The following matters were raised in submissions. These matters go to technical issues on which the committee has no comments to make but draws to them to the attention of the Department of the Prime Minister and Cabinet.
| Provision |
Comments received |
| Throughout |
Consumer Action Law noted that the term 'written note' is used throughout the Draft and stated that these references should perhaps be changed to a 'record' rather than a 'note'. It is unclear whether there is a requirement to retain these notes or whether these notes will be included in the credit report so that the individual can access them. Consumer Action Law believed that they should be. Consumer Action Law, Submission 63, p. 13. |
Part A – Credit reporting
Division 2 – Credit reporting agencies |
| Section 103 – Application of the Division to credit reporting agencies |
The National Australia Bank (NAB) queried why subsection 103(3) referred to CP derived information as it is unclear why a credit reporting agency would hold this information. National Australia Bank, Submission 2a, p. 5. |
| Section 105 – Open and transparent management of credit reporting information |
The NAB submitted that subsection 105(4) appears to allow credit reporting agencies to have their own data standard. If this is the case, NAB stated that it would impractical from a credit reporting system perspective and add enormous cost for all users. National Australia Bank, Submission 2a, p. 5. |
| Section 106 – Collection of solicited credit information |
The NAB commented that section 106 (collection of solicited information) appears to attach a limitation on the collection of identification information. This may affect a credit reporting agency's ability to conduct identity verification services and NAB suggested that an exception be included for these purposes. National Australia Bank, Submission 2a, p. 5. The APF commented that paragraph 106(4)(f) 'hints at mutual exchange between CRAs but needs clarification'. In addition, the APF commented that the issue of reciprocity is outstanding, that is whether only lenders inputting information to the credit reporting system should be allowed to access the pooled information'. Australian Privacy Foundation, Submission 33a, p. 8. The AFC submitted that subsection 106(4)(d) should also be qualified by a knowledge/reasonableness test in the same way as subsection 106(4)(c) is qualified. Australian Finance Conference, Submission 12a, Attachment 2, p. vi. |
| Section 107 – Dealing with unsolicited information |
Experian commented that section 107 provides for the destruction of unsolicited credit information as soon as practicable if a credit reporting agency determines that the information could not have been collected under 106 if the agency had solicited the information. Subsection 107(4) provides for a civil penalty if this does not occur. Experian commented that the remaining provisions of Division 2 already have the effect of prohibiting a credit reporting agency from using or disclosing such credit information. Experian argued that these provisions, which include civil penalty provisions, are adequate to constrain the agency from dealing further with such credit information and that the additional obligations in subsection 107(4) regarding the destruction of such information are unnecessary and should not carry civil penalty consequences. Experian, Submission 46, p. 21. |
| Section 111–Use or disclosure of pre-screening determinations |
The APF commented that section 111 seems to be addressing the outsourcing of contact, for example, to a mailing house. The APF questioned whether this was the intention of the section. Australian Privacy Foundation, Submission 33a, p. 10. |
| Section 112 – Destruction of pre-screening determinations |
The APF commented that there appears to be some overlap between subsection 112(2) and section 104, which could be clarified. Australian Privacy Foundation, Submission 33a, p. 10. |
| Section 116 – Quality of credit reporting information |
ARCA argued that because credit reporting is not mandatory and there are different levels of information that can be supplied by certain credit providers, a credit report is unlikely to contain a total complete record of all of a consumer's debts. Thus it is unclear what 'complete' means. ARCA recommended that all credit providers be allowed to access repayment history, or alternatively to clarify that each record within a credit report is required to be 'complete'. Australasian Retail Credit Association, Submission 48, p. 17. |
| Section 117 – False or misleading credit reporting information |
The NAB commented that it supported the inclusion of the reference to 'a material particular' requirement in reference to any claim of credit reporting information being false or misleading. However, the NAB suggested that a threshold assessment be articulated in relation to this concept. National Australia Bank, Submission 2a, p. 6. |
