant it also runs the government business of monetary policy so when you are doing all this then obviously payment is one of the things but then it is just one of the things and also your main incentive is about protecting the financial stability and making sure that the monetary policy is well carried now that at times is that conflict with the essential requirement of payments which is how do you speed up payments how do you make it more innovative so that is where I think the basic landscape sits thank you so two broad points that the PSSA the law itself needs to be reimagined so currently as I would understand most fintech and in fact I should give a shout out here so the Sudarshan Sen committee report for those of us who are in research it is an inter banking regulatory report not inter banking I am sorry inter sectoral regulatory report that brought down all sectors of the financial sector financial regulators the insurance regulator pension regulator SEBI and of course the RBI to see how digital services can actually be kind of encouraged in what are the regulatory barriers right now so the Sudarshan Sen committee report actually says that going by the definition of payment systems most fintech would actually fall out of the ambit of the law currently so is there a need should we just regulate them for the sake of regulating them or what are the points or the functions that they perform that they need regulation to kind of keep the system going exactly so what is the risk that we are trying to regulate so there are broadly 3-4 kinds of risk one is the risk of anti-money laundering terror financing that is one kind of a risk then there is a risk of operational risk or technology risk you know and should not blow up in transit there is a fit and proper risk I should not run away with somebody's money so these are various kinds of risk now who can run away with the money one who has your money but if I am not having your money then I cannot run away with your money therefore that is not the regulation you want to burden me with so if you put this on x-axis and y-axis and then come to a kind of a fair balance you can come up with the risk which you want to regulate but the current pss act it has a kind of an omnibus definition of payment system so practically anything can be part of the payment system and practically anything could also not be part of the payment system so what you want to do is you want to be little more clear on what kind of services you are trying to regulate and then put those risk in context and accordingly have a risk based regulation like amul initially mentioned so amul do you have so there are several examples at present which defy the logic of regulation or the logic of risk based regulation perhaps I can give some examples and then also talk a little bit about how things should be taking from where Ashish has said so for instance let's start with pss act pss act has a section which says that only banks can own settlement agency and all public sector banks should have at least 51% and that is why npci is owned by banks and all public sector banks have more than 50% now npci should in an ideal world be a platform to at which non-banks can directly link up and it is just a payment platform which is facilitating payments from point A to point B it should not matter whether a banking linking up to it or a non-banking is linking up to it which is technically known as interoperability which is also a problem at present and a non-bank has to because of this problem in pss act has to link through a non-bank to link to npci for ensuring that payments happen so this is an even playing field between banks and non-banks when we think about payments and despite both of them bank payment provider or a non-bank payment provider running with the same risk providing same services performing same functions but treated differently and banks being unfairly given unfair advantage as compared to non-banks is it unfair though because banks also undergo a prudential regulation which many payments so do you think exactly so the question is not whether non-bank should go through prudential regulation are they providing some functions which are worthy of being prudentially regulated that is what has ashish pointed out if banks are providing some functions which are worthy of being prudentially regulated they should be but to the extent they are providing payment related services the risk which is to be regulated to the extent payment services are provided basically identity and authentication risk only to that extent non-bank should be also subject to regulation you are actually maneuvering the space as a provider so what are your big kind of takeaways from the current regulatory landscape what's working what needs to be done better so I think what NPCI and even RBI has done well to some extent is regulating the P2P landscape and so we are predominantly in the P2P space so that is where I have most insight so in the P2P space you know like back in the day when wallets came around PATMs and mobile clicks and likes people used to think now we have solved the P2P problem now we can just upload money into a wallet and boom it's P2P what people did not realize and still don't realize many of them that wallets were not meant for P2P wallets actually came around for remittance functions even though remittance is sort of you know one very small sector of P2P the broad P2P that is happening right now is just friends and colleagues and all those people sharing amongst each other casually or friends giving each other loans and all that and then of course the most sophisticated P2P lending sector which is coming up the wallets were actually meant for remittance it's just that they modified it for an urban use case using recharge as a hook and then you know got the people on for other services and that's where RBI and these people have to jump in hold on it's like you were not meant for this