This document has been archived and is no longer in use by the Office. A list of the Office's current Credit Provider Determinations is available on the Credit Reporting page - http://www.privacy.gov.au/act/credit/

Determination under the Privacy Act 1988: 1996 No.2 s.18K(3)(b)

Concerning disclosures by the Credit Reference Association of Australia of information included in a credit information file before 24 September 1991

• Concerning disclosures by the Credit Reference Association of Australia of information included in a credit information file before 24 September 1991
• Reasons for determination
  • Background
  • Reasons for decision
  • Duration

Concerning disclosures by the Credit Reference Association of Australia of information included in a credit information file before 24 September 1991

Under s.18K(3)(b) of the Privacy Act 1988, I DETERMINE that:

1. The Credit Reference Association of Australia (CRAA) may continue to disclose information which indicates that an individual has defaulted in making a payment in respect of commercial credit and which was included in a credit information file before 24?September 1991.

2. This determination represents a partial continuation of Determination 1992 No.1 which expires on 24 September 1996.

3. This determination shall take effect on 25 September 1996 and shall lapse on 24?September 1997.

Dated 4 September 1996

Kevin Patrick O'Connor Privacy Commissioner

Back to Top

Reasons for determination

Background

1. Section 18E of the Privacy Act lists all the types of information which a credit reporting agency is permitted to keep on a consumer credit information file. Section 18F requires that a credit reporting agency must delete from an individual's credit information file any personal information in respect of which the maximum permissible period for retaining that information has expired. Section 18K(2) prohibits a credit reporting agency from disclosing personal information contained in a credit information file, or information derived from the file, if the information is information it would be prohibited from including in the file under s.18E, or information it is required to delete from the file by s.18F. In most cases, the Act allows for a maximum retention period of five years from the date on which the information is recorded. Information relating to serious consumer credit infringements can be retained for seven years.

2. The combined effect of the above provisions is to ensure that the information which can be kept on file and disclosed by a credit reporting agency in the form of consumer credit reports is relevant to the individual's credit worthiness and hence relevant in the credit-related situations in which an agency is permitted under the Act to provide a report.

3. However, the Act also recognises that there may be occasions when the nature of past practice makes it impracticable to bring into conformity with the requirements of the Act information compiled by a credit reporting agency before the commencement of the Act. The Act gives the Privacy Commissioner power under s.18K(3)(b) to determine that a type of information which is not permitted contents of a credit information file may be disclosed by a credit reporting agency without breaching the requirement of s.18K(2) if the information was collected before the commencement of the section, that is before 24?September 1991.

4. The Credit Reference Association of Australia is a credit reporting agency as defined under s.11A of the Act. Prior to the introduction of the legislation CRAA provided consumer credit information to a wide range of businesses, some of which were not involved in the provision of credit. As a result, some of the credit information files of CRAA contained old information of a kind which is no longer permitted to be held. This information basically concerned enquiries made by non-credit providers and overdue payments owed to them.

5. In addition, information about commercial credit defaults is no longer permitted to be included in a credit information file. Prior to the commencement of the Act, CRAA did not, in recording information given by its members, make any distinction as to whether an enquiry or default listing was relating to consumer or commercial credit. Therefore, some of its consumer credit records contained information on both consumer and commercial defaults.

6. When the Act came into effect, CRAA deleted as much of the non-permitted data as it was able to readily identify. However, it knew that some records would still contain non-permitted data that it was either not possible or practicable to identify without a detailed manual review of its credit database of over 24 million items. It undertook to delete any further non-permitted data as it came to its attention, primarily through requests for access and amendment.

7. On 19 February 1992 I issued Determination No 1 under s.18K(3)(b) to allow the CRAA to disclose, until 24 September 1996, certain information which does not fall within the permitted contents of a consumer credit information file as defined by s.18E but which was collected prior to the commencement of the Act.

8. The duration of Determination 1992 No 1 was based on the fact that, under s.18F, the maximum period of retention for most information collected is five years. As determinations issued by me under s.18K(3) can only apply to information included in a credit information file before commencement of the section, that is 24 September 1991, the five year period of retention commenced from that date.

9. Although it is likely that most of the information referred to in Determination 1992 No?1 has now been automatically deleted, there is a possibility some has not. This is because there may be information on serious credit infringements of a commercial nature which was legitimately collected prior to the commencement of the Act and which has not subsequently been identified, through normal review processes, as not being information concerning consumer credit and therefore not permitted to be held in a credit information file under the Act. As information relating to serious credit infringements can be retained for a period of seven years, this pre-Act information about commercial credit infringements would not be automatically deleted by 24?September 1996.

Back to Top

Reasons for decision

10. I raised with the CRAA the likelihood that it might still hold information referred to in Determination 1992 No 1 after 24 September 1996. I also brought the matter to the attention of the Tasmanian Collection Service, another credit reporting agency in respect of whose activities I had issued a similar determination (Determination 1992 No?2).

11. The CRAA requested that Determination 1992 No 1 be reissued for a further 12?months, by which time I was assured that all of the information which is not otherwise permitted to be held will have been removed. The Tasmanian Collection Service advised that it had removed all such information from its records.

12. While I am not required to publicly consult on determinations of this kind, I did seek the views of the Consultative Group which has assisted me in the development and review of the Credit Reporting Code of Conduct and which I continue to consult on credit reporting matters. Membership includes representatives of peak industry bodies and consumer organisations. None of the members consulted indicated any difficulties with the reissue of Determination 1992 No 1 for a further twelve months.

13. The Compliance Section of my office, during its routine auditing processes, has encountered no problems with the use of pre-Act information by the CRAA nor with the operation of this particular determination. In addition, my Privacy Complaints and Enquiries Unit has received no complaints regarding the application of this determination.

14. I believe that the reasons I gave for Determination 1992 No 1 remain valid. In the absence of any effective means of retrospectively separating all consumer and commercial default listings, and recognising this as a transitional situation, I have determined that, until 24 September 1997, the CRAA may continue to disclose in credit reports, without beaching the Act, information about commercial defaults that was collected before 24 September 1991.

Back to Top

Duration

15. I consider the period of 12 months commencing on 25 September 1996 a reasonable period for the purpose of this determination. I will continue to monitor the operation of this determination and review it if necessary.

Kevin O'Connor Privacy Commissioner

4 September 1996

For further information please contact

Privacy Commissioner GPO Box 5218 Sydney NSW 1042

Privacy Hotline: 1300 363 992 Telephone: (02) 9284 9800 Fax: (02) 9284 9666

E-mail: privacy@privacy.gov.au

Back to Top