pdf (141.26 KB)

Case Citation:

J v Credit Reporting Agency [2010] PrivCmrA 11

Subject Heading:

Accuracy of a credit information file

Law:

Section 18G(a) of the Privacy Act 1988 (Cth) and parts 1.3(b) and 3.15 of the Credit Reporting Code of Conduct

The following case was decided by the Privacy Commissioner prior to 1 November 2010. On 1 November 2010 all the powers of the Privacy Commissioner under the Privacy Act were conferred on the Australian Information Commissioner. A reference to a thing done by the Privacy Commissioner before this date should be taken to have been done by the Information Commissioner.

Facts:

The complainant applied for a copy of their consumer credit information file held by a credit reporting agency.

The complainant subsequently complained to the credit reporting agency that a number of credit applications, addresses, and an overdue payment default, had been inaccurately listed on their credit file.

Issues:

Section 18G of the Privacy Act requires a credit reporting agency in possession or control of a credit file to take reasonable steps to ensure that personal information contained in the file or report is accurate, up-to-date, complete and not misleading.

Part 1.3(b) of the Credit Reporting Code of Conduct requires that where a credit reporting agency becomes aware that information supplied by a credit provider, and included in a credit information file, appears to be of a type not permitted to be included in the file the credit reporting agency must remove the information from the credit information file.

Part 3.15(b) and (c) of the Credit Reporting Code of Conduct requires that where a credit reporting agency amends a credit file after a dispute, it must advise the individual of certain things in writing within 14 days.  The individual may nominate any persons who have received the credit file in the past three months to receive notice of the amendment.  The credit reporting agency must then notify those nominated persons.

Outcome:

The Commissioner investigated the matter under section 40(1) of the Privacy Act.

The inaccurate information on the complainant’s credit file was the inclusion of information contained on a credit file under a different name.  The credit reporting agency had combined the two files because of some common identity details.  However, the common features were not significant and the credit reporting agency acknowledged that the credit files should not have been combined.

As required by the Credit Reporting Code of Conduct, the credit reporting agency removed the inaccurate information, provided the complainant with a copy of their amended credit file and offered to write to any credit provider that had accessed their file in the last three months to inform them of the amendments made. 

The complainant considered their individual complaint had been resolved.  However they asked that any systemic issues be considered in future audits or own motion investigations of the credit reporting agency. 

The Commissioner decided not to investigate the matter further under section 41(2)(a) of the Privacy Act on the basis that the matter had been adequately dealt with.

Office of the Australian Information Commissioner
December 2010