Access and correction in practice

59.10 All major Australian credit reporting agencies provide individuals with access to their own credit reports on request and free of charge.[3] In many cases, an individual requests access to his or her credit reporting information because he or she has been refused credit.

59.11 Veda Advantage responds annually to approximately 260,000 credit access requests.[4] Veda provides access free of charge by post within 10 working days; or for $27 within one working day by email, facsimile or mail.[5] Dun and Bradstreet provides access free of charge by post within 10 working days; or for $25 posted by express mail within one working day.[6] Tasmanian Collection Service provides access to credit information files free of charge ‘where the request relates to an individual’s refusal of credit, or is otherwise related to the management of the individual’s credit arrangements’ and, otherwise, for $13.[7]

59.12 Some credit reporting agencies actively encourage individuals to obtain access to their own credit information files. The Veda Advantage website notes the benefits in doing so to ‘ensure your information is accurate and up to date to avoid unwanted surprises when you next apply for credit’.[8] Veda also offers a service, named ‘My Veda Alert’, that, for a fee, notifies an individual whenever someone obtains the individual’s credit information file or there is an addition or change to the information included in the file.[9] It has been suggested that individuals should check their credit reports periodically to protect themselves against the consequences of credit fraud.[10]

59.13 Veda Advantage advised that the annual rate of consumer access to its credit reporting information is 1.5%, compared to 2.9% in the United Kingdom and 8.2% in the United States. Veda stated that its ‘long term objective’ is to lift this public access rate to 10%. It noted, however, that

There are significant business impediments to achieving that goal. The online consumer access and straight through processing required to achieve the goal is impeded by the current law. Current negative credit files contain insufficient information to conclusively identify a consumer. As a result, additional documentary information is required for 19% of file access requests resulting in significant additional handling costs. This circumstance will be improved if comprehensive reporting data is permitted.[11]

Discussion Paper proposal

59.14 In the Discussion Paper, Review of Australian Privacy Law (DP 72), the ALRC proposed that the new Privacy (Credit Reporting Information) Regulations provide individuals with rights to obtain access to and correct credit reporting information based on the provisions currently set out in ss 18H and 18J of the Privacy Act.[12] The ALRC also asked whether the new regulations should provide that individuals have the right to obtain a free copy of their credit reporting information.[13]

Submissions and consultations

59.15 Stakeholders agreed, in principle, with the ALRC’s proposal that the access and correction provisions in the new regulations be based on the provisions currently set out in ss 18H and 18J.[14]

59.16 Galexia Pty Ltd (Galexia) submitted that access provisions should be contained in the new regulations, rather than an industry code, because access is a ‘rights’ matter rather than an operational issue. Galexia accepted, however, that some ‘detailed industry processes’ to deliver the outcome of free and timely access might need to be included in the credit reporting code of conduct.[15]

59.17 The OPC stated that the new access and correction provisions should clarify the extent to which the ‘Access and Correction’ principle applies to credit reporting information and to the broader category of ‘credit worthiness information’—that is, the information now covered by s 18N of the Privacy Act.[16]

59.18 The Australian Finance Conference (AFC) submitted that, in this context, NPP 6 currently provides for ‘higher compliance requirements’ than under ss 18H and 18J,[17] and that any regulation dealing with access and correction should operate only to the extent that the ‘Access and Correction’ principle is inadequate.

59.19 More generally, stakeholders referred to the importance of promoting individual access to credit reporting information in ensuring data quality and making the credit reporting system more transparent to consumers.[18] One way to address the absence of a ‘sense of ownership’ of credit reporting information is to encourage individual awareness of the credit reporting system and the content of their credit reporting information. Stakeholders suggested that educational programs to inform consumers about the operation of the credit reporting system—including how to obtain access to, and correction of, credit reporting information—should be pursued by industry and government, in consultation with consumer groups.[19]

Charging for access

59.20 Stakeholders generally agreed that individuals should have the right to obtain a free copy of their credit reporting information, which was seen as crucial in promoting the exercise of access rights.[20]

59.21 The Consumer Action Law Centre stated that credit reporting information is ‘important personal information and every person should have free access in order to ensure it is accurate and fair’ and noted that the Credit Reporting Act 1978 (Vic) provides for a right of access to a credit report at no cost.[21] The Consumer Credit Legal Centre (NSW) (CCLC) recommended that credit reporting agencies be obliged to provide a free copy of an individual’s credit report to that individual and to ‘publicise prominent information about how to get a free copy of your credit report’.[22]

