Case Citation:

U v Betting Agency [2008] PrivCmrA 21

Subject Heading:

Unauthorised access to consumer credit information files

Law:

Section 11B, section 18S and section 49 of the Privacy Act 1988 (Cth)

Facts:

The Privacy Commissioner became aware that a Betting Agency had access to consumer credit information files held by a credit reporting agency.  The betting agency had accessed individuals' credit information files on numerous occasions.

Section 18S of the Privacy Act provides that a person must not obtain access to an individual's credit information file held by a credit reporting agency unless the access is authorised by the Privacy Act.  Under the Privacy Act, access to credit information files held by credit reporting agencies is generally limited to credit providers.  The definition of a credit provider is contained in section 11B of the Privacy Act and generally means bodies whose business or undertaking is the provision of loans or credit.  The betting agency, in this instance, did not appear to be a credit provider. 

The Commissioner opened an investigation into this matter under section 40(2) of the Act. That section gives the Commissioner the power to investigate a matter on her own initiative.  During the course of this investigation, it became apparent that the Betting Agency may have committed a credit reporting offence under section 18S(3) of the Privacy Act.  Section 49(1)(a) of the Privacy Act provides that the Privacy Commissioner shall inform the Commissioner of Police or the Director of Public Prosecutions where they form the opinion that a prescribed credit reporting offence may have been committed.

In accordance with this provision, the Commissioner informed the Commissioner of Police that a credit reporting offence may have been committed and discontinued her investigation.  On advice that the Commissioner of Police would not be investigating the matter, the Commissioner subsequently resumed her investigation into the matter.

Issues:

The issue for consideration was whether the Betting Agency was a credit provider within the definition of section 11B of the Privacy Act and whether the Betting Agency had contravened section 18S of the Privacy Act.

Outcome:

The Privacy Commissioner formed the view that the Betting Agency did not meet the definition of a credit provider as defined in section 11B of the Privacy Act.  The Commissioner was of the opinion that access by the Betting Agency to credit information files held by a credit reporting agency may be considered an offence under section 18S of the Privacy Act.

Following a full investigation of this matter, the Commissioner was of the opinion that the Betting Agency did not intentionally contravene section 18S.  The Commissioner took into consideration information provided by the Betting Agency that it ceased accessing credit information files after receiving advice from the Commissioner that this may be unlawful. 

The Commissioner decided not to investigate the matter further and closed this matter on the grounds that by ceasing to access consumer credit information files, the Betting Agency had adequately dealt with this matter.  The Commissioner noted however, that any future access by the Betting Agency to consumer credit information files may be viewed as an intentional contravention of section 18S and a credit reporting offence.

OFFICE OF THE PRIVACY COMMISSIONER

August 2008