Jamii Microfinance: A Biased Scorecard, a Stolen Laptop and a Quiet CEO

Diagnosis

• Postcode is not a cause of default; it is a proxy for region, and region here correlates with drought exposure. The model is therefore partly measuring the weather, not the borrower's willingness or capacity to pay.
• The outcome is a three-fold decline rate concentrated on a group defined by geography. Even if unintended, that is indirect discrimination in effect, and it is commercially self-harming: Jamii is exiting a market segment on the basis of a risk driver it has not tried to price or mitigate.
• The model cannot explain itself: with no income variable, an officer cannot tell a customer why she was declined, and cannot show a regulator that the decision was fair.

What must be done

1. Validate - test the model separately for each branch and for default driven by rainfall versus default driven by borrower behaviour. Separate the two before condemning the segment.
2. Add income and cash-flow data (mobile money statements, cooperative records) which are available even for pastoralist borrowers.
3. Replace or re-weight postcode with the underlying variables to be predicted.
4. Human review for declines at the margin; officers should be able to override with documented reasons - and overrides must themselves be monitored for abuse.
5. Give reasons for decline in every case; record model version and inputs per decision.
6. Board approval and periodic re-validation - a three-year-old model on a changing portfolio is a governance failure, not an IT issue.

Breach analysis

• The officer's action breached the security and confidentiality principle: records collected for credit assessment were copied to a personal account with no lawful basis, no authorisation and no safeguards. This is both a misuse of access and a data protection breach.
• Losing the laptop converted a policy breach into a reportable incident.
• The controller (Jamii) must notify the Data Protection Commissioner within 72 hours of becoming aware of a breach likely to result in a risk to data subjects, and notify affected customers without undue delay where the risk is high - ID numbers and loan balances create a real identity-fraud and reputational risk.
• Records must be kept of the breach, its effects and remedial action; access must be revoked immediately and affected accounts flagged for fraud monitoring.
• The officer's conduct is also a disciplinary and possibly criminal matter.

Ethical analysis of the CEO's instruction

• Keeping quiet protects the licence application, not the customers. That is a conflict of interest between the institution's short-term goal and its duty to clients and the regulator.
• Silence breaches integrity, confidentiality and professional behaviour, and it converts a technical breach into deliberate concealment.
• Withholding a known material incident from the regulator during a licensing process is itself a misrepresentation - and a licence obtained that way is at risk of revocation later.

Decision: do not comply.

1. Report internally in writing to the board audit committee, not only to the CEO.
2. Make the statutory notification within 72 hours; document the dissent and the CEO's instruction.
3. Notify affected customers, with advice on fraud risk.
4. If the board endorses concealment, escalate to the regulator and take advice on your own position, including resignation.

The request is not permissible as framed.

• Purpose limitation. The data was collected to assess and administer credit. Selling insurance is a different purpose. Re-use requires a new lawful basis.
• Lawful basis. Cross-selling to a third party will normally require the customer's specific and informed consent - not a pre-ticked box in a loan form. In Kenya, direct marketing by electronic means also requires consent.
• Disclosure to a third party needs a data-sharing agreement making the insurer a separate controller (or processor), with security, retention, breach-notification and no onward-selling obligations.
• Banking confidentiality is a separate duty: customer balances should not be disclosed for marketing irrespective of consent wording, and loan balances should be removed from any list shared.
• Data minimisation: name and phone number are enough for a marketing approach. ID numbers and balances must not leave the building.

What to advise the marketing manager

1. Re-permission: a clean opt-in at onboarding and a fresh opt-in campaign to existing customers.
2. Do the cross-sell through Jamii's own channels, with Jamii as the face of it and the insurer as the product provider - this avoids a third-party disclosure entirely.
3. If a disclosure is unavoidable, a signed data-sharing agreement and a redacted dataset (no ID, no balances).
4. Route it through the data protection officer and record the decision.

Test to apply: could you explain to a customer, and to the Commissioner, exactly why her loan file was sent to an insurer? If not, it does not get sent.