House of Representatives

Explanatory Memorandum

(Circulated by the authority of the Attorney-General the Honourable Michael Duffy, MP)

GENERAL OUTLINE

The provisions in this Bill will amend the Privacy Act 1988 to:

•

insert a new Part IIIA providing for regulation of the practices of credit reporting agencies and credit providers in relation to personal credit information;

•

provide the Privacy Commissioner with responsibilities for supervision of the consumer credit industry;

•

provide for the development of a Code of Conduct for the collection and handling of personal credit information by the Privacy Commissioner in consultation with the credit industry, government, consumer and privacy groups and other relevant bodies;

•

provide individuals with an enforceable right of access to, and correction of, their personal credit records;

•

limit the types of information which a credit reporting agency may hold;

•

place limits on the disclosure of personal credit information by credit providers;

•

limit access to a credit reporting agency database to those credit providers who, as a substantial part of their business, provide consumer credit;

•

mortgage and trade insurers;

•

other credit reporting agencies;

•

provide the Privacy Commissioner with powers to determine that a credit reporting infringement has been committed by a credit provider or credit reporter [and to determine that the individual be paid damages as compensation?];

•

provide certain offences for the intentional misuse or unauthorised access to, and fraudulent practices relating to, credit information.

FINANCIAL IMPACT

The amendments will have a limited impact on Commonwealth expenditure. Additional staff for the Human Rights and Equal Opportunity Commission will be required. This is estimated to cost the Government in the order of $365,000 in the first full year of operation. This figure contains an establishment component. It is expected that the figure would drop to around $250,000 for a full year of operation in subsequent years.

There will be minimal direct cost impact on consumer credit reporting agencies and credit providers as the industry already finances a self regulatory scheme for the industry.

Notes on Clauses

PART I - PRELIMINARY

Clause 1: Short title

1. When enacted, the Bill will be cited as the Privacy Amendment Act 1990. The Principal Act is the Privacy Act 1988.

Clause 2: Commencement

2. The Bill will come into operation on a day to be fixed by Proclamation; (sub-clause 2(1)). If a provision of the Bill has not commenced within 9 months of the Bill receiving Royal Assent, the Act will commence on the first day after the end of that period; (sub-clause 2(2)).

Clause 3: Saving of certain State and Territory laws

3. This clause affirms the intention of the Parliament to preserve any State or Territory law which makes provision with respect to interferences with privacy in relation to credit reporting or the use of information held in connection with credit reporting and which is capable of operating concurrently with this legislation.

Clause 4: Extension to external Territories

4. This clause extends the application of the Privacy Act to every external Territory.

Clause 5: Interpretation

5. Section 6 of the Principal Act is amended to include the following definitions relevant to the consumer credit reporting industry.

6. "financial corporation" is defined to mean a financial corporation for the purposes of paragraph 51(xx) of the Constitution.

7. "bank" is defined to include the Reserve Bank of Australia, a bank within the meaning of the Banking Act 1959 or a person who carries on State banking under paragraph 51(xiii) of the Constitution.

8. "building society" is defined as a society registered or incorporated under State or Territory legislation relating to such bodies.

9. "Code of Conduct" is defined to mean that Code which the Privacy Commissioner must publish in the Gazette concerning the collection of personal information for inclusion in individuals' credit information files and the storage of, security of, access to, correction of, use of and disclosure of personal information included in individuals' credit information files or in credit reports. The Commissioner is required to consult with various groups including the consumer credit reporting industry before issuing the Code; see new section 18A.

10. "Commercial credit" - The distinction between consumer credit and commercial credit is central to the scheme proposed by the Bill. "Credit" as already defined in the Bill refers to consumer credit. The insertion of a new definition to cover non-consumer credit is necessary in view of the commercial/consumer distinction. The proposed new definition of "commercial credit" is defined to mean a loan given to an individual, other than a loan given to an individual to be used for domestic family or household (ie consumer credit) purposes.

11. "Credit" means a loan sought or obtained by an individual from a credit provider body that is in the business of providing credit and which is to be used for domestic, family or household (ie consumer) purposes. The Bill proposes to regulate the collection and handling of personal information concerning consumer credit records. It does not purport to regulate the provision of information relevant to the granting of commercial credit.

12. "credit card" means a credit card, a charge card or any similar article used for obtaining cash, goods or services by means of loans. It includes any type of credit card issued by persons carrying on business for use in obtaining goods and services from those persons by means of loans.

13. "Credit information file" is defined as any record kept by a credit reporting agency that contains information relating to an individual and that is kept by a credit reporting agency in the course of carrying on a credit reporting business.

14. "credit provider" is defined in clause 11B, but for the purposes of sections 7 and 8 and Parts III, IV, and V also includes mortgage insurers and trade insurers.

15. "Credit report" means any record or information whether in a written, oral or other form relating to credit that is prepared by a credit reporting agency and has a bearing on the provision of credit to an individual, and is used for establishing an individual's eligibility for credit. This information may concern the individual's eligibility, credit worthiness, credit standing, credit eligibility, credit history or capacity to repay credit.

16. "Credit reporting agency" is defined in clause 11A.

17. "Credit reporting business" means a business or undertaking that involves preparing or maintaining records containing personal information relating to individuals for the purpose of providing information to other persons on an individual's eligibility to be provided with credit, history in relation to credit, or capacity to repay credit, whether or not the information is provided for the purposes of assessing applications for credit. The purpose of the Bill is not to regulate the reporting of publicly available information, and therefore the definition of 'credit reporting business' does not include a business or undertaking that prepares records in which the only personal information is publicly available information.

18. "Credit reporting complaint" means a complaint about an act or practice that, if established, would be an interference with the privacy of the complainant because it breached the Code of Conduct or breached a provision of Part IIIA.

19. "Credit reporting infringement" is defined as a breach of the Code of Conduct or a breach of the credit reporting provisions of this legislation (ie Part IIIA - Credit Reporting).

20. "Credit union" is defined as a society or other body of persons that is registered or incorporated as a credit union under State or Territory legislation.

21. "Current credit provider" is defined as a credit provider who has given credit to an individual, and that credit has not been fully repaid or fully discharged.

