Time limits on disputed credit reporting information

59.145 In DP 72, the ALRC noted that individuals effectively have the burden of showing that a disputed debt is listed improperly because the listing will remain part of their credit reporting information until this is shown.[170]

59.146 This position was considered to be unfair given the relative positions of credit providers and individual consumers who may, for example, never have received a utilities bill.[171] Any delay in resolving a dispute between a credit provider and an individual about the correctness of credit reporting information, including due to the inaction of the credit provider, may prejudice the individual.

59.147 To address this issue, time limits could be placed on certain steps in the dispute resolution process. A model for such a reform is contained in United States credit reporting legislation. In the United States, the FCRA provides that if the completeness or accuracy of information is disputed by a consumer, the credit reporting agency must conduct an investigation and, if the information is not verified, it must be deleted within 30 days.[172]

Discussion Paper proposal

59.148 In DP 72, the ALRC proposed that the new Privacy (Credit Reporting Information) Regulations provide that credit providers have an obligation to provide evidence to individuals and dispute resolution bodies to substantiate disputed credit reporting information, such as default listings. If the information is not provided within 30 days the credit reporting agency must delete the information on the request of the individual concerned.[173]

Submissions and consultations

59.149 All stakeholders who addressed the issue were in favour of requiring credit reporting agencies and credit providers to verify the accuracy of disputed credit reporting information within a certain time period.[174]

59.150 Stakeholders generally supported the ALRC’s proposal, subject to a range of qualifications.[175] The Financial Counsellors Association of Queensland, for example, stated that a 30-day time limit would provide credit providers with ‘an incentive to cooperate with consumers and advocates to reach an outcome’.[176]

59.151 Veda Advantage submitted that the new regulations should require that, if a credit provider cannot substantiate disputed credit reporting information within 30 days, then ‘the dispute is resolved in the consumer’s favour’.[177] ARCA agreed with the proposal but noted that, because it ‘reverses the current onus of proof’, a strict time limit would

allow disreputable individuals to engage in ‘credit repair’ which is currently a significant problem in both the US and the UK. That is, individuals flood credit providers with questions that cannot be answered in the timeframe and thus are rewarded by information being removed from their record.[178]

59.152 ARCA submitted that controls would need to be established to prevent individuals (or third parties on behalf of individuals) from deliberately impeding the dispute resolution process.[179] Similarly, the AFC stated:

Whatever its actual scale, AFC does not condone credit provider intransigence in the face of bona fide disputed listings. However, if policy is to go in the direction proposed, it must also include practical protections from vexatious and delaying disputation.[180]

59.153 A range of comments were made about the ALRC’s proposed time limit and the way in which the time limit is measured. The ANZ stated that a 30 day time limit would be onerous for credit providers, and 60 days would be ‘a more realistic timeframe’.[181] Stakeholders suggested that the 30 days commence at the time the individual complaint first is made with the credit provider or credit reporting agency.[182] The Cyberspace Law and Policy Centre also submitted that ‘the proposed industry code should address the issue of what happens to the listing during the 30 day challenge period’.[183]

ALRC’s view

59.154 Consumer advocates have noted that credit reporting information adverse to an individual’s credit worthiness may be in dispute because

  • liability for a debt is in dispute (for example, because of mistaken identity or a contractual dispute); or

  • the individual had no notice of the obligation and no opportunity to pay (for example, because the credit provider has made billing errors).[184]

59.155 There should be a positive obligation on a credit provider to verify disputed credit reporting information. The ALRC recommends that the new Privacy (Credit Reporting Information) Regulations should provide that, within 30 days, evidence to substantiate disputed credit reporting information must be provided to the individual, or the matter referred to an EDR scheme recognised by the OPC.

59.156 If these requirements are not met, the credit reporting agency should delete or correct the information on the request of the individual concerned. This will provide an incentive for appropriate record-keeping practices and speedy dispute resolution by credit providers and credit reporting agencies. Where information is documented adequately by the credit provider, but remains disputed by the individual, the complaint should be referred to an EDR scheme for resolution.

59.157 There is a range of matters that need to be considered in drafting this provision of the regulations. These include means to deal with frivolous or vexatious complaints and the availability to other credit providers of disputed credit reporting information within the 30 day period.

Recommendation 59-8 The new Privacy (Credit Reporting Information) Regulations should provide that, within 30 days, evidence to substantiate disputed credit reporting information must be provided to the individual, or the matter referred to an external dispute resolution scheme recognised by the Privacy Commissioner. If these requirements are not met, the credit reporting agency must delete or correct the information on the request of the individual concerned.

[170]Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), [55.99].

[171] See Energy and Water Ombudsman NSW, Submission PR 225, 9 March 2007; Telecommunications Industry Ombudsman, Submission PR 221, 8 March 2007.

[172]Fair Credit Reporting Act 1970 15 USC § 1681 (US) s 1681i.

[173]Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 55–7.

[174] Australian Privacy Foundation, Submission PR 553, 2 January 2008; Optus, Submission PR 532, 21 December 2007; Consumer Action Law Centre, Submission PR 510, 21 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Veda Advantage, Submission PR 498, 20 December 2007; Legal Aid Queensland, Submission PR 489, 19 December 2007; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007; ANZ, Submission PR 467, 13 December 2007; Law Society of New South Wales, Submission PR 443, 10 December 2007; National Australia Bank, Submission PR 408, 7 December 2007; Dun & Bradstreet (Australia) Pty Ltd, Submission PR 401, 7 December 2007; Financial Counsellors Association of Queensland, Submission PR 371, 30 November 2007; Australasian Retail Credit Association, Submission PR 352, 29 November 2007; Queensland Law Society, Submission PR 286, 20 April 2007; Banking and Financial Services Ombudsman Ltd, Submission PR 263, 21 March 2007; Consumer Credit Legal Centre (NSW) Inc, Submission PR 255, 16 March 2007; Consumer Credit Legal Centre (NSW) Inc, Credit Reporting Research Report (2007), rec 16; J Codrington, Submission PR 81, 2 January 2007.

[175] Australian Privacy Foundation, Submission PR 553, 2 January 2008; Optus, Submission PR 532, 21 December 2007; Consumer Action Law Centre, Submission PR 510, 21 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Veda Advantage, Submission PR 498, 20 December 2007; Legal Aid Queensland, Submission PR 489, 19 December 2007; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007; ANZ, Submission PR 467, 13 December 2007; Law Society of New South Wales, Submission PR 443, 10 December 2007; National Australia Bank, Submission PR 408, 7 December 2007; Dun & Bradstreet (Australia) Pty Ltd, Submission PR 401, 7 December 2007; Financial Counsellors Association of Queensland, Submission PR 371, 30 November 2007; Australasian Retail Credit Association, Submission PR 352, 29 November 2007.

[176]Financial Counsellors Association of Queensland, Submission PR 371, 30 November 2007.

[177]Veda Advantage, Submission PR 498, 20 December 2007.

[178]Australasian Retail Credit Association, Submission PR 352, 29 November 2007.

[179]Ibid. See also GE Money Australia, Submission PR 537, 21 December 2007.

[180]Australian Finance Conference, Submission PR 398, 7 December 2007.

[181] ANZ, Submission PR 467, 13 December 2007.

[182]Australian Privacy Foundation, Submission PR 553, 2 January 2008; Optus, Submission PR 532, 21 December 2007; Legal Aid Queensland, Submission PR 489, 19 December 2007; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007.

[183]Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007. See also Australian Privacy Foundation, Submission PR 553, 2 January 2008.

[184] Consumer Credit Legal Centre (NSW) Inc, Credit Reporting Research Report (2007), 106.