Last Modified 11 September
1991
Determination under the Privacy Act 1988: 1991 No 2 (s.18E(3))
Concerning identifying particulars permitted to be included in a credit
information file
Concerning identifying particulars permitted to be included
in a credit information file
Under s.18E(3) of the Privacy Act 1988, I DETERMINE that:
1. The following kinds of information are reasonably
necessary to be included in an individual's credit information file in
order to identify the individual:
- full name, including any known aliases; sex; and date of birth;
- a maximum of three addresses consisting of a current or last known
address and two immediately previous addresses;
- name of current or last known employer; and
- driver's licence number.
2. This determination shall take effect on 24 September
1991.
Dated 11 September 1991
Kevin Patrick O'Connor
Privacy Commissioner
Back to Top
Reasons for determination
Background
1. In accordance with s.18E(3) of the Privacy Act 1988,
as amended by the Privacy Amendment Act 1990, the Privacy Commissioner
may determine the kinds of information that are reasonably necessary to
be included in an individual's credit information file in order to identify
the individual.
Back to Top
Examination of practices
2. Prior to formulating this determination, I examined
current practices engaged in by the major credit reporting agencies which
provide consumer credit reports (Credit Reference Association of Australia,
and Tasmanian Collection Service). Account was taken of the types of information
which the credit reporting agencies currently use for identification and
matching of credit information files.
Back to Top
Minimising intrusiveness
3. Balanced against the need to ensure maximum accuracy
in relation to matching credit information files, I took account of the
requirements of s.18E of the Act, which sets strict limits on the permitted
contents of credit information files. In accordance with the spirit of
that section, I have sought to minimise the possibility of unnecessary
personal information being included on an individual's credit information
file. The objective was to ensure that the need to hold identifying particulars
in a credit information file did not give rise to unnecessary intrusion
when information from the credit information file was disclosed in the
form of a credit report. As a result, a number of items which are currently
collected, such as marital status and spouse's name, have not been included
in the determination, and a limit has been placed on the number of previous
addresses that can be kept on an individual's credit information file.
4. It should be noted that a credit reporting agency
does not have to include all of the permitted identifying particulars
in an individual's credit information file. For example, should a credit
reporting agency consider that it does not need to rely on a driver's
licence number in order to identify an individual from its files, then
it is acceptable that this item is not included in the credit information
files maintained by the agency.
Back to Top
Permitted items
5. Listed below are the types of information that I have
determined to be reasonably necessary to be included on an individual's
credit information file and the reasons for doing so:
(i) Full name including any known aliases, sex,
date of birth: These are all basic identifiers in common use in
the community, and together assist significantly in distinguishing between
people with other similar or the same identifiers.
(ii) Address Information
Current or last known address: An identifier
in common use in the community and routinely gathered in business settings.
Previous addresses: In the light of consultation
with credit reporting agencies and the long experience of the New South
Wales Privacy Committee in this field, I am satisfied that there is
a need for a credit reporting agency to keep an individual's previous
address information to assist in ensuring that an enquiry from a credit
provider who might, for example, have an old address, is properly matched.
In the interests of privacy, reasonable limits should be placed on the
possibility of a history of addresses being compiled. Accordingly, this
category of information on the file should be limited to only two immediately
previous addresses.
During public consultations on the draft of this determination,
it was suggested (by the New South Wales Privacy Committee) that a credit
reporting agency be allowed to retain previous address information for
only five years. The concern, I understand, was related mainly to the
possibility that an individual who might have no outstanding credit
commitments, or who has not made any new applications for credit over
a lengthy period, could still have a file with the credit reporting
agency. While I appreciate the point that a time limitation on retention
of previous address information might be in keeping with other requirements
for deletion of file information after a period, I have taken the view,
based on the advice from the CRAA that it automatically deletes files
which have been inactive for five years, that a requirement of this
sort should not be imposed unless experience shows that retention of
this information does have significant privacy implications. This question
can be reviewed in the light of any problems or complaints that arise
once the Act comes into force.
(iii) Name of current or last known employer:
A discrepancy between an individual's stated employer and the information
included in a credit information file would alert a credit provider
to the possibility of an inaccurate match in circumstances where all
other identifiers indicated an accurate match. It is accepted that while
an individual's employment details do not constitute an important element
in the process of a credit reporting agency identifying an individual
from the agency's files, such information is a more important identifier
for a credit provider and should be permitted to be included in a credit
information file. Consideration was given to restricting employment
information to a generic description of an individual's occupation,
such as 'teacher' or 'electrician'. However, the view was strongly put
to me in consultation that a description of occupation on its own would
in many cases be too imprecise for it to be of any value in identifying
an individual. In view of this, information on occupation has not been
included as permissible contents of a credit information file, but recording
the name of the current or last known employer will be permitted.
(iv) Driver's Licence Number: This number
is generated by State and Territory driver licensing authorities for
reasons unconnected with credit granting. Nonetheless the number is
widely collected as a routine identifier in connection with credit transactions.
It has, for many years, been a routine element of the identifying particulars
collected by credit reporting agencies and by credit providers. Under
the credit reporting system the CRAA relies upon the driver's licence
number to assist with identity problems. The driver's licence number
provides the agency with an additional identifier with which to correctly
identify and match files. The information provided by the CRAA suggested
that this information plays a part in correctly identifying and matching
a proportion of credit information files.
It is considered that the practice of credit reporting
agencies holding this item of information should continue, especially
in light of the many years' experience of the New South Wales Privacy
Committee in its monitoring of the credit reporting system.
I acknowledge (as observed by the Australian Privacy
Foundation during consultation on the draft determination) that the
holding of a driver's licence number is inconsistent with usual privacy
principles and tends to encourage its use as a universal identifier.
Nonetheless its use in this area is long-established and the New South
Wales Privacy Committee advises that it has received very few complaints
about misuse of the driver's licence number. It would, I consider, be
unfairly disruptive to prevent its continued use, especially in light
of the views of the New South Wales Privacy Committee. But I note that
there has been considerable recent public controversy over improper
accessing of personal information held in connection with a range of
official records including driver's licence information. If I detect
evidence of abuse of this element of this determination, I will consider
revoking it immediately.
Back to Top
Monitoring
6. The question of what personal information is necessary
for accurate identification is one which I will continue to look at in
the light of experience of the practical operation of the Act. In this
connection, I will pay particular attention to assessing whether driver's
licence number, previous address information and name of the current or
last known employer are essential for identification purposes. I propose
to review my position on the inclusion of identifying information in a
credit information file when I generally review the operation of the Code
of Conduct.
Kevin O'Connor
Privacy Commissioner
September 1991
For further information please contact
Privacy Commissioner
GPO Box 5218
Sydney NSW 1042
Privacy Hotline: 1300 363 992
Telephone: (02) 9284 9800
Fax: (02) 9284 9666
E-mail: privacy@privacy.gov.au
Back to Top
|