22. "Eligible communications service" is defined as a postal, telegraphic, telephonic or other like service, within the meaning of paragraph 51(v) of the Constitution.

23. "Loan" means a contract or arrangement under which a person is permitted to defer a payment of a debt, or to incur a debt and defer its payment, including

•

a hire purchase agreement;

•

a contract for the hire, lease, or renting of goods or services, (except where payment is made in full before or at the time the goods or services are provided, or where an amount greater than or equal to the value of the goods is paid as a deposit.

Transactions such as hire purchase, credit contracts, leases and rental agreements for goods and services are thus regarded as provision of credit for the purposes of the Bill.

24. "Mortgage credit" is defined to mean credit provided in relation to the acquisition, maintenance, or improvement of real property.

25. "Mortgage insurer" is defined to mean a corporation carrying on business that involves providing insurance to credit providers in respect of mortgage credit given by the credit provider.

26. "Serious credit infringement" is defined to cover cases where a person fraudulently obtains or attempts to obtain credit; fraudulently evades an obligation, or intends no longer to comply with his or her obligations in respect of the loan.

27. "Trade insurer" is defined as a corporation providing insurance to credit providers in respect of commercial credit given by credit providers to other persons.

28. Subsection 6(3A) is inserted into the Principal Act to confirm that a breach of the Code of Conduct is an act or practice that is contrary to or inconsistent with the Code.

29. Subsection 6(5A) is inserted into the Principal Act to maintain a distinction between consumer credit and commercial credit. This subsection will ensure that, for the purpose of the definition of "credit reporting business", information about an individual's commercial transactions will not be taken to be information relating to the individual's consumer credit eligibility, history or capacity to pay.

30. Subsection 6(5B) is inserted to ensure that a business or undertaking carried on by a credit provider that is a corporation is not a credit reporting business merely because it provides information to a related corporation.

31. Subsection 6(5C) provides that the regulations may provide that businesses or undertakings of a specified kind are not credit reporting businesses within the meaning of the Act. The purpose of this provision is to provide a means whereby the effect of the definition of `credit reporting business can be modified if experience indicates that the definition does not meet all commercial realities.

32. Proposed Subsection 6(7) of the Principal Act is amended to provide that a complaint in relation to the misuse of a tax file number could also be a complaint about misuse of personal credit information.

33. Subsection 6(8) provides that the question of whether corporations are related to each other is to be determined in the same manner as the same issue is determined under the Companies Act 1981.

Clause 6: Acts and Practices of agencies etc

34. This clause will amend s.7 of the Principal Act to provide that a reference in the Principal Act to an act or to a practice is a reference to an act done, or practice engaged in, by a credit reporting agency or a credit provider.

35. New subsection 7(3A) will provide that an act in relation to an individual's credit record by a credit provider that is not a corporation is an act for the purposes of the Principal Act if it is done for the purposes of banking carried on by the credit provider. This is a technical drafting provision which is required so that the Commonwealth Banking Corporation which is excluded from the operation of the Information Privacy Principles is not excluded from the operation of the credit reporting provisions.

Clause 7: Acts and practices of, and disclosure of information to, staff of agency etc.

36. This clause will amend section 8(1)(a) of the Principal Act to provide that any act done or engaged in by, or information disclosed to, a person in the course of employment by, or in the service of, a credit reporting agency or a credit provider will be treated as having been done, engaged in by, or disclosed to, the credit reporting agency or credit provider.

Clause 8: Insertion of new sections:

37. Clause 8 inserts new sections in the Principal Act which define a credit reporting agency and a credit provider.

Section 11A - Credit reporting agencies

38. New section 11A will provide that a body will be regarded as a credit reporting agency if the body is a corporation which carries on a credit reporting business. A credit reporting business means a business or undertaking that involves preparing or maintaining records containing personal information relating to individuals for the purpose of providing information to other persons on an individual's eligibility to be provided with credit, history in relation to credit, or capacity to repay credit. (See the definition of 'credit reporting business' in clause 5).

Section 11B - Credit providers

39. It is considered that to protect individuals' privacy it is necessary to limit the bodies who have access to the records of personal information held by a credit reporting agency.

40. Section 11B will provide that a body will be regarded as a credit provider for the purposes of the Principal Act if the body is either a bank or a corporation which is one of the following: a building society, a credit union, a retailer which issues credit cards or charge cards, or a corporation, a substantial part of whose business is the provision of loans, including the issuing of credit cards or charge cards. The definition also includes commercial credit providers. This will allow disclosure of a consumer credit report by a credit reporting agency to a commercial credit provider in certain circumstances and to allow the use of commercial credit report by a credit provider for the assessment of consumer credit transactions.

41. Subparagraph 11B(b)(v) provides that the Privacy Commissioner will be empowered to determine that a class of corporations which carry on a business involving the provision of loans (including the provision of loans by issuing of credit cards) are to be credit providers for the purposes of the Bill.

42. Paragraph 11B(c) provides that a natural person may be a credit provider for the purposes of the Bill if he or she satisfies any of the conditions that would make a corporation a credit provider for the purposes of the Bill.

43. Subsection 11B(2) provides that a body, which is a credit provider under the categories set out in that section, may, by regulation, be declared not to be credit provider for the purposes of the Act.

44. Subsections 11B(3) and 11B(4) provide that determinations by the Privacy Commissioner relating to a class of corporations being deemed credit providers for the purposes of the Act under s. 11B(1)(b)(v)(B) are required to be published in the Gazette and are disallowable instruments for the purposes of s.46A of the Acts Interpretation Act 1901. The Gazettal notice will take effect on the first day on which it is no longer liable to be disallowed or a date the notice provides for commencement.

45. A Gazettal notice is required to be laid before each House of Parliament within 15 sitting days of their making. If it is not laid before each House, the notice will be void and of no effect. Each House may pass a resolution disallowing a notice.

Clause 9: Insertion of new section

Section 12A - Act not to apply in relation to State banking or insurance within that State.

46. New section 12A is a Constitutional provision. It provides that the Bill does not purport to regulate intra State banking or insurance activities.