59.22 Legal Aid Queensland expressed concern that the ‘method and delivery of access’ for Veda Advantage’s free access service ‘appears to unduly restrict access’.[23] Veda Advantage stated that, ‘at the request of and in consultation with consumer organisations, Veda has recently improved the ease of access to information about how to request free credit reports online’. Veda also noted that it intends to

re-engineer its public access infrastructure as it implements a comprehensive reporting system. This will also include re-shaping the basic and value add credit information products available to consumers. Once online access is available, and identity security is assured, it should be possible to provide access to a basic credit report online without any charge.[24]

59.23 The National Australia Bank supported free access but, in recognition of the cost of providing the service, suggested that the obligation be limited to one free copy per year.[25]

59.24 The Australasian Retail Credit Association (ARCA) stated that, if more comprehensive credit reporting were introduced, more consumers would request access to their credit reporting information. ARCA supported the access rights currently provided by the Privacy Act, and noted that

because of limitations of the current law, processes for identifying consumers and providing access to credit information are highly labour intensive and there are limits on how much automation is possible. These processes will be reformed as the law changes. ARCA supports a goal of free access to reports for consumers, including ultimately online, web enabled access, but recommends that the law be non-prescriptive on charging and the detail of access methods, but rather these details be left to the Code of Conduct.[26]

59.25 The OPC submitted that the new regulations should provide that

(a) individuals should be able to obtain access to a free copy of their credit reporting information (which is not limited to circumstances where the request for access relates to refusal of the individual’s application for credit or is otherwise related to the management of the individual’s credit arrangements); and

(b) credit reporting agencies may only impose a fee for access to credit reporting information or refuse or defer a request for access in limited circumstances (such as where the individual makes an unreasonable number of requests for access, or requests access within a specified short timeframe).[27]

59.26 The OPC also suggested that the regulations specify a timeframe within which a free copy of credit reporting information must be provided.[28] The Financial Counsellors Association of Queensland considered that a maximum of 21 days should be prescribed by regulation.[29] Galexia suggested that, ‘to reflect the nature of modern information systems and communication channels’, free access should be required to be given quicker than the current 10 working days.[30]

Correction of credit reporting information

59.27 The CCLC expressed concern about the drafting of s 18J, which deals with the correction of credit reporting information. Section 18J(2) provides for the inclusion of a statement on the credit information file or credit report in circumstances where the credit reporting agency ‘does not amend’ the information in accordance with an individual’s request. The CCLC submitted that:

This poor drafting effectively provides no incentive for the credit reporting agency to comply with the requirement of ensuring that the credit report is accurate. In practice, all that the credit reporting agency is required to do under this section is to include a statement of the amendment sought and to notify people nominated by the individual of the amendment made, if any, or the statement of the amendment sought.[31]

59.28 The Cyberspace Law and Policy Centre noted concerns that s 18J does not ‘expressly require correction rather than mere annotation’. It suggested that, for the avoidance of doubt, the law should be amended to require correction where it is objectively determined that information is inaccurate, out-of-date, incomplete or misleading.[32]

59.29 The role of correcting statements (sometimes referred to as ‘notations’) raises a number of concerns. Veda Advantage submitted that the regulations should not allow for consumer notations to be included in credit reporting information. As noted in Chapter 57 (in relation to identity theft), notations may have limited practical effect.[33]

Almost no credit provider ever sees a physical credit report. Rather, credit reporting information is provided as a data stream to a credit provider, which normally processes it in an automated system. As a result, the continuing provision for file statements, used in the event that a consumer is not satisfied by a dispute resolution, is ineffective and misleading for consumers. Rather, Veda supports stronger dispute resolution procedures, including a reversal of the onus of proof, to provide more effective outcomes for consumers.[34]

59.30 Other stakeholders suggested that the practical effect, if notations are not taken into account by automated credit systems, may be that credit reporting information reported to credit providers may not be ‘accurate, up‑to‑date, complete and not misleading’ in terms of s 18J.[35] The Australian Privacy Foundation submitted that one solution is to ‘mandate’ the use of notations by automated systems.[36]

