Views on the bill
2.1
This chapter summarises the views held by stakeholders on the provisions
of the bill and its effects.
General support for the bill
2.2
Submitters and witnesses were broadly supportive of the bill and its key
intention of increasing competition and providing Australians with better
access to finance through mandating comprehensive credit reporting (CCR).[1]
2.3
The Australian Retail Credit Association (ARCA) welcomed the certainty
that the introduction of mandatory CCR will provide, noting that it agrees with
the Treasurer, the Hon Scott Morrison MP's, description of a functioning CCR
system as 'a vital part of Australia's economic infrastructure'.[2]
2.4
ARCA further submitted that:
ARCA considers that the Bill establishes an appropriate
mechanism for mandating the supply of credit reporting data by the major banks,
and—subject to the finalisations of the Regulations—ensures that the industry
developed frameworks relating to on-disclosure are supported.[3]
2.5
Mr Michael Laing, Executive Chairman of ARCA, told the committee that
because of the introduction of a mandatory CCR regime for the four major banks,
as proposed by the bill, 'other credit providers have joined or are close to
the point of joining the system'.[4] Mr Laing also noted that 'one of the major banks, the National Australia Bank,
is already reporting, with the other three having invested in and developed
systems to share their comprehensive information shortly'.[5]
2.6
ANZ characterised CCR as 'an important tool for credit providers (CP) to
improve outcomes for consumers and the quality of credit decisions'. ANZ also
noted that 'CCR will help credit providers improve the level and efficiency of
compliance with responsible lending provisions in the National Consumer
Credit Protection Act 2009 (NCCP Act)'.[6]
2.7
Westpac Group (Westpac) expressed its support for the bill, noting that
it 'will provide long term benefits for both consumers and credit providers'.[7]
2.8
illion submitted that with poor take-up of CCR following its
introduction in 2014, it 'strongly concurs with the need for a mandatory
approach'.[8] illion described the bill as 'an important and pressing next step towards the
full implementation of an effective CCR regime in Australia'.[9]
2.9
Mr Poli Konstantinidis, Executive General Manager, Credit Services and
Decision Analytics A&NZ, Experian, applauded the progress which has been
made on CCR in Australia. Mr Konstantinidis further commented that 'I think we
are well on our way to an effective CCR regime'.[10]
Benefits of CCR
2.10
Inquiry participants were in broad agreement with regard to the consumer
and economic benefits of CCR. Specifically, submitters and witnesses noted the
positive impact that an effective CCR regime will have with regard to increasing
competition in the market. Overall, participants agreed that by better
supporting credit providers' understanding and thereby the pricing of credit
risk, CCR will facilitate consumers' access to suitable credit and better
enable credit providers to meet their responsible lending obligations.
Increased competition
2.11
The provision of CCR data into the credit-reporting system will
facilitate competition in the market by allowing for a more granular assessment
of consumer credit risk. As summarised by ANZ, 'CCR allows CPs [credit
providers] to share information and gain a more detailed picture of a
consumer's financial situation'.[11]
2.12
Mr Steven Brown, Director, Bureau Engagement at illion, explained for
the committee how CCR would increase competition and thereby benefit consumers
by reducing information asymmetries and 'levelling the playing field' between
credit providers:
Not only does an information asymmetry exist between lenders
and borrowers, there are also data differences between lenders. In other words,
if I am a very large bank, I may have a lot of information on which to draw
upon to make credit decisions; if I am a small fin tech, a start-up lender,
clearly I would have less information available to me to make a credit
decision, so the information asymmetry between borrowers and lenders is even
greater if I am a smaller player. The provision of this information into the
credit-reporting system allows a level playing field across lenders, which
makes the small lenders more competitive. So borrowers should expect higher degrees
of competition in financial services. They should also expect to see a lender
that's got a greater understanding of their ability to take on additional
credit and therefore better credit decision-making.[12]
Consumer benefits
2.13
PERC summarised the flow-on benefits to consumers of a CCR system that
promotes competition between credit providers:
Improved access to credit, particularly for the under-served,
lower costs for both consumers and lenders, and lower default rates have all
been proven to be the outcome of a CIS [credit information system] system
designed to promote competition among lenders, particularly in markets where
monopolies or oligopolies exist.[13]
2.14
Similarly, illion submitted that for consumers, 'CCR will facilitate
greater competition in the market, thereby increasing access to more affordable
and innovative products'. illion elaborated on this point, commenting that:
Borrowers with positive credit histories, for example, will
have greater opportunities to benefit from their actions and behaviour, while
those previously excluded due to a lack of information may now be able to
access mainstream credit (as opposed to being unable to borrow at all, or
reverting to unscrupulous credit providers).[14]
2.15
Importantly, illion also noted that the introduction of CCR data better
allows for individuals in a vulnerable credit situation to be identified and
assisted earlier.[15]
2.16
ARCA referred the committee to a KPMG report on the benefits of enhanced
credit data. The KPMG report recognised that the more detailed assessments of
consumers' ability to service debts 'would reduce the proportion of credit
applications declined on a relatively arbitrary basis due to lack of credit
data' and that, in turn, 'this could provide considerable social benefits to
those currently marginalised by the financial system'.[16]
2.17
Mr Laing of ARCA argued that the increased competition brought about by
the supply of CCR data 'is already delivering benefits to Australian consumers through
better-tailored products, empowering fintech entrants to challenge the
established financial service providers and spark industry into better
servicing Australians'.[17] Mr Laing provided the committee with the following example:
Recent advice from a well-known fintech is that, following
the sharing of comprehensive data by NAB and HSBC, fintech found it could
reduce interest rates that it was already charging for most of those banks'
customers, saving those customers, on average, up to $1,000 over the term of a
three- to five-year loan.[18]
2.18
Mr Brown from illion presented the committee with examples of the
benefits of CCR experienced in other jurisdictions, including better access to
credit, particularly for those consumers who are younger or on lower incomes,
and reductions in the number of individuals that default on loans:
For example, in the US, CCR enabled an uplift of 40 per cent
for what we classify as the underserved segments—so some of the lower income,
younger segments—according to 2010 research by the Organisation for Economic
Cooperation and Development. In Hong Kong, credit card lending increased by
almost 10 per cent in two years following the introduction of CCR according to
the Hong Kong monetary authority. And in Japan, we saw the probability of
delinquencies greater than 16 days past due date reduced by 34 per cent,
according to the policy and economic research council.[19]
Meeting responsible lending
obligations
2.19
Under the NCCP Act, holders of an Australian credit licence must comply
with the responsible lending conduct obligations. The responsible lending obligations
are aimed at ensuring that credit licensees do not enter into a credit contract
with a consumer, suggest a credit contract to a consumer, or assist a consumer
to apply for a credit contract if the credit contract is unsuitable for the
consumer.[20]
2.20
Before providing credit assistance to a consumer, a credit licensee must
make a preliminary assessment about whether the credit contract will be
unsuitable for the consumer. To do this, a credit licensee must make reasonable
inquiries about the consumer's financial situation, and their requirements and
objectives; and take reasonable steps to verify the consumer's financial
situation.[21] A credit licensee is prohibited from providing credit assistance to a consumer
in relation to a credit contract if the contract will be unsuitable for the
consumer.[22]
2.21
Mr Ian Gilbert, Executive Director, Legal and Regulation at the
Australian Banking Association (ABA), explained how CCR will allow credit
providers to better meet their responsible lending obligations once a consumer
is already approved for a loan:
A customer's financial situation is important to understand.