Clause 10: Interferences with privacy

47. This clause will amend section 13 of the Principal Act to provide that an act or practice is an interference with the privacy of an individual, if and only if, the act or practice engaged in by a credit reporting agency or a credit provider constitutes a credit reporting infringement in relation to personal information that relates to the individual. A credit reporting infringement is a breach of the Code of Conduct or a breach of the statutory provisions for credit reporting set out in Part IIIA.

Clause 11: Guidelines relating to tax file number information

48. This provision is a formal drafting provision which clarifies the operation of s. 17(3) of the Principal Act. It is not relevant to consumer credit reporting.

Clause 12: Insertion of new sections

Section 18A - Code of Conduct relating to credit information files or credit reports.

49. New section 18A requires the Privacy Commissioner to issue a Code of Conduct. Subsection 18A(1) sets out the matters that the Code of Conduct can deal with -

•

the collection of personal information for inclusion in individuals' credit information files;

•

the storage of, security of, access to, correction of, use of, and disclosure of personal information included in individuals' credit information files or in credit reports;

•

any other activities engaged in by credit reporting agencies or credit providers that are connected with credit reporting;

•

the procedure for the manner in which disputes between individuals and credit providers and credit reporting agencies (including their initial resolution) are to be handled by the industry.

The Code is required to be published in the Gazette - s. 18A(1).

50. Subsection 18A(2) provides that the Commissioner is required in formulating the Code to consult with the credit industry, government, consumer, privacy groups and other relevant bodies to the extent that it is appropriate and practicable to do so.

51. Subsection 18A(3) provides that, in preparing the Code of Conduct, the Commissioner is required to have regard to the Information Privacy Principles set out in s.14 of the Principal Act, the provisions of new Part IIIA of the Principal Act, and the likely costs to credit reporting agencies and credit providers of complying with the Code of Conduct. The Code of Conduct will be a disallowable instrument (new s.18A(4)).

52. Subsection 18A(4) provides that the Commissioner must publish notice of the Code of Conduct in the Gazette and that it will take effect on the first day on which it is no longer liable to be disallowed or a date the Code provides for commencement. The Code will be required to be laid before each House of Parliament within 15 sitting days of their making. If it is not laid before each House, it will be void and of no effect. Each House may pass a resolution disallowing any part of the Code.

Section 18B - Credit reporting agencies and credit providers to comply with Code of Conduct.

52. New section 18B requires a credit reporting agency or a credit provider not to do an act or engage in a practice that breaches the Code of Conduct. A breach of the Code of Conduct is an interference with an individual's privacy (s.13 of the Principal Act).

53. A credit reporting agency or credit provider could be prosecuted for an offence or be liable to pay damages as compensation for an infringement of an individual's privacy through the breach of the Code; (see s.52. of the Principal Act).

Clause 13: Insertion of new Part

Part IIIA - CREDIT REPORTING

Section 18C - Certain credit reporting only to be undertaken by corporations

54. This provision defines which persons may operate as credit reporting agencies.

55. New section 18C(1) will provide that a person must not in the course of carrying on a credit reporting business use an eligible communications service unless that person is a corporation.

56. Subsection 18C(2) is a Constitutional provision.

57. Subsection 18C(3) will provide that a person must not in the course of carrying on a credit reporting business act on a corporation's behalf unless the person is a corporation. A person will be undertaking a credit reporting business where it is a corporation and is in the business of preparing or maintaining files containing personal credit information for the sole or principal purpose of allowing access to credit providers for profit, reward or otherwise in order to assist credit providers in assessing applications by individuals for credit (see definition of `credit reporting business' in clause 5(b)).

58. Subsection 18C(4) provides that a person who knowingly or recklessly contravenes this section is guilty of an offence punishable on conviction by a fine not exceeding $30,000.

Section 18D - Personal information not to be given to certain persons carrying on credit reporting agencies.

59. Section 18D provides that a person must not use an eligible communications service to give to a person carrying on a credit reporting business personal information for the purpose of carrying on that business unless the person carrying on the business is a corporation.

60. New section 18D(2) is a Constitutional provision.

61. Subsection 18D(3) prohibits a corporation from giving personal information to a credit reporting agency for the purpose of the agency creating an individual's credit information file or the agency including the information in an individual's credit information file unless the credit reporting agency is a corporation.

62. Subsection 18D(4) creates an offence whereby a person who knowingly or recklessly contravenes this section is guilty of an offence punishable on conviction by a fine not exceeding $12,000.

63. Subsection 18D(5) provides that for the purpose of this section, personal information will be taken to be given to a person if the person receiving the information is likely to use the information in the course of carrying on a credit reporting business.

Section 18E - Permitted contents of credit information files.

64. New section 18E sets out the type of personal credit information which a credit reference agency can include in an individual's credit information file.

65. Subsection 18E(1) provides that a credit reporting agency is prohibited from holding personal information (as defined by section 6 of the Principle Act) on an individual's credit information file unless the information is -

(a)

information which is reasonably necessary in order to identify the individual;

(b)

(i)

a record of a credit provider who has sought a credit report in relation to the individual who has made an application for consumer credit or commercial credit to that credit provider and the amount of credit sought in that application;

(ii)

a record of a mortgage insurer having sought a credit report in connection with the provision of insurance to a credit provider in relation to credit given by the credit provider.

(iii)

a record of a trade insurer having sought a credit report in connection with the provision of insurance to a credit provider in relation to commercial credit given by the credit provider.

(iv)

a record of a credit provider having sought a credit report in connection with an individual having offered to act as guarantor in respect of a loan;

(v)

the name of a current credit provider;

(vi)

a record of credit provided by a credit provider to an individual, being credit in respect of which the individual is at least 60 days overdue in making a payment and the credit provider has taken steps to recover any part of the debt;

(vii)

a record of a cheque that has been presented and dishonoured twice, and which is for an amount of more than $100;

(viii)

a record of court judgements against the individual;

(ix)

a record of bankruptcy orders made against the individual;

(x)

a record of the opinion of a credit provider that the individual has committed a serious credit infringement; the credit provider must have reasonable grounds for the opinion;

(c)

the information is included in a statement provided by the individual for a correction, deletion or addition to the individual's file under s.18J(2);

(d)

the information is a record of notification given under s.18F(4) that an individual is no longer in default in relation to credit.