| Section 118 – Security of credit reporting information |
The APF commented that the audit and dealing with suspected breach elements of the agreements between credit providers and credit reporting agencies in paragraphs 118(2)(b) and (c) are subject to interpretation. Australian Privacy Foundation, Submission 33a, p. 10. Telstra commented on the inclusion of the word 'interference' in this provision as it had done in relation to the APPs. Telstra also noted that there is no mention of including the word 'interference' in relation to security in the ALRC's report. Telstra, Submission 19, p. 2. |
| Section 120 – Correction of credit reporting information |
APF sought re-assurance that no rights have been lost through the separation of the correction obligation when the credit reporting agency becomes aware by other means (section 120) from correction 'on request' (section 121). APF also voiced concern with the reference in paragraph 120(3)(a) to it being 'impracticable' for a credit reporting agency to give notice to a recipient of credit reporting information that the information has been corrected. APF noted that there is similar wording in some other sections and commented that it could not understand why it might be impracticable for a credit reporting agency to provide corrected information to a recipient if it has appropriate systems in place. Australian Privacy Foundation, Submission 33a, p. 11. The NAB suggested that obligation to provide previous recipients of the information with a written notice of the correction unless it is impracticable for them to give the notice appears to be in conflict with subdivision E obligations (integrity of information). National Australia Bank, Submission 2a, p. 6. |
| Section 125 – Retention period for credit information – personal insolvency information |
Section 125 provides for the retention periods for credit information that relates to personal insolvency information. ARCA commented that there appears to be items of information in the retention criteria that are not data that is allowed within the definition of Credit Reporting Information, for example, certificates signed under section 232 of the Bankruptcy Act 1966 are not something for which provision has been made for credit reporting agencies to be able to score this data. In addition, for items 2, 3, 4 (personal insolvency agreements and debt agreements) the retention period starts 'on the day' on which the agreement is executed. ARCA commented that the timing of bankruptcy notifications (the lag between when these items actually occur) and when the credit reporting agency could first know about them is likely to be more than 'on the day'. This makes the deletion of the data in accordance with the provisions not possible. ARCA recommended that the requirement be amended to a 'reasonable period'. Australasian Retail Credit Association, Submission 48, pp 17–18. |
| Division 3 – Credit providers |
| Section 137 – Permitted CP disclosures between credit providers |
ARCA also commented on the intent of paragraph137(2)(b) in relation to consent being given to the credit provider or recipient and stated that this provision is unclear, particularly whom the 'recipient' is. ARCA recommended that paragraph 137(2)(b) be removed from the Exposure Draft. Further, subsections 137(1) and 137(2) require the consent to allow for the transfer of data, however, subsection 137(3) does not require consent for the transfer to an external agent. ARCA questioned whether this lower standard of data security was intentional. Australasian Retail Credit Association, Submission 48, pp 17–18. |
| Section 140 – Permitted CP disclosures to debt collectors |
Section 140 provides for disclosures of certain information to debt collectors. ARCA and the NAB commented that this provision requires clarification as it is unclear what information can and can't be provided to or obtained by debt collectors. Australasian Retail Credit Association, Submission 48, p. 18; National Australia Bank, Submission 2a, p. 7. |
| Section 143 – Quality of credit eligibility information |
The ANZ Bank argued that this section is unnecessary as there is a similar requirement under APP 10. In addition, the agreements that must be entered into between credit reporting agencies and credit reporting providers under section 116 would seem to make the provision unnecessary. The ANZ recommended that the subsection should be omitted to streamline compliance requirements to credit providers and avoid overlap with other provisions in the Exposure Draft. ANZ Bank, Submission 64, pp 7–8. |
| Section 145 – Security of credit eligibility information |
