TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

The Privacy Advisor | Privacy considerations for crowdfunding platforms Related reading: A view from Brussels: EDPS sends signal on data transfers 

rss_feed

""

""

Crowdfunding has seen explosive growth, both domestically and globally, in the past few years. As the industry continues to mature, U.S.-based crowdfunding platforms are beginning find that privacy considerations deeply impact their business. Aside from the usual considerations facing traditional financial service companies, crowdfunding platforms must be conscientious in the type of borrower or sponsor data they choose to display to investors on their website.

Crowdfunding in a nutshell

Crowdfunding, or crowdfinancing, is the process of raising capital from several people through an online medium — namely, the Internet. According to a report by Massolution, crowdfunding was on track to reach an estimated $34.4 billion in funding transactions in 2015, up from $16.2 billion in 2014, and $6.1 billion in 2013. A variety of sources indicate that the yearly total market potential of the crowdfunding industry could average around $300 billion by 2025.

Generally, there are four types of crowdfunding: donation-based crowdfunding, in which campaigns collect money with no promise of anything in return, via such platforms as GoFundMe; rewards-based crowdfunding, where the sponsor sets various levels of rewards that correspond with pledge amounts, popularized by platforms like Kickstarter and Indiegogo; equity crowdfunding, which is the exchange of shares of a private company for capital via platforms like SeedInvest, AngelList, Crowdfunder; and debt crowdfunding or marketplace lending, which is the raising of capital in the form of a loan, whether for a personal, small business, or real estate loan, via a portals such as Lending Club, Prosper, FundingCircle, Patch of Land.

Privacy in crowdfunding, generally

In translating the JOBS Act into final regulations, the Securities Exchange Commission sought to protect investors in myriad ways: limiting certain opportunities to accredited investors only, implementing caps on the annual amount certain investors may invest, and requiring certain disclosures, among other things. Understandably, the bulk of crowdfunding regulations seek to protect investors and are aimed at fraud and other investment-related concerns. With regard to privacy concerns, the JOBS Act provides only that crowdfunding platforms “take such steps to protect the privacy of information collected from investors as the Commission shall, by rule, determine appropriate." Aside from this, the JOBS Act and its ensuing regulations do not specifically address privacy concerns, and to the extent they do, they are investor, not sponsor, centric. Instead, crowdfunding platforms must look to other statutes for guidance on how to best protect both their borrowers and investors.

Disclosure of information in crowdfunding campaigns

It seems obvious enough that private information should not be shared online. Crowdfunding platforms, especially those that focus on marketplace lending, must be conscientious when disclosing the personal data of those promoting campaigns, and should carefully analyze the implications of the Fair Credit Reporting Act and Gramm-Leach-Bliley Act of 1999 when deciding what type of information to disclose in a crowdfunding campaign. Disclosure of individual credit data, for example, is generally not permissible unless the identity of the individual has been sufficiently anonymized. If credit data is disclosed alongside information that could lead to the identity of an individual, such data cannot be disclosed on a platform.

Regulatory and contractual hurdles

Two hurdles, regulatory and contractual, need to be overcome before a crowdfunding platform may post an individual’s credit score.

Regulatory compliance must first be squared away with a platform’s legal team. Platforms should ensure that their reporting practices are lawful. The GLBA governs the permissibility of public releases of consumer credit information by financial institutions — including crowdfunding platforms. Underscoring the GLBA is a strong public policy in favor of protecting the personal information of consumers. Section 501(a) states that “each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information.” In addition to the GLBA, crowdfunding platforms must also be compliant with state privacy laws and identity theft laws, including the Red Flag monitoring prescribed by the FCRA.

If a platform is able to meet regulatory requirements, contractual requirements present an additional hurdle. With a few exceptions, the three major credit bureaus have been largely reluctant to allow the disclosure of FICO scores on crowdfunding platforms. In many cases, the credit bureaus have no knowledge that a platform publishes or intends to publish the FICO score online. Further, credit scores are constantly in flux and may vary across credit bureaus. That’s why some platforms that currently do have permission to disclose credit data publish a credit score range instead of a static credit score.

Application in the marketplace lending context

Early on, pioneers such as Prosper and Lending Club posted a plethora of information about their borrowers, including name, loan purpose, even phone number and photos of their borrowers. As these two consumer marketplace lending platforms matured over nearly a decade, both have largely standardized the data made available to investors and have anonymized the identities of their borrowers. For example, although Prosper publishes borrower FICO scores, it only publishes information pertaining to the identity of the borrower regarding location (at the state level), employment status, income range, and occupation. These pieces of information are sufficiently broad such that the viewer would not be able to pin down the specific identity of this borrower.

Disclosure of credit data for small business marketplace lending portals present additional complexities. In such loans, the subject individual is not the borrower (an entity), but more likely a guarantor that owns the company, either wholly or partially. Because certain business information is public record in the U.S., small business marketplace lenders must decide whether they prefer to disclose the actual business name or its guarantor’s credit information. Funding Circle, for example, made the choice of displaying a guarantor’s credit score instead of disclosing the borrower’s business name.

Real estate marketplace lenders face a similar decision as that of small business marketplace lenders. In the U.S., real estate ownership information is public record. Thus, when a real estate lending platform discloses both a property address and guarantor’s credit score, it may indirectly publish the identity of the individual tied to that credit score on the internet.

Platform maturity from a privacy perspective

As platforms mature and gain greater understanding of key laws and regulations affecting nuances of their business, platforms will increasingly adopt an eye towards privacy. If not, platforms will increasingly subject themselves to a high amount of legal and reputational risk.

Crowdfunding platforms can still protect their borrowers and guarantors while continuing to provide investors enough information to make informed investment decisions. Younger crowdfunding and marketplace lending companies will likely mature in all aspects of their compliance and operations over the next few years — not just in the context of disclosing credit data, but also with regard to other privacy obligations generally. In the meantime, crowdfunding platforms must be cognizant of the fact that the online world is vast and increasingly so. Each piece of information shared could cause a domino effect, leading to potential violations of privacy laws and opening the door to serious legal liability.

In light of this, crowdfunding and marketplace lending platforms must be conscientious about the type of personal or financial information they disclose. Depending on the particular measures employed to protect the individual’s identity, the website may end up publishing very sensitive information in violation of strong public policies in favor of identity protection. Each platform must carefully evaluate the risks associated with privacy rights and balance protection of an individual’s credit information with the need to offer investors enough information to evaluate risk. This is not only necessary to remain within the law and avoid breaching contracts, it is also the right thing to do if platforms truly want to give borrowers the best experience possible.

photo credit: Symposium crowdfunding voor natuur via photopin (license)

Comments

If you want to comment on this post, you need to login.