We've heard this morning, and we support, that the responsible lending
obligations under the National Credit Code or the National Consumer Credit
Protection Act are very strong provisions. But they don't provide for what
happens after a loan has been made, responsibly, and a customer subsequently
falls into financial difficulty. The credit-reporting system is going to
provide that additional piece of information about how that customer's going
with their credit facility, including the fact that the bank may record the
fact that there's a missed payment and to understand why that has occurred.[23]
2.22
Mr Laing of ARCA also commented on the benefits that CCR will provide
with regard to credit providers meeting their lending obligations under the
NCCP Act, noting that the need to enhance responsible lending has been a key
matter under consideration in the current financial services Royal Commission:
[CCR] will ensure a more robust environment that enables
financial service providers to lend more responsibly, which benefits both
consumers and lenders. The need to enhance responsible lending has been a key
take-out of the current royal commission into banking. The commissioner has
already highlighted the need to use actual data to verify information on a
lending application. And I can say with certainty that comprehensive
information is a critical independent verification tool that will better
support responsible lending. It's a tool that allows a lender to have greater
transparency over what credit cards, home loans, personal loans and other types
of credit a consumer has and, equally important, their track record for
repayment.[24]
Other consumer benefits
2.23
Mr Brown from illion argued that, by increasing the overall transparency
of credit reporting, CCR will have benefits for consumers in the form of
increased financial literacy:
I think what we should expect from a comprehensive
credit-reporting system with all the big banks data in it as a result of this
bill is a much more understandable system for consumers. By relying more on the
repayment history information, with their performance as a borrower being more
clearly visible then consumers can reasonably understand whether they can
afford additional credit and understand how their credit worthiness is measured
and impacted and understood by borrowers. It's a much more transparent system.[25]
2.24
The committee also heard from Mr Brown that effective CCR will result in
a fairer system for consumers, whereby borrowers are better able to
'rehabilitate' their credit history when they acquire a default on their credit
report:
The other thing that consumers should expect is obviously a
fairer system. If we think about how the system operates today in a negative
credit-reporting environment, we've got a situation where I can have a default
on my credit report, which could essentially lock me out of mainstream credit
for up to five years. In a properly operating comprehensive credit-reporting environment
I have the ability to rehabilitate myself through making regular repayments.
Those repayments then become visible to lenders and, indeed, I can then take on
more mainstream credit. Borrowers should expect a fairer credit-reporting
system under this bill.[26]
Interaction with the hardship provisions
2.25
A key concern raised by most inquiry participants was the interaction
between the mandatory credit information required to be provided under the CCR
regime—specifically, the requirement to provide repayment history information
(RHI) in accordance with section 6V of the Privacy Act 1988 (Privacy
Act)—and the hardship provisions contained under the National Credit Code (NCC).
Operation of financial hardship
provisions
2.26
Financial hardship is regulated under the NCC in Schedule 1 of
the
NCCP Act, which is overseen by the Australian Securities and Investments
Commission (ASIC).
2.27
Section 72 of the NCC provides for a debtor to give a credit provider a
'hardship notice', either orally or in writing, when they are unable to meet their
repayment obligations under a credit contract, and when they reasonably expect
to be able to discharge those obligations if the terms of the contract were
changed.[27]
2.28
The credit provider may request further information from the debtor, either
orally or in writing, within 21 days of receiving the hardship notice. The
debtor must provide the relevant information within 21 days of the credit
provider's request. The credit provider must respond to the debtor's hardship
notice within a set time frame, notifying the debtor of the decision and, if
the hardship notice is refused, the reasons for refusal.[28]
2.29
Where a credit provider agrees to enter into an agreement with the
debtor to change a credit contract as a result of financial hardship (a financial
hardship agreement), section 73 of the NCC requires that the credit provider give
the consumer a notice in writing within 30 days after the agreement is made
stating the particulars of the change.[29]
2.30
However, there is an exception to this section 73 requirement for a
credit provider to provide a written notice to a debtor. Under section 203A of
the NCC, ASIC may exempt a person, contract, mortgage, guarantee or consumer
lease from all or specified provisions of the NCC.[30]
2.31
Accordingly, ASIC Class Order [CO 14/41] exempts a credit provider from
the obligation to provide a written notice to a debtor if the financial
hardship agreement entered into is a 'simple agreement'. A simple agreement is
defined as 'an agreement that defers or reduces the obligations of a lessee [debtor]
for a period of no more than 90 days'.[31]
2.32
A range of different payment arrangements may be made between a credit
provider and an individual where the individual is in financial hardship and
unable to meet the terms of a consumer credit contract. An arrangement may
involve a formal variation to the terms of a consumer credit contract.
Alternatively, a simple agreement made between a credit provider and debtor may
not result in a formal variation—known to industry as an 'indulgence'.
2.33
Ms Angelene Falk, the Acting Information Commissioner and Acting Privacy
Commissioner, summarised in simple terms what an indulgence may look like:
In other cases there might be what's known in the industry as
an indulgence made—that is, perhaps not a formal variation to a contract but a
meeting of the minds between the consumer and the credit provider that monthly
payments have been changed for perhaps a particular period of time and that the
credit provider will not call on the original contract price for payment.[32]
Reporting of Repayment History
Information
2.34
Concurrent to the financial hardship requirements under the NCC, as
outlined above, credit providers have obligations under the Privacy Act 1988 (Privacy Act) in regards to the way they report an individual's repayment
history information (RHI) to credit reporting bodies.
2.35
Credit providers are required to report an individual's RHI in
accordance with section 6V of the Privacy Act. Subsection 6V(1) of the Privacy Act
defines repayment history information as:
(1) If a credit provider
provides consumer credit to an individual, the following information about the
consumer credit is repayment history information about the individual:
- whether or not the individual has
met an obligation to make a monthly payment that is due and payable in relation
to the consumer credit;
- the day on which the monthly
payment is due and payable;
-
if the individual makes the
monthly payment after the day on which the payment is due and payable—the day
on which the individual makes that payment.[33]
2.36
As explained by Ms Falk, in circumstances where an individual has made
an application to a credit provider for hardship assistance, currently, the
Privacy Act prevents the credit provider from disclosing to a credit reporting
body the fact that a hardship application has been made by that individual.
Consequently, this information—often referred to by industry representatives as
a 'hardship flag'—cannot be included in an individual's credit report.[34]
2.37
The ABA described how the reporting of RHI works in practice under the
current legislative framework for CCR:
Currently, the CCR system provides for a bank to report to
its credit bureau whether the customer has met the monthly payment(s) due under
their credit facility. If the payment is made on time (within the 14 days
period of grace) the CCR system records a "0". If the payment is
missed (after the grace period of 14 days) the system will record this as
"1" (missed payment) and so on if the payment remains unpaid (for the
next month as "2" etc). These entries are maintained as a record of
performance by the customer for 24 months.
OAIC Guidance
2.38
As noted in Chapter 1, in an effort to enhance clarity in regards to the
way credit providers report information about an individual's RHI to credit
reporting bodies, the Office of the Australian Information Commissioner (OAIC)
has published guidance about the reporting of RHI and default information in
circumstances of financial hardship. The OAIC has also published guidance about
the meaning of 'repayment history information' where a consumer credit contract
is varied or an 'indulgence' is in place.[35]
2.39
The OAIC guidance clarifies how the term 'due and payable', which is not
defined in the Privacy Act, is to be interpreted. For the purposes of section
6V of the Privacy Act (see paragraph 2.35), the OAIC understands the term 'due
and payable' to mean 'that the credit provider has a legal entitlement to
maintain an action for recovery against a consumer in respect of a missed
monthly payment'.[36]
2.40
The OAIC guidance also clarifies how the meaning of 'due and payable' is
applied in regard to the different financial hardship arrangements that may be
made between a credit provider and an individual where the individual is unable
to meet the terms of a consumer credit contract:
- Where
the arrangement is a variation to the terms of the consumer credit contract,
then an assessment of whether RHI is 'due and payable' under s 6V(1) should be
by reference to the terms of the varied contract.
- Where
there is no variation to the consumer credit contract and an indulgence is
made, whether RHI should be assessed by reference to the terms of the
indulgence or by reference to the underlying credit contract will depend on the
nature of that arrangement, particularly, whether the credit provider could
maintain enforcement action against the individual for default of the original
contract despite compliance with the indulgence.[37]
2.41
ARCA submitted that it and industry welcome the legal clarity given by
the OAIC's guidance.[38]
Stakeholder views
2.42
Submitters and witnesses had differing opinions as to the extent of
credit providers' RHI reporting obligations when an individual is in financial
hardship.
2.43
Consumer representatives strongly contested the OAIC's guidance as to
when an amount is 'due and payable', submitting that:
Consumer Representatives strongly disagree with the Office of
the Australian Information Commissioner's (OAIC's) interpretation of when an
amount is 'due and payable' under the Privacy Act as per its guidance that was
recently published on its website. The OAIC has limited its interpretation of 'due
and payable' to the legal entitlement to maintain an action for recovery, but
has not considered the requirements under the Credit Act which impact directly
on when an action for recovery can be maintained.[39]
2.44
Consumer representatives argued that, if an arrangement has been made
with a consumer to change their payments in circumstances of financial hardship,
and the consumer is meeting their payment obligations under that arrangement,
then the original amount cannot be due and payable.[40]
2.45
ANZ disagreed with this view and expressed concern that, when reporting
RHI, it cannot report customers in hardship programs as being up to date as
this would not meet its reporting obligations.[41]
2.46
ANZ further outlined its position with regard to its reporting
obligations under the Privacy Act, submitting that:
ANZ sees its obligations under the Privacy Act as requiring
the reporting of RHI based on the customer’s status in relation to contractual
minimum monthly repayments. Where a customer enters into a temporary
arrangement because they are experiencing financial hardship, and this does not
involve a variation to the contract, our view is that reporting of repayment
information must be by reference to whether the customer has met, and/or
continues to meet, their originally contracted repayments, not the repayments
under their temporary arrangement.[42]
2.47
Westpac expressed a similar view, commenting that, under the current
legislative framework, credit providers 'will not have the option to withhold
the fact that customers have not met repayments in accordance with their
original contract'.[43]
Consequences and concerns
2.48
While the reporting obligations for the CCR regime are well established
under the Privacy Act, a number of inquiry participants expressed concern that
they thought the bill had proceeded to legislative enactment without clear
legislative provision as to how credit providers must report repayment history
information where a customer has entered into a financial hardship agreement
with the credit provider.[44]
2.49
In their joint submission to the inquiry, consumer representatives
commented:
Consumer representatives are deeply concerned that RHI data
will be wildly inaccurate if the banks start reporting customers as making
payments late when those consumers have called up and arranged a hardship
variation as they are legally able to do under the credit law. It is our strong
view that they are not making late payments since the contract has been
