The Office of the Australian Information Commissioner (OAIC) has published a FAQ setting out its views on the notice required to be given to individuals before their repayment history information can be collected and disclosed as a result of amendments to the Privacy Act made by the Privacy Amendment (Enhancing Privacy Protection) Act 2012.

In part it states:

“Prior to the commencement of the reforms, a credit provider that collects repayment history information (RHI) that it intends to disclose to a credit reporting body (CRB) after commencement should, at a minimum, comply with the notification requirements in National Privacy Principle (NPP) 1 (Collection). For example, the credit provider should notify the individual at or before the time of collection of the RHI that the credit provider will disclose that information to CRBs from March 2014; see NPP 1.3(d).

There is also an argument that, from commencement, a credit provider cannot disclose RHI to a CRB unless it has, to the extent possible, met the notification requirements in s 21C of Schedule 2 of the Privacy Amendment (Enhancing Privacy Protection) Act 2012. The OAIC, therefore, recommends that credit providers also meet the additional notification requirements in s 21C. For example, by notifying the individual of the name and contact details of any CRB to which the credit provider is likely to disclose the individual’s RHI; see s 21C(1)(a).”

Background

We will be discussing notification and transition issues at our February seminars.

The Privacy Commissioner has requested the Australasian Retail Credit Association (ARCA) to develop a Credit Reporting code and apply for the code to be registered.

The Code will replace the existing Code and implement the new credit reporting provisions in the Privacy Amendment act.

ARCA must comply with this request by Friday 19 April 2013.

In ‘S’ and Veda Advantage Information Services and Solutions Limited [2012] AICmr 33 the Privacy Commissioner determined that Veda Advantage Information Services and Solutions Limited (Veda)’s practice of keeping 2 separate but cross-referenced credit files for the complainant (one in her original name and one in her then married name) interfered with the complainant’s privacy by failing to take reasonable steps to ensure that the personal information contained in the complainant’s credit information file was accurate, up to date, complete and not misleading, in breach of s 18G(a) of the Privacy Act 1988 (Cth) (Privacy Act).

The Privacy Commissioner concluded that:

“During the period 2006-09, the complainant’s credit information files contained a number of duplicated credit enquiry listings, where the enquiry details varied slightly but related to the same credit enquiry (and the same credit application). I consider that, on the balance of probabilities, at least some of those credit providers accessing the complainant’s cross-referenced credit files during that period would have misunderstood the similar enquiries listing information they contained. As such, I am of the view that Veda breached s 18R(1) of the Privacy Act when it provided that information to subscriber credit providers, and that Veda has interfered with the complainant’s privacy in this respect.”

Despite the complainant’s claims that as a result of Veda’s practice, she was unable to obtain credit which, in turn, resulted in her incurring significant financial loss the Privacy Commissioner was not satisfied that the complainant was refused credit or would have been able to obtain credit on more favourable terms had the similar listings not been made.

He rejected the claim for economic loss.

However he decided that the complainant was made anxious by Veda’s practice of duplicating enquiry listings and that this stress and anxiety has spanned the substantial period of time of her complaint about Veda’s practice. He awarded her compensation in the amount of $2000 for non-economic loss .

He accepted’s Veda’s submission that it investigated the matter in accordance with its normal practice and procedures. He did not consider the way in which Veda conducted its case was “high-handed, malicious, insulting or oppressive”. He refused to award aggravated damages.

Although Veda advised of the introduction, since mid-2009, of a ‘multiple identity report’ (MIR) feature, which has ‘fundamentally changed the way in which Veda provides credit reports to approximately 90% of its credit provider subscribers’, in relation to Veda’s practice of recording similar enquiry listings, he recommended that Veda:

• develop revised training packages and user information guides for subscribers, which clearly address the issue of similar enquiry listings and how to interpret them;
• engage an independent auditor to assess Veda’s cross-referencing processes, both the MIR option and the non-MIR alternative, in compliance with s 18G(a) of the Privacy Act.