Problems with more comprehensive credit reporting

55.83 Those against introducing more comprehensive credit reporting challenge some of the claimed benefits, as discussed above. In addition, it is argued that any benefits from the introduction of comprehensive reporting are likely to be outweighed by concerns about information privacy and security.

Impact on privacy and security of personal data

55.84 There is disquiet about the impact of comprehensive credit reporting on an individual’s right to privacy. Various government inquiries have expressed concern in this regard.[119] The Victorian Review noted that a system of more comprehensive credit reporting would have a significant ‘potential impact on privacy … particularly in relation to financial matters’.[120]

55.85 Telstra Corporation Ltd (Telstra) stated simply that ‘it is by no means clear that more comprehensive credit reporting would provide additional benefit outweighing the additional exposure to an individual’s privacy’.[121] Other stakeholders elaborated privacy concerns about more comprehensive reporting. The CCLC, for example, submitted that more comprehensive credit reporting ‘is fraught with privacy and security risks’, particularly given that it will likely entail ‘a large database of information about millions of people [being] maintained by one or more third parties’. In particular, the CCLC was concerned about data accuracy, and misuse for marketing and other unauthorised purposes, including identity fraud.[122]

55.86 Veda Advantage characterised the privacy risks as involving: first, the risk to the individuals arising from a more significant quantity of data about them being held and shared among credit providers; and secondly, the potential harms arising from the misuse of the data, for both credit and non-credit related purposes. Concerns were expressed about the possible use and disclosure of credit information for non-credit related purposes.[123] National Legal Aid, for example, stated:

Our concerns in relation to the proposed expansion of the contents of a credit report are related to the continuation or expansion of the organisations that have access to the main consumer credit reporting databases. The risk is too great that comprehensive information about individuals’ finances will be used for a range of purposes that go beyond simply assessing the creditworthiness of an applicant for credit.[124]

55.87 The accuracy of the information collected under a more comprehensive credit reporting system was another focus of concern in submissions.[125] The Office of the Privacy Commissioner (OPC) submitted that expanding the volume and depth of information that would be available on individuals’ credit information files ‘may worsen the current problems with accuracy of credit information’.[126] Galexia expressed specific concerns about the accuracy of repayment performance information,[127] which may be affected by requiring credit providers ‘to provide more information, requiring more data entry and more opportunities for errors’; and because credit providers ‘may not have the same motivation to check the accuracy of data (especially disputed data) as they do to check default data in traditional credit reporting information, as the consequences of an inaccuracy will appear less severe’.[128]

55.88 In contrast, credit reporting agencies and some credit providers believed that more comprehensive credit reporting should result in improved accuracy of data.[129] These improvements would result from more frequent and automated reporting[130] (depending on the model of reporting implemented) and more consumer engagement with credit information files.[131] The chances of inaccuracies affecting decisions about granting credit may be reduced because of the presence of other data.[132] For example, the impact of one late payment on an individual’s credit score may be mitigated by the balance of that individual’s overall repayment history.

55.89 Data security was also cited as a privacy concern. Reference was made to incidents overseas where the security of comprehensive credit reporting information has been compromised by credit reporting agencies.[133]

55.90 Finally, there was concern about the appropriateness of credit reporting agencies collecting and reporting payment performance information in relation to utilities, such as telecommunications, energy and water.[134] The Telecommunications Industry Ombudsman noted that there ‘are numerous reasons why a customer may not be able to pay their bill on time, many of which do not equate to the customer being a potential credit risk’.[135]

55.91 Submissions from those in favour of more comprehensive credit reporting indicated that the proponents are well aware of these and other privacy concerns. American Express stated, rather than being insurmountable, privacy concerns can be addressed through ‘the imposition of legislative controls or general prohibitions on the use of information’, strengthened enforcement and more flexible penalties.[136]

55.92 Proponents agree that, if a more comprehensive credit reporting system is to be implemented, there needs to be a range of improvements to the present regulatory regime. These improvements—many of which are desirable whether or not there is a move toward more comprehensive reporting—are discussed in detail in Chapters 56–59.

[119] See, eg, Parliament of Australia—Senate Legal and Constitutional References Committee, The Real Big Brother: Inquiry into the Privacy Act 1988 (2005), [7.46].

[120] Consumer Affairs Victoria, The Report of the Consumer Credit Review (2006), 273.

[121] Telstra Corporation Limited, Submission PR 459, 11 December 2007.

[122] Consumer Credit Legal Centre (NSW) Inc, Submission PR 28, 6 June 2006.

[123] Issues concerning regulation of the use and disclosure of credit reporting information, including any personal information additional to that currently permitted, are discussed in more detail in Ch 57.

[124]National Legal Aid, Submission PR 521, 21 December 2007.

[125] Galexia Pty Ltd, Submission PR 465, 13 December 2007; Office of the Privacy Commissioner, Submission PR 281, 13 April 2007.

[126] Office of the Privacy Commissioner, Submission PR 281, 13 April 2007.

[127] Such as the information proposed to be collected under the ARCA proposal (discussed in detail below).

[128]Galexia Pty Ltd, Submission PR 465, 13 December 2007.

[129] ANZ, Submission PR 291, 10 May 2007; Veda Advantage, Submission PR 272, 29 March 2007; MasterCard Worldwide, Submission PR 237, 13 March 2007; GE Money Australia, Submission PR 233, 12 March 2007.

[130] Veda Advantage, Submission PR 272, 29 March 2007; MasterCard Worldwide, Submission PR 237, 13 March 2007; GE Money Australia, Submission PR 233, 12 March 2007.

[131] Veda Advantage, Submission PR 272, 29 March 2007; GE Money Australia, Submission PR 233, 12 March 2007. Under some models of more comprehensive reporting, what is reported to the credit reporting agency will be reflected on the individual’s statement of account, greatly reducing the incidence of incorrect default listings: GE Money Australia, Submission PR 233, 12 March 2007.

[132] Veda Advantage, Submission PR 272, 29 March 2007.

[133] Westpac, Submission PR 256, 16 March 2007.

[134] Energy and Water Ombudsman NSW, Submission PR 225, 9 March 2007; Telecommunications Industry Ombudsman, Submission PR 221, 8 March 2007.

[135] Telecommunications Industry Ombudsman, Submission PR 221, 8 March 2007. For example, customers may have received an unexpectedly high bill due to inadequate management of utilities provision.

[136] American Express, Submission PR 257, 16 March 2007.