purpose we need to regulate the space something weird is happening and of course when the limits around came around so I think that has been a good timing from RBI's and MPCI's point of view for purely for P2P regulation and that is working well so now wallets have sort of shunk away into a relish which they were always meant to be because you know like if we speak about if we compare them to generations of beings they were the amphibians while they were reptiles behind them and now they mammals are coming out so the amphibians will not stay for long and they will always vanish away so that's for the P2P regulations but I think in general especially given what I'm also saying that you know giving access to non banks through NPCI or even other service providers that is something that the government is still lacking on and I think we can discuss that on length in detail how the UK providers like us or other companies as well have been slowed to some extent even though we have managed because of our hustling start of nature but we have still been slowed to some extent just because of these regulations and not getting access to NPCI or such services because of not being a bank Ashish, I see you have an interest yeah so do you know in early days when RBI was up even individuals could have accounts with RBI directly and those checks were treated with greater value than non RBI checks so that's the ultimate of access to banking so in my head there is no fundamental problem with an entity having why not Ashish having an account with RBI okay I may not need it that's a different matter what's the risk we are trying to solve so there are two risks right or one risk the settlement risk so settlement risk predominantly is a risk of payment not going through now in a gross settlement that risk is practically zero because I have my money with RBI I am transmitting that money to Amul and RBI can see my money sitting in its accounts and it will transmit it so there is practically zero settlement risk in a netting system there is more of a risk because the transactions are cleared on a net basis so if something happens then you need to take care so you have the settlement guarantee funds to take care of it also in 80s it was not very efficient to make all transactions go on a gross basis because technology was expensive so you came up with this nice idea of netting it why do you route the same money five times when you can net it out but sitting in 2018 I think computing cost of trash we can even think of routing more payments on a gross system so in effect I don't see a great risk in opening up access as long as the fit and proper criterias are met and if that being so then what's the problem and on that I just want to highlight one point see one thing which has changed is the business model why are we talking about payments outside of banks earlier there was no business model of payments outside banks so what's the traditional model so I am a vendor I supply raw material to a bank which is my savings account now the bank takes that and gives it to a person as a loan so he makes a sale and that's where it earns a net margin now that's the business model of banking so I am the supplier and customer is actually somewhere else now in a payment ecosystem the business model is again the same similar I supply raw material the money goes into a wallet or something and then instead of lending it I am using it for e-commerce and make you shop, make you do transactions and that's the model and that's where I earn my money now the incentives are different in the first model one of my incentive is to slow the money so I want float in the system because I am lending it in the second system I want to speed up the money because if you can't spend your money when you want it and you can do it quickly you are not going to put your money there so I think that's the business model which has changed and which has permitted non-banks to come in and do a business around payments and this is what the law needs to recognize and I think that's the move forward as a service provider I am sure this is not your business model though but it's very close so why don't you take us through what you do and then we will have set of questions around it we started as being more of a B2C company though now our focus is 90% shifted to B2B side we primarily started by helping people collect money amongst each other more like group payments for specific use cases like events, movies, parties and those kinds of things it's a very fun friendly app and diverting away from the boring gambit of payments because this is like a known fact that nobody likes to pay cash out or give it to someone else payment is painful and even asking friends for money is painful and it's awkward so the idea was that how can we make it fun and we saw a couple of models working in the US and the West as well with Venmo and VChat we realized we need to do something different here because this is India it's more like a hybrid of the West and China the way I see it so that's how we came out with our consumer app so we started with group payments we went into P2P over UPI UPI has been a strong base as the backbone and recently we started provisioning out these individual solutions so individual parts of the individual parts of the app as APIs and microservices to other vendors and businesses SMEs, corporates whole bunch of stuff so that has been the journey what would this look like without UPI yeah I think without UPI I would say we won't have 90% of our business and because we based our business solely on this thing and we realized very early on that UPI has to be the future the way it was being designed at that time and wallets as I mentioned were just passing by waving at us and so yeah so we could have made a hybrid app or hybrid business which was doing so so not so good just using wallets or PPI's which were like intermediaries but if we did not have UPI the real