mutually agreed to be varied. It is critical that this area of the law (and how
it will work in practice) is clarified as soon as possible.[45]
2.50
Similarly, the Australian Finance Industry Association (AFIA) argued
that this 'is a critical issue for consumers and industry alike and should be
resolved as a priority'.[46] AFIA also warned that omitting information relating to customers financial
hardship 'devalues the credit reporting process' and 'potentially creates risk
of inadvertent irresponsible lending to consumers'.[47]
2.51
AFIA further reflected on the importance of obtaining clarity on this
issue to ensure that individual's credit reports are accurate and do not
adversely affect consumer credit decisions:
Credit providers regularly work with their customers when
they experience periods of financial difficulty to provide relief and a way for
the customer to 'get back on track'. We believe the issue of how these
situations should be reported needs to be addressed so that an individual's
credit report remains a clear and objective historic record of all facts
relevant to future consumer credit decisions.[48]
2.52
The ABA underlined that, without an agreed resolution and legislative
change as to how financial hardship arrangements are to be reported under the
CCR framework, customers in financial hardship are likely to be detrimentally
affected and 'lumped together with those customers who simply don't comply with
their repayment obligations'.[49]
2.53
Consumer representatives noted that most consumers will have limited
understanding of how entering into financial hardship arrangements with a
credit provider and how their credit report may be adversely affected. This could
lead to further distrust of the industry and increased complaints.[50]
2.54
Consumer representatives also expressed concern that the potential for
the mandatory reporting of RHI to reflect negatively on a consumer's credit
standing may 'discourage people from accessing the financial hardship
arrangements that they are legally entitled to'.[51] Consumer representatives provided the following context:
The consumers we speak to on the National Debt Helpline are
overwhelmingly concerned about their credit reports and credit scores and the
impact upon this information by any actions they take. These people need to be
confident that they will be treated fairly if they do the right thing and
contact their credit provider for a financial hardship arrangement when they
cannot pay, but will be able to get back on track within a reasonable time.[52]
2.55
The Queensland Law Society (QLS) emphasised the importance of mandatory
CCR not reducing the flexibility of credit providers responses to circumstances
where a consumer is in financial hardship, including whether or not to report a
default. Elaborating on this point, QLS observed that:
There may be particularly sensitive circumstances giving rise
to the default, such as financial abuse or domestic violence, and it is crucial
that lenders be able to take appropriate steps, including making indulgences,
to ensure that the consumer is not further disadvantaged.[53]
Hardship flag
2.56
As noted at paragraph 2.36, the Privacy Act does not currently permit a
credit provider to disclose to a credit reporting body the fact that an
individual is in financial hardship—often referred to by industry as a
'hardship flag'.
2.57
Most inquiry participants were supportive of proposals to amend the
Privacy Act to introduce a hardship flag into the credit reporting system to
identify that a consumer has asked their credit provider to change their credit
contract on the grounds of financial hardship and provide a true indications of
their financial position.[54]
2.58
ARCA noted that additional hardship data would allow for differentiation
between repayment history that is reported for a varied credit contract,
compared to that being reported for a consumer's original payment obligations.[55]
2.59
The ABA drew the committee's attention to what it considered the
potential risks posed to consumers by inconsistent and inaccurate RHI reporting
under different financial hardship arrangements:
Some options mean the credit provider has no visibility that
the customer is in financial difficulty and may extend further credit, while
other options will not reflect that the customer is actively engaged with the
credit provider to work through their current difficulties.
On the other hand, if the payment is recorded as paid because
the customer is adhering to a different payment arrangement made with their
bank, other credit providers could conclude the individual is a good credit
risk and may place the customer under greater hardship by extending further
credit.[56]
2.60
The ABA considered this to be 'an unacceptable exposure of customers to
risk' and one that could be avoided 'if a hardship indicator is permitted to be
added to the relevant RHI reporting under the Privacy Act'.[57]
2.61
Westpac also supported the proposals for inclusion of a hardship flag to
RHI reporting, arguing that it would enable credit providers to perform better
lending assessments and ensure the quality of credit information:
In Westpac’s view, the customer benefits from including a 'hardship
flag' because it allows for a transparent and fair representation of a
customer’s situation—it would represent the current status of the arrears and
protect customers from inappropriate lending when the customer is at the height
of their financial stress.[58]
2.62
In contrast, consumer representatives disagreed with these views,
arguing that '[h]ardship flags will only serve to further disincentivise
consumers from proactively reaching out to lenders when they are in financial
difficulty, undermining the current financial hardship protections'.[59]
Attorney-General's review
2.63
On 28 March 2018, the Attorney-General, the Hon Christian Porter MP,
announced that the government will conduct a review of financial hardship
arrangements, including looking into the intersection between hardship
arrangements and the credit reporting framework.[60]
2.64
Inquiry participants were generally welcoming of the Attorney-General's
review, however noted that the timing of the review and any resultant changes
are unlikely to be completed prior to the proposed commencement of the
mandatory CCR regime.[61]
2.65
ARCA noted that, in the absence of a means to identify consumers in
financial hardship in consumer credit reports, 'the repayment history
information reported for those consumers could be misleading'. ARCA contended
that:
Given this issue will become more significant as the number
of credit providers supplying comprehensive credit data increases, we strongly
urge that this review be brought forward.[62]
2.66
Similarly, AFIA recommended that the government expedite the review into
hardship reporting with the purpose of allowing credit providers to transparently
report instances of customers in hardship.[63]
2.67
Westpac also submitted that an earlier review time frame is necessary in
order to 'ensure the fairest possible outcome for any customers who are in
hardship during the reporting period'.[64]
Scope of mandatory CCR
2.68
Some inquiry participants expressed concern that the bill restricts the
mandatory CCR regime to large ADIs with total resident assets are greater than
$100 billion—effectively compelling the Australia's big four banks to
participate in CCR.[65]
2.69
For instance, Westpac contended that the CCR regime should apply to
all credit providers. Westpac reasoned that:
Restricting the Scheme to the majors leaves 20 per cent of
consumer credit lending out of the picture...Without full coverage, Westpac will
not have access to the credit history details of accounts a customer holds with
CPs who are not supplying comprehensive information, potentially resulting in
an incomplete assessment of their financial situation.