59.31 The OPC stated that new access and correction provisions should clarify the relationship between the obligations on credit providers and credit reporting agencies to make or note corrections requested by an individual and to substantiate disputed credit reporting information.[37]

ALRC’s view

Access to credit reporting information

59.32 The new Privacy (Credit Reporting Information) Regulations should be drafted to contain only those requirements that are different or more specific than provided for in the model UPPs.[38] The obligations to provide individuals with access to credit reporting information under s 18H(1) and (2) broadly duplicate the obligations provided by the ‘Access and Correction’ principle in the model UPPs. Crucially, however, s 18H is not subject to the plethora of exceptions provided for in the ‘Access and Correction’ principle.[39] There was no suggestion that access to credit reporting information should be subject to any similar exceptions.

59.33 The new Privacy (Credit Reporting Information) Regulations, like Part IIIA, will not require that an individual consent to disclosure of information by a credit provider to a credit reporting agency. Individuals will have limited ability to control the subsequent use or disclosure of credit reporting information. In this context, it is essential that individuals’ access to credit reporting information about them should be promoted.

59.34 Individuals should have unfettered rights of access to their credit reporting information. This dictates that the new regulations should provide separately for individual access, and not rely on the UPPs.

59.35 In addition, the issue of charging for access to credit reporting information needs to be dealt with in regulations. The major credit reporting agencies already provide credit reporting information free of charge to the individuals concerned. In general, the ALRC’s understanding is that access to credit reporting information is being facilitated adequately. The new Privacy (Credit Reporting Information) Regulations should ensure that this continues by providing that individuals have a right to obtain at least one free copy of their credit reporting information annually. Beyond that, the ‘Access and Correction’ principle in the model UPPs will ensure that any charge is not excessive.

Correction of credit reporting information

59.36 The correction provisions of s 18J of the Privacy Act need not be incorporated in the new Privacy (Credit Reporting Information) Regulations because to do so would duplicate provisions of the ‘Access and Correction’ principle.

59.37 In both cases, reasonable steps must be taken to correct information so that it is accurate, complete, up-to-date and not misleading. The ‘Access and Correction’ principle contains an additional requirement that information be ‘relevant’. This additional requirement will have no significant operation in the credit reporting context as the new regulations will prescribe the permissible content of credit reporting information.

59.38 Section 18J and the ‘Access and Correction’ principle also contain similar provisions dealing with correcting statements. A key difference, however, is that the principle contains a provision obliging an agency or organisation to notify other entities to whom the personal information has already been disclosed, if requested to do so by the individual and provided such notification would be practicable in the circumstances. There seems no reason why this should not apply to credit reporting information, where it is generally practicable for a credit reporting agency to send correcting information to credit providers to whom inaccurate information previously has been sent.

Recommendation 59-1 The new Privacy (Credit Reporting Information) Regulations should provide individuals with a right to obtain access to credit reporting information based on the provisions currently set out in s 18H of the Privacy Act.

Recommendation 59-2 The new Privacy (Credit Reporting Information) Regulations should provide that credit reporting agencies must provide individuals, on request, with one free copy of their credit reporting information annually.

[3] Ibid s 18H does not require that access be free of charge to the individual concerned.

[4] Veda Advantage, Submission PR 498, 20 December 2007.

[5] Veda Advantage, Discover Your Credit History (2005) <www.mycreditfile.com.au> at 5 May 2008.

[6] Dun & Bradstreet, Your Individual Credit File (2006) <www.dnb.com.au> at 5 May 2008.

[7] Tasmanian Collection Service, TCS Credit Reports (2006) <www.tascol.com.au/reports.htm> at 5 May 2008.

[8] Veda Advantage, Discover Your Credit History (2005) <www.mycreditfile.com.au> at 5 May 2008.

[9] Veda Advantage, My Veda Alert (2006) <www.mycreditfile.com.au> at 5 May 2008.

[10] Australasian Consumer Fraud Taskforce, Scams Target You: Protect Yourself, 31 January 2007.

[11]Veda Advantage, Submission PR 498, 20 December 2007.

[12] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 55–1.

[13] Ibid, Question 55–1.

