Complaint handling

59.89 The following section of this chapter examines aspects of complaint handling in relation to credit reporting. Complaints about credit reporting are handled by credit reporting agencies and credit providers, external dispute resolution (EDR) schemes such as the Telecommunications Industry Ombudsman (TIO) and Banking and Financial Services Ombudsman (BFSO),[94] or by the OPC under the complaint-handling provisions of the Privacy Act.

Credit reporting agencies and credit providers

59.90 Under the Credit Reporting Code of Conduct, credit reporting agencies and credit providers must establish procedures to deal with disputes relating to credit reporting.[95] Credit providers that are financial services providers under the Corporations Act 2001 (Cth) are required to establish internal dispute resolution systems that comply with standards set by the Australian Securities and Investments Commission (ASIC).[96] Internal dispute resolution systems also may be required by industry codes, such as the Code of Banking Practice[97] or by the terms of membership of EDR schemes.

59.91 The Credit Reporting Code of Conduct makes credit reporting agencies responsible for attempting to resolve disputes between credit providers and individuals where the dispute involves the content of a credit report. The Code states:

3.3 A credit provider should refer to a credit reporting agency for resolution a dispute between that credit provider and an individual where the dispute concerns the contents of a credit report issued by the credit reporting agency.

3.4 In referring a dispute to a credit reporting agency, a credit provider must inform the individual of the referral and must provide the individual with the name and address of the credit reporting agency.

3.5 Upon receipt, from a credit provider, of a referral of a request for dispute resolution, a credit reporting agency must handle the request as if the request had been made directly to the agency by the individual concerned.

3.7 Where a credit reporting agency establishes that it is unable to resolve a dispute it must immediately inform the individual concerned that it is unable to resolve the dispute and that the individual may complain to the Privacy Commissioner.[98]

59.92 After receiving a complaint about the content of a credit report, Veda Advantage recommends that the complainant first contact the credit provider responsible for the listing to resolve the issue. If that is unsuccessful, Veda conducts an investigation ‘on the consumer’s behalf’.[99] Veda Advantage advised that it ‘currently manages approximately 25,000 investigations arising from consumer complaints each year’.[100] Veda stated that:

Approximately 34% of investigations require assistance from our subscribers before they can be resolved … Others involve reference to external parties such as the Insolvency and Trustee Service of Australia … 47% of complaints require minor investigation … or an internal check, usually on data quality issues …[101]

External dispute resolution schemes

59.93 Many credit providers are members of EDR schemes, including financial services providers who are required by the Corporations Act to belong to an EDR scheme approved by ASIC.[102]

59.94 ASIC-approved and other EDR schemes deal with some complaints about credit reporting. The TIO, for example, receives and resolves complaints concerning credit reporting by telecommunications service providers.[103] The TIO advised that, in the six months to December 2006, it received 1,437 complaints concerning credit reporting.[104]

59.95 The BFSO resolves some complaints concerning credit reporting by banks and their affiliates.[105] The BFSO stated that in a five-year period to December 2006, it closed 517 cases where ‘privacy’ or ‘credit reporting’ was recorded as a ‘problem type’. The BFSO noted, however, that problems with credit reporting commonly arise in the course of disputes about other matters such as debts, and the credit reporting aspect ‘is not always captured by the BFSO data collection system if the credit reporting issue is incidental to the main issues in dispute’.[106]

59.96 Other utilities and finance industry ombudsmen—such as the Energy and Water Ombudsman NSW, the Credit Ombudsman Service and the Credit Union Dispute Resolution Centre—may also deal with credit reporting complaints.

The Office of the Privacy Commissioner

59.97 The Privacy Act provides an avenue for individuals to complain to the Privacy Commissioner about an act or practice that may be an interference with their privacy.[107] The Act sets out detailed provisions on how the Commissioner can receive, investigate and resolve complaints, including credit reporting complaints.[108] The investigation and resolution of complaints under Part V of the Act is discussed in detail in Chapter 49.

