The National Privacy Commission has ordered the immediate takedown of four online lending apps (OLAs), JuanHand, Pesopop, CashJeep, and Lemon Loan to protect the data privacy rights of borrowers.
Privacy commissioner Raymund Liboro said the orders banning the four apps “are crucial to prevent serious privacy risks and protect and preserve the privacy rights of data subjects.”
“These online lending apps raised many red flags and the companies operating these apps demonstrate problematic data actions that expose borrowers to serious privacy risks and harms,” he added.
The apps have been the subject of various complaints of unauthorized use of personal data that resulted in harassment and shaming ofborrowers and are currently being investigated for violations of the Data Privacy Act and other NPC issuances.
The NPC said the apps have gained access to a trove of information in the borrowers’ mobile devices, including contacts and social media data, that are excessive and may be weaponized to harass and shame delinquent borrowers before persons in their mobile devices’ contact list to collect debts.
In four separate orders, the NPC directed Wefund Lending Corporation, Joywin Lending Investor Inc., Cash8 Lending Corporation, and Populus Lending Corporation—operators of Juan Hand, Lemon Loan, CashJeep, and Pesopop, respectively – to halt the processing of their borrowers’ personal data.
The Commission said the apps were engaged in “irrelevant, unnecessary, and excessive” harvesting of personal and sensitive information without borrowers’ free and informed consent.
The NPC has furnished copies of the orders to the National Telecommunications Commission (NTC) to take down the four apps from the internet and to Google LLC to remove them from the Google Play Store.
The Commission issued the orders based on the findings of the NPC’s Complaints and Investigation Division (CID) which examined the apps and found that these violated the principles of transparency, legitimate purpose, and proportionality in the Data Privacy Act of 2012 and the NPC issuance on the Processing of Personal Data for Loan- Related Transactions (NPC Circular No. 20-01).
The 4 apps have gained access to practically all the data in a borrower’s mobile device, according to NPC’s CID, which simulated the registration process of loan applicants and evaluated source codes.
The apps can process information ranging from a borrower’s sensitive personal data, location, photos, media files, emails, contact lists,
and data from social media platforms like Facebook, Instagram, and Google.
Companies operating these apps were provided the opportunity to reply to NPC’s findings, but two of the apps did not file position papers, while the other two failed to convince the Commission why it should not impose the ban. The ban shall remain in effect until lifted by the Commission.
Meanwhile, the NPC continues to investigate the possible criminal liabilities of the OLA operators’ directors, officers, and agents.
The CID said it was conducting investigations of OLAs amid numerous complaints against them. Based on Google’s statistics, JuanHand has been downloaded more than 1 million times; Lemon Loan and Pesopop, more than 500,000 times each; and CashJeep, over 100,000 times.
The NPC is currently studying and investigating more than 200 OLAs available for download and will issue orders and other actions according to the investigation results.