A variation to the Privacy (Credit Reporting) Code 2014 (the “CR Code”) has been approved by the Australian Information Commissioner (“OAIC”) commencing 14 February 2020.
The OAIC has given a summary of the changes:
- Writs and summons will no longer be considered publicly available information, and can no longer be listed on credit reports
- Credit reporting bodies (CRBs) will no longer be able to use pre-ticked direct marketing consents
- When requested by an individual, CRBs are obliged to notify other CRBs of that individual’s ban period request
- A Repayment History information (RHI) code ‘X’ will be introduced, intended to more accurately indicate when a payment is 180 days or more overdue.
In fact, there are more changes to the CR Code than indicated. While none of the changes are major, both credit providers (CPs) and credit reporting bodies (CRBs) need to be across them, because they will impact on day to day operations.
1. Clarification of what is meant by the expression “publicly available information”
Writs, summons and judgments unrelated to credit will no longer be considered “publicly available information”. That means they will no longer be listed on credit reports (Clause 11.2 CR Code).
The amendments are precise:
11.2 For the avoidance of doubt publicly available information does not include:
a) originating process issued by a Court or Tribunal; or
b) any judgment or proceedings where the individual’s rights have been subrogated to an insurer; or
c) any judgment or proceedings that is otherwise unrelated to credit;
because this information does not relate to the individual’s creditworthiness.
2. Territorial nexus on information that may be collected by CRBs
CRBs may only collect publicly available information about individuals if the information relates to activities conducted by that individual in Australia or its external territories (Clause 11.1 CR Code).
3. Additional obligations imposed on CRBs where individual is a victim of fraud and requests a “ban Period”
If an individual believes they are a victim of fraud (including identity fraud) they may request a CRB include a notation on their credit file. The CRB must explain to the individual that the notation may adversely affect their ability to obtain credit during the “ban period”
Going forward, the CRB receiving the request must also tell the individual that they may request other CRBs notate a ban period. If the individual wants other CRBs to notate a “ban period”, the first CRB must notify all the other CRBs nominated (Clause 17.1 CR Code).
Similar provisions apply where an individual seeks to extend the initial “ban period” ( section 17.4 CR Code).
Given that many requests for implementation of banning periods are communicated by individuals to credit providers, it will be interesting to observe how this new procedure will work in practice.
4. Interpretive Materials
Clause 8 CR Code has been inserted to clarify that the CR Code is to be read in conjunction with applicable laws and guidance by the Office of the Information Commissioner.
5. Consumer credit liability Information – clarification of “when consumer credit is entered into”
CRBs may collect and disclose “consumer credit liability information” from credit providers.. There are seven types of consumer credit liability information, one of which is:
“the day on which the consumer credit is entered into”
For consumer credit liability information disclosed from 14 February 2020, the expression “the day on which the consumer credit is entered into” will mean:
the day that, the consumer credit is unconditionally approved by the credit provider, and the credit provider has generated the consumer credit account within its credit management system;
This makes it easier for credit providers to precisely identify this date. All credit providers now need to do is to identify the date on which the credit account is opened. (Clause 6.2 CR Code).
6. Repayment History Information
One matter reported by credit providers to CRBs as part of comprehensive credit reporting is how long a repayment has been overdue. The categories used are numbered 1 to 7 – number 7 indicates that a payment is overdue at least 180 days.
Credit providers have tended to mark a “X” instead of using the number “7”.This change brings the CR Code into line with industry practice.
7. Correction of information – Introduction of specific timelines
Currently, clause 20.2 of the CR Code provides that a CRB or CP consulted by another CRB or CP about a correction request must take reasonable steps to respond to as soon as practicable.
This clause has been rewritten to introduce specific timeframes and a clearer mechanism for dealing with requests to correct information.
The amendments are designed to ensure that the consulted CRB or CP responds promptly to the request so that the first responder, (either a CP or CRB) can meet their 30-day correction timeframe to the consumer. Specifically:
- The first responder CRB or CP must take reasonable steps to provide the consultation request to the consulted CRB or CP within a time period of five business days of the correction request being made by the individual;
- The first responder must notify the consulted CRB or CP as to when the 30 day response period to resolve the individual’s correction request ends (the correction period);
- The consulted CRB or CP must respond to the first responder at least five (5) days before the end of the correction period or if they cannot do so they must explain why and provide and timeframe for response.
8. Correction of information – Clarification as to who makes the decision about the correction request
Clause 20.4 of the CR Code makes it clear that the consulted CRB or CP is the person who decides whether the credit-related personal information of the individual needs to be corrected. And they must do so as soon as practicable.
If the consulted CRB or CP decides that the requested correction is justified, they must make the correction within five business days and otherwise as soon as practicable.
9. Individuals must Opt In before CRBs are permitted to market to them.
This change applies solely to CRBs.
Individuals may obtain “free” credit reports in certain circumstances (Clause 19.3 CR Code). Where individuals obtained free credit reports, the individual had to “opt out” of receiving direct marketing material from the CRB.
The CR Code has now been amended so that CRBs may only provide the individuals with direct marketing communications where the individual has opted in to receive this communication. Specifically, it is stated that a pre-ticked consent box does not constitute opting in (Clause 19.4 CR Code).