business that we have right now not just monetarily but more in terms of the impact that we are having would not have been good and I guess this is also true for many payment apps and other business models that are solely kind of leveraging UPI yeah absolutely I mean if you are leveraging UPI I mean the way I see it UPI gives you ultimate freedom in terms of banking access to a person so I think the person also feels very powerful this is something that people don't realize initially they actually feel like sort of afraid when they are not aware of the whole litigies or even just how to use it they feel afraid that an app has access to a bank account what does that mean and all that stuff but what they don't realize is that you own the app you own the device so as long as you are in control you should be powerful and they are giving power back to consumers that's the way I see it so what are its unique vulnerabilities allegiance to devices is one right right so I think that's actually yeah they are always closing cons of any any direction that you take so given that it's linked to uniquely to your device so that's the benefit that nobody else can use it but then if you use your device then there is a high potential risk even then there is a second factor authentication which comes in which is your MPIN which ideally people should not reveal and they should not even keep it same as ATMPIN which is again an education part people think of UPMPIN as an ATMPIN people think of debit card as an ATM card like 80% of people use debit cards for ATM cards that's it no other use case so you know that shows you there is like a lack of education which is a big problem not the security not the security okay so as I understand most payment providers are they currently regulated do they fit into the payment systems or are you regulated by the third party guidelines of the bank yeah so mostly depending on what infrastructure you are using so if you are using UPI then definitely you come under the bank guidelines NPCA guidelines and the way RBI structured the whole UPI as an infrastructure so those guidelines need to be followed so those are predominantly well as I said UPI as an infrastructure is pretty well designed like I think there was a recent article as well by Wharton if I'm not wrong how UPI is literally like breaking literally breaking leaks and bounds in terms of the whole world not just India no way in the world can we do instant bank transfers from one bank to another bank 24x7 free of course and you know using just one single switch so no way in the world so yeah so I think those guidelines are there for us but depending on again your infrastructure so there are some companies that use white label PPI solutions, white label wallets from banks then they come under the PPI guidelines if you are just using you know pool account or nodal account so those things then you come under DMT which is the best money transfer guidelines so yeah depending on those infrastructure there is a set of guidelines that you will come under so clearly UPI has been revolutionary Ashish what's your take on the revolution of UPI we only know how good we are when we compete right I'll always win the race if I am the single guy running and I don't say it in a I don't mean to take it lightly in fact I completely agree with you in terms of just having a 24x7 payment system IMPS and UPI is revolutionary in fact when we look at the laws in many other countries which are maybe far superior to Indian law they still don't have the systems that we have managed to develop and that gives us confidence US is so complicated because of their legacy systems we have to fix things it's going to take them a lot of time to make payments in US it's actually not so easy even within Europe it's not so easy to do payments while they have the EU and things so in that sense I think we are really making a lot of progress but I think there is a lot we can do and for instance I was just putting down some questions and these are all wise so why do we not have a zero KYC low value digital card which is equivalent of cash and which I can cash in anywhere in the world I can go to a grocery shop and cash in and when I want to exit that card I surrender it and I get my money back it happens in South Korea I use it so I think it easy is a lot of things why is it so difficult to do an outward foreign remittance I had to transfer 70 euros and it was a struggle unless I decided to go to a bank branch and actually get it done why does RTGS system go back home at 6.30 or 8 in the evening and takes weekends off it's a software it should run 24 by 7 public holidays also what's the risk in allowing the non banks to access RTGS directly I just quickly complete there are more than 26,000 NBFCs in India we started in 1960s why can't complaints against NBFCs be filed with the banking ombudsman I mean we are talking about PPI's complaint but look at them Ashish I'm sure we have a time for this in just about 5 minutes but quickly coming back to UPIs so I think that many of the things about portability and few of the other questions they are being addressed by UPI in some way it doesn't take weekends off you take UPI's procedural guidelines which says that non bank access can happen through sponsor bank and then you go and sit with your sponsor bank and figure it out there are no API like guidelines which are objective which says that if you follow ABC you will get access that's what you want that's like the PSD2 directive that you have API based access lay down the rules that's it how are consumers perceiving UPI do we feel are there any challenges I'm an economist I really kind of like numbers so we have a lot of bank led UPI's I'm sorry but if I include WhatsApp then I guess it's about 5 today which are non bank most of them are backed by formidable capital and they have the luxury which many players won't is it a symptomatic of something some underlying regulatory