Senate

Supplementary Explanatory Memorandum

(Circulated by authority of the Treasurer, the Hon Josh Frydenberg MP)

Chapter 1 Amendments to the National Consumer Credit Protection Amendment (Mandatory Credit Reporting and Other Measures) Bill 2019

Outline of chapter

1.1 This chapter explains the amendments to the Bill.

Summary of new law

1.2 The amendments to the Bill delay:

•

the operation of the mandatory comprehensive credit reporting regime set out in Schedule 1 to the Bill, so that it begins on 1 July 2021 rather than 1 April 2020; and

•

the commencement of the financial hardship information reporting framework in Schedule 2 to the Bill, so that it begins on 1 July 2022 rather than 1 April 2021.

1.3 The amendments also enhance the credit reporting framework in Schedule 2 to the Bill and the Privacy Act 1988 to provide greater protections for consumers and access to their information. These amendments involve:

•

limiting disclosure of financial hardship information by credit reporting bodies to situations where the consumer is seeking to access new credit;

•

allowing consumers to access their credit information that is held by a credit reporting body free of charge more frequently; and

•

requiring credit reporting bodies to provide consumers with their rating on a credit score scale and related information if requested by the consumer.

Comparison of key features of new law and current law

Detailed explanation of new law

Application of the mandatory comprehensive credit reporting regime

1.4 The mandatory comprehensive credit reporting regime established in Schedule 1 to the Bill currently begins on 1 April 2020.

1.5 Amendments 2 to 23 delay the operation of Schedule 1 to the Bill so that the mandatory comprehensive credit reporting regime begins on 1 July 2021 instead.

1.6 This means the obligation to supply mandatory credit information under the regime will begin on 1 July 2021 or the first 1 July that the licensee is an eligible licensee. In particular, the initial bulk supply of credit information is split as follows:

•

By 28 September 2021, large ADIs must supply credit information on 50 per cent of the consumer credit accounts within the banking group to all credit reporting bodies the large ADI had a contract with on 2 November 2017.

•

By 28 September 2022, large ADIs must supply credit information on the remaining accounts, including those that opened after 1 July 2021 and those held by subsidiaries of the large ADI, to the same credit reporting bodies as the first bulk supply.

1.7 Amendment 24 extends the timeframe for completing the independent review of the mandatory comprehensive credit regime. The Treasurer is required to cause an independent review of the mandatory regime which must be completed and a report given to the Treasurer before 1 October 2024, rather than 1 October 2023.

1.8 These amendments ensure that Schedule 1 to the Bill applies prospectively. With respect to the independent review of the mandatory regime, the amendments ensure sufficient time has passed since the commencement of the regime before the review must be completed.

Application of the financial hardship information framework

1.9 Amendments 1 and 26 to 29 delay the commencement and operation of the financial hardship information framework in Schedule 2 to the Bill so that it begins on 1 July 2022 rather than on 1 April 2021.

1.10 Therefore, beginning on 1 July 2022, credit information will include financial hardship information under the Privacy Act 1988.

1.11 This means that in certain circumstances, on or after 1 July 2022:

•

credit reporting bodies are permitted to use, disclose and retain financial hardship information; and

•

credit providers are permitted to disclose financial hardship information to credit reporting bodies.

1.12 Amendment 31 requires the Attorney-General to cause an independent review of the credit reporting system in Part IIIA of the Privacy Act 1988, which must be completed and a report given to the Attorney-General before 1 October 2024, rather than 1 October 2023. This aligns the timeframe for completing the report with the review of the mandatory comprehensive credit reporting regime, discussed above.

Disclosure of financial hardship information by credit reporting bodies

1.13 Amendment 25 amends section 20E of the Privacy Act 1988 to impose tighter restrictions on when a credit reporting body can disclose financial hardship information.

1.14 In particular, credit reporting information that is or was derived from financial hardship information about an individual must not be disclosed by a credit reporting body:

•

to a credit provider for the purpose of collecting payments that are overdue in relation to consumer credit provided by the provider to the individual; or

•

to a credit provider for the purpose of collecting payments that are overdue in relation to commercial credit provided by the provider to a person; or

•

to a credit provider for the purpose of assessing whether to accept the individual as a guarantor in relation to credit for which an application has been made to the provider by a person other than the individual; or

•

to a mortgage insurer for the purpose of assessing the risk of the individual defaulting on mortgage credit in relation to which the insurer has provided insurance to a credit provider.

1.15 Failure to comply with these requirements attracts a civil penalty of up to 2,000 penalty units. This is consistent with the other civil penalty provisions in the Privacy Act 1988 and is intended to deter contraventions of the new requirements.

1.16 The following table illustrates the effect of Amendment 25 (and existing provisions in the Privacy Act 1988) by setting out when a credit reporting body is permitted to disclose financial hardship information about an individual.

