Determination under the Privacy Act 1988: 1996 No 1 s.11B(1)(b)(v)(B)

Last Modified September 1991

Determination under the Privacy Act 1988: 1996 No 1 s.11B(1)(b)(v)(B)

Concerning classes of credit providers

Concerning classes of credit providers
Reasons for determination

Concerning classes of credit providers

Under s.11B(1)(b)(v)(B) of the Privacy Act 1988, I DETERMINE that:

1. All corporations belonging to the following classes are to be regarded as credit providers for the purposes of the Act:

a corporation where, in relation to a transaction, it is considering providing or has provided a loan in respect of the provision of goods or services on terms which allow the deferral of payment, in full or in part, for at least 7 days; or
a corporation engaged in the hiring, leasing or renting of goods, where, in relation to a transaction, no amount, or an amount less than the value of the goods, is paid as deposit for return of the goods, and the relevant arrangement is one of at least 7 days' duration.

2. This determination affects those businesses which are not already credit providers by virtue of paragraphs (a) or (b)(i) to (iv) of s.11B(1) of the Act.

3. This determination represents a continuation of Determination No.1 of 1993 which expired on 25 August 1996. Determination No.1 of 1993 was itself a continuation of Determination 1991 No 1.

4. This determination shall take effect on 26 August 1996 and shall lapse, unless continued by a further determination of the Privacy Commissioner, on 25 August 2001.

Dated 13 June 1996

Kevin Patrick O'Connor
Privacy Commissioner

Reasons for determination

Background

On 11 September 1991 I issued Determination 1991 No 1 under section 11B(1)(b)(v)(B) of the Privacy Act which deals with the definition of 'credit provider' for the purposes of the Act. Under that determination all corporations belonging to certain classes were to be regarded as credit providers. At the same time I issued a statement of reasons for the determination. A copy of this statement is attached.

Determination 1991 No 1 lapsed on 25 August 1993 and was continued, without amendment, by Determination No.1 of 1993.

Consultation

In reviewing Determination No.1 of 1993 I undertook consultation with the Credit Reporting Consultative Group. The process of consultation revealed that there have been no difficulties with the determination and the that there is continuing support for the determination in its present form. In addition, I believe that the reasons I gave for the earlier determination continue to apply, and support its continued existence. Accordingly, I have decided to reissue the determination without amendment, as Determination 1996 No 1.

Duration and Further Review

As to the life of the determination, I have taken the view that it should not be open-ended, but should be the subject of further review once there has been sufficient experience of its continued operation. I consider that a period of 5 years commencing on 26 August 1996 is appropriate for this purpose. I have therefore included in the determination that it is to lapse unless continued by a further determination on 25 August 2001. In the meantime, I will monitor the operation of the determination in order to determine whether it should continue after 25 August 2001.

Kevin O'Connor
Privacy Commissioner

13 June 1996

Reasons for determination

Background

1. The Privacy Act 1988 under section 11B(1) lists a range of categories of businesses which are defined as 'credit providers' for the purposes of the Act. The principal categories are as follows:

"(a) a bank; or

(b) a corporation (other than an agency):

that is a building society; or

that is a credit union; or

a substantial part of whose business or undertaking is the provision of loans (including the provision of loans by issuing credit cards); or

that carries on a retail business in the course of which it issues credit cards to members of the public in connection with the sale of goods, or the supply of services, by the corporation".

These categories seek to cover all major participants in the credit industry.

2. However a large number of businesses which have an occasional or minor involvement in the provision of credit can only continue to lawfully participate in the consumer credit reference system if they are included within a further category, being category (v) of the list in paragraph (b). The scope of category (v) is a matter for determination by the Privacy Commissioner.

3. Category (v) reads as follows:

"[a corporation]

(v) that:

(A) carries on a business or undertaking involving the provision of loans (including the provision of loans by issuing credit cards); and

(B) is included in a class of corporations determined by the Commissioner to be credit providers for the purposes of this Act".

General Approach

4. In preparing the determination, I have sought to ensure that businesses which have a legitimate need for access to the credit referencing system and which genuinely provide credit retain access to it. I therefore consider that, in keeping with the policy intention behind the legislation, my determination should seek to declare as credit providers as wide a range of businesses as is both practicable and permissible whose need to access consumer credit information is similar to that of businesses automatically classed as credit providers under the principal categories of s.11B of the Act.