2.70
Westpac recognised that while 'the Government is open to including other
[credit providers] at a later date'[66],
there appears to be no mechanism to monitor which and when other credit
providers come on board. Westpac suggested that the statutory review of the
mandatory CCR regime, to be completed by 1 January 2022, examine any unintended
consequences for customers of smaller credit providers not contributing
comprehensive credit information.[67]
2.71
illion acknowledged that mandating the major banks to participate in CCR
'will undoubtedly prove significantly more effective than the voluntary CCR
framework currently in place'. However, illion considered that the mandated CCR
participation threshold 'be lowered to $50 billion so that large, "second
tier" ADIs are also obliged to participate in CCR 12 months after the
largest institutions if this has not occurred voluntarily'.[68]
2.72
illion also contended that restricting the scope of the mandatory CCR
regime to the big four banks will limit the potential positive impact on
competition in the market that would result from a more fully inclusive regime:
By restricting mandatory CCR to effectively only the largest
four lenders, illion contends the competitive effects arising from the regime
will fall far short of what is possible, in that competition is likely to be
largely felt between the big four rather than with other lenders...Should
competition only be improved amongst Australia’s four largest lenders,
consumers will be faced with an unchanged market amongst small lenders that are
not compelled to participate.[69]
2.73
In further evidence to the committee, Mr Brown from illion argued that
broad-based adoption of CCR 'is key to making sure that the maximum information
is available to ensure that banks can detect undisclosed liabilities and lend
responsibly'.[70]
2.74
The Customer Owned Banking Association (COBA), the industry association
for Australia's customer owned banking institutions such as mutual banks,
credit unions and building societies, took a differing view. COBA supported the
government's decision to limit mandatory CCR to only large ADIs. COBA submitted
that this approach avoids 'imposing unnecessary costs on smaller ADIs while
creating a critical mass of CCR data to encourage all credit providers to
undertake the investment needed to participate'.[71]
Regulation to prescribe eligible
licensees
2.75
The bill allows for the extension of the mandatory CCR regime to credit
providers other than those considered 'large' ADIs under a regulation-making
power. As noted in the explanatory memorandum, the government expects that
regulations would be made after the mandatory regime has been in operation for
a period of time and other credit providers are not voluntarily supplying data.[72]
2.76
The ABA reminded the committee of the burden that ongoing regulatory
change has on its members, and particularly for regional and smaller ADIs with
more limited resources. The ABA recommended that, if the government were to
consider prescribing regulation to extend the mandatory CCR regime to smaller
ADIs, an additional period of consultation with these ADIs be afforded 'to
identify an appropriate and achievable implementation timeframe'.[73]
2.77
AFIA conveyed support for the current scope of the CCR regime as
proposed in the bill, where mandated participation is restricted to large ADIs.[74] However, AFIA stressed that its preferred position is not to mandate CCR
participation across the sector as a 'one-size fits all' approach. AFIA
reasoned that industry participation outside the mandated large ADIs will grow
organically over time.[75]
2.78
Ms Helen Gordon, Chief Executive Officer of AFIA, elaborated on this
point in evidence to the committee:
Our position there is really that the smaller entities will
benefit from that information in the system, so they will want to participate.
They will want to include their data about their customers in the system
because they will get the benefit of information from other players, which have
a lot more information about a lot more people, in return. There'll be an
organic kind of outcome, if you like. So that statutory obligation is not appropriate
for all of the players in the system. The government will achieve the outcomes
it's seeking, but not necessarily through having to mandate compliance across
all participants.[76]
2.79
AFIA also reflected on the internal resources required to engage in CCR,
noting that smaller credit providers would need 'a significant lead time to
make the necessary capital expenditure in IT, credit criteria redevelopment and
retraining'.[77]
Data privacy and security
2.80
The Privacy Act sets out the regulatory model for credit reporting
information including use and disclosure, de-identification of credit reporting
information, using credit reporting information for marketing purposes, and how
this information must be protected from unauthorised access or misuse.[78]
2.81
Part IIIA of the Privacy Act, supported by the Privacy (Credit
Reporting) Code 2014 (Privacy Code) and the Privacy Regulation 2013, regulates
consumer credit reporting in Australia. As summarised by the Attorney-General's
Department (AGD):
Part IIIA of the Privacy Act provides the statutory basis for
limitations on how credit reporting information may be used. Credit reporting
information means credit information or 'CRB derived information' and broadly
extends to any information that has a bearing on an individual’s credit worthiness
or could be used to establish an individual’s eligibility for consumer credit.[79]
2.82
The OAIC has regulatory oversight of credit reporting, ensuring that
credit reporting bodies and credit providers comply with their requirements
under the Privacy Act, including the requirements in Part IIIA. The Privacy Act
confers broad powers on the Australian Information Commissioner, via the OAIC,
in relation to monitoring, investigation and enforcement.
2.83
As noted in Chapter 1, the amendments proposed in the bill 'do not
require or allow disclosure, use or collection of credit information beyond
what is already permitted under the Privacy Act and Privacy Code'.[80]
2.84
Inquiry participants were generally welcoming of the fact the bill
preserves and is reliant on the existing consumer protections under the Privacy
Act and Privacy Code relating to the security and privacy of consumers' credit
information.
