Following is an extract from the "Guidelines on credit card operations" that is drafted and will soon be implemented by RBI.

The law clearly refrains the banks from harassing consumers by engaging recovery agents as well as disclosing the consumer's number. Read on..... (important points in red)
5. Protection of Customer Rights Customer's rights in relation to credit card operations primarily relate to personal privacy, clarity relating to rights and obligations, preservation of customer records, maintaining confidentiality of customer information and fair practices in debt collection. The card issuing bank / NBFCs would be responsible as the principal for all acts of omission or commission of their agents (DSAs /DMAs and recovery agents).
i. Right to privacy
a. Unsolicited cards should not be generally issued. In case, an unsolicited card is issued and activated without the consent of the recipient and the latter is billed for the same, the card issuing bank / NBFC shall not only reverse the charges forthwith, but also pay a penalty without demur to the recipient
amounting to twice the value of the charges reversed.
b. The card issuing bank / NBFC should not unilaterally upgrade credit cards and enhance credit limits. Prior consent of the borrower should invariably be taken whenever there are any change / s in terms and conditions..
c. The card issuing bank / NBFC should maintain a Do Not Call Registry (DNCR) containing the phone numbers (both cell phones and land phones) of customers as well as non-customers (non-constituents); who have informed the bank / NBFC that they do not wish to receive unsolicited calls / SMS for marketing of its credit card products.
d. The intimation for including an individual's telephone number in the Do Not Call Registry (DNCR) should be facilitated through a website maintained by the bank / NBFC or on the basis of a letter received from such a person addressed to the bank / NBFC.


e. The card issuing bank / NBFC should introduce a system whereby the DSAs/ DMAs as well as its Call Centers have to first submit to the bank / NBFC a list of numbers they intend to call for marketing purposes. The bank / NBFC should then refer to the Do Not Call Registry (DNCR) and only those numbers which do not figure in the Registry should be cleared for calling.
f. The numbers cleared by the card issuing bank / NBFC for calling should only be accessed. The bank / NBFC would be held responsible if a Do Not Call Number (DNCN) is called on by its DSAs / DMAs or Call Centre/s.
g. The card issuing bank / NBFC should ensure that the Do Not Call Registry (DNCR) numbers are not passed on to any unauthorised person/s or misused in any manner.
h. Bank / NBFCs/their agents should not resort to invasion of privacy viz., persistently bothering the card holders at odd hours, violation of "do not call" code.
(ii) Customer confidentiality
a. The card issuing bank / NBFC should not reveal any information relating to customers obtained at the time of opening the account or issuing the credit card to any other person or organization without obtaining their specific consent, as regards the purpose / s for which the information will be used and the organizations with whom the information will be shared. The banks / NBFCs should satisfy themselves, based on specific legal advice, that the information being sought from them is not of such a nature as will violate the provisions of the laws relating to secrecy in the transactions. The bank / NBFC would be solely responsible for the correctness or otherwise of the data provided for the purpose.
b. In case of providing information relating to credit history / repayment record of the card holder to a credit information company (specifically authorized by RBI), the bank / NBFC may explicitly bring to the notice of the customer that such information is being provided in terms of the Credit Information Act (to receive President's assent).
c.Before reporting default status of a credit card holder to the Credit Information Bureau of India Ltd. (CIBIL) or any other credit information Company authorized by RBI, banks / NBFCs may ensure that they adhere to a procedure, duly approved by their Board, including issuing of sufficient notice to such
card holder about the intention to report him/ her as defaulter to the Credit Information Company. The procedure should also cover the notice period for such reporting as also the period within which such report will be withdrawn in the event the customer settles his dues after having been reported as defaulter. Banks / NBFCs should be particularly careful in the case of cards where there are pending disputes. The disclosure/ release of information, particularly about the default, should be made only after the dispute is settled as far as possible. In all cases, the well laid down procedure should be transparently followed.
d. The disclosure to the DSAs / recovery agents should also be limited to the extent that will enable them to discharge their duties. Personal information provided by the card holder but not required for recovery purposes should not be released by the card issuing bank / NBFC. The card issuing bank / NBFC should ensure that the DSAs/ DMAs do not transfer or misuse any customer information during marketing of credit card products.
(iii) Fair Practices in debt collection
(a) In the matter of recovery of dues, banks / NBFCs may ensure that they, as also their agents, adhere to the extant instructions on Fair Practice Code for lenders (circular DBOD. Leg. No. BC. 104 /09.07.007 / 2002-03 dated May 5, 2003)as also their own code for collection of dues or in the absence of such a code at the minimum adopt the IBA's Code for Collection of dues and repossession of
security.
(b) In particular, in regard to appointment of third party agencies for debt collection, it is essential that such agents refrain from action that could damage the integrity and reputation of the bank / NBFC and that they observe strict customer confidentiality.
(c) The bank / NBFCs and their agents should not resort to intimidation or harassment of any kind either verbal or physical against any person in their debt collection efforts, including acts intended to humiliate publicly or intrude the privacy of the credit card holders' family members referees and friends, making threatening and anonymous calls or making false and misleading representations.
Best regards,