Determination under the Privacy Act 1988: 1991 No 2 (s.18E(3)) concerning identifying particulars permitted to be included in a credit information file

Last Modified 23 August 2001

• Concerning identifying particulars permitted to be included in a credit information file
• Reasons for determination
  • Background
  • Examination of practices
  • Minimising intrusiveness
  • Permitted items
  • Monitoring

Under s.18E(3) of the Privacy Act 1988, I DETERMINE that:

1. The following kinds of information are reasonably necessary to be included in an individual's credit information file in order to identify the individual:

(i) full name, including any known aliases; sex; and date of birth;
(ii) a maximum of three addresses consisting of a current or last known address and two immediately previous addresses;
(iii) name of current or last known employer; and
(iv) driver's licence number.

2. This determination shall take effect on 24 September 1991.

Dated 11 September 1991

Kevin Patrick O'Connor
Privacy Commissioner

Back to Top

Reasons for determination

Background

1. In accordance with s.18E(3) of the Privacy Act 1988, as amended by the Privacy Amendment Act 1990, the Privacy Commissioner may determine the kinds of information that are reasonably necessary to be included in an individual's credit information file in order to identify the individual.

Back to Top

Examination of practices

2. Prior to formulating this determination, I examined current practices engaged in by the major credit reporting agencies which provide consumer credit reports (Credit Reference Association of Australia, and Tasmanian Collection Service). Account was taken of the types of information which the credit reporting agencies currently use for identification and matching of credit information files.

Back to Top

Minimising intrusiveness

3. Balanced against the need to ensure maximum accuracy in relation to matching credit information files, I took account of the requirements of s.18E of the Act, which sets strict limits on the permitted contents of credit information files. In accordance with the spirit of that section, I have sought to minimise the possibility of unnecessary personal information being included on an individual's credit information file. The objective was to ensure that the need to hold identifying particulars in a credit information file did not give rise to unnecessary intrusion when information from the credit information file was disclosed in the form of a credit report. As a result, a number of items which are currently collected, such as marital status and spouse's name, have not been included in the determination, and a limit has been placed on the number of previous addresses that can be kept on an individual's credit information file.

4. It should be noted that a credit reporting agency does not have to include all of the permitted identifying particulars in an individual's credit information file. For example, should a credit reporting agency consider that it does not need to rely on a driver's licence number in order to identify an individual from its files, then it is acceptable that this item is not included in the credit information files maintained by the agency.

Back to Top

Permitted items

5. Listed below are the types of information that I have determined to be reasonably necessary to be included on an individual's credit information file and the reasons for doing so:

(i) Full name including any known aliases, sex, date of birth: These are all basic identifiers in common use in the community, and together assist significantly in distinguishing between people with other similar or the same identifiers.

(ii) Address Information

Current or last known address: An identifier in common use in the community and routinely gathered in business settings.

Previous addresses: In the light of consultation with credit reporting agencies and the long experience of the New South Wales Privacy Committee in this field, I am satisfied that there is a need for a credit reporting agency to keep an individual's previous address information to assist in ensuring that an enquiry from a credit provider who might, for example, have an old address, is properly matched. In the interests of privacy, reasonable limits should be placed on the possibility of a history of addresses being compiled. Accordingly, this category of information on the file should be limited to only two immediately previous addresses.

During public consultations on the draft of this determination, it was suggested (by the New South Wales Privacy Committee) that a credit reporting agency be allowed to retain previous address information for only five years. The concern, I understand, was related mainly to the possibility that an individual who might have no outstanding credit commitments, or who has not made any new applications for credit over a lengthy period, could still have a file with the credit reporting agency. While I appreciate the point that a time limitation on retention of previous address information might be in keeping with other requirements for deletion of file information after a period, I have taken the view, based on the advice from the CRAA that it automatically deletes files which have been inactive for five years, that a requirement of this sort should not be imposed unless experience shows that retention of this information does have significant privacy implications. This question can be reviewed in the light of any problems or complaints that arise once the Act comes into force.

(iii) Name of current or last known employer: A discrepancy between an individual's stated employer and the information included in a credit information file would alert a credit provider to the possibility of an inaccurate match in circumstances where all other identifiers indicated an accurate match. It is accepted that while an individual's employment details do not constitute an important element in the process of a credit reporting agency identifying an individual from the agency's files, such information is a more important identifier for a credit provider and should be permitted to be included in a credit information file. Consideration was given to restricting employment information to a generic description of an individual's occupation, such as 'teacher' or 'electrician'. However, the view was strongly put to me in consultation that a description of occupation on its own would in many cases be too imprecise for it to be of any value in identifying an individual. In view of this, information on occupation has not been included as permissible contents of a credit information file, but recording the name of the current or last known employer will be permitted.

(iv) Driver's Licence Number: This number is generated by State and Territory driver licensing authorities for reasons unconnected with credit granting. Nonetheless the number is widely collected as a routine identifier in connection with credit transactions. It has, for many years, been a routine element of the identifying particulars collected by credit reporting agencies and by credit providers. Under the credit reporting system the CRAA relies upon the driver's licence number to assist with identity problems. The driver's licence number provides the agency with an additional identifier with which to correctly identify and match files. The information provided by the CRAA suggested that this information plays a part in correctly identifying and matching a proportion of credit information files.

It is considered that the practice of credit reporting agencies holding this item of information should continue, especially in light of the many years' experience of the New South Wales Privacy Committee in its monitoring of the credit reporting system.

I acknowledge (as observed by the Australian Privacy Foundation during consultation on the draft determination) that the holding of a driver's licence number is inconsistent with usual privacy principles and tends to encourage its use as a universal identifier. Nonetheless its use in this area is long-established and the New South Wales Privacy Committee advises that it has received very few complaints about misuse of the driver's licence number. It would, I consider, be unfairly disruptive to prevent its continued use, especially in light of the views of the New South Wales Privacy Committee. But I note that there has been considerable recent public controversy over improper accessing of personal information held in connection with a range of official records including driver's licence information. If I detect evidence of abuse of this element of this determination, I will consider revoking it immediately.

Back to Top

Monitoring

6. The question of what personal information is necessary for accurate identification is one which I will continue to look at in the light of experience of the practical operation of the Act. In this connection, I will pay particular attention to assessing whether driver's licence number, previous address information and name of the current or last known employer are essential for identification purposes. I propose to review my position on the inclusion of identifying information in a credit information file when I generally review the operation of the Code of Conduct.

Kevin O'Connor
Privacy Commissioner

September 1991

For further information please contact

Privacy Commissioner
GPO Box 5218
Sydney NSW 1042

Privacy Hotline: 1300 363 992
Telephone: (02) 9284 9800
Fax: (02) 9284 9666

Email: privacy@privacy.gov.au

Back to Top