67. New s.18E(2) will provide that a credit reporting agency is prohibited from including in an individual's credit information file personal information recording the individual's:

(a)

political, social or religious beliefs;

(b)

criminal record;

(c)

medical history or physical handicaps;

(d)

race, ethnic origins or national origins;

(e)

sexual preferences or practices;

(f)

lifestyle, character or reputation;

68. Subsections 18E(3) and 18E(4) will enable the Privacy Commissioner to determine in writing the kinds of information that are reasonably necessary to be included in the individual's credit information file in order to identify the individual. This determination is required to be published in the Gazette and is a disallowable instrument (ss. 18D(5) and (6)).

69. Subsection 18E(7) will prohibit a credit reporting agency from opening a credit information file in relation to an individual unless it has information concerning the individual to include in the file which is information prescribed by s. 18E(1)(b). The effect of the provision will be to ensure that publicly available information cannot be used to create a credit information file. This is consistent with the Bill's approach of not seeking to regulate publicly available information.

70. Subsection 18E(8) will prohibit a credit provider from giving to a credit reporting agency -

(a)

information which the agency is prohibited from including in an individual's credit information file;

(b)

information which the credit provider does not have reasonable grounds for believing is correct;

(c)

information which the credit provider did not, at the time of, or before acquiring the information, inform the individual that it might be disclosed to a credit reporting agency.

Section 18F - Deletion of information from credit information files.

71. Subsection 18F(1) provides that a credit reporting agency must delete from an individual's credit information file any personal information in respect of which the maximum permissible period for retaining that information has expired. The credit reporting agency has a period of one month after the expiry of that period in which to make the deletion.

72. Subsection 18F(2) sets out the maximum permissible period in respect of each class of personal information. These are -

(a)

5 years for information concerning a credit provider, or a mortgage or trade insurer having sought a credit report in relation to the individual. The 5 year period will run from the day on which the credit report concerned was sought;

(b)

in the case of a notation of a current credit provider, 14 days from the day the reporting agency receives notification that the credit provider is no longer a current credit provider in relation to the individual concerned;

(c)

5 years for information concerning credit provided by a credit provider to an individual, being credit in respect of which the individual is at least 60 days overdue in making a payment and the credit provider has taken steps to recover the total amount of credit outstanding. The 5 year period will run from the day on which the reporting agency was informed of the overdue payment;

(d)

5 years in the case of a dishonoured cheque, with the time to run from the date of the second dishonouring of the cheque (paragraph 18E(1)(b)(vii) refers);

(e)

5 years for information concerning court judgements made against the individual. The 5 year period will run from the day on which the court judgement was made;

(f)

7 years for information concerning the bankruptcy order made against the individual. The 7 year period will run from the day on which the bankruptcy order was made;

(g)

7 years in the case of an opinion of a credit provider that the individual has committed a serious credit infringement.

73. Subsection 18F(3) - Currently, individuals are being denied credit because the records of the credit reference agency concerning an individual are incorrect as credit providers have failed to notify the agency of the satisfaction of overdue debts. Subsection 18F(3) will remedy this situation by imposing an obligation on a credit provider to inform a credit reporting agency that the individual, about whom the credit provider has previously given information to the credit reporting agency, is no longer overdue, or that the individual disputes the debt.

74. Subsection 18F(4) requires a credit reporting agency, on notification of the satisfaction of a debt, to note the individual's credit information file to that effect and, in addition, to note any disputed debts notified to it by the credit provider; new s. 18F(4).

75. Subsection 18F(5) provides that a credit provider that has notified a credit reporting agency that it is a current credit provider must, upon ceasing to be a current credit provider, notify that fact to any credit reporting agency it had previously informed that it was a current credit provider.

Section 18G - Accuracy and security of credit information files and credit reports.

76. Incorrect credit information can have a profound effect on the lives of individuals. Section 18G provides that a credit reporting agency and a credit provider will be required to take steps to ensure that the personal information contained in a credit report is accurate, up to date, complete and not misleading (paragraph 18G(a)), and that reasonable security measures are taken to safeguard the information from loss, unauthorised access or disclosure (paragraph 18G(b)). Where there are disagreements between an individual and a credit reporting agency or credit provider as to the accuracy of a credit record, the individual will be able to request the record-holder to include a statement or note in the credit file or report; see new s. 18J.

77. Paragraph 18G(c) provides that a credit reporting agency and credit provider will be required to ensure that where a credit file or report is given to a person in authorised circumstances, everything reasonably within the power of the agency or credit provider is done to prevent the unauthorised use or disclosure of the personal information contained in the file or report; new s. 18G(c).

Section 18H - Access to credit information files and credit reports.

78. It is a basic privacy right that individuals should have a right of access to their personal information held by others in the community.

79. Section 18H provides an enforceable right of access for individuals to their credit information files or credit files which are in the control or possession of a credit reporting agency or a credit provider. A credit provider or credit reporting agency will be required to take all reasonable steps to ensure that the individual can obtain access to their files or reports.

Section 18J - Alteration of credit information files and credit reports.

80. Section 18J(1) will require a credit reporting agency or a credit provider who have in their possession a credit file or a credit report to take responsible steps by making corrections etc. to that information to ensure the information is accurate, up-to-date, complete and not misleading.

81. Subsection 18J(2) requires a credit reporting agency or a credit provider to take reasonable steps to include in the file within 30 days any statement provided by the individual of a correction, deletion or addition where the credit reporting agency or credit provider has not made an amendment requested by the individual.

82. Under subsection 18J(3) a credit reporting agency or credit provider which considers a statement to be of undue length can refer the matter to the Privacy Commissioner for such reduction in length as is considered appropriate; an amended statement must be included on the file.

Section 18K - Limits on disclosure of personal information by credit reporting agencies.

83. Section 18K will impose strict limits on the disclosure of personal information by credit reporting agencies. As a means of protecting individuals' privacy, credit reporting agencies will only be able to disclose an individual's personal credit information in authorised circumstances.

