Consumer lender's breach, credit-scoring DPIA and offshore cloud
Shanghai-based consumer lender QuickCredit has 2.3 million borrowers. It stores loan applications, ID numbers, income statements and bank account details on a Singapore cloud. It uses a Hefei SMS vendor to send repayment reminders and a Shenzhen analytics firm to score credit risk. On 3 March it discovers that an unpatched API exposed 120,000 records, including 18,000 bank account numbers, for 11 days. QuickCredit's part-time 'privacy lead' is the HR manager. It notifies the police on 8 March but not users; it has no DPIA for the credit-scoring model and no cross-border transfer records. The board asks whether it must notify individuals, whether the SMS vendor is a processor, and what records it must keep.
1. Must QuickCredit notify authorities and affected individuals of the API breach? Explain the timing and content duties.
Read the worked answer
Article 57 requires immediate remedial action and notification to the authorities and to affected individuals. Notification to individuals is not required only if the measures effectively avoid harm; here, 120,000 records including 18,000 bank account numbers were exposed for 11 days, so harm is plausible and individual notification is likely required. Notifying the police on 8 March does not substitute for notifying the cybersecurity or PIPL authority and the individuals. A five-day delay is difficult to reconcile with 'immediately'. The notice should cover the information categories, cause, possible harm, remedial measures, and contact details, and the company should keep a record. It should also assess whether the incident triggers other reporting duties under cybersecurity rules.
2. Does QuickCredit need a DPIA for the credit-scoring model, and what records must it keep?
Read the worked answer
Article 55 requires a DPIA before processing sensitive PI, using automated decision-making, entrusting processing, providing PI to third parties, public disclosure, or cross-border transfer. Credit scoring is automated decision-making with significant effects, uses sensitive financial data, and is provided to or used with third parties, so a DPIA is required. Article 56 requires the DPIA report and processing records to be kept for at least three years. QuickCredit should document the necessity and impact assessment, safeguards, and the balancing of rights. The absence of a DPIA and records is itself a compliance gap, even if no incident had occurred.
3. QuickCredit uses a Hefei SMS vendor and a Shenzhen analytics firm. How should it classify and govern these relationships, and what cross-border mechanism is likely needed?
Read the worked answer
The SMS vendor processes repayment reminders on QuickCredit's instructions and does not decide purposes or methods; it is an entrusted processor under Article 21, so a written agreement is needed, covering purpose, duration, processing method, data types, safeguards, supervision and deletion on termination. The analytics firm may be an entrusted processor or an independent processor depending on whether it determines purposes or methods; QuickCredit must not assume it is a processor just because it is a supplier. Sending data to Singapore requires an Article 38 mechanism. At 2.3 million borrowers, the CAC security assessment is the most likely route, but the exact threshold and data categories must be confirmed, and Article 39 notice plus separate consent is also needed.