📋 Tender Overview
The National Authority for the Protection of Personal Data (ANPD) of MINJUSDH has been carrying out inspection actions related to complaints of improper processing of personal data in mobile applications for money loans, reported by the Superintendency of Banking, Insurance and AFP (SBS). In this context, it has been verified that most of these applications are available on the Play Store platform of Google LLC. However, there is no effective control that has been verified on the real existence of these and their adequacy to Peruvian legality.
Although Google LLC indicates, in response to an information request from the ANPD, that it does not support harmful or deceptive financial applications and that, in case of breach of the Google Play terms of service, it reserves the right to disable the developers' accounts, which results in the loss of access to Google services and Google Play, the truth is that the ANPD, through its Directorate of Supervision and Instruction (DFI), has verified that the applications reported by the SBS: LOAN PORTFOLIO / LOAN PORTFOLIO / CRECY / CRECI / CREDI PERU / CREDIT PERU / CREDIT PERU / CUYCASH / HICASH / HI CASH / HOLA CASH / HOLACASH / HUAY MONEY / HUAYMONEY / FINANCIAL HUAY MONEY / FINANCIAL HUAYMONEY / MISOLES / MISOLES PERU / PERU LOAN / PERU LOAN / LOAN / YEP CREDIT / YEPCRÉDITOS, do not comply with the information requirements of the Personal Data Protection Law, Law No. 29733; That is, they do not have a privacy policy.
Regarding the applications ALPACASH / C PLATINKA / EKEKO / IKORI / KORI / KOIRI / ISOLEZ / KOLQUE / KOLKE / PERU CREDIT / PRESTASOLE / PRESTASOLES / PRESTA SOL / LEND SOLES / SOL CASH / SOLCASH / VAMOCASH, although they have a privacy policy, they do not comply with the informative requirements of the Law on Protection of Personal Data, Law No. 29733 (Article 18).
It is necessary to highlight the particular case of the applications IKORI / KORI / KOIRI / KOLQUE / KOLKE / VAMOCASH, which recorded in their privacy policies false addresses in the national territory. This has been verified in person by the DFI inspectors.
These applications do not comply with the informative requirements of the Personal Data Protection Law by not indicating which entity is responsible for the processing of personal data of Peruvian users; not have a registered address in the country; not explain the purposes of use of the personal data collected; the recipients of data transfers, if any; the shelf life of the same; on the possibility of exercising the rights of Access, Rectification, Cancellation and Opposition to data processing, among others. And, the most serious and dangerous for the user who downloads them on his cell phone, the user is not informed that he is allowing unknown people to access all his contacts and information on the device.
This last action, as reported by various media, is what allows unscrupulous people to demand with threats the payment of loans both to the loan holder and his contacts.
In short, the ANPD informs, from the response provided by Google LLC to its information request, that the aforementioned company has not established as requirements for the hosting of a loan application in Play Store, that the developers of the same have accredited compliance with the regulations of the country to which the service they offer is directed, that is, in Peru, to the requirements of Law 26702, General Law of the Financial System, and the SBS, as well as the requirements derived from Law 29733, Law on Protection of Personal Data.
Olga Escudero, director of the DFI, points out that the lack of identification of the person responsible for the processing of personal data and an address in the national territory constitutes an obstacle to carry out the control actions that allow the ANPD to determine the circumstances that justify the establishment of the sanctioning procedure; that is, the people who use them are in a situation of virtual helplessness; Therefore, it recommends the general public not to download apps that do not give them information about what they are going to do or how they are going to manage their personal data.
Finally, the ANPD informs that it has initiated a sanctioning procedure against IPESO PERU S.A.C., owner of the applications "C Platinka", "iSolez", and "Solcash", for collecting personal data by illicit means through the iSolez application, as well as for using the data of a person to collect the loan of another without their consent, in addition to the charge of obstructing the work of control; all serious and very serious infringements.