stances that have been taken are we kind of preferring one kind of players over others and what is the consumer experience like okay so I think yes when we take a look at different types of players in different payment services made be P2B lending or PPI's or other such things I think it is predominantly dominated by bank led service providers and while non bank service providers are there they are catching up fast but they are still small and a lot of way to go you had mentioned WhatsApp and Google so for instance I was just looking at some of the numbers and we all know that UPI has three major players are basically BIM then there is a phone pay and TES so while BIM was leading both volume and value since 3 months ago but after the launch of TES and phone pay has also caught up and both of them had dislodged a BIM to the number 3 slot and they are leading the transactions by volume as well as value which basically is also significant because of these non banks or independent providers are not being incentivized by government if you see government regulations or government incentives they have launched a lot of cashback schemes they have launched a lot of promotional schemes to promote UPI and BIM which is NPCI owned so I was looking at some statistics around 3000 crores have been budgeted to be spent on promotional schemes for 3 years to make UPI and BIM functional and despite that bank led UPI models are not in a position to provide user interface or provide stickiness which non banks can provide which is basically shows what experience and what is the comfort level when innovation and consumer interest come together this raises a very interesting facet that when NPCI itself has a product that comes out and tries to compete in the market I am not sure if it is competing and I mean things that they have been able to do let's say add BIM to the name of every UPI player and similar things do there is competition issues right at the outset is it in some way subtly kind of impairing the balance of the field? Absolutely and this has been one of major pain points on what exactly is NPCI because you said that you are following NPCI directives but NPCI is not a regulator NPCI is just a bank owned as Srikanth had mentioned yesterday we are in an environment which is owned by banks and NPCI should ideally be regulated by payments regulatory board which was supposed to be made last year which hasn't been operationalized as yet NPCI is a systemically important entity to my mind but it has not been treated as such and then it has launched an app which is competing with other service providers and banks who own NPCI have to change the names of their apps to BIM app and government is incentivizing that BIM app so there is a lot of fuzziness which is happening and the most important problem is that NPCI doesn't give it numbers there is no transparency on what are the failure rates what is the success rate what are you charging, what are you not charging what is the level of security you are providing I hate being a moderator because of bells like those and I will quickly there are two important questions that I really want to take on this panel one is on the ecosystem level there is this whole question of data protection and while we see that UPIs are privacy enhancing with respect to some transacting parties but not all and there is this differential not differential privacy as we understand in the world of data protection but there is this whole concern about privacy that's one and second is consumer grievance that where does the consumer go a lot of layers are being added transactions failure can happen at different levels is it time that we had a unified redress once and for all for financials actually I will now just go alphabetically because I am just doing a rabbit fire now so I think Sudarshan Saiyan committee had talked about grievance status mechanism and monetary policy statement of RBI has in one of the press releases of development objectives they have said that yes they will come out with a non-banking ombudsman but I really don't understand what is this banking ombudsman how would a consumer know which entity to approach when we talk about grievance status and that is why there is a need of financial redress agency we already have a FSAT which is across sectors so there is the earlier we think about unified redress agency and therefore a unified service regulator not a entity based regulator then it will complete the circle just having a unified redress agency won't fit within the broader ecosystem quickly your thoughts on data protection so in the financial space data protection in the financial space is very important the legitimate purpose test is required despite there being a consent or not there has to be in our submissions to the committee there should be no and then the consumer should be prompted to take over on options of what data it should be willing to share but then despite consent the purpose limitation should be there and there should be grievance redress at all levels I am sorry for rushing this yes Rohit grievance redress and data grievance redress I think has been sort of covered to some decent extent in the matured systems like PPI's and wallets have covered to some extent because they have been there for like 5-6 years now UPI UPI you are right is still very new in terms of these because people are still coming to terms with the fact that how do I use the system rather than let alone solve an issue it will take a while just like any system has go to standard S curves and there will be a three stage cycle earlier doctors later doctors same cycle and I think this is in the first so I would expect grievance redress to catch pace and come in the limelight when we reach the second slope what would a good grievance redress look like according to so I think in this case like if you take an example of if I am a customer of a beam branded app like a bank app so the