Section 145 provides for the security of credit eligibility information including the destruction of information no longer needed. ARCA commented that paragraph145(2)(b) 'may increase the danger of deleting information that is still legally required to be held' as the provision relates to information no longer needed 'under this Division'. ARCA submitted that this may be problematic if the data is needed to meet requirements of another Division, for example, an allowable use would be research sanctioned by the Information Commissioner but because that capacity to sanction research is not within this provision, the data could arguably not be retained for that purpose. ARCA recommended that the words 'under this Division' are deleted from the provisions. Australasian Retail Credit Association, Submission 48, p. 18. |
| Section 147 – Correction of credit information |
Credit providers must take steps to correct information that is inaccurate, out-of-date, incomplete or irrelevant. ARCA suggested that clarification is required regarding 'out-of-date' in paragraph 147(1)(b). ARCA stated that it is unclear where in the Privacy Act there is provision for holding data for use in scorecard development, which may require holding data for several years which for other purposes could be deemed to be out-of-date. Australasian Retail Credit Association, Submission 48, p. 19. |
| Section 148 – Correction of credit eligibility information |
ARCA commented that section 148 seems to duplicate 147 and therefore should be removed. Australasian Retail Credit Association, Submission 48, p. 19. |
| Section 149 – Individual may request the correction of credit information etc |
The ANZ was of the view that individuals should not be entitled to amend CP derived information and CRA derived information as proposed by section 149 as 'this is an assessment by either the credit provider or credit reporting agency of the individual's credit worthiness'. Rather, the ANZ considered that individuals should be able to request corrections to the credit information that feeds into those assessments.
ANZ Bank, Submission 64, p. 6.
The APF also commented:
- paragraph 149(1)(b) requires that the credit provider must hold at least one kind of personal information that an individual may have corrected. The APF stated that, in practice, almost all consumers who complain to credit providers do so because of information that has been reported to a credit reporting agency by a credit provider, so the requirement of paragraph 149(1)(b) is unnecessary and it would be unfair if a consumer had to show that the credit provider held that information. Therefore, 149(1)(b) should be amended to read 'the provider holds or has reported to a CRA at least one kind of the personal information referred to in paragraph (a)';
- subsection 149(3) appears to leave consultation with the credit reporting agency/other credit provider as a discretion, but section 159 in effect requires the credit provider to notify the individual. It was submitted that a cross reference note would be useful here.
Australian Privacy Foundation, Submission 33a, p. 12. |
| Section150 – Notice of correction etc must be given |
The APF suggested that the notice of correction should include a statement of the individual's rights and EDR scheme contact details. Australian Privacy Foundation, Submission 33a, p. 12. |
| Section 157 – Individuals may complain to a credit reporting agency or credit provider |
The Law Institute of Victoria (LIV) suggested a further ground for complaint be provided for in section 157. The LIV commented that section 126 provides for the destruction of credit reporting information in cases of fraud. The section applies if a number of circumstances arise including that an agency is satisfied that an individual has been the victim of fraud (including identity fraud) and the consumer credit was provided as a result of that fraud (paragraph 126(1)(c)). The LIV noted that there is no right of review or complaint with respect to any decision of an agency that is not satisfied of the matters set out in paragraph 126(1)(c) and recommended that such a ground for complaint be included in section 157. Law Institute of Victoria, Submission 36a, p. 3. |
| Part B – Other relevant provisions Division 1 – Definitions |
Section 180
Definitions |
Consumer credit
ARCA commented that as the definition of consumer credit is based on a threshold of 'primarily', this would mean that up to 50 per cent of the credit in a 'package' product could be consumer, but any difference in the allowability of certain types of information to be used in assessing (and presumably managing and collecting) on such credit would be applied to all of the consumer credit within that package as well. Such a situation could have an impact on packaged products for small business customers. Australasian Retail Credit Association, Submission 48, p. 13. Consumer credit related purpose In relation to a consumer credit related purpose, Westpac commented that it was concerned that the definition of a consumer credit related purpose in section 180 is currently restricted to assessing an application and collecting overdue payments. The definition does not include credit providers periodically obtaining an updated credit report