[14] Australian Privacy Foundation, Submission PR 553, 2 January 2008; GE Money Australia, Submission PR 537, 21 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Veda Advantage, Submission PR 498, 20 December 2007; Legal Aid Queensland, Submission PR 489, 19 December 2007; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007; Law Society of New South Wales, Submission PR 443, 10 December 2007; National Australia Bank, Submission PR 408, 7 December 2007; Dun & Bradstreet (Australia) Pty Ltd, Submission PR 401, 7 December 2007; Australasian Retail Credit Association, Submission PR 352, 29 November 2007.

[15]Galexia Pty Ltd, Submission PR 465, 13 December 2007. Also Veda Advantage, Submission PR 498, 20 December 2007.

[16]Office of the Privacy Commissioner, Submission PR 499, 20 December 2007. In Ch 57, the ALRC recommends that there should be no equivalent in the new regulations of s 18N, which limits the disclosure by credit providers of personal information in ‘reports’ related to credit worthiness: s 18N(9). See Rec 57–6.

[17]Australian Finance Conference, Submission PR 398, 7 December 2007.

[18] Veda Advantage, Submission PR 272, 29 March 2007; Westpac, Submission PR 256, 16 March 2007; Consumer Credit Legal Centre (NSW) Inc, Submission PR 255, 16 March 2007; Edentiti, Submission PR 210, 27 February 2007.

[19] Westpac, Submission PR 256, 16 March 2007; Consumer Credit Legal Centre (NSW) Inc, Submission PR 255, 16 March 2007; Consumer Credit Legal Centre (NSW) Inc, Credit Reporting Research Report (2007), rec 3.

[20] Australian Privacy Foundation, Submission PR 553, 2 January 2008; GE Money Australia, Submission PR 537, 21 December 2007; National Legal Aid, Submission PR 521, 21 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Veda Advantage, Submission PR 498, 20 December 2007; Legal Aid Queensland, Submission PR 489, 19 December 2007; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007; Banking and Financial Services Ombudsman, Submission PR 471, 14 December 2007; Galexia Pty Ltd, Submission PR 465, 13 December 2007; National Australia Bank, Submission PR 408, 7 December 2007; Financial Counsellors Association of Queensland, Submission PR 371, 30 November 2007; Australasian Retail Credit Association, Submission PR 352, 29 November 2007; Consumer Action Law Centre, Submission PR 274, 2 April 2007; Consumer Credit Legal Centre (NSW) Inc, Submission PR 255, 16 March 2007; Consumer Credit Legal Centre (NSW) Inc, Credit Reporting Research Report (2007), rec 3.

[21]Credit Reporting Act 1978 (Vic) s 4.

[22] Consumer Credit Legal Centre (NSW) Inc, Submission PR 255, 16 March 2007; Consumer Credit Legal Centre (NSW) Inc, Credit Reporting Research Report (2007), rec 4.

[23]Legal Aid Queensland, Submission PR 489, 19 December 2007.

[24]Veda Advantage, Submission PR 498, 20 December 2007.

[25]National Australia Bank, Submission PR 408, 7 December 2007.

[26]Australasian Retail Credit Association, Submission PR 352, 29 November 2007.

[27]Office of the Privacy Commissioner, Submission PR 499, 20 December 2007.

[28]Ibid.

[29]Financial Counsellors Association of Queensland, Submission PR 371, 30 November 2007.

[30]Galexia Pty Ltd, Submission PR 465, 13 December 2007.

[31] Consumer Credit Legal Centre (NSW) Inc, Submission PR 28, 6 June 2006.

[32]N Waters—Cyberspace Law and Policy Centre UNSW, Submission PR 277, 3 April 2007. Also Australian Privacy Foundation, Submission PR 275, 2 April 2007.

[33]Veda Advantage, Submission PR 498, 20 December 2007; Legal Aid Queensland, Submission PR 489, 19 December 2007.

[34] Veda Advantage, Submission PR 498, 20 December 2007.

[35] Australian Privacy Foundation, Submission PR 553, 2 January 2008; Legal Aid Queensland, Submission PR 489, 19 December 2007.

[36] Australian Privacy Foundation, Submission PR 553, 2 January 2008.

[37]Office of the Privacy Commissioner, Submission PR 499, 20 December 2007.

[38] Rec 54–2.

[39]See Ch 29.