first level of redress should be the bank because the bank is providing the front end to me obviously even though there has been just a label of beam but then beam won't listen to me there is no entity as beam it's just a brand of all so the bank has to be the first point and the bank needs to take owners and I think banks are already taking owners on that RBI is very strict about that and RBI makes sure that banks are always on the toes so I think that is the first step and then if need be then the next step would be the bank would obviously the customer cannot interface the bank needs to pass it to NPCI or whoever the authority might be in that and data protection so data protection I mean just from being like founder of a company I know that privacy or just like protecting data pure transaction data which is of supreme importance or even user that details of profile data both are equally important for any consumer but I think if we talk about the user profile data the user profile data as a generation we have reached a point where privacy has become a myth for user profile data that's the way I see it and as soon as we accept it the happier it will be that does not mean that user profile data is not important just means that yes it's literally everywhere and also I mean being a payment service provider someone who personitates payments how important is security like what is the security arrangement like what are the vulnerabilities so in this case the good thing is that if you are riding on a strong system like UPI because I will speak only for my example the vulnerabilities get down drastically by default because there is only so many evers that you can pull because you can't like customize the whole thing again and again so the only vulnerabilities that come around are from your front-end system your application not from the server itself so the idea is that okay your application designer should be well suited first of all to make sure the bugs are not there in the first phase itself and then you need to have an audit internal external audit to make sure those vulnerabilities go away purely but application level that's what is you guys recall the Uber incident in London when Uber was trying to sidestep the regulators right so I just want to say that where is the regulatory capacity in India to actually supervise a lot of these issues about privacy and data protection so if I put an owner so new as a regulated entity that you should do this this this what is my ability to actually check and verify that you are actually doing this so I think that is a cause of concern and where the regulation may to develop and what is the solution to that I think regulatory capacity partly that is the solution I mean you can have great laws in future also but the regulator needs to develop that kind of supervision on the consumer address as Amol mentioned when I buy a service now I buy a multiplicity of service bundled into one so where is the payment and where is the mutual fund and where is the insurance and where is the banking they merge so I think I was also the technical secretariat to the financial address agency and I think the time for that is there that we should have a single agency I agree with Amol that the challenge of having a single address agency in a multi regulatory environment is not necessarily great but which just means that our regulator need to coordinate even more thank you I think job of saying that I am afraid I can't give you time for concluding remarks because think will de-chair us all here so quickly the big points of the panel are the regulator before entering into the financial space regulation should always be careful about what is it that they are regulating in ownership neutrality irrespective of who runs the institution is a big regulatory principle that regulators need to follow functional regulation guide your regulatory requirements by the function that they are providing in the financial value service chain as compared to having a omnibus regulatory requirement is really not desirable then there are of course competition issues when you know when government entities and other entities actually compete in the same space and it's not just about ownership again it's also about most of them being backed by formidable capital and that may actually work to the detriment of the consumer in terms of limiting the choices that are available Ashish made a point that if I am the single person running and I win then that is that really a victory so the point is that of course more consumer choice which automatically means more players and that is one objective that the regulator should have it's time that we had a unified redress agency most importantly one touch point for the consumer regardless of the medium that they are using so more and more what I am hearing is that regulation needs to be technologically agnostic institutionally agnostic and less and less burden on the consumer because we are all nice people here quickly coming to data protection side of things yes to the extent we can and just to say this that in my own capacity to the fullest extent that we can legitimate processing, proportionate processing of data and consent not being a kind of a means to circumvent responsibility on the provider side is really that will help encourage the confidence of the consumer when entering digital financial services thank you for a great panel thank you for upkeeping the academic rigor also great shout outs from Amol last night regarding the Sudarshan Sen committee report and a few other things that we haven't been able to go to thanks and I open for audience questions you have just a minute if anyone has a question raise your hand one okay quickly guys just a couple of quick questions one is to Ashish specifically because I know you are part of the Watli committee and generally along the lines of why do you what was the exact thinking about recommending a PRB structure