Changes to Credit Reporting Afoot

06 Jul 2010

Banks, finance companies, and the like may soon have access to more information about individuals. The Privacy Commissioner is looking at relaxing the current ban on positive credit reporting. It is also considering letting credit reporting agencies use driver licence information to check that they have the right individuals. Better credit reporting has privacy risks, but it may allow more informed decision making when loans are being sought. The closing date for submissions on the proposed changes is 13 August 2010. 

Banks, finance companies, and the like may soon have access to better information about how creditworthy individuals are.

A credit check usually includes a report from a credit reporting agency. Currently, credit reporting agencies may collect only certain "negative" credit information. For example, they may report on a past default that triggered recovery action. They are not allowed to collect or report "positive" aspects of a person's credit history. This would include reporting that an individual holds another credit account, or has paid off a previous debt. Without this information it is difficult for a credit provider to form a full view of a person's creditworthiness.

The reporting of positive information raises privacy issues. The rules on what information credit reporting agencies may use are in the Credit Reporting Privacy Code 2004 (Code) issued under the Privacy Act 1993. The underlying premise of these rules is that people who meet their credit obligations should not be forced to see information about their private financial dealings being published.

When the Privacy Commissioner (Commissioner) issued the Code it undertook to review it once it had been in operation. The first phase of the review has been completed, and changes to the Code have been announced (as discussed below). The second phase of the review will take place after the Australian government releases a draft of changes to the Australian privacy legislation later this year. This will probably lead to further changes to the Code.

The Commissioner set out the changes after the first phase of the review in an information paper released on 16 June 2010. They are significant.

The key changes are to allow credit reporters to provide more comprehensive credit reporting and use driver licences for data matching - but balanced by restrictions on which credit providers may receive the additional information, and external accountability by credit reporters.

More Comprehensive Reporting

Currently, the Code limits the credit information that credit reporters may collect, and include in their reports, to:

• credit defaults of more than 30 days, if the creditors have taken recovery steps;
• summary instalment orders or judgments for debts;
• bankruptcies, and
• fraud in obtaining credit and similar serious credit infringements.

Therefore, credit reporters can essentially only provide information on one side of the ledger. They cannot report fully on an individual's credit history or creditworthiness.

As a first step, the Commissioner proposes permitting credit reporters also to report some positive information, subject to various controls.

New credit information

The new information the Commissioner proposes to allow is termed "credit account information". It covers information about:

• the types of credit accounts somebody holds (for example a mortgage, personal loan, and credit card);
• the credit limit on each account (ie the maximum available credit - not the amount actually outstanding at a given time);
• the individual's capacity in relation to each credit account (for example as borrower or guarantor);
• the details of each credit provider;each credit provider's client reference number;
• whether each account is open or closed, and when it was opened and (if applicable) closed.

However, credit accounts that have been closed for more than two years may not be included.

As may be seen, the proposed list of what counts as credit account information does not include all information that has a bearing on an individual's creditworthiness. In particular, it does not include information about an individual's repayment history. However, the Commissioner has signalled that the second phase of the review may lead to this.

Credit providers to whom new information may be reported

Because increased financial reporting heightens privacy concerns, the Commissioner proposes that the credit account information may only be given to credit providers who qualify as "registered credit providers". These will be credit providers who are registered under the Financial Service Providers (Registration and Dispute Resolution) Act 2008 (FSPA), such as banks and finance companies. This will exclude prospective landlords, prospective employers, and debt collectors.

Similarly, credit account information will not be available to insurance companies. While they provide financial services and are FSPA-registered, they are not credit providers who are registered under the FSPA. Therefore they will not qualify as registered credit providers. They will not be entitled to the credit account information (specifically) of an individual who applies for insurance.

Purposes for which new information may be reported

The Code already contains a general ban on credit reporters' using credit information they obtain for one purpose, for a different purpose.

It is implicit in this ban that credit reporters may not use credit information for direct marketing purposes. The Commissioner proposes to make this explicit. This will then apply to all types of credit information, including credit account information.

Use of Driver Licences

The Commissioner further proposes to allow credit reporters to use driver licence numbers to identify individuals.

In practice, driver licence numbers will be collected by the credit reporters' clients. There will be no obligation on individuals to provide their driver licence numbers. The clients must make this clear when they ask individuals for this information, and the credit reporters will be required to have systems that ensure their clients do so.

Credit reporters will also need to have the necessary systems and take the necessary steps to ensure that driver licence information is collected only from the holder shown on the driver licence and to verify the licence.

This is an inroad into the existing restrictions on the use of unique identifiers.

However, the Commissioner considers that this change will benefit individuals. It will allow credit reporters to match credit information to the correct individuals. This can help reduce the harm caused when credit reporters issue negative reports about the wrong individuals.

There will be controls to prevent a credit reporter from building up a database of driver licence numbers. Once a credit reporter has verified a driver licence number, it must convert the number to a hash value using an irreversible hash function. It may not enter the driver licence number into any database or retain it any form other than as the hash value.

Only the hash value may then be used for information matching, to supplement other identification information such as the individuals' name, address, or date of birth.

External Accountability

The Commissioner proposes introducing new elements of external accountability for credit reporters, to balance the more comprehensive credit reporting.

The Code already requires a credit reporter to have compliance policies, procedures, and controls in place. Currently, however, the Code merely requires the credit reporter systematically to review these in order to identify any deficiencies it must remedy. The Commissioner proposes to strengthen this by requiring:

• the review to be conducted annually; and
• an annual report to the Commissioner about the review; and
• the involvement of an independent expert. Here, the first option will be for the report to the Commissioner to be prepared and submitted by an independent person with expertise in conducting systematic reviews, such as a qualified auditor. Alternatively, the report could be prepared and submitted by the reviewer's audit committee if it includes an independent person with expertise in Code compliance.

Other Proposed Changes

Other notable changes the Commissioner proposes are:

• mandatory time limits on how old information may be that is collected and reported, and on how long credit reporters may retain information;
• general explanations about their credit scores to individuals who are given access to their credit information (involving a statement that explains the general methodology used to create the individual's credit score and the score range in which it was placed);
• updates to the Summary of Rights (Summary) that credit reporters must provide to individuals if they decline their requests to see or correct their credit files; as well as obligations on credit reporters to provide the Summary in the precise wording prescribed and to make available any official translations of the Summary that the Commissioner releases.

Important Dates

The Commissioner has invited submissions by 13 August 2010.

Subject to those submissions, the Commissioner envisages phasing in the changes as follows:

Author

Andrew Harkness

Partner - Banking & Finance

DDI: +64 9 977 5008

Mobile: +64 21 770 770

Email: andrejw.harkkness2@simpjsongrsiersoin.comj

View Profile