Complaint-handling processes

59.98 A range of criticisms have been made about the handling of credit reporting complaints. These included concerns that:

  • in order to initiate a credit reporting complaint with the OPC, complainants may be required to contact the credit reporting agency to obtain a copy of their credit information file and then to complain to the credit provider;[109]

  • dispute resolution procedures established by credit providers and credit reporting agencies lack transparency and fail to address complaints in relation to repeated problems or possible systemic issues;[110] and

  • dispute resolution procedures generally place the onus of proving that listings are inaccurate on individuals who lack any real negotiating power.[111]

The complaints ‘merry-go-round’

59.99 Stakeholders emphasised concerns[112] about what has been termed the credit reporting complaints ‘merry-go-round’.[113] Section 41(1A) of the Act provides that the Commissioner must not investigate a complaint if the complainant did not complain to the respondent before making the complaint to the Commissioner. Consistently, the Credit Reporting Code of Conduct provides that:

The Privacy Commissioner may decide not to investigate a complaint about a credit reporting dispute if the Commissioner considers that:

(a) the dispute should first be dealt with by a credit reporting agency or credit provider; or

(b) the dispute is being, or has been, dealt with adequately by the credit reporting agency or credit provider.[114]

59.100 Under the Privacy Act, the respondent to a complaint is the person who engaged in the act or practice that is the subject of the complaint.[115] In the case of credit reporting complaints, it is often unclear whether the problem has been caused by the credit provider or the credit reporting agency, making the respondent to the complaint hard to identify.[116]

59.101 The Consumer Action Law Centre observed that the most common way in which an individual discovers inaccurate information is when the individual obtains a copy of his or her credit report—usually after an application for a loan has been rejected on the basis of the credit report. This generally means that the consumer makes a complaint to the credit reporting agency. Under the Code, the credit reporting agency must try to resolve the dispute and, where it cannot, it is required to inform the individual concerned that the individual may complain to the OPC (not to the credit provider).

Unfortunately, the practice of the OPC upon receipt of these complaints is to … refer the consumer to the relevant credit provider before it will take the complaint, even though the consumer has already complained to the [credit reporting agency] (and the [credit reporting agency] would most likely have dealt with the credit provider in its investigation of the complaint). If the credit provider cannot or does not resolve the complaint, under the Code they must refer it back to the [credit reporting agency] … It is no wonder that many consumers become confused by the process.[117]

59.102 The Consumer Action Law Centre submitted that, while this ‘merry-go-round’ is made possible by provisions of the Credit Reporting Code of Conduct, ‘ultimately it occurs because the OPC does not use its discretion to accept complaints … nor accept that a complaint made to a [credit reporting agency] has been made to the respondent’.[118]

Discussion Paper proposal

59.103 In DP 72, the ALRC proposed that the new Privacy (Credit Reporting Information) Regulations should provide that:

(a) credit reporting agencies and credit providers must handle credit reporting complaints in a fair, efficient and timely manner;

(b) credit reporting agencies and credit providers must establish procedures to deal with a request by an individual for resolution of a credit reporting complaint;

(c) a credit reporting agency should refer to a credit provider for resolution of a complaint about the content of credit reporting information provided to the agency by that credit provider; and

(d) where a credit reporting agency or credit provider establishes that it is unable to resolve a complaint it must immediately inform the individual concerned that it is unable to resolve the complaint and that the individual may complain to an external dispute resolution scheme or to the Privacy Commissioner.[119]

59.104 The ALRC also proposed that the new regulations provide that the information to be given, if an individual’s application for credit is refused based wholly or partly on credit reporting information, should include the avenues of complaint available to the individual if he or she has a complaint about the content of his or her credit reporting information.[120]

Submissions and consultations

59.105 The OPC supported the ALRC’s complaint-handling proposal, which it noted is generally consistent with the obligations set out in the Credit Reporting Code of Conduct. The OPC also noted that the requirement set out in sub-paragraph (c) of the proposal reverses the existing position,[121] but agreed that the credit provider should be the initial point of referral for a complaint about the content of credit reporting information.[122]

59.106 Other stakeholders also generally supported the ALRC’s complaint-handling proposal, although some changes of approach were suggested.[123] While no stakeholder disagreed with the ALRC’s proposal, the AFC suggested that complaint handling may be addressed better through a code of conduct, than prescribed by regulation.[124]

