Attachment Two

Committee Secretary
Senate Finance and Public Administration Legislation Committee
PO Box 6100
Parliament House
Canberra ACT 2600
8 March 2011

Inquiry into Exposure Drafts of Australian Privacy Amendment Legislation – Credit Reporting

The Australian Law Reform Commission (ALRC) welcomes the opportunity to make this submission to the Senate Finance and Public Administration Legislation Committee Inquiry into the Exposure Drafts of Australian Privacy Amendment Legislation, Part 2—Credit Reporting (the Exposure Draft).

The purpose of the Exposure Draft is to amend the Privacy Act 1988 (Cth) (Privacy Act) to introduce provisions relating to collection, use and disclosure of personal information for credit reporting purposes, which will form part of a new Privacy Act.

ALRC privacy inquiry

Reform of credit reporting regulation was a matter considered in detail by the ALRC in the course of its major inquiry into Australian privacy law and practice, conducted in 2006–08. This inquiry culminated in the report For Your Information: Australian Privacy Law and Practice (ALRC Report 108), released in May 2008. The report, which made 197 recommendations for reform in relation to privacy law, is available on the ALRC’s website at <www.alrc.gov.au/publications>.

The Exposure Draft provisions are stated to ‘substantially implement’ the Government’s response to the ALRC report recommendations on credit reporting. The ALRC welcomes the proposed implementation of these recommendations made in Part G of ALRC Report 108 (Recs 54–1 to 59–9).

In two significant respects, however, the Exposure Draft takes a different approach from that recommended by the ALRC, