© Human Rights and Equal Opportunity Commission, 1996. ISBN 0 642 24846 X
In May 1989 following public controversy over the credit industry's intention to introduce a system of routine monitoring of consumers' management of their loans, the federal government announced its intention to regulate credit reporting practices by amending the Privacy Act. These amendments, which received Royal Assent on 24 December 1990, are contained in Part IIIA of the Privacy Act 1988. The amendments included section 18A(1) which required that I issue a Code of Conduct on credit reporting.
As required by s.18A(2) of the Act, I consulted with government, commercial, consumer and other relevant bodies and organisations during the development of the Code of Conduct.
I was assisted in developing the Code of Conduct by a Consultative Group which comprised representatives of industry (the Credit Reference Association of Australia, the Australian Association of Permanent Building Societies, the Australian Bankers' Association, the Australian Federation of Credit Unions, the Australian Finance Conference and the Retail Traders' Associations of Australia), representatives of consumers (Australian Federation of Consumer Organisations and the Australian Financial Counselling and Credit Reform Association), government representatives (from the Federal Attorney-General's Department and the Federal Bureau of Consumer Affairs) and a person experienced in privacy issues affecting credit reporting (from the New South Wales Privacy Committee). The Consultative Group was also attended by my representatives (officers of the Privacy Branch of the Human Rights and Equal Opportunity Commission).
At the time the Code was issued, it was acknowledged that the Code would not cover all aspects of credit reporting practices, and that questions would continue to arise as members of the credit industry sought to apply it to their particular circumstances. For this reason, I undertook to monitor the operation of the Code closely and conduct a general review of its contents within 18 months of its coming into force. The review commenced in late 1993.
As with the original development of the Code of Conduct, the review of the Code also involved extensive consultation with interested parties. In July 1993 I advertised the review in the national press and invited submissions. I also convened three major meetings with the Credit Reporting Consultative Group. This process of consultation involved the preparation and dissemination by my office of several discussion papers, which identified key issues for consideration in the review, and canvassed options for resolving those issues.
Advice from the Consultative Group and submissions from other interested parties did not indicate any significant dissatisfaction with the Code of Conduct. On the contrary, comments which I received indicated that for the most part the Code was perceived to be working well and that only minor changes were needed. I take this opportunity to thank those organisations and individuals who provided submissions to the development and the further review of the Code of Conduct.
Most of the changes resulting from the review of the Code were made in the Explanatory Notes as they involved guidance on technical matters or points of clarification. Very few changes were made to the legally binding requirements of the Code.
The amendments were issued by me on 6 March 1995 and were gazetted on 9 March 1995 in Special Gazette No. S 82, Thursday 9 March 1995. They took effect on 27 March 1995. The provisions of the Code which were subject to amendment have been annotated accordingly throughout the revised Code booklet. Appendix 2 lists the amendments and my reasons as to why the amendments were made. The amendments to the Code and Explanatory Notes also take into account changes made to Part IIIA of the Privacy Act by virtue of the following enactments: Law and Justice Legislation Amendment Act (No. 4) 1992 and Law and Justice Legislation Amendment Act 1993.
As with the original Code of Conduct, I will monitor closely the operation of the amended Code. I will conduct a further review of its contents to commence within three years from the date on which these amendments came into force.
Kevin O'Connor
Privacy Commissioner
Together, Part IIIA of the Privacy Act and the Credit Reporting Code of Conduct seek to apply information privacy principles to the specialised area of consumer credit reporting. The information privacy principles aim to protect personal information by emphasising the need for information collectors to be open, fair and accountable in their use of information, to ensure that the individual is given a measure of control over the manner in which personal information about him or her is used and disseminated. The principles cover a number of areas including the following:
These broad principles are reflected in the requirements of Part IIIA of the Act (passed in 1991 and fully operational in February 1992), and the Code of Conduct (issued by the Privacy Commissioner in 1991 and fully operational in February 1992), which together relate specifically to the information handling practices of credit providers and credit reporting agencies.
The Code of Conduct supplements Part IIIA on matters of detail not addressed by the Act. Among other things, it requires credit providers and credit reporting agencies to:
Part IIIA and the Code of Conduct generally only apply to consumer credit. As such, commercial credit is generally unaffected other than in limited exceptional circumstances. Exceptions include where consumer credit information relating to an individual is disclosed in the context of a commercial credit application.
The Code of Conduct, like Part IIIA of the Act, is legally binding. The Code is accompanied by Explanatory Notes which seek to explain, in a systematic way, how Part IIIA and the Code interact.
PRIVACY ACT 1988
SECTION 18A
Dated 11 September 1991
Kevin Patrick O'Connor
Privacy Commissioner
PRIVACY ACT 1988
SECTION 18A
Dated 6 March 1995
Kevin Patrick O'Connor
Privacy Commissioner
1.1 A credit reporting agency recording an enquiry made by a credit provider in connection with an application for credit may include, within the record of the enquiry, a general indication of the nature of the credit being sought.
1.2 To ensure that personal information included in credit information files and credit reports is accurate, up-to-date, complete and not misleading, a credit reporting agency must issue to credit providers or other persons supplying it with personal information detailed instructions on the types of personal information permitted to be given to a credit reporting agency.
1.3 To ensure that only permitted information is included in a credit information file, a credit reporting agency must take the following steps:
1.4 Where a credit reporting agency:
1.5 Where a credit reporting agency becomes aware that it has disclosed personal information from a credit information file, and the personal information relates to an individual other than the individual who was the subject of the enquiry, the credit reporting agency must as soon as practicable:
1.6 A credit reporting agency must ensure:
1.7 A credit reporting agency must ensure that an individual is given access to his or her personal credit information file in circumstances where the request for access
Paragraph 1.7 is a new paragraph and was issued by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
1.8 Where a credit reporting agency receives a request from an individual for access to his or her credit information file, and:
the credit reporting agency may:
Paragraph 1.8 is a new paragraph and was issued by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
1.9 Where a credit reporting agency refuses or defers a request by an individual or his/her authorised agent for access to the individual's credit information file, or charges a fee for such access, the individual or his/her authorised agent may complain to the Privacy Commissioner, who may order the credit reporting agency to provide access to that person (including an order that access be provided free of charge).