59.107 ARCA agreed with the ALRC’s complaint-handling proposal, and stated that operational detail should be set out in a code of conduct rather than in the new regulations.[125] In this context, ARCA members have each appointed a ‘single point of contact’ for complaint handling as part of initiatives to improve the timeliness of complaint handling. ARCA stated:

ARCA credit providers and [credit reporting agencies] collaborate to resolve a consumer complaint if at all possible at the first point of contact or where it needs to be referred to other parties to simplify the process through the use of the single point of contact network. This has improved customer management, reduced ‘hand-offs’ of customers and supported an ‘end to end process’. ARCA is endeavouring to establish a target of a maximum number of consumer contacts in such a situation. This is expected to include a standard of no more than two contacts for a significant proportion.[126]

59.108 More generally, ARCA and its members have been active in developing new policies and procedures for credit reporting complaint handling, in consultation with consumer groups. ARCA has, among other things, established minimum complaint-handling standards, policies and procedures for its members and a process for reviewing and referring systemic complaints to ARCA for guidance and resolution.[127]

59.109 The Consumer Action Law Centre submitted that there are two main weaknesses with the current complaint-handling system.

Firstly, the complaints handling process is fragmented, requiring consumers to make more than one complaint to more than one organisation. Secondly, the [OPC’s] role as complaints handler is not effective for consumers, nor does it appear to effectively identify systemic problems or gaps in industry complaints handling.[128]

59.110 The Centre generally supported proposals for complaint handling put forward by ARCA and ‘ARCA’s commitment to a maximum of two consumer contacts in relation to a dispute’.[129] The Centre also proposed, among other things, that credit reporting agencies should have ‘an obligation to communicate with the credit provider about the dispute, rather than referring the consumer to the credit provider’. It also proposed that consideration be given to establishing a central register (probably within a credit reporting agency) that would allow credit providers or credit reporting agencies ‘to log that a complaint had been made, so that the other party is aware of the complaint’.[130]

59.111 Similarly, Legal Aid Queensland stated that once a complaint is made to a credit reporting agency about a listing, the agency

should be the intermediary that deals with the credit provider and, if the complaint is not resolved, advises the complainant how to complain to the EDR scheme or the OPC.[131]

59.112 Veda Advantage stated that it supported that ALRC’s proposals for dispute resolution generally, ‘with some further modifications to strengthen and streamline dispute resolution’. These modifications should include providing that a

[credit reporting agency] that receives a complaint must do all that is necessary to determine that complaint itself, including contacting credit providers and debt collectors on behalf of the consumer … [132]

59.113 Inaccuracies may exist in credit reporting information acquired from public registers, such as the National Personal Insolvency Index.[133] Veda stated that where it has correctly recorded the public register information it is, nevertheless,

prepared to consider handling the complaint on behalf of the consumer with the public register owner to ensure the consumer is not ‘shopped around’. Detailed consideration of this will be undertaken with consumer advocates.[134]

59.114 Finally, stakeholders agreed with the ALRC’s proposal[135] that the new regulations provide that, where an individual’s application for credit is refused based wholly or partly on credit reporting information, the information to be given by the credit provider should include information about the avenues of complaint available.[136]

ALRC’s view

59.115 Under the existing Credit Reporting Code of Conduct, credit reporting agencies are responsible for resolving disputes between consumers and credit providers.[137] Notably, the Code provides that ‘a credit provider should refer to a credit reporting agency for resolution a dispute between that credit provider and an individual where the dispute concerns the contents of a credit report issued by the credit reporting agency’.[138]

59.116 A focus on complaint handling by credit reporting agencies may be seen as ‘logical given their central role in the credit reporting system’,[139] but creates problems in practice. First, where a credit provider considers that information it disclosed to the agency is accurate, the credit reporting agency has limited capacity to ‘look behind’ the listing of its subscriber credit provider. Arguably, credit reporting agencies cannot resolve credit reporting complaints that require a determination of rights in specific consumer credit contexts. Secondly, an agency’s commercial interests may conflict with the need to make decisions that may affect adversely the interests of its subscribers.