Table 1.1

1.17 The amendments to the Bill do not result in the outcomes set out in items 4 and 6 of the Table above. Rather, the Privacy Act 1988 currently permits the disclosure of credit reporting information more generally in those circumstances and will apply to financial hardship information automatically on 1 July 2022, when financial hardship information forms part of credit information.

1.18 Amendment 25 therefore limits the disclosure of financial hardship information by credit reporting bodies to credit providers and mortgage insurers to circumstances where the consumer is seeking access to new credit.

1.19 This amendment strengthens the protections for financial hardship information in the credit reporting system. This amendment applies in addition to the protections in Schedule 2 to the Bill, including the requirement that financial hardship information is only retained for one year and the prohibition on credit reporting bodies using financial hardship information to calculate a consumer's credit score.

1.20 As with the other amendments in Part 1 of Schedule 2 to the Bill, this amendment commences on the later of the day after Royal Assent and 1 July 2022.

Improving access for consumers to their credit reports

1.21 Section 20R of the Privacy Act 1988 allows a consumer to request access to their credit information from a credit reporting body that holds that information. Subsection 20R(5) currently provides that a fee cannot be charged by a credit reporting body for such a request if the consumer has not made another request in the last 12 months.

1.22 Amendment 30 shortens this timeframe and allows a consumer to request their credit information from a credit reporting body every three months without needing to pay a fee.

1.23 The purpose of this amendment is to make it easier for consumers to access their credit information, which will enhance the transparency and accountability in the credit reporting system. It also recognises that a consumer's credit information may change frequently, which could have a considerable impact on the consumer.

1.24 For example, where repayment history information and financial hardship information about a consumer exists in a month it must be reported. The frequency of potential month-to-month changes warrant consumers having greater free access to the information in their credit reports.

1.25 As with the other amendments in Part 3 of Schedule 2 to the Bill, the amendment commences on the day after Royal Assent. Amendments 32 to 34 provide that the amendment applies to requests made on or after the commencement date.

Information that must be given by credit reporting bodies to consumers

1.26 Amendment 30 also amends section 20R of the Privacy Act 1988 to require credit reporting bodies which are constitutional corporations to provide the following information to a consumer if the consumer requests credit reporting information from the body:

•

the body's credit score scale;

•

the consumer's rating on the credit score scale (however described);

•

the credit information that was used by the body to generate the consumer's rating on the credit score scale; and

•

the relative importance or weighting of that credit information.

1.27 This new requirement applies in addition to the existing requirement to provide credit reporting information to a consumer under subsection 20R(1) of the Privacy Act 1988. That is, if the consumer's rating on the credit reporting body's credit score scale is held by the credit reporting body, it would currently need to be provided under subsection 20R(1). This new requirement (in paragraph 20R(1)(b) and subsection 20R(1A)) applies even where the credit reporting body does not hold that information at the time of the request but can generate that information in the ordinary course of its business.

1.28 Existing subsections 20R(2) to 20R(4), 20R(6) and 20R(7) of the Privacy Act 1988, which set out exceptions to access, dealing with requests for access, access charges and refusal to give access, apply to the new requirement. Amendment 30 adds to the existing exceptions to access by providing that a credit reporting body is not required to give access to a consumer's rating on a credit score scale if the body does not hold sufficient credit information about the consumer to generate the consumer's rating in the ordinary course of its credit reporting business.

1.29 Credit reporting bodies use credit score scales (also referred to as credit score ranges) to provide a high-level summary of a consumer's credit worthiness. For example, a credit reporting body may use the following credit score scale:

•

Below Average: 0-505

•

Average: 506-665

•

Good: 666-755

•

Very Good: 756-840

•

Excellent: 841-1,200

1.30 The new requirement is therefore intended to assist consumers to understand their credit worthiness. It also reflects that a consumer's rating on the credit score scale is a common product based on consumers' credit information and recognises community concern about how certain information may be weighed up in the calculation of these ratings.

1.31 The new requirement does not prevent a credit reporting body from proactively providing a precise credit score to a consumer on request. For example, a credit reporting body may, in the interests of transparency, provide information that a consumer has a credit score of 850 in addition to informing the consumer that this score falls within the 'Excellent' credit score rating of 841-1,200.

1.32 Informing consumers about the inputs of their rating will allow consumers to understand the factors that contribute to their credit worthiness and how their behaviours affect their rating, allowing them to adjust their financial habits accordingly and work towards improving their loan accessibility.

1.33 This requirement increases transparency and accountability in the credit reporting system. It is also consistent with similar requirements in other jurisdictions, such as New Zealand.

1.34 This amendment commences on the day after Royal Assent and applies to requests made on or after the commencement date - see Amendments 32 to 34.