for open accounts post-approval. Westpac argued that periodic reviews are important tools to ensure that customers are accessing and managing credit in a responsible manner and therefore recommended that such a purpose be included in the definition. Westpac, Submission 13a, p. 2. Credit reporting agency The ANZ Bank submitted that given the broad definition of credit reporting business, credit providers could be inadvertently captured by the definition. As a consequence, credit providers could be regulated as both credit providers and credit reporting agencies. The ANZ Bank recommended that the definition of credit reporting business be amended to exclude credit providers. Alternatively, the definition could be amended to include a dominant purpose test, as is the case currently in the Privacy Act. ANZ Bank, Submission 64, p. 5. Pending correction request ARCA stated that the definition of pending correction request refers specifically to 'credit information' and 'CRA derived information' only. Therefore, this would exclude CP derived information. Subsection 157(2) includes the ability to complain about 'credit eligibility information' which includes CP derived information. ARCA commented that this would suggest that due to the limited definition of a pending correction request, there can be no pending complaints that relate to CP derived information. The same issue arises with the definition of pending dispute. Australasian Retail Credit Association, Submission 48, p. 13. |
| Section 191 – Acquisition of the rights of a credit provider |
ARCA commented that section 191 states that a debt buyer, upon buying a specified debt, becomes for the purposes of the Act a credit provider. If that is the case, then other sections with regard to collections agencies, and other assignees, would seem to be inconsistent. Australasian Retail Credit Association, Submission 48, p. 13. |
| Section 181 – Meaning of credit information |
APF commented a new concept of 'Identification Information' is used in the definition of credit information. The definition of identification information is context specific to credit reporting and APF argued that it would be better not to introduce a term into Australian law which may be taken out of context and used as a precedent in other contexts. APF submitted that this should be replaced with Credit Identifying Information. Australian Privacy Foundation, Submission 33a, p. 4. |
| Section 185 – Meaning of payment information |
ARCA stated that within the meaning of payment information, it is unclear whether the requirement for updating a previously listed default is only when it is paid in full (or the debt is settled for less than the full amount) or if the requirement is to update when any payment of the previously default amount is made. Further, as the amount of a defaulted debt can increase with the addition of further missed payments or fees or interest, it is not clear whether a previously default amount can be updated (assuming the appropriate notification and collections actions have been undertaken). Australasian Retail Credit Association, Submission 48, p. 13. |
| Section 189 – Agents of credit providers |
ABA noted that an agent of a credit provider is treated as a credit provider itself. Section 189 appears to recreate section 11B(4B) of the current Privacy Act with respect to an agent acting on behalf of a credit provider. ABA stated that some of its members operate branch structures as franchises. These franchisees are agents of the principal bank and their operations are seamless to the customer, branded as the bank and they create deposits and credit facilities as items on the bank’s balance sheet. Under the NCCP these franchised branches are treated as credit representatives of the licensee bank. ABA argued that a similar approach may need to be taken in the Exposure Draft because the franchisees are not licensees within the meaning of the NCCP and hence the Exposure Draft. Under the NCCP the bank as licensee is liable for the conduct of its credit representatives. There is scope for this to be addressed under the regulation making power in subsection 194(4). Australian Bankers' Association, Submission 15a, p. 5. |
| Section 193 – Meaning of credit and amount of credit |
Within the meaning of credit and amount of credit, ARCA argued that it is unclear whether or not interest, fees and charges are to be considered as part of the debt when referring to the amount. If it were the case that they were not, then this would create substantial issues in relation to the listing of missed repayments and defaults, for example. Unpaid fees and charges are incorporated into the principle for certain products. Separating these, if that were required under this section could require substantial systems modification and may have tax and other legal ramifications not contemplated when this section was drafted. Australasian Retail Credit Association, Submission 48, pp 13–14. |