2.85
Ms Falk, the Acting Information Commissioner and Acting Privacy
Commissioner, contended that '[t]hese laws provide a robust and effective
framework for ensuring that risks to personal information are appropriately
mitigated'.[81]
2.86
ARCA expressed a similar view, submitting that:
Given the detailed and extensive consumer protections already
contained in Part IIIA and the CR Code, we consider that the draft Bill does
not raise additional issues in relation to consumer rights.[82]
2.87
In relation to data privacy, ARCA pointed out that under a mandatory CCR
regime, existing consumer records will be expanded, rather than created. ARCA
further explained:
Most consumers will already have identity information held by
a credit reporting body. Anyone who has applied for credit; including loans by
banks and other finance providers, such as in-store finance or motor vehicle
finance; a telecommunications service, such as a mobile telephone; or access to
an energy supplier, will have a record at a bureau.[83]
Non-compliance with section 20Q
2.88
Section 20Q of the Privacy Act requires a credit reporting body to take
reasonable steps to protect the information it receives, including from misuse,
interference and unauthorised access.
2.89
The bill enables an eligible licensee to withhold the supply of
mandatory credit information where a licensee does not believe the credit
reporting body is meeting its information security obligations under section
20Q of the Privacy Act. In such circumstances, a licensee is required to notify
the credit reporting body, ASIC and the Australian Information Commissioner.[84]
2.90
Representatives from the Treasury outlined the reasoning behind the
inclusion of these additional security obligations in the bill:
The risk in mandatory participation in comprehensive credit
reporting was that if they were mandated to provide data, whatever the
circumstances, in a sense, they would lose their bargaining power around the
contracts. So the bill makes provision that if a bank has concerns about the
security of the data it's providing to a credit bureau then it can go through various
steps. Effectively, it can make the decision not to supply that data, and then
there are various kinds of processes and time lines that sit in the bill in
respect of that.[85]
2.91
Some submitters noted their support for the enhanced security
obligations imposed by the bill in relation to suspected non-compliance by a
credit reporting body with section 20Q of the Privacy Act.
2.92
For example, in their joint submission to the inquiry, consumer
representatives commented that:
We believe this subsection will drive better security
standards across the entire industry by forcing banks to take responsibility
for the security compliance of CRBs when they hand over customer data. This
subsection also empowers banks to cease supplying customer data if a CRB
demonstrates a major security breach which the banks reasonably believe amounts
to non-compliance with s. 20Q.[86]
2.93
Westpac Group also welcomed the addition of a mechanism to raise
concerns with credit reporting bodies security management, arguing that:
In today's fast-moving data security landscape, data security
standards will be ever changing. A breach of security of personal or credit
information in Australia would be disastrous for confidence in the Australian
financial system.[87]
2.94
illion expressed a differing view, arguing that this mechanism by which
credit providers can be exempted from their obligation to share information
with credit reporting bodies is 'superfluous' given the existing safeguards
enshrined in the Privacy Act. Elaborating on this point, illion submitted that:
Our view is also based on the fact that the adequate
information security protocols are already in place, allowing CRBs to receive
credit enquiries from a bank in the present ‘negative’ data environment, is
prima facie evidence that information security is adequate in a more
comprehensive regime. There is no added risk associated with the sharing of
further data, as current safeguards in place do not differentiate between the
volume or type of protected data.[88]
2.95
illion also commented on what it considers potential practical effects
of such an exemption; specifically, that it may be utilised by credit providers
as a barrier to the provision of data.[89]
Interaction with existing Privacy
Act provisions
2.96
Under existing section 21U of the Privacy Act, credit providers are
required to take reasonable steps to correct credit information that is
inaccurate, out-of-date, irrelevant or misleading. Further, section 21U
provides that where a credit provider corrects information in this way, it
must, with some limited exceptions, notify credit reporting bodies to which it
has previously given the information.[90]
2.97
The OAIC expressed concern that proposed section 133CV(4) of the
bill—which provides an exception to the bulk and ongoing supply requirements
where an eligible licensee has a reasonable belief that a credit reporting body
is not complying with its security obligations under the section 20Q of the
Privacy Act—will limit the operation of requirements regarding notices of
correction in existing section 21U of the Privacy Act.
2.98
The OAIC acknowledged that while it appreciates the intent of these
provisions in not mandating disclosures of credit information where there may
be security risks, the operation of these provisions could have a detrimental effect
on data quality and flow on consequences for a consumer's credit report. The
OAIC explained:
An effect of proposed section 133CV(4) of the Bill appears to
be that other CPs may obtain information from the relevant CRB that is
out-of-date, incomplete, irrelevant or misleading. The OAIC's concern is that
CPs may then make credit worthiness decisions on the basis of poor quality
information. The quality of credit reporting information is of fundamental
importance to individuals, given the significant consequences that may flow, in
terms of future access to credit, from an adverse credit report.[91]
2.99
The OAIC suggested that the enhanced security protections envisaged by
these provisions 'could be achieved by limiting the mandated supply
requirements under the bill, without limiting the correction requirements under
the Privacy Act'.[92] The OAIC further stated that:
This would mean that an eligible licensee would not be
required to disclose information about individuals as envisaged under the Bill,
while preserving the data quality protections in the Privacy Act.[93]
Increased amount of data in the
system
2.100
Consumer representatives drew the committee's attention to the
significant increase in the amount of data on a consumer's credit report as
credit providers are mandated to participate in the CCR regime.[94] In their joint submission, the Financial Rights Legal Centre (FRLC) and other
consumer representatives argued that this increase in data:
...will proportionally increase the potential errors that might
occur that consumers will need to dispute. This is particularly the case with
RHI which will be updated monthly with up to two years of data available at any
one time.[95]
2.101
The OAIC also recognised the increased volume of credit information in
the consumer credit reporting system as a result of the mandating of CCR. The
OAIC submitted that this 'will require proactive oversight and accountability
for participants in the scheme', and further contended that:
To enhance consumer trust in the scheme, it will be important
to ensure the OAIC is resourced to exercise its functions to effectively
oversee the handling of credit information in the system.[96]
2.102
Ms Falk, the Acting Information Commissioner, explained to the committee
the practical implications of the legislation with regard to the OAIC's
regulatory oversight of the credit reporting system:
We would expect that the mere fact of having an increased
volume of credit-reporting information in the system would result in increased
regulatory activity required by the OAIC.