Business Significance of Definition of 'Credit Provider'

5. My consultations with the credit industry highlighted that the scheme of legislation is such that the definition of "credit provider" is critical to the lawfulness of a range of business activities. Only a "credit provider", as defined by s.11B, can:

give information to, or receive from, a consumer credit reporting agency a credit report on consumer credit transactions;
exchange consumer credit information with other credit providers.

6. Moreover, a trader who gives trade credit must fall within the definition of "credit provider" in order to access consumer credit history. Cross-access of this kind is recognised by the Act as an activity which should be permitted subject to notice being given to, and permission obtained from, the customer. It has, therefore, been necessary for me, in forming a view as to what the final category should embrace, to take into account credit-giving practices among commercial traders.

Wide Variety of Credit Arrangements

7. While the credit arrangements most typically affected by the new law are long-term loans payable by instalments and permanent credit-lines provided by many retail stores and credit card issuers, I am satisfied that the credit referencing system has also been routinely used by many credit providers involved in quite short-term arrangements, for example 7 and 30 day accounts. The areas of trade where such short credit terms exist include retailers, providers of professional services and wholesale distributors and suppliers. Accordingly, my determination under category (v) seeks to cover these sectors of credit-granting, thereby placing them on the same footing under the law as the categories of persons and organisations which are already automatically designated as credit providers by the Act.

Seven-Day Criterion

8. In my draft of this determination, issued for public comment on 23 July 1991, I proposed a 14 day benchmark. I am satisfied in light of a number of industry submissions received (which endorsed the general thrust of my approach) that a 7 day benchmark would be more appropriate. In that regard I note that:

There appears to be a large number of situations involving consumer credit where short-term credit on 7 day terms is given.
Those arrangements often involve small businesses with a need for speedy cash flows or businesses which have a high volume of small amount transactions where there is a custom of allowing payment on account.
Setting a limit based on a fixed number of days will ensure that there is a practical and reasonably objective criterion available to credit reporting agencies and credit providers to use in making sure that they are dealing with an authorised party when transmitting regulated credit information.

Hiring and Leasing Arrangements

9. It was also drawn to my attention that the draft determination did not address the position of hiring and leasing arrangements where, typically, possession of a valuable item is given to a customer subject to no deposit or one which is well below the actual value of the item. This type of situation is recognised in the definition section of the Act as one of credit provision.

Consequently, I have also determined businesses to be credit providers in relation to transactions where they hire, lease or rent goods for periods of 7 days or more without requiring a deposit equal to or greater than the value of the goods.

Privacy Concerns

10. Concern was expressed by two bodies with an interest in privacy protection (the New South Wales Privacy Committee and the Australian Privacy Foundation) that a broad determination of this sort may allow businesses with only minor involvement in the provision of credit to gain access to credit reports and information, and that this might undermine the intention of the legislation that information of this sort should, in general, only be used in connection with the provision of loans. On the other hand, the view was put to me in the majority of submissions I received on the matter that short-term credit arrangements were common and gave rise to a legitimate need for credit information. I am satisfied that it was not intended by the Government or the Parliament that this sector of legitimate credit-granting be denied access to the credit referencing system.

11. In assessing the risk that this determination will undermine consumer expectations by allowing "back-door" access to credit information, it is important to emphasise that the determination only permits a business to use the credit referencing system in connection with legitimate credit transactions. This determination does not allow businesses to gain access to the system for purposes unconnected with credit decision making, or to subsequently use or disclose the information obtained except in the strictly defined circumstances laid down by the Act. Individual complaints and the exercise by me of my audit powers both offer ways for any misconduct to be brought to light. I would expect credit reporting agencies to give significant weight to any recommendation I might make for the removal of an errant member from their system. In addition, significant criminal penalties attach to wilful breach of the legislation.

12. The submissions objecting to the scope of the determination do not give sufficient recognition, I consider, to the diversity of situations to which "credit provider" status is essential. While in 1989 when this legislation was first mooted, the principal role of the definition of "credit provider" was to set a control on membership of credit reporting agencies, it has been the case since the changes to the bill in 1990 and subsequent amendments, that this definition is critical to all aspects of the operation of the scheme both at credit reporting agency level and at the credit provider-to-credit provider level.