Paragraph 1.9 is a new paragraph and was issued by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
1.10 In meeting an individual's request for access to his or her credit information file, a credit reporting agency should require such evidence as is reasonable in the circumstances to satisfy itself as to the identity of the individual.
Paragraph 1.10 was previously paragraph 1.7 and was renumbered by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
1.11 A credit reporting agency in receipt of a request by an individual for access to his or her credit information file, for purposes described in paragraph 1.7 above, must give access within 10 working days of having received the request for access.
Paragraph 1.11 was previously paragraph 1.8 and was renumbered and amended by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
1.12 A credit reporting agency may not charge a fee for access by an authorised agent of an individual unless the agency believes on reasonable grounds that the agent has requested a copy of the individual's credit information file while acting as a business intermediary between the individual and the credit provider.
Paragraph 1.12 was previously paragraph 1.11 and was renumbered by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
1.12A Where a credit reporting agency denies access to an individual or his or her authorised agent because the individual or the agent has refused to pay the fee, the agency should advise the individual concerned that he or she may refer the matter to the Privacy Commissioner.
Paragraph 1.12A - amendment issued by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
1.13 Where a credit reporting agency is provided with a statement by an individual of an amendment sought, and the credit reporting agency considers the statement unduly long, the credit reporting agency shall, as soon as possible, but in any event no later than 30 days, refer the statement to the Privacy Commissioner for a reduction as considered appropriate. In referring the statement, the credit reporting agency may include a suggested shortened version prepared by the credit reporting agency for consideration by the Privacy Commissioner. A copy of the suggested shortened version must, at the same time, be given to the individual concerned.
1.14 Where an amendment has been made to, or a statement has been included in, an individual's credit information file, and the amended information or the statement relates to information of a type detailed in any one or more of subparagraphs (i), (v), (vi), (vii), (viii), (ix) or (x) of paragraph 18E(1)(b) of the Act, the credit reporting agency must, within 14 days of amending the information or including the statement:
1.15 Before a credit reporting agency discloses personal information contained in a credit information file, the credit reporting agency should ensure that the recipient of the information has been notified of the requirements of the Act governing limitations on use and disclosure of personal information contained in credit reports and credit information files.
1.16 A credit reporting agency should include in a credit report a warning to the effect that overdue payments which were listed prior to 25 February 1992 may need to be verified by the credit providers which listed the overdue payments in order to ensure the currency of the listings. This warning is to be given on all reports for five years after 25 February 1992.
1.17 On each occasion a credit reporting agency discloses personal information contained in an individual's credit information file, a note of the disclosure must be included in the file, setting out:
1.18 Credit reporting agencies must maintain annual records, which must be made available upon request to the Privacy Commissioner, indicating the occurrence of serious credit infringement listings made by individual credit providers where the listings had not been previously reported as overdue payments.
2.1 Where a credit provider makes an enquiry to a credit reporting agency in connection with an application for credit, and the amount of credit sought is unknown or incapable of being specified, the credit provider may advise the credit reporting agency that the amount of credit being sought is unspecified. The credit reporting agency may then record that an unspecified amount of credit is being sought.
2.2 Where a credit provider has made an enquiry to a credit reporting agency in connection with an application for credit, and subsequently becomes aware that the credit report given by the credit reporting agency related to an individual other than the one to whom the enquiry related, the credit provider must:
2.3 Where a credit provider has informed a credit reporting agency that it was a current credit provider in relation to an individual, and the credit provider ceases to be a current credit provider in relation to the individual, the credit provider must as soon as practicable, but in any event no later than 45 days after ceasing to be a current credit provider, notify the credit reporting agency that it is no longer a current credit provider in relation to the individual.
2.4 Where a credit provider has been notified by a credit reporting agency in accordance with paragraph 1.3 that it has given the credit reporting agency information which the credit reporting agency is not permitted under the Act to include in an individual's credit information file, the credit provider must take steps to remedy its reporting procedures to ensure that the requirements of the Act may be complied with in future.
2.5 Where a credit provider becomes aware that
the credit provider must immediately advise the credit reporting agency of the inaccuracy or the existence of prohibited information.
2.6 Where a credit provider has been notified by a credit reporting agency in accordance with paragraph 1.4 it shall:
2.7 A credit provider may report an overdue payment to a credit reporting agency:
2.8 A credit provider must not give to a credit reporting agency information about an individual being overdue in making a payment where recovery of the debt by the credit provider is barred by the statute of limitations.
2.9 A credit provider must not report to a credit reporting agency an overdue payment listed against a guarantor:
2.10 Where a credit provider has previously listed with a credit reporting agency an overdue payment or a serious credit infringement against an individual in respect of an amount outstanding, and the credit provider subsequently enters into an arrangement with the individual for the repayment of the outstanding amount, the credit provider may contact the credit reporting agency to advise that a note should be included in the individual's credit information file to the effect that an arrangement has been entered into with the individual for repayment of the outstanding amount.
Paragraph 2.10 - amendment issued by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
2.11 Where a credit provider has reported a joint serious credit infringement in respect of an amount outstanding, and is subsequently satisfied that one of the individuals was released from the obligation to repay the outstanding amount by an order of a court or by legal agreement, the credit provider should advise the credit reporting agency that the serious credit infringement listing should be removed from that individual's credit information file.