84. Subsection 18K(1) sets out the authorised circumstances in which a credit reporting agency may disclose information from an individual's credit information file. These are -

(a)

the information is provided in a credit report given to a credit provider who requested the report to assess an application for consumer credit by the individual (s.18K(1)(a); or

(b)

the information is provided in a credit report given to a credit provider for the purposes of assessing an application for commercial credit, and the individual to whom the report relates has agreed in writing (S.18K(1)(b);

(c)

the information is provided in a credit report given to a credit provider for the purposes of assessing the individual as guarantor in respect of a loan, and the individual who is to be guarantor has agreed in writing to the credit report being given to the credit provider (s.18K(1)(c);

(d)

the information is given to a mortgage insurer for the purpose of assessing whether to provide insurance to the credit provider in respect of mortgage credit applied for by or given to the individual the subject of the report (s.18K(1)(d);

(e)

the information is given to a trade insurer for the purpose of assessing whether to provide insurance to a credit provider in respect of commercial credit given by the credit provider to the individual or another person, and the individual has agreed in writing to the disclosure (s.18K(1)(e);

(f)

30 days after a credit reporting agency has received notification that an individual is 60 days overdue in making a payment, the credit reporting agency may provide a credit report to any credit provider who is a 'current credit provider' in respect of that individual (s.18K(1)(f);

(g)

the information is given to a credit provider who requested it for the purposes of collection of payments that are overdue in respect of consumer credit given to the individual (s.18K(1)(g);

(h)

the information is given to a credit provider who requested it for the purposes of collection of payments that are overdue in respect of commercial credit, and the individual has agreed to the information being provided, or the individual had agreed to a credit report being provided to assess the original application for commercial credit, or the commercial credit was provided before the commencement of the section (s.18K(1)(h);

(j)

the information is given to another credit reporting agency (s.18K(1)(j);

(k)

the information is contained in a record in which the only personal information is publicly available information (s.18K(1)(k);

(m)

the disclosure is required or authorised under law (s.18K(1)(m);

(n)

where the credit reporting agency is satisfied that a credit provider or law enforcement agency believes on reasonable grounds that the individual has committed a serious credit infringement, the credit reporting agency may disclose the information to a credit provider or law enforcement agency (s.18K(1)(n).

85. Subsection 18K(2) prohibits a credit reporting agency disclosing personal information contained on a credit information file, or information derived from the file, if the information is information it would be prohibited from including in the credit file by section 18E(1), or information it is required to delete from the file by section 18F.

86. The prohibition on disclosure of information in subsection 18K(2) does not apply to information included on a credit file prior to the commencement of section 18K, and the information is of kind which the Privacy Commissioner has determined may be disclosed without contravention of subsection 18K(2); (s. 18K(3)).

87. It is a serious offence for a credit reporting agency to knowingly or recklessly disclose personal information in unauthorised circumstances (ie contrary to subsections (2) or (3)). On conviction, a fine not exceeding $150,000 could be imposed by a court; (s. 18K(4).

88. Subsection 18K(5) requires a credit reporting agency to include a note in an individual's credit information file when that person's information is disclosed.

89. It is reported that some individuals such as small businessmen and sole traders have been unfairly denied credit for domestic purposes on the basis of their commercial credit records. This will be remedied by prohibiting a credit reporting agency from including in a consumer credit report given to a credit provider under paragraph 18K(1)(a) any information relating to the individual's commercial activities; (s. 18K(6)).

90. Determinations under paragraph 18K(2)(b) are to be notified in the Gazette, and such a notice is to be a disallowable instruments for the purposes of section 46A of the Acts Interpretation Act 1901; (ss. 18K(7) & (8)).

Section 18L - Limits on use by credit providers of personal information contained in credit reports etc.

91. New section 18L will impose strict limits on how a credit provider can use information which is obtained from a credit reporting agency.

92. Subsection 18L(1) provides that a credit provider will be prohibited from using the information contained in a credit report for a purpose other than the assessing of a credit application made to the credit provider by the individual concerned unless -

(a)

the credit report was obtained under the provision relating to obtaining of credit reports for the purposes of assessing an application for commercial credit information (s. 18K(1)(b)), and the report is used to assess that commercial credit application;

(b)

the credit provider uses the report for the purposes of assessing a guarantor (and the report was obtained under paragraph 18K(1)(c));

(c)

where the report was obtained under paragraph 18K(1)(f) (ie a report provided to a current credit provider in respect of payments which are 60 days overdue), the credit provider may use the report for the purpose of assisting the individual to avoid defaulting on credit obligations;

(d)

the report is used for the purpose of collection of overdue payments;

(e)

the use of the report is required or authorised by law;

(f)

the credit report is used in connection with a serious credit infringement;

93. Subsection 18L(2) makes it an offence for a credit provider to knowingly or recklessly use personal information contained in a credit report for an unauthorised purpose. On conviction, a fine not exceeding $150,000 could be imposed by a court.

94. Subsection 18L(3) requires a credit provider in possession of a credit report, before using it, to delete any personal information in the report that is not permitted to be included in a credit file by section 18E(1). Further, it may not use information derived from the report if the information is not permitted contents of a credit file under section 18E(1).

95. Subsection 18L(4) prohibits a credit provider from using any commercial credit information relating to the individual to assess an application for (consumer) credit by the individual unless the individual agrees in writing.

96. Subsection 18L(5) permits a credit provider to use information which would not be permitted to be included on a credit reference file if the information is permitted to be disclosed by a credit reference agency under subsection 18K(3). Thus the credit provider may use the information if it was included in the file or other record prior to the commencement of section 18K (Limits on disclosure of personal information by credit reporting agencies), and where the Privacy Commissioner has determined that the information may be disclosed without contravening subsection 18K(2).

97. The Privacy Commissioner may determine the manner in which commercial information obtained under subsection 18L(4) may be used, including the manner in which the individual's consent may be obtained. Such a determination is to be published in the Gazette, and is a disallowable instrument; (s. 18L(6),(7), and (8)).

Section 18M - Information to be given if an individual's application for credit is refused.

98. A credit provider will be required to give a written notice to an individual where that person has been refused credit on the basis of information contained in a credit report provided by a credit reporting agency for the purpose of assessing an application for credit by the individual.

99. The written notice shall state that:

•

the application has been refused;

•

the refusal was based on wholly or partly on the credit report provided by a credit reporting agency;

•

the name and address of the agency; and

•

the fact that the individual has an enforceable right of access to his/her credit information file maintained by the credit reporting agency.

