A significant increase in digital loans in Kenya has resulted in some service providers extracting data from the mobile devices of unsuspecting customers in order to evaluate risk profiles.

A new report by finance and economy focused organisation FSD Kenya, established in 2005 by the UK's Department for International Development, titled Digital Credit Audit, said that the scraping of data from a users' phone strengthens the financial system through credit scoring.

An excerpt from the report reads: "A FinTech app-based lender without access to potential borrowers' financial data may require permissions for the app to scrape data from the borrower's phone, including reading messages with details of financial transactions."

It added: "The borrower's phone number, name, e-mail address, ID or passport number are the most requested information during sign-up. Some lenders also require potential borrowers to provide income data such as employment status and monthly income, while others require borrowers to have a social media account."

SMSs, call logs, phone contacts and GPS locations was among the most requested data, according to the report.

However, the report acknowledged that the use of this data could pose risks to the consumer.

It explained that most consumers often do not know what data is being used, or how their data is being shared, and neither can they easily control how the data is used.

Shivani Siroya, the founder and chief executive officer of mobile lending company Tala says customer protection needs to be at the forefront for the industry to grow.

"The way we design our product ultimately it's their (customers') decision. They have to give us access to that information of their phones," said Siroya. "We then give the optionality to take it away."

She said that in addition to self-regulation by the 33 companies representing the industry, the government must move to support regulation and ensure the protection of client data.

The FSD Kenya report urged an immediate introduction of regulation to protect customers and their data.

"Inevitably, there have been growing calls to regulate the sector. Consumers have a collective interest in many elements of regulation," the report stated.

The Central Bank of Kenya has already published a draft mandate for credit sharing within the sector, a move the FSD Kenya has welcomed.

The country has also passed the Data Protection Bill 2019 which will regulate how personal information is collected, processed and shared. The legislation is not yet enforced.