...
Similarly, we would expect an increase in the volume of
complaints. When the credit-reporting provisions were amended in 2014, we
experienced a significant increase in complaints from consumers in terms of
credit reporting. On average, about 25 per cent of about 2½ thousand complaints
that we receive relate to credit reporting. However, in 2014 we received more
than 2,000 complaints simply on credit-reporting matters.
We've also got powers—they're outlined in pages 4 to 5 of the
submission—to undertake regulatory activity on our own initiative where issues
arise. The bill will also envisage a role for the OAIC where a credit provider
has some security concerns about a credit-reporting body. Under that provision
a notice would need to be given to the OAIC and we would then need to apply our
regulatory action policy to decide what, if any, further regulatory action is
needed.[97]
2.103
In response to questions on notice regarding the regulatory environment
supporting CCR and the OAIC's oversight role in consumer credit reporting, AGD
advised the committee that:
AGD and OAIC have been consulted through the development of
the proposed legislation and AGD considers that the powers conferred on the
OAIC are appropriate for the OAIC to be able to effectively regulate the credit
reporting sector after the introduction of mandatory comprehensive credit
reporting.[98]
Vulnerable and lower income consumers
2.104
The implications of the mandatory CCR regime as proposed by the bill for
vulnerable and lower income consumers was raised by a number of submitters and
witnesses. In particular, the potential for increased price differentiation,
consumer use of 'credit-cleaning' organisations, and the use of pre-screening
for marketing purposes were highlighted as matters of concern.
Increased price differentiation
2.105
QLS expressed concern that the increase in available credit information
resulting from mandatory CCR 'may result in lower income applicants being
charged more for credit due to greater differential pricing'.[99]
2.106
QLS took the view that:
This is likely to push these applicants more towards higher
cost lower-tiered lenders, like the providers of small amount and medium amount
credit contracts. It may also mean that a consumer’s credit score/risk score is
going to increase and could have a negative affect when a person tries to
purchase credit.[100]
2.107
The committee heard a similar view from consumer representatives, who submitted
that:
We are also concerned that some lenders are likely to use
this increased information not to deny people credit where it appears their
finances are already stretched, but to charge those customers more for credit.
We may see a significant increase in price discrimination including an influx
of expensive, priced-for-risk products...Risk based pricing exacerbates
inequality, as consumers deemed higher risk not only pay more for credit, but
are at greater risk of default because of those higher repayments.[101]
2.108
Reflecting on the possibility of increased price differentiation between
consumers as a result of CCR, Mr Konstantinidis from Experian suggested that increased
price differentiation based on consumers' credit history would be a reflection
of more responsible lending practices:
Senator McALLISTER: Will the system create a capacity
for rewards to consumers with positive credit histories?
Mr Konstantinidis: Yes.
Senator McALLISTER: By implication, it will also
create penalties, relative to those with positive histories, for people with poor
credit histories, will it not? You can't have one without the other.
Mr Konstantinidis: That is a fair question. I would
probably look at it in the way that there will definitely be the reward
element. Whether it is a penalty, I look at it going back to using the
terminology more-responsible or appropriate—whether or not it is an extension
of credit, and I think in a better position not to place a consumer in a
vulnerable situation.[102]
Use of 'credit-cleaning'
organisations
2.109
QLS considered that, as a consequence of greater price differentiation, the
introduction of mandatory CCR may drive more consumers to use credit
repair—often called 'credit-cleaning'—organisations. QLS noted that, in some
cases, such organisations 'have not led to the best consumer outcomes'.[103]
2.110
Dr Andrew Grant from the University of Sydney also cited the growth of
'credit-cleaning' businesses as a possible outcome of introducing CCR:
The outcomes for individuals on the lower end of the credit
spectrum may be negative; evidence from Dun and Bradstreet's implementation of
CCR in New Zealand has indicated as much. This may lead to the growth of
so-called 'credit-cleaning' businesses or the introduction of products
specifically targeting the borrowers with adverse events in their credit
histories.
2.111
Similarly, Ms Katherine Temple, Senior Policy Officer at the Consumer
Action Law Centre (CALC), asserted that the increase in information on
consumers' credit reports as a result of CCR 'will just turbo-charge these
unregulated and harmful businesses'.[104]
2.112
Consumer representatives described the unscrupulous practices of
unregulated credit-cleaning organisations in their joint submission to the
inquiry:
DMFs [debt management firms] target people struggling with
debt, promising to clean or fix their credit reports. DMFs regularly mislead
people about the nature of their service/product and charge thousands of
dollars for poor quality services. They also use customer's enquiries about
fixing their credit report as an opportunity to steer debtors into unsuitable
debt agreements or other expensive and often inept debt negotiation services.[105]
2.113
Representatives from the Treasury recognised the concerns raised by
consumer groups with regard to the provisions proposed in the bill giving rise
to growth in the credit-cleaning industry, and advised that it thinks it is 'an
issue that needs further consideration'.[106] Mr James Kelly, Chief Advisor, Financial System Division, Treasury, further
told the committee that:
My understanding is that consumer affairs ministers,
Commonwealth and state, have also flagged that as an area requiring
consideration, and it is something that's on the agenda to look at.[107]
Pre-screening
2.114
Consumer representatives highlighted the use of 'pre-screening' under
section 20G of the Privacy Act to direct marketing of more costly credit
products to consumers whose credit information indicates that they are of
higher risk.[108]
2.115
However, as clarified by a number of industry representatives, under
section 20G of the Privacy Act, pre-screening is limited to using 'negative
only' data and, moreover, only to assess whether the individual is eligible to
receive the communication.[109] Pre-screening 'is a safeguard to ensure that offers of credit are not sent to
consumers who, because they already have defaults and other adverse information
on their credit report, are unlikely to be approved if they take up the offer
and apply for the product'.[110]
2.116
As explained by AFIA:
A key objective of this provision was to assist credit
providers ensure financially vulnerable customers, in particular, do not
receive offers potentially increasing their exposure to credit and financial
difficulties.[111]
Other matters raised
2.117
Other matters raised by inquiry participants in relation to the bill
included: the drafted definition of 'evidential burden'; and the requirement to
provide statements of compliance to the Treasurer.