59.117 Credit reporting agencies should refer complaints about the content of credit reporting information provided to the agency by a credit provider to that credit provider for initial dispute resolution. As currently set out in the explanatory notes to the Code, and as agreed by the industry, credit reporting agencies should be able to nominate an officer at each credit provider as the first point of contact for the handling of credit reporting complaints.[140]

59.118 Credit reporting agencies and credit providers need to establish effective complaint-handling mechanisms. In many instances, the involvement of a credit reporting agency and a credit provider will be necessary to deal with a credit reporting complaint. The credit provider may need, for example, to investigate the circumstances of an overdue payment and the credit reporting agency to amend its credit reporting information following the outcome of an investigation. Where credit reporting agencies and credit providers share the handling of a complaint, some potential for a complaint-handling ‘merry-go-round’ may remain.

59.119 This problem may be addressed, in part, by the provision of appropriate information to complainants about the respective roles of credit reporting agencies and credit providers, and access to EDR and OPC complaint-handling processes.

59.120 The ALRC recommends that the new Privacy (Credit Reporting Information) Regulations provide that notification of adverse credit reports include information about the avenues of complaint available to the individual if he or she has a complaint about the content of his or her credit reporting information. In addition, the ‘Notification’ principle in the model UPPs also will require that, at or before the time credit reporting information is collected, reasonable steps must be taken to notify or ensure that the individual is aware of the fact that avenues of complaint are set out in the agency or organisation’s Privacy Policy.[141]

59.121 Time limits on substantiating disputed credit reporting information and mandated credit provider membership of EDR schemes (discussed below) should also help to ensure effective complaint handling for individuals who are contesting adverse credit reporting information.

Recommendation 59-5 The new Privacy (Credit Reporting Information) Regulations should provide that:

(a) credit reporting agencies and credit providers must establish procedures to deal with a request by an individual for resolution of a credit reporting complaint in a fair, efficient and timely manner;

(b) a credit reporting agency should refer to a credit provider for resolution complaints about the content of credit reporting information provided to the agency by that credit provider; and

(c) where a credit reporting agency or credit provider establishes that it is unable to resolve a complaint, it must inform the individual concerned that it is unable to resolve the complaint and that the individual may complain to an external dispute resolution scheme or to the Privacy Commissioner.

Recommendation 59-6 The new Privacy (Credit Reporting Information) Regulations should provide that the information to be given, if an individual’s application for credit is refused based wholly or partly on credit reporting information, should include the avenues of complaint available to the individual if he or she has a complaint about the content of his or her credit reporting information.

[94] In October 2007, the BFSO announced that it would merge with the Financial Industry Complaints Service and the Insurance Ombudsman Service. The new EDR scheme is expected to operate from 1 July 2008: Banking and Financial Services Ombudsman, ‘EDR Scheme Merger’ (Press Release, 30 October 2007).

[95] Office of the Federal Privacy Commissioner, Credit Reporting Code of Conduct (1991), Part 3.

[96]Corporations Act 2001 (Cth) s 912A(2)(a).

[97] Australian Bankers’ Association, Code of Banking Practice (1993).

[98] Office of the Federal Privacy Commissioner, Credit Reporting Code of Conduct (1991).

[99] Veda Advantage, Submission PR 272, 29 March 2007.

[100]Veda Advantage, Submission PR 498, 20 December 2007.

[101] Veda Advantage, Submission PR 272, 29 March 2007.

[102]Corporations Act 2001 (Cth) s 912A(2)(b).

[103] The TIO is wholly funded by telecommunications service providers, who are required by law to be part of, and pay for, the TIO Scheme: Telecommunications (Consumer Protection and Service Standards) Act 1999 (Cth) s 126.

[104] Telecommunications Industry Ombudsman, Submission PR 221, 8 March 2007.

[105] Banking and Financial Services Ombudsman, Case Studies <www.abio.org.au> at 5 May 2008. Non-bank institutions and their affiliates can also apply to join the BFSO scheme: Banking and Financial Services Ombudsman, About Us <www.abio.org.au> at 5 May 2008.

[106] Banking and Financial Services Ombudsman Ltd, Submission PR 263, 21 March 2007.