Section 18N - Limits on disclosure by credit providers of personal information contained in reports relating to credit worthiness etc.

100. Section 18N will prohibit a credit provider from disclosing a report (as defined by subsection 18N(9)), or information derived from a report, to another person unless the disclosure is authorised by the Principal Act. Authorised disclosures are listed in subsection (1) and are as follows -:

(a)

where the information is disclosed to a credit reporting agency to create, or to be included in, a credit information file in relation to the individual concerned;

(b)

the individual has specifically agreed in writing to the disclosure of the report to another credit provider;

(c)

a credit provider may provide a report (not being a credit report) to a debt collector; however the report must contain only personal identification information and information relating to credit provided by the credit provider in relation to which the individual is 60 days overdue and which the credit provider has taken steps to recover (see 18E(1)(b)(vi));

(d)

where the credit provider is a corporation, and the report is disclosed to another related corporation;

(e)

a credit provider may provide a report to a corporation (or its professional legal advisers) so that the corporation may consider whether to accept an assignment of a debt owed to the credit provider, accept a debt owed to the credit provider as security for a loan, or to purchase an interest in the credit provider; or so the corporation may exercise any rights arising from such an acceptance or purchase;

(f)

the report is made to a manager of loans for a credit provider, for the purpose of managing those loans;

(g)

disclosure is required or authorised by law;

(h)

where the credit provider believes on reasonable grounds that an individual has committed a serious credit infringement the credit provider may give a report or information to another credit provider or a law enforcement authority.

99. Subsection 18N(2) is an offence provision. It provides that a credit provider who knowingly or recklessly contravenes this provision is guilty of an offence punishable on conviction by a fine not exceeding $150,000.

100. Subsection 18N(3) requires a credit provider, before disclosing a credit report, or personal information derived from a report, to delete from it any information that a credit reporting agency could not include on the credit file under section 18E(1). Subsection 18N(4) provides that the information referred to in subsection 18N(3) does not include information which might be disclosed by a credit reporting agency as a result of the operation of subsection 18K(3). That is information included in the report prior to the commencement of the Act, and the information is of the type the Privacy Commissioner has determined, pursuant to subsection 18K(3), may be disclosed.

101. Subsection 18N(5) provides that the Commissioner will be empowered to determine in writing the manner in which a report or personal information derived from a report may be disclosed. This will include the manner in which an individual's agreement is obtained for a disclosure.

102. A report disclosed in a manner contrary to the determination is to be taken to have been disclosed contrary to subsection 18N(1) (but not for the purposes of the criminal offence in subsection 18K(2)). A determination under s. 18N(5) will be published in the Gazette and will be a disallowable instrument; new s. 18N(6), (7) and (8).

103. Subsection 18N(9) ensures that the regulatory regime of the Bill will not apply to publicly available information. It provides that for the purpose of this provision, a report means a credit report or any other record or information whether in written, oral or other form that has any bearing on an individual's credit worthiness, credit standing, credit history or credit capacity, but does not include a report in which the only information is publicly available information.

104. Subsection 18N(10) is a Constitutional provision which, in relation to the application of section 18N to a non-corporate credit provider, provides that a report may only be a report for the purposes of section 18N if it has been prepared by or for a corporation. This ensures that the operation of section 18N is limited to the extent supportable by Commonwealth Constitutional power.

Section 18P - Limits on use or disclosure by mortgage insurers or trade insurers of personal information contained in credit reports

105. Proposed subsection 18P(1) makes provision for limiting the use and disclosure by mortgage insurers of credit reports and personal information derived from those reports. A mortgage insurer will only be able to use a credit report or any information derived from a report for assessing whether to provide insurance to a credit provider in respect of mortgage credit provided to the individual the subject of the report.

106. Subsection 18P(2) makes provision for limiting the use or disclosure by trade insurers of credit reports or personal information derived from those reports. A trade insurer will only be able to use a credit report or any information derived from the report to assess whether to provide insurance to a credit provider in respect of commercial credit given by the credit provider, or to assess the risk of the person defaulting on commercial credit in respect of which the trade insurer has insured the credit provider.

107. Proposed subsection 18P(3) makes provision for mortgage insurers and trade insurers to be required to delete certain information from a credit report before using that report. The information that has to be deleted will be any personal information contained in the credit report, or derived from the report which is not within the authorised type of information set out in section 18E.

108. Subsection 18P(4) provides that the information referred to in subsection (3) does not include information which might be disclosed by a credit reporting agency as a result of the operation of subsection 18K(3). That is information included in the report prior to the commencement of the Act, or information of the type the Privacy Commissioner has determined, pursuant to section 18K(3), may be disclosed.

109. Proposed subsection 18P(5) provides that a mortgage insurer and trade insurer will be required to not to disclose any personal information contained in a credit report unless disclosure of the information is required or authorised by or under law. It will be an offence to knowingly or recklessly breach the disclosure rules set out in the provision. On conviction, a fine not exceeding $150,000 could be imposed by a Court (s. 18NA(6)).

Section 18Q - Limits on use or disclosure by certain persons of personal information obtained from credit providers

110. Subsection 18Q(1) provides that where a corporation has obtained a credit report or information from a related corporation under subsection 18N(1)(d), it may only use or disclose the report or information in the same way that a credit provider could use the information under section 18L, or disclose the information under section 18N.

111. Subsection 18Q(2) provides that a corporation that has obtained a report or information for the purposes of considering whether to accept an assignment of a debt, accept a debt as security for a loan, purchase an interest in a credit provider, or for the purposes of exercising a right arising from an acceptance or purchase (see 18N(1)(e)), may only use that report or information for that purpose.

112. Subsection (3) places limitations on the use of a report or information by a corporation's professional legal adviser. It provides that a corporation's professional legal adviser or professional financial adviser who has obtained a report under paragraph 18N(1)(e) may only use a report, or any personal information derived from the report, for purposes related to the purpose for which the corporation obtained the report.

113. Subsection (4) provides that a person who has received a report as a loans manager (paragraph 18N(1)(f) refers) may only use the report or information derived from the report for the purposes of managing loans.