Drafted definition of 'evidential
burden'
2.118
The bill inserts the definition of the term 'evidential burden'—that
being, 'in relation to a matter, means the burden of adducing or pointing to
evidence that suggests a reasonable possibility that the matter exists or does
not exist'—into subsection 5(1) of the NCCP Act.[112]
2.119
QLS criticised this definition as drafted in the bill, contending that
it 'adopts a standard of proof contrary to that developed by the law over
time'.[113] QLS argued that this drafting 'will create confusion rather than
clarification', and advocated for a 'more orthodox approach'.[114]
2.120
Specifically, QLS recommended that:
Where the evidential burden relates to a civil matter, the
normal civil burden, on the balance of probabilities, should apply and, in the
case of the evidential burden relating to a criminal matter, the standard
should be beyond a reasonable doubt.[115]
Statements of compliance to the
Treasurer
2.121
As noted in Chapter 1, credit providers and eligible credit reporting
bodies will be required to provide statements to the Treasurer relating to
their compliance with the initial bulk supplies of credit information under the
mandatory CCR regime.[116]
2.122
The ABA questioned why this requirement to make statements of compliance
to the Treasurer is necessary, contending that it is a regulatory impost which
duplicates the role of the regulator, ASIC. The ABA submitted that it 'believes
only the one process of audited compliance reporting should be made to ASIC.
These statements can then be provided by ASIC to the Treasurer'.[117]
2.123
In response to a question from the committee regarding the reasoning
behind this requirement in the bill to provide statements of compliance, representatives
from the Treasury explained:
It's an accountability measure on the banks. It reflects the
history of what has been a very long process to actually establish a
comprehensive reporting regime. When it was set up and legislated in 2012, the
expectation was that we would now have a fully functioning comprehensive
credit-reporting regime. It has always been a disappointment. So, in some ways,
I think you can see that report to the Treasurer as a way of emphasising the
importance the government attaches to it.[118]
Committee view
2.124
There is broad agreement amongst stakeholders with regard to the
consumer and economic benefits of comprehensive credit reporting. Participants in
the inquiry noted the positive impact that an effective CCR regime will have
with regard to increasing competition in the market by reducing information
advantages and levelling the playing field between lenders. Stakeholders agreed
that by allowing credit providers to obtain a comprehensive view of an
individual's financial situation, effective CCR will also facilitate consumers'
access to tailored and suitable credit, and ensure credit providers better meet
their responsible lending obligations.
2.125
Importantly, the committee notes that CCR's 'principle of reciprocity'
ensures that all present and future credit providers must supply their own
collected credit information into the CCR system in order to get information
out. In these terms, it is recognised that all credit providers can have the
confidence that everyone participates in the system on equal terms providing
full credit data.
2.126
However, it is also apparent to the committee that there is a disjunct
between credit providers' RHI reporting obligations under the Privacy Act and
financial hardship arrangements under the NCCP Act. Stakeholders strongly
disagreed on how circumstances of financial hardship are to be reflected, or in
fact not reflected, in an individual's credit information, and the potentially
adverse consequences this can have on a consumer's credit report.
2.127
The committee agrees that this is an issue that should be resolved as a
matter of urgency and welcomes the government's review of financial hardship
arrangements. However, the committee is cognisant that, under the current time
frame, outcomes of the review will come after the enactment of the bill.
Recommendation 1
2.128
The committee recommends that the Australian Government consider
expediting its review of financial hardship arrangements.
2.129
Regarding the scope of CCR as proposed in the bill, the committee is
confident that mandating the big four banks to participate in CCR will create a
critical mass of data and should encourage other credit providers to
voluntarily partake in the CCR regime. The committee also recognises the
significant resources required for credit providers to engage in CCR, and is of
the view that considered consultation be undertaken should the government
decide to extend the mandatory CCR regime to credit providers other than large
ADIs in future.
2.130
Credit-related information is one of the most strictly regulated forms
of personal information under the Privacy Act. The committee is confident that
the existing consumer protections under the Privacy Act, as well as the
security enhancements in the bill in relation to how and where credit
information is stored and suspected non-compliance, will ensure that risks to
consumers' personal information are mitigated.
2.131
The committee notes the OAIC's concerns regarding the interaction of
certain provisions in the bill with those existing in the Privacy Act. The
committee also acknowledges the concerns of some stakeholders regarding the
implications of the mandatory CCR regime for vulnerable and lower income
consumers; in particular, a potential growth in so-called 'credit-cleaning'
businesses as a result of CCR. The committee suggests that any implications of
the credit reporting framework—including unintended interactions or limitations
imposed on other legislation and consumer use of 'credit-cleaning' services—be
examined as part of the Treasurer's statutory review into the operation of the
credit reporting system.
2.132
The committee also encourages the relevant regulatory bodies to engage
early with plain English information campaigns to facilitate greater public
awareness and financial literacy of these new arrangements.
2.133
Australians have been waiting for comprehensive credit reporting for a
long time. The committee considers the reforms in the bill to be an important
and essential next step in transforming Australia's current negative and
assumption-based credit reporting system into one that provides for a holistic,
accurate and comprehensive view of consumers' credit standing. A fully
functioning and effective CCR regime will bring Australia into line with
arrangements equivalent to CCR in other OECD countries.
2.134
The committee notes that the reforms proposed by the bill are not new,
and have been born out of recommendations from multiple and extensive inquiries
and consultations. The legislative framework for comprehensive credit reporting
has been in place since March 2014 when amendments to the Privacy Act came into
effect. The changes proposed by the bill will ensure that the full benefits of
comprehensive credit reporting are realised.
Recommendation 2
2.135
The committee recommends that the bill be passed.
Senator
Jane Hume
Chair
Navigation: Previous Page | Contents | Next Page