[107]Privacy Act 1988 (Cth) s 36(1).

[108] Ibid s 6 defines a ‘credit reporting complaint’ as a complaint about an act or practice that, if established, would be an interference with the privacy of the complainant because: (a) it breached the Code of Conduct; or (b) it breached a provision of Part IIIA.

[109] Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), 139.

[110] Parliament of Australia—Senate Legal and Constitutional References Committee, The Real Big Brother: Inquiry into the Privacy Act 1988 (2005), [5.11].

[111] Ibid, [5.11].

[112] Consumer Action Law Centre, Submission PR 274, 2 April 2007; National Credit Union Association Inc, Submission PR 226, 9 March 2007.

[113] Consumer Action Law Centre, Submission PR 274, 2 April 2007; J Corker and C Bond, ‘The Merry-Go-Round: Credit Report Complaint Handling under the Privacy Act’ (2001) 8(5) Privacy Law and Policy Reporter 1.

[114] Office of the Federal Privacy Commissioner, Credit Reporting Code of Conduct (1991), [3.17].

[115]Privacy Act 1988 (Cth) s 36(8).

[116] Consumer Action Law Centre, Submission PR 274, 2 April 2007.

[117] Ibid.

[118] Ibid.

[119] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 55–4. In the discussion below, this is referred to as the ‘ALRC’s complaint-handling proposal’.

[120] Ibid, Proposal 55–5.

[121] Office of the Federal Privacy Commissioner, Credit Reporting Code of Conduct (1991), [3.3].

[122]Office of the Privacy Commissioner, Submission PR 499, 20 December 2007.

[123] Australian Privacy Foundation, Submission PR 553, 2 January 2008; GE Money Australia, Submission PR 537, 21 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Veda Advantage, Submission PR 498, 20 December 2007; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007; HBOS Australia, Submission PR 475, 14 December 2007; Law Society of New South Wales, Submission PR 443, 10 December 2007; National Australia Bank, Submission PR 408, 7 December 2007; Dun & Bradstreet (Australia) Pty Ltd, Submission PR 401, 7 December 2007; Australasian Retail Credit Association, Submission PR 352, 29 November 2007.

[124]Australian Finance Conference, Submission PR 398, 7 December 2007.

[125]Australasian Retail Credit Association, Submission PR 352, 29 November 2007.

[126]Ibid.

[127]Ibid. Veda Advantage stated the ‘the appropriate place for monitoring and correcting any emerging systemic issues should be the ARCA Policy and Compliance Committee, independently chaired and comprising equal numbers of consumer and industry representatives’: Veda Advantage, Submission PR 498, 20 December 2007.

[128]Consumer Action Law Centre, Submission PR 510, 21 December 2007.

[129]Ibid.

[130]Ibid. The Centre stated that this may also assist credit reporting agencies to ‘identify possible systemic problems’.

[131]Legal Aid Queensland, Submission PR 489, 19 December 2007.

[132] Veda Advantage, Submission PR 498, 20 December 2007.

[133] The National Personal Insolvency Index is established and maintained in accordance with the Bankruptcy Regulations 1996 (Cth) pt 13.

[134] Veda Advantage, Submission PR 498, 20 December 2007.

[135] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 55–5.

[136] GE Money Australia, Submission PR 537, 21 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Veda Advantage, Submission PR 498, 20 December 2007; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007; Law Society of New South Wales, Submission PR 443, 10 December 2007; National Australia Bank, Submission PR 408, 7 December 2007; Dun & Bradstreet (Australia) Pty Ltd, Submission PR 401, 7 December 2007; Australasian Retail Credit Association, Submission PR 352, 29 November 2007; AAPT Ltd, Submission PR 338, 7 November 2007.

[137] Office of the Federal Privacy Commissioner, Credit Reporting Code of Conduct (1991), [3.3]–[3.6].

[138] Ibid, [3.3].

[139] Consumer Action Law Centre, Submission PR 274, 2 April 2007.

[140] Office of the Federal Privacy Commissioner, Credit Reporting Code of Conduct (1991), [78B].

[141]See Ch 23.