within the RBA as opposed to another option which was clearly referenced on having an independent regulator all together and in general now that's happened now that legislations are loved for the fact that you have a PRB now with adequate or maybe too much RBA representation in it what do you think is probably the structure in which it should go about and what are the predominant functions it should address that is one and secondly it is to Amol just to this is not a nitpick just to understand what is the exact nature currently in the system do you think is not functional or risk based because in the payments industry I feel we can't say it's completely risk based or completely functional but there is a definite movement towards it and clearly we see that with the PPI guidelines moving to say that there should be full KYC before you know you want to increasing the transaction limits so in general just to give you just to ask you about where the largest pain points lie in terms of not having a functional or risk based regulation the short answer to your question is that a committee has a group of people and the final recommendation represents a consensus view and it does carry all the individual views so that's where we are so you talked about PPI regulations I think in PPI regulation and you talked about full EKYC we need to take a step back and think about why there is a need for fully EKYC in case you have if you are okay with functioning with 10000 rupees a wallet why do you need to provide all your details which are on par with 10000 rupees a wallet so that itself is a question second question if you go a little bit deeper is non banks have to park all their money in an escrow with banks so why is there a need? because banks are their competitors so to speak so can there be no better mechanisms to save to save consumer money and to ensure that non bank PPS can also earn interest or can also earn income on their stock which is happening so there are several issues on PPI and P2P platform regs which distort the level paying field and which perhaps are not ideal in nature we can I think discuss thank you very much Denny that was an incredible panel and thank you to all our panelists so about those flash talks still don't have any sign ups which means you have to hear the song and I actually need some help so I promise I'm not sure which but I would sing a song if no one signed up for flash talks and no one did so at lunchtime I wrote a Gregorian chant about bitcoin but I need some help because I can't sing both parts myself so audience is going to get to be the one note drone against which I sing so can you guys sing let's see oh okay ready oh today I found I had no bit yesterday I'm sure that there were ten did somebody go shopping my smart contract says that I can spend up to 0.004 per transaction that's the same as one of those pink bill did I buy a 2BH in my sleep better check my ledger since there are no flash talks you guys are free to go and have a little bit of an early tea break there's a bof upstairs in the circular area with all the chairs on data protection that Sunil is running so if you want to have a random chat and ask questions and answer questions please do go upstairs to the first floor we will be back here at 4.30 for a birds of a feather session on security and fintech so if you're still interested in talking to people about security come back here at 4.30 for a 45 minute session enjoy your tea


Hey everyone, it's Gabrielle. Today I'm over here at Oxmer Toyota. You guys, I'm going to talk a little bit about a 2021. This is Toyota RAV4LE. All right guys, so the front of the vehicle, you do have LED headlights and you have the LED daylight running lights. Now on the vehicle, you have the roof rack crossbars. For the tires, you do have 17 inch wheel caps. And then for this vehicle, if we want to kind of come to the back, you're going to have the black badging or the black emblems. So that RAV4LE, the LE, this Toyota sign up here, all in that really beautiful matte black. And then you do have dual exhaust as well. So why don't we take a look at the interior. So on the interior, you are going to have different driving modes. You've got the Eco, Normal, Sport, Snow, Mud and Sand, Rock and Dirt. Today we could use the snow. But if you look up here, they kind of change colors. So right there, you can see little snow. If you change it to Normal, that goes away. Sport, it comes, there's like a red. So that's kind of fun when you change them. And then Rock and Dirt, you'll see that that'll change too. This vehicle does have the park button or the park hold. So when you're at a stoplight or something, you need to take your foot off the brake. You can push that and it will hold the vehicle. Up here for your screen, you do have a seven inch touchscreen. There are six speakers throughout this vehicle, and you're going to have Bluetooth, you have Apple CarPlay, Android Auto. As far as down here, we're going to have all weather floor mats. So that'll be up front in the back. That's going to be really nice, especially for this weather with all the snow and the salt and stuff like that. For the seating, you're going to have fabric trimmed black seating.  And then you do have heated power outside mirrors, and they're going to have the turn signal and the blind spot indicators. So if someone comes in your blind spot, there is like two little vehicle kind of signs on there and it'll blink red. So right there. And lastly, you do have an SOS up here. So you would flip this down and hit that. If you were in an accident or you would need emergency assistance, that will get their attention. Alright guys, and just a reminder that the RAV4 LE, it does come in all wheel drive. So just keep that in mind. That'll be great for weather like this. Now, if you all have any questions, feel free to let us know. All of our contact information will be right here. Hopefully we'll see you all soon. Bye.