115. Subsection (5) provides that a person who has obtained a report or information under paragraph 18N(1)(e), or (f) must not disclose the report or personal information derived from the report unless the disclosure is required or authorised by law.

116. Subsection (6) provides that a person who has obtained a report under paragraphs 18N(1)(d), (e), or (f) must, before using it, or any information derived from it, delete any information that could not be included in a credit file by a credit reporter (ie any information not of a kind referred to in s. 18E(1)).

117. Subsection (7) provides that where subsection (6) refers to information not of a kind referred to in s.18E(1), that reference does not include information which was included in the credit file prior to the commencement of the Act, and which is information which the Privacy Commissioner has determined may be released (see subsection 18K(3)).

118. Subsection (8) is a Constitutional provision which restricts the obligations imposed by this section in relation to a report, or information derived from a report, to corporations, or persons who obtained the report or information from an incorporated credit provider.

119. Subsection (9) makes it an offence to contravene subsections (1), (2), (3), (4) or (5). The maximum penalty on conviction is $30,000.

Section 18R - False or misleading credit reports.

120. It will be an offence for a credit reporting agency or a credit provider to give a credit report, that the credit reporting agency or credit provider knows to contain false or misleading information, to any person or body; (s. 18R(1)).

121. A conviction for this offence will carry a penalty of a fine not exceeding $75,000; (s. 18R(2)).

Section 18S - Unauthorised access to credit information files or credit reports.

122. Subsections 18S(1) and 18S(3) provide that it will be an offence where a person knowingly or recklessly obtains unauthorised access to an individual's credit information file that is in the possession of a credit reporting agency. A penalty of a fine not exceeding $30,000 is prescribed for this offence; (s. 18S(3)).

123. Subsection 18S(2) and 18S(3) provide that it will be an offence where a person knowingly or recklessly obtains access to an individual's credit report that is in the possession of a credit provider or credit reporting agency unless the access is authorised by the Principal Act. A penalty of a fine not exceeding $30,000 is prescribed for this offence; (s. 18S(3)).

Section 18T - Obtaining access to credit information files or credit reports by false pretences.

124. It will be an offence for a person by a false pretence, to obtain access to an individual's credit information file that is in the possession or control of a credit reporting agency. A penalty of a fine not exceeding $30,000 is prescribed for the offence; (s. 18T(1)).

125. It will be an offence for a person, by a false pretence, to obtain access to a credit report that is in the possession or control of a credit provider or credit reporting agency. A penalty of a fine not exceeding $30,000 is prescribed for this offence (s. 18T(2)).

Section 18U - Application of section 4B of Crimes Act.

126. Section 18U provides that subsection 4B(3) of the Crimes Act 1914 does not apply in relation to the credit reporting offences set out in the Bill. This provision is to express a contrary intention for the purposes of subsection 4B(3) of the Crimes Act, which might otherwise allow a Court to escalate the maximum penalty for an offence by a factor of five where the person convicted is a corporation.

Section 18V - Application of this Part.

127. Section 18V will provide that 'Part IIIA - Credit Reporting' applies in relation to any credit information file or report that is in existence on or after the commencement of this section, whether or not it was in existence before that commencement.

128. Subsection (2) provides that paragraph 18E(8)(c) does not apply to information collected before the commencement of the Act. This is a technical provision. It disapplies, in respect of personal information acquired before the commencement of the Act, the requirement that a credit provider must, before providing information to a credit reporting agency, inform the individual concerned that the information may be disclosed to the credit reporting agency.

129. Subsection 18V(3) provides that in respect of information collected before the commencement of the Act, the permitted period for the retention of information (subsection 18F(2) refers) will be calculated from the date of commencement of section 18V.

Clause 14: Functions of the Commissioner in relation to tax file numbers

130. This clause inserts a reference to section 28A into section 28 of the Principal Act, and is consequential on the insertion of the new section 28A into the Principal Act.

Clause 15: Functions of Commissioner in relation to tax file numbers

131. Clause 15 inserts a new section 28A after section 27 of the Principal Act.

Section 28A - Functions of Commissioner in relation to credit reporting.

132. New section 28A will provide functions for the Privacy Commissioner in relation to credit reporting.

133. The functions are -

(a)

to develop a Code of Conduct for the credit reporting industry following consultations with government, commercial, consumer and other relevant bodies; (s. 28A(a));

(b)

to investigate an act or practice of a credit reporting agency or a credit provider that may constitute a breach of the Code or Part IIIA of the Act and where the Commissioner thinks appropriate to try through conciliation to settle the matter; (s. 28A(b));

(c)

to promote understanding and acceptance of the Code and Part IIIA of the Act and their objects; (s. 28A(c));

(d)

to make such determinations relating to credit reporting as the Commissioner is empowered to make under section 11B and Part IIIA; (s. 28A(d));

(e)

to prepare and publish guidelines for credit reporting agencies and credit providers for the avoidance of acts and practices that are interferences with privacy; (s. 28A(e));

(f)

to provide advice to the Minister and to credit reporting agencies and credit providers on any matter under the legislation; (s. 28A(f));

(g)

to conduct audits of credit information files maintained by credit reporting agencies and credit reports maintained by credit providers or credit reporting agencies for the purpose of ascertaining whether the files or reports are maintained in accordance with Part IIIA and the Code of Conduct; (s. 28A(g));

(h)

to monitor the security and accuracy of personal information contained in credit information files maintained by credit reporting agencies and in credit reports in the possession, or under the control, of credit providers or credit reporting agencies; (s. 28A(h));

(j)

to examine the records of credit reporting agencies and credit providers to ensure that they are not using personal credit information for unauthorised purposes and that they are taking adequate measures to prevent unlawful disclosures of personal credit information; (s. 28A(j)); and

(k)

to undertake educational programs to promote personal privacy; (s. 28A(k)).

132. New section 28A(2) provides that the Commissioner will have the power to do all things that are necessary or convenient to be done in connection with the performance of his functions under new section 28A(1).

Clause 16: Commissioner to have regard to certain matters.

133. This clause will amend section 29(d) of the Principal Act to require the Privacy Commissioner to ensure that his or her directions and guidelines are consistent with the Information Privacy Principles set out in s. 14 of the Principal Act and the credit reporting provisions set out in the Code of Conduct and in new Part IIIA.