2.12 Before a credit provider obtains from another credit provider a report about an individual's consumer credit worthiness, the credit provider obtaining the report must be satisfied that the individual has given his or her specific written agreement to the disclosure (unless the report is requested for the purpose of assessing an application for either consumer credit or commercial credit that was at first made orally, in which case the agreement need not be in writing).
2.13 A credit provider which has been requested by another credit provider to disclose to the latter information about an individual's consumer credit worthiness should be satisfied that the second credit provider has obtained the individual's specific agreement to the disclosure. If the individual's specific agreement has not been obtained, the first credit provider may not, unless it had itself obtained the individual's specific agreement to the disclosure for the particular purpose, disclose the personal information to the second credit provider.
2.14 Whenever a credit provider obtains from another credit provider a report about an individual's consumer credit worthiness, the credit provider requesting the report shall make a record of:
2.14A A record which is made by a credit provider in accordance with paragraph 2.14 should be retained for a minimum period of 12 months from the date on which it is made.
Paragraph 2.14A is a new paragraph and was issued by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
2.15 Where a credit provider has obtained from another credit provider information about an individual's credit worthiness, and subsequently becomes aware that the report given by the other credit provider was mistaken because it related to an individual other than the one to whom the enquiry related, the first credit provider must:
2.16 A credit provider which is a bank may not disclose to another bank a 'banker's opinion' relating to an individual's consumer credit worthiness, unless that individual's specific agreement to the disclosure of such information for the particular purpose has been obtained.
2.17 Where a credit provider has been requested by an agent of an individual to disclose to the agent personal information relating to the individual's credit arrangements with the credit provider, the credit provider should satisfy itself that the agent is acting under the specific written agreement of the individual before disclosing the information. Where the credit provider is not satisfied that a written agreement exists, the credit provider shall request that the agent of the individual produce evidence of the specific written agreement before making the disclosure.
2.18 A credit provider may furnish to an individual's authorised agent only information permitted by the scope of the individual's written agreement.
2.19 Where a credit provider provides a report about an individual's credit worthiness to an authorised recipient other than a credit provider, the credit provider should, to the extent practicable, make a record of the disclosure.
2.20 A credit provider must ensure that
2.21 A credit provider must, when so requested in writing by an individual, attempt to give that individual access to any of his or her credit reports which are in the possession of the credit provider within 10 working days, and in any event, must give access within 30 calendar days of receipt of the individual's request.
2.22 Where an individual has requested access to a credit report which he or she believes may be in the possession of a credit provider to whom the individual has applied for credit, and the credit provider no longer possesses the report, the credit provider must advise the individual to contact the credit reporting agency from which a copy of the credit information file may be obtained.
2.23 Where a credit provider receives a request from an individual for an amendment of, or for the inclusion of a statement in, a credit report issued by a credit reporting agency, the credit provider should, within 10 working days of receipt of the request:
3.1 Credit reporting agencies and credit providers must handle credit reporting disputes in a fair, efficient and timely manner.
3.2 Credit reporting agencies and credit providers must establish procedures to deal with a request, in writing, by an individual for resolution of a dispute relating to credit reporting.
3.3 A credit provider should refer to a credit reporting agency for resolution a dispute between that credit provider and an individual where the dispute concerns the contents of a credit report issued by the credit reporting agency.
3.4 In referring a dispute to a credit reporting agency, a credit provider must inform the individual of the referral and must provide the individual with the name and address of the credit reporting agency.
3.5 Upon receipt, from a credit provider, of a referral of a request for dispute resolution, a credit reporting agency must handle the request as if the request had been made directly to the agency by the individual concerned.
3.6 Where a credit reporting agency is unable to clearly establish the nature of the dispute which has been referred to it for resolution by a credit provider, the agency may write to the individual concerned asking for further information, before proceeding with the request.
3.7 Where a credit reporting agency establishes that it is unable to resolve a dispute it must immediately inform the individual concerned that it is unable to resolve the dispute and that the individual may complain to the Privacy Commissioner.
3.8 Where an individual has requested an amendment to personal information included in a credit information file or credit report, and the credit reporting agency establishes that an amendment to personal information contained in the credit information file or credit report is necessary, the credit reporting agency must, as soon as practicable, but in any event, within 5 working days, amend the file or report.
3.9 Where a credit reporting agency is informed that an individual is no longer overdue in making a payment or that the individual contends that he or she is not overdue in making the payment, the credit reporting agency must, within 5 working days of being so informed, add to the credit information file or credit report a note to that effect.
3.10 Where a credit reporting agency does not amend a disputed entry in accordance with an individual's request, the credit reporting agency must, within 30 days of having received the individual's request, inform the individual in writing of:
3.11 Where a credit reporting agency is provided by an individual with a statement for inclusion in his or her credit information file or credit report, and the credit reporting agency considers the statement unduly long, the credit reporting agency may, within 30 days, refer the statement to the Privacy Commissioner for a reduction as considered appropriate.
3.12 In referring the statement, the credit reporting agency may include a suggested shortened version prepared by the credit reporting agency for consideration by the Privacy Commissioner. A copy of the suggested shortened version must, at the same time, be sent to the individual concerned.
3.13 A credit reporting agency must, where so requested by an individual, remove from his or her credit information file or credit report any statement previously provided by the individual for inclusion in his or her credit information file or credit report.