Impracticability of 'List' Approach to Defining Classes of Credit Providers

13. In preparing this determination, I examined the categories of current membership of credit reporting agencies. I noted that most typically members are involved in long-term consumer financing. If the only effect of this determination was to identify which credit providers could access information held by a credit reporting agency, then a more restrictive determination could possibly have been adopted. However, as I have noted, the scheme of this legislation also regulates credit provider-to-credit provider exchanges of consumer credit information. It seems reasonably clear that a not insignificant number of businesses rely on referencing of this kind, rather than using a central credit bureau. This method of checking tends, understandably, to be quite common among occasional credit givers and those involved in short-term credit arrangements. This determination ensures that the operation of this sector of credit-granting is not impeded.

14. I did consider and rejected a form of determination which listed - trade sector by trade sector - classes of corporations which might be treated as credit providers. In the end I reached the view that all "classes of corporations" should have access subject to an objectively assessable criterion based on trading terms practices. This approach has been criticised by the Australian Privacy Foundation as an abdication of discretion. This view fails to take account of the practical difficulties which surround the administration of a trade sector-by-trade sector approach. Inevitably a list-approach would produce its own series of arguments about definition (eg. what is meant by "suppliers of home furnishings", etc.); and tend to lag behind trends in commerce, giving rise to frequent requests for amendment. A list-approach would, I consider, be likely to promote a climate of disrespect for the law, with constant protests from those in business who provide some credit but are not covered by such a determination.

Relevance of Determination to Non-Corporation Traders

15. In making the determination I also had regard to its "flow-on" effect for small businesses which are not run as corporations, eg. sole traders and partnerships. Section 11B(1)(c) treats as a credit provider

"a person:

who is not a corporation; and

in relation to whom paragraph (b) would apply if the person were a corporation".

My determination under s.11B(1)(b)(v) should ensure that an equally broad range of non-corporation traders will continue to have a right to participate in the consumer credit referencing system, i.e. any trader who gives 7 day credit terms (or more).

Sanctions against Abuse of Credit Provider Status

16. In seeking to bring within the scheme of the Act a wide range of appropriate business settings, I have been mindful of the several sanctions which can apply if a business improperly passes itself off as a credit provider so as to obtain consumer credit report information. These include:

criminal penalties;
determinations by the Privacy Commissioner which could involve payment of monetary compensation to a harmed individual; and
exclusion from the system by regulation.

Clause 2 of Determination

17. A view was put to me during the consultation process that the scope of the determination might be seen as unduly restrictive and might have the effect of redefining the meaning of "credit provider" as provided for under paragraphs (a) or (b)(i)-(iv) of section 11B(1) of the Act. This concern was, I feel, unnecessary, as the intention of Parliament seems clearly to me to be that my determination under s.11B(1)(b)(v) would only cover those businesses which do not fall within one of the categories listed in paragraphs (b)(i)-(iv). However, in order to put the matter beyond any doubt, I have sought to clarify the scope of the determination by indicating in clause 2 of the determination that businesses which are considered to be credit providers by virtue of paragraphs (a) or (b)(i)-(iv) of section 11B(1) will not be affected by the terms of my determination.

Clause 3 of Determination

18. As to the life of the determination, I have taken the view that it should not be open-ended, but should be the subject of review once there has been enough experience of its operation to indicate whether this relatively permissive approach is leading to abuse. I acknowledge that there will be a settling-in period for the industry while it adapts to the new regulation of its activities, but consider that a period of 18 months from the date of commencement of the major provisions of the Act, namely 25 February 1992, should be sufficient to assess how the determination is operating beyond the period of transition. I have accordingly included in the determination that it is to lapse unless continued by a further determination on 25 August 1993. In the meantime I will closely monitor the operation of the determination, and will review its operation in order to determine whether it should continue after 25 August 1993.

Kevin O'Connor
Privacy Commissioner

September 1991

For further information please contact

Privacy Commissioner
GPO Box 5218
Sydney NSW 1042

Privacy Hotline: 1300 363 992
Telephone: (02) 9284 9800
Fax: (02) 9284 9666

E-mail: privacy@privacy.gov.au