Clause 17: Reports following investigation of act or practice

134. Clause 17 makes a number of amendments to s. 30 of the Principal Act. Following an investigation of an act or practice of a credit reporting agency or credit provider the Commissioner will be required to report to the Minister if -

•

the Minister has so directed; or

•

the Commissioner concludes that the act or practice was an interference with privacy but conciliation has failed or was inappropriate.

135. A report to the Minister must include reasons for the Commissioner's findings. It may include recommendations for prevention of repetition of the interference, a recommendation for compensation and/or recommendations for the taking of any other remedial action. A copy of the report is to go to the credit reporting agency or credit provider and the complainant - if the complainant was not affected by the interference, provision of the report is discretionary. Other affected persons may also be given copies.

136. If after 60 days from giving a credit reporting agency or the credit provider a copy of such a report the Commissioner thinks that proper remedial action has not been taken, s.30(4) of the Principal Act requires a further report to be given to the Minister on the action taken by the credit reporting agency or the credit provider and stating why the Commissioner is dissatisfied with the action taken by the credit reporting agency or the credit provider.

Clause 18: Report following monitoring of certain activities

137. This clause amends section 32 (Reports following monitoring of certain activities) of the Principle Act. The Commissioner will be able to report on his activities or audits conducted under new provisions inserted by this Bill and can be required to do so by the Minister.

Clause 19: Investigation under section 40 to cease if certain offences may have been committed

138. This provision amends section 49 (Investigation under section 40 to cease if certain offences may have been committed). The effect of the amendments is to provide that where, during the course of an investigation of a complaint, the Privacy Commissioner forms the opinion that a credit reporting offence may have been committed, the investigation is to cease and the Commissioner of Police or the Director of Public Prosecutions (DPP) is to be informed of the matter; (s. 49(1)). Subsection 49(3) enables the Commissioner to re-commence an investigation once written notice is received from the Commissioner of Police or the DPP that the matter is not subject to proceedings for an offence. A credit reporting offence is defined in new s. 49(4).

Clause 20: Determination of the Commissioner

139. Section 52 of the Principal Act will apply to credit reporting complaints, see definition of a credit reporting complaint in cl 5(b) and what is an interference with privacy in cl 10. Section 52 provides that following the investigation of a complaint, the Commissioner may make a determination:

•

dismissing the complaint;

•

declaring that the credit reference agency or credit provider has breached an individual's privacy and should not repeat or continue such conduct;

•

declaring that the credit reference agency or credit provider should perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant;

•

declaring that the complainant is entitled to a specified amount by way of compensation for any loss or damage suffered (except where the complainant was dealt with as a representative complaint); or

•

declaring that it would be inappropriate for any further action to be taken.

140. Section 52(2) requires the Commissioner to state any findings of fact upon which the determination is based.

141. Section 52(3) provides that when making a determination under s.52(1) other than on a representative complaint the Commissioner may include a declaration that the complainant is entitled to be paid a specified amount for expenses reasonably incurred during the investigation of the complaint.

142. New paragraph 52(3A)(a) will provide that the Privacy Commissioner may determine that an agency in relation to a record of personal information or a credit reporting agency or a credit provider in relation to a credit record shall make appropriate corrections, deletions or additions to a record. The Privacy Commissioner will also be able to determine that an agency, credit reporting agency or credit provider attach to a record, file or report a statement provided by the complainant of the correction, deletion or addition sought; new s. 52(3A)(b).

Clause 21: Heading to Division 4

143. The heading of the Division 4 of Part V of the Principal Act will be amended to read "Enforcement of determinations relating to tax file numbers or credit reporting".

Clause 22: Application of Division

144. Section 60 of the Principal Act, which is a procedural provision, is amended.

145. New section 60(c) will provide that the Principal Act will apply to determinations made by the Privacy Commissioner in relation to complaints about interferences with privacy which constitute a credit reporting infringement. A credit reporting infringement is a breach of the Code of Conduct or a breach of the credit reporting provisions in new Part IIIA of the Principal Act, see cl. 5(b).

Clause 23: Power to enter premises

146. Section 68 of the Principal Act will be amended to apply to credit reporting agencies and credit providers. New s. 68(1) will provide that subject to new s. 68(3) a person authorised by the Commissioner may enter premises of credit reporting agencies and credit providers and inspect documents for the purpose of the performance of the Commissioner's functions under the Act. Section 68(2) requires the occupier of the premises entered by an authorised person to provide that person with reasonable assistance to facilitate the exercise of the person's powers.

147. Section 68(3) will prohibit an authorised person from entering premises not occupied by the Commonwealth or by a Commonwealth authority, unless the occupier consents or the person is authorised to enter the premises by a warrant issued under s. 68(4) by a Magistrate.

148. Section 68(5) provides that the warrant shall specify the hours during which entry may be made and shall set a date after which the warrant will cease to have effect.

Clause 24: Insertion of new section:

Section 99A Conduct of directors, servants and agents

149. This provision is a standard provision in Commonwealth law which provides that for the purposes of prosecuting a body corporate for an offence it is sufficient to establish that the unlawful conduct engaged in by the director, servant or agent of the body corporate was within the scope of his or her actual or apparent authority and the person had the knowledge, intention or purpose to undertake the conduct; (s. 99A(1)).

150. Also, any unlawful conduct engaged in on behalf of a body corporate by a director, servant or agent of the body corporate which is within that persons authority is to be taken to have been engaged in by the body corporate unless the body corporate can establish that they took reasonable precautions and exercised due diligence to avoid the conduct; (s. 99A(2)).

151. A reference to an offence in this section is an offence created by the regulations and certain offences created by the Crimes Act 1914; (s. 99A(9)).

152. New s. 99A(3) provides that in proceedings for an offence where it is necessary to establish the state of mind of a person other than the body corporate, it is sufficient to show that the conduct was engaged in by a servant or an agent within the scope of his or her actual or apparent authority and that that person had the knowledge or and intention to undertake the unlawful conduct.

153. A person who is convicted of a credit reporting offence is not liable to be punished by imprisonment for that offence; (s. 99A(5)).