3.14 Where an amendment has been made, or a statement provided by the individual has been included by a credit reporting agency in the individual's credit information file or credit report, the credit reporting agency shall, within 14 days of having made the amendment or included the statement:
3.15 Where, as a result of a dispute having been resolved, a credit reporting agency amends information from a credit information file or credit report and that information is of a type detailed in sub-paragraphs 18E(1)(b)(i), (v), (vi), (vii), (viii), (ix) or (x) of the Act, the credit reporting agency must, within 14 days of amending the information:
3.16 Where a credit reporting agency or a credit provider receives a request in writing from an individual seeking resolution of a dispute concerning an act or practice of the credit reporting agency or credit provider in relation to credit reporting, the credit reporting agency or credit provider should, within 30 days of receipt of the request:
3.17 The Privacy Commissioner may decide not to investigate a complaint about a credit reporting dispute if the Commissioner considers that:
3.18 Where the Privacy Commissioner decides not to investigate an individual's complaint about a credit reporting dispute, the Commissioner shall advise the individual of the reasons for his or her decision not to investigate the complaint.
4.1 Credit reporting agencies, credit providers and others lawfully involved in the handling of personal information contained in credit information files and credit reports shall take such steps as are reasonable in the circumstances to inform those staff whose duties involve handling of personal information included in credit information files or credit reports of the requirements of the Act and the Code of Conduct, and in particular:
4.2 The time limits set out in Parts 1, 2 and 3 of this Code of Conduct and affecting acts and practices of credit reporting agencies and credit providers may be varied with the approval of the Privacy Commissioner where the parties concerned are unable to comply with the specified time limits due to circumstances such as technological failures or due to other practical or unforeseen difficulties.
4.3 The Privacy Commissioner shall review the Code of Conduct after 18 months of its operation, and may, following consultation with affected parties, make amendments to the Code as considered necessary.
4.4 Where a term used in this Code of Conduct is defined in the Privacy Act, the term has the meaning given to it by the Privacy Act.
These explanatory notes are provided to assist in understanding the relationship between the Code of Conduct and the Act, and give guidance on what practical steps should be taken to achieve compliance.
The notes first deal in turn with the standards applying to credit reporting agencies and credit providers. The notes then cover the dispute-settling procedures and finally, address other matters such as staff training and the review of the operation of the Code.
The provisions of the Code of Conduct are inserted in the relevant places throughout these notes and are distinguishable by bold typeface, indentation, and separate numbering.
The Code provisions, denoted in bold typeface, have the force of law and must be complied with. The ordinary, unbolded typeface seeks to summarise the requirements of the Act and contains guidance on how compliance with the statutory requirements of the Act and the Code may be achieved.
The Code of Conduct came into effect on 24 September 1991 but none of the provisions of the Code of Conduct were legally-binding until 25 February 1992. In reviewing the Code of Conduct and the Explanatory Notes, some changes were made and are marked in appropriate areas in the text. The amendments to the Explanatory Notes also reflect changes to the law made by the Law and Justice Legislation Amendment Act (No. 4) 1992 and the Law and Justice Legislation Amendment Act 1993 which took effect on 7 December 1992 and 18 January 1994 respectively.
1 Personal information must not be included in an individual's credit information file unless that information is permitted to be on the file in accordance with s.18E of the Privacy Act. Section 18E(1) of the Privacy Act permits inclusion of the following information:
2 Because of the size of the credit reporting system, and the large number and variety of credit applications recorded every year, it is accepted that an account type indicator should be allowed to be included in the file in order to facilitate speedy and accurate identification and verification by credit providers of the enquiries recorded in credit information files.
3 Credit reporting agencies will advise members as to acceptable forms of account type indicator following consultation with the Privacy Commissioner.
4 Credit reporting agencies must ensure that personal information contained in credit information files is deleted in accordance with the requirements of s.18F and s.18V(3) of the Privacy Act.
5 Section 18F provides time limits for the retention of personal information permitted under s.18E to be included in a credit information file. Section 18V(3) provides that these time periods commence on 25 February 1992. Credit reporting agencies must, within one month of the expiry of the permitted time period (referred to as `maximum permissible periods') applying to each category of personal information, delete personal information from the file. The length of time personal information may be retained is as follows:
6 Credit reporting agencies must take reasonable steps to ensure that personal information contained in credit information files is protected by security safeguards against loss, unauthorised access, use, modification or disclosure and against other misuse. These requirements are spelt out in section 18G of the Act which requires credit reporting agencies to:
7 Credit reporting agencies must ensure that personal information contained in credit information files is accurate, up-to-date, complete and not misleading. Where there is doubt as to a credit reporting agency's ability to comply with these standards of accuracy, up-to-dateness, and completeness in respect of any item of information, such items should be removed from the credit information file (see s.18G of the Act).
8 For the purposes of s.18J(1), reasonable steps to amend credit information files created before the commencement of the Act may be considered to have been taken by a credit reporting agency when the credit reporting agency, upon discovering that the contents of any credit information file are not accurate, up-to-date, complete or are misleading, immediately makes any amendments which the agency considers are necessary to render the contents of the credit information file accurate, up-to-date, complete and not misleading.
the credit reporting agency must, as soon as practicable:
9 Where information from an individual's credit information file has been disclosed in error, the credit reporting agency will, in accordance with the requirements of s.18K(5) of the Act, record on the individual's credit information file a note of the disclosure having mistakenly occurred.
10 Once a credit provider has received advice from a credit reporting agency of a kind described in Code provisions 1.3 and 1.4 above, the credit provider is then subject to the requirements of provisions 2.4 and 2.6 of the Code of Conduct that steps be taken to ensure that non-permitted information is not supplied to a credit reporting agency.
11 A credit reporting agency is required under s.18H of the Act to take reasonable steps to ensure that an individual or his or her authorised agent can obtain access to the individual's credit information file. This provision of the Act comes into force on 24 September 1991.
12 A credit reporting agency giving to an individual or to his or her authorised agent access to the individual's credit information file should take reasonable steps to safeguard delivery of the copy of the file to the individual concerned or to his or her agent, and should ensure that the information is in a form that is readily intelligible.
Paragraph 1.7 is a new paragraph and was issued by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
the credit reporting agency may:
Paragraph 1.8 is a new paragraph and was issued by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
13 A credit reporting agency may provide a copy of an individual's credit information file to a person who has been authorised in writing to act on the individual's behalf. In accordance with s.18H of the Act, which comes into force on 24 September 1991, such an agent of the individual may exercise the rights on behalf of the individual only in connection with:
This provision would typically apply to situations where an individual engages the services of a debt counsellor or a financial advisor.
As a guide only some suggested forms of wording to be used by agents when obtaining credit information from credit reporting agencies are provided.
I/we [name/s] authorise [counsellor's name] or other persons providing financial counselling employed by [counselling agency's name] to:
Act as my/our agent in seeking access to my/our consumer credit information file held by [name of credit reporting agency].
This authority only applies to enquiries made by [counsellor's name] or persons employed by [counselling agency's name] in connection with:
(Signed and dated by the parties).
Paragraph 1.9 is a new paragraph and was issued by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
Paragraph 1.10 was previously paragraph 1.7 and was renumbered by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
Paragraph 1.11 was previously paragraph 1.8 and was renumbered and amended by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
Paragraph 1.12 was previously paragraph 1.11 and was renumbered by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
Paragraph 1.12A - amendment issued by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
14 In considering whether or not an agent of the individual should be charged a fee for access, credit reporting agencies should take into account the nature of the service being provided by the agent. For example, where the service is provided by a financial counsellor to assist the individual in meeting his or her credit obligation, a fee should not be charged.
15 Section 18J(1) requires a credit reporting agency to take reasonable steps by way of making appropriate amendments to ensure that the contents of credit information files are 'accurate, up-to-date, complete and not misleading'.
16 Where an individual requests an amendment to his or her credit information file, a credit reporting agency should promptly address the question of whether the amendment sought can be made and, if possible, accommodate the individual's request.
17 Where a credit provider refers to a credit reporting agency an individual's request for amendment or inclusion of a statement to the individual's credit information file, the credit reporting agency should:
18 Where the credit reporting agency does not make the change(s) sought, the agency should advise the individual of his or her rights to have a statement included in the file of the amendment sought by the individual. If the individual requests that a statement be included in the file, the credit reporting agency is then required by s.18J(2) to take reasonable steps to include the statement in the file within 30 days of the individual's request.
19 Credit reporting agencies should attempt to accommodate the wishes of an individual in regard to the length of a statement before referring the statement to the Privacy Commissioner. As a guide, credit reporting agencies should generally be prepared to accept statements of up to 150 words in length.
20 A credit reporting agency must not disclose personal information contained in a credit information file unless the disclosure is in accordance with s.18K of the Privacy Act. Generally, disclosure by a credit reporting agency of personal information contained in credit information files is limited to:
21 Where a credit reporting agency receives a request by a law enforcement authority for disclosure of information from an individual's credit information file in connection with a serious credit infringement, the credit reporting agency should, wherever practicable, obtain from the law enforcement authority, a notice in writing to the effect that the law enforcement authority believes that the individual concerned has committed a serious credit infringement.
22 A credit reporting agency may, in accordance with s.18K(1)(f), disclose a credit report to a credit provider listed as a current credit provider in relation to the individual where the credit reporting agency had received information about the individual's overdue payments, and held such information on the individual's file for at least 30 days before disclosing the information.
23 This may be achieved by way of the credit reporting agency making its membership conditional upon the credit provider observing the requirements of the Privacy Act. The notice may be given at the time membership is granted, or at renewal of membership.
24 It may be difficult for some credit providers to ascertain whether a report of an overdue payment had been made to a credit reporting agency prior to 25 February 1992. This warning is aimed at assisting credit providers in meeting the requirements under s.18F(3) that a credit provider must inform a credit reporting agency, as soon as practicable, of the fact that an individual has ceased to be overdue in making a payment or contends that he or she is not overdue in making the payment, where the credit provider had previously reported to the credit reporting agency about the overdue payment.
25 In disclosing personal information to a credit provider listed on an individual's credit information file prior to 25 February 1992 as being a current credit provider in relation to the individual, the credit reporting agency should request the credit provider to verify that it is still a current credit provider in relation to the individual. The agency should take reasonable steps to remove from an individual's credit information file names of any credit providers not currently providing credit to the individual.
26 The Act does not impose restrictions on the disclosure by a credit reporting agency of commercial credit information where the disclosure is in response to enquiries by credit providers for purposes associated with the giving of commercial credit.
27 In giving a credit report to a credit provider for the purposes of the credit provider assessing an individual's application for consumer credit, a credit reporting agency must observe the requirements of s.18K(6), which prohibits the credit reporting agency from including in the report any information about the individual's commercial activities, other than commercial information that the credit reporting agency is permitted under s.18E to include in the individual's credit information file. Examples of permitted commercial information include:
28 Such records must be capable of detailing specific serious credit infringement reports made by individual credit providers.
29 Where a credit provider intends to obtain a consumer credit report issued by a credit reporting agency to assess an application for either consumer or commercial credit, the credit provider will first need to notify the individual that items of personal information will be disclosed to a credit reporting agency by the credit provider.
30 There are other occasions during the life of the individual's loan contract with the credit provider where the credit provider may wish to disclose personal information to a credit reporting agency. The credit provider will not be permitted to do this unless the individual has previously been notified of the disclosure. These notices should be given at the time the individual applies for credit with the credit provider. If such a notice was given, credit providers would then not be required to issue a specific notice prior to any subsequent disclosures.
31 The notice may be given orally. However, obtaining a written acknowledgment, where practicable, is advisable for reasons of certainty.
32 The notice should explain clearly what items of the individual's personal information may be disclosed to a credit reporting agency. As a guide only to credit providers, the following form of wording is considered to be an appropriate form of notification. It should be noted that not all of the information categories listed below need to be included in the notice.
[Name of credit provider] may give information about you to a credit reporting agency for the following purposes:
This information is limited to:
This information may be given before, during or after the provision of credit to you.
(Acknowledged by the individual)
33 Specific agreements with individuals are required in a number of circumstances. However, it should be noted that not all agreements will be required in most cases. For example, it is not anticipated that in the case of applications for commercial credit, access to consumer credit reports is automatically required, and vice versa.
34 The agreements with credit applicants required to be obtained under the Privacy Act relate to activities engaged in by:
credit providers when:
trade insurers when:
Paragraph 34 updated in March 1995.
35 When entering into agreements with an individual, credit providers will first need to ascertain whether the type of credit being applied for is consumer or commercial credit. If a credit provider is unable to ascertain the nature of the credit being applied for, the individual who is applying for the credit should be requested to advise the credit provider as to the nature of the credit being sought.
36 As a guide to credit providers, the following paragraphs give forms of wording which are considered likely to meet the requirements of the Privacy Act.
In assessing an application for consumer credit a credit provider must not use any information concerning an individual's commercial activities or commercial credit worthiness that was obtained from a commercial reporting agency unless the individual has given his or her prior written agreement to the information being obtained by the credit provider for this purpose. The agreement need not be in writing when the application is, in the first instance, made orally.
I/we agree that [name of credit provider] may:
obtain information about me/us from a business which provides information about the commercial credit worthiness of persons
for the purpose of assessing my/our application for consumer credit.
(Signed and dated by the individual/s)
Where a credit provider in receipt of an individual's application for commercial credit wishes to obtain a consumer credit report from a credit reporting agency in order to assess the individual's application for commercial credit, the credit provider must obtain the specific written agreement (unless the application for commercial credit was in the first instance made orally, in which case the agreement need not be in writing) of the individual to receive information from a credit reporting agency for that purpose.
I/we agree that [name of credit provider] may:
obtain a consumer credit report containing information about me/us from a credit reporting agency
for the purpose of assessing my/our application for commercial credit.
(Signed and dated by the individual/s)
Under the Act a credit provider may not obtain a credit report issued by a credit reporting agency in respect of an individual who has offered to act as a guarantor to another individual's loan with the credit provider unless the credit provider has obtained the guarantor's specific agreement to the report being given to the credit provider for that purpose.
I/we agree that [name of credit provider] may:
obtain from a credit reporting agency a consumer credit report containing information about me/us
for the purpose of assessing whether to accept me/us as a guarantor for credit applied for by, or provided to, the borrower(s) [named below].
I/we agree that this agreement commences from the date of this agreement and continues until the credit covered by the borrower(s) application ceases.
(Signed and dated by the individual/s)
A credit provider must obtain an individual's specific written agreement in order to disclose personal information to a person who is acting as guarantor or who has provided property as security for a loan, unless the following circumstances apply:
A credit provider must also obtain an individual's specific written agreement when disclosing personal information to a person who is considering whether to offer to act as guarantor or to offer property or security for the individual's loan.
The agreement need not be written when the application is, in the first instance, made orally.
I/we agree that [name of credit provider] may:
give to a person who is currently a guarantor, or whom I/we have indicated is considering becoming a guarantor, a credit report containing information about me/us
for the purpose of [name of the prospective guarantor] deciding whether to act as guarantor, or
(Signed and dated by the individual/s)
Where an individual becomes overdue in making a payment in respect of commercial credit given by a credit provider, that credit provider may only obtain a consumer credit report from a credit reporting agency to assist in collecting overdue payments if:
I/we agree that [name of credit provider] may:
obtain a consumer credit report about me/us from a credit reporting agency.
for the purpose of collecting overdue payments relating to commercial credit owed by me/us.
(Signed and dated by the individual/s)
The exchange of commercial or trade references between credit providers in relation to commercial credit transactions is unaffected by the Privacy Act.
Where a credit provider, in accordance with s.18N(1)(b), wishes to obtain from, or to give to, another credit provider, a report about an individual's consumer credit worthiness for a particular purpose, the individual's specific written agreement will need to be obtained for the particular purpose (unless the report is sought for the purpose of assessing an application for credit or commercial credit that was initially made orally, in which instance the agreement need not be in writing). Ideally, credit providers should draw to the individual's attention, and explain at the time of obtaining the specific agreement, the effect of such an agreement.
It should be noted that, for the purpose of this provision of the Act, a 'report' means a credit report issued by a credit reporting agency, as well as any other record or information which has a bearing on an individual's credit worthiness (see s.18N(9) of the Act).
Trade insurers wishing to obtain a credit report from a credit reporting agency for the purposes of assessing whether to provide insurance to a credit provider in respect of commercial credit provided by the credit provider to the individual must have the individual's specific written agreement to the report being given to the trade insurer for that purpose.
I/we agree that [name of credit provider] may:
exchange information about me with those credit providers names in this application or named in a consumer credit report issued by a credit reporting agency
I/we understand that the information exchanged can include anything about my/our credit worthiness, credit standing, credit history or credit capacity that credit providers are allowed to exchange under the Privacy Act.
(Signed and dated by the individual/s)
37 A credit provider may only obtain access to a credit report issued by a credit reporting agency if the credit provider is permitted by law to be given the information by the credit reporting agency.
38 Access to credit information contained in a credit information file held by a credit reporting agency is generally restricted to those businesses or persons falling within the definition of 'credit provider' given under s.11B of the Act. The Privacy Commissioner has issued a determination (see text of determination at Appendix 1) under sub-paragraph (v) of s.11B(1)(b) to declare to be 'credit providers' those businesses which are not automatically covered by those categories defined in paragraphs (a), or (b)(i) - (iv) of s.11B(1).
39 Credit provider must not use any personal information contained in a credit report issued by a credit reporting agency unless the use is in accordance with s.18L of the Act. Section 18L of the Act permits only the following uses:
40 A credit provider who has refused an individual's application for credit based on a credit report issued by a credit reporting agency must provide the individual with written notice of refusal, informing the individual:
Paragraph 40 amended in March 1995.
40A A credit provider who refuses an individual's application for credit because of a credit report issued by a credit reporting agency about a proposed guarantor must provide the individual with written notice of the refusal, informing the individual that the refusal was based wholly or partly on the guarantor's credit report.
Paragraph 40A added in March 1995.
41 A credit provider must also, in refusing an application for credit made jointly by an individual and one or more other persons and the refusal was based wholly or partly on a credit report relating to one of those other persons, inform the individual of this fact.
42 In advising applicants for credit that the credit has been refused, the following standard statement may be used.
Dear [applicant's name]
I am writing to inform you that your application for credit has not been approved.
Our decision to refuse your application was based wholly/partly on
(delete as applicable)
Under the Privacy Act 1988, you have the right to obtain access to your credit information file held by a credit reporting agency. The most convenient way for you to obtain access to your credit information file is to contact [name of credit reporting agency] at [address of credit reporting agency].
When writing to the credit reporting agency, you should print your name and address in full. The credit reporting agency may require you to provide other identifying particulars.
43 Circumstances where an amount of credit sought in an application for credit is not specified typically involves credit relating to:
Where the amount of credit being sought is known, the Act requires, under s.18E(1)(b)(i)(B), that the amount sought must be recorded.
44 Upon being informed of the mistake as to identity, the credit reporting agency will, in accordance with s.18K(5) of the Act, record on the individual's credit information file a note of the disclosure having been mistakenly made.
45 A credit provider who has approved an individual's application for credit and entered into a credit agreement may notify any credit reporting agency that it is a current credit provider in relation to the individual.
46 The credit provider will then be listed on the individual's credit information file as a 'current credit provider' for the purposes of receiving information about overdue payments owed by that individual to another credit provider.
47 Where a credit provider has previously notified a credit reporting agency that an individual to whom it provided credit is overdue in making a payment and that individual subsequently fulfils his or her obligations in relation to that payment, or that the individual contends that he or she is not overdue in making the payment, the credit provider must, as soon as practicable, notify the credit reporting agency that the individual concerned is no longer overdue, or that the individual contends that he or she is not overdue in making the payment, as the case may be (s.18F(3)).
48 As it may be difficult for credit providers to ascertain whether a report of an overdue payment had been made to a credit reporting agency before 25 February 1992, it is suggested that in order to fulfil this obligation, credit providers should, as far as practicable, adopt the practice of notifying the credit reporting agency as a matter of course when an individual is no longer overdue in making a payment, or contends that he or she is not overdue, as the case may be. (See also Code provision 1.16 and paragraph 24 on page 45 of Explanatory Notes).
49 In the case of an instalment loan where the individual is overdue in respect of a payment, the individual is considered to remain overdue until all arrears are brought up to date. That is, the credit provider is not required to make a series of reports of overdue payments and reinstatements in respect of the loan while the individual is still behind in payment.
50 For the purposes of revolving credit arrangements, the obligation upon a credit provider to notify a credit reporting agency that it is no longer a current credit provider in relation to an individual does not apply until such time as the revolving credit arrangement ceases to exist between the credit provider and the individual. That is, the credit provider ceases to a credit provider only when the account is actually closed, and not when the account is merely inactive (e.g. there is a 'nil' balance on the account).
51 A credit provider ceases to be a current credit provider in relation to an individual where:
Paragraph 51 amended in March 1995.
52 Where a credit provider is aware that, or would expect that, it notified a credit reporting agency prior to 25 February 1992 that it was providing credit to an individual, and the individual discharges his or her credit obligations after 25 February 1992, the credit provider should take reasonable steps to advise the credit reporting agency that the individual's credit obligations have been discharged. This could be achieved by responding to a request by a credit reporting agency for verification of current credit provider status (see paragraph 25 in the Explanatory Notes).
the credit provider must immediately advise the credit reporting agency of the inaccuracy or the existence of prohibited information.
53 A credit provider must not give to a credit reporting agency personal information about an individual unless the credit provider has reasonable grounds for believing that the information is correct.
54 Where an individual becomes overdue in respect of credit given by a credit provider the credit provider may not report the overdue payment to a credit reporting agency unless the credit provider has first notified the individual that the credit provider may lodge a report about the overdue payment against the individual with a credit reporting agency.
55 A credit provider may report an overdue payment to a credit reporting agency in respect of a savings account, or a similar facility which has been overdrawn, provided that the credit provider has first notified the individual of the disclosure.
55A The prohibition in paragraph 2.8 includes the re-listing of information with the same credit reporting agency after the maximum period permitted for the retention of such information on a credit information file has expired.
Paragraph 55A added in March 1995.
55B Care and judgment should be exercised by the credit provider when reporting an overdue payment to a credit reporting agency, to ensure that such reporting accords with the requirement that information contained in credit information files is accurate, up-to-date, complete and not misleading (refer section 18G).
Paragraph 55B added in March 1995.
55C An overdue payment reported by a credit provider to a credit reporting agency should generally reflect the amount which, if paid, would result in the individual no longer being overdue in respect of the debt. This may vary according to the terms of the particular loan. For example, with some loans the entire balance of the loan falls due where the individual falls into arrears by a certain amount, or on the occurrence of a particular event. Where this is the case, it should be reflected in the information reported to the credit reporting agency. The amount to be reported will not necessarily be the amount recoverable at law, which may be affected by other contingencies not foreseen at the time of reporting.
Paragraph 55C added in March 1995.
55D A credit provider may seek amendment of overdue payment information previously reported to a credit reporting agency, where legal or other developments have occurred which affect the amount by which the individual is regarded as being overdue. Changes to the credit information file may be needed to ensure that the information remains accurate, up-to-date, complete and not misleading.
Paragraph 55D added in March 1995.
55E A credit provider may only report an arrangement for repayment to a credit reporting agency where the arrangement relates to an overdue payment or serious credit infringement which has been reported by the credit provider to the credit reporting agency. An arrangement for repayment may only be reported to a credit reporting agency where it is a formal written arrangement involving a substantial renegotiation of the terms of the loan. An arrangement would normally involve a significant variation of the individual's obligations with regard to one or more of the main elements of the contract such as the period of the loan, or the size and frequency of repayments. For the purposes of paragraph 2.10 an arrangement would not include, for example, a verbal agreement to allow a one-off late payment.
Paragraph 55E added in March 1995.
55F Where the arrangement has the effect of rendering the individual no longer overdue in respect of their payments under the loan and the credit provider has reported the overdue payment(s) to a credit reporting agency, then the credit provider is obliged under section 18F(4) of the Act to report to the credit reporting agency that the individual is no longer overdue. A revised schedule of repayments would not normally be regarded as rendering the individual no longer overdue. On the other hand, an arrangement where the overdue amount is 'forgiven' would most probably be regarded as having that effect. This distinction is important because the reporting of arrangements is optional, whereas reporting that the individual is no longer overdue is mandatory. The above examples are intended as general guidance only; in all cases the question of whether the arrangement has the effect of rendering the individual no longer overdue will depend on the intention of the parties as indicated by the terms of the arrangement and any other relevant circumstances.
Paragraph 55F added in March 1995.
55G Where information relating to an arrangement for repayment has been reported to a credit reporting agency, the individual is entitled under the Act to request amendment of the information by way of correction, deletion, or addition. The request should be directed to the credit reporting agency in possession of the credit information file.
Paragraph 55G added in March 1995.
Paragraph 2.10 - amendment issued by the Privacy Commissioner (Special Gazette No. S 82, Thursday, 9 March 1995).
56 A credit provider may report an overdue payment to another credit provider only where the individual's specific written agreement to the credit provider exchanging such information with the credit provider for this particular purpose has been obtained (unless the disclosure is for the purposes of the other credit provider assessing an application for credit which was at first instance made orally to that other credit provider, in which case the agreement need not be in writing).
57 A credit provider which has lawfully obtained a credit report for the purposes of collecting overdue payments in respect of either consumer or commercial credit provided by that credit provider may use the entire report only for 'in-house'debt collection activities. That is, where such activities are conducted by a debt recovery department established within the credit provider's organisation, and no outside debt collection agents are involved.
58 Where a credit provider wishes to commence recovery action in respect of either consumer or commercial credit provided and in so doing engages the services of a debt collection agent, the credit provider may provide the debt collection agent with only certain items of information derived from a credit report obtained from a credit reporting agency for this purpose.
59 Section 18N(1)(c) of the Act provides that the only information contained in, or derived from, a credit report issued by a credit reporting agency which a credit provider may pass to a debt collection agent for the purpose of collecting overdue consumer credit payments owed to that credit provider is the following information:
Paragraph 59 amended in March 1995.
59A Section 18(1)(ca) of the Act provides an equivalent to section 18N(1)(c), but in relation to commercial credit. It provides that the only information contained in, or derived from, a credit report issued by a credit reporting agency which a credit provider may pass to a debt collection agent engaged in the collection of overdue commercial credit is the following:
Paragraph 59A added in March 1995.
60 Any other items of information in the possession of the credit provider which are not derived from a credit report issued by a credit reporting agency may also be given to a debt collection agent, but only for the purposes of the agent collecting overdue payments owed to the credit provider.
61 Under s.6(1) of the Act a 'serious credit infringement' is defined to mean
an act done by a person:
- that involves fraudulently obtaining credit, or attempting fraudulently to obtain credit; or
- that involves fraudulently evading the person's obligations in relation to credit, or attempting fraudulently to evade those obligations; or
- that a reasonable person would consider indicates an intention, on the part of the first-mentioned person, no longer to comply with the first-mentioned person's obligations in relation to credit
62 Where a credit provider has reasonable grounds to believe that an individual to whom it has provided credit has committed a serious credit infringement, that credit provider may notify a credit reporting agency, another credit provider or a law enforcement authority of the infringement.
63 Section 18E(8) requires that a credit provider may not give personal information, including a report of a serious credit infringement, to a credit reporting agency unless the credit provider has reasonable grounds for believing that the information is correct. Further, before a credit provider reports a serious credit infringement to a credit reporting agency, the credit provider must have notified the individual of the disclosure to the agency. For loans which were taken out before 25 February 1992, the requirement to have first notified the individual before disclosure to an agency may be satisfied by writing to the individual at his or her last known address, notifying him or her of the disclosure prior to the disclosure to the agency.
64 A credit provider is not required to notify the individual concerned before reporting a serious credit infringement to another credit provider or to a law enforcement authority.
65 Caution should be exercised in reporting a serious credit infringement. Overdue payment alone is not a sufficient ground for reporting a serious credit infringement. Where a credit provider forms a view in accordance with paragraph (c) of the definition of 'serious credit infringement', a guide as to what could reasonably be considered an intention on the part of an individual no longer to comply with credit obligations may include:
66 A typical example of the above situation would be cases where a deserted spouse has been left with insufficient means to meet financial obligations incurred during the marriage. A serious credit infringement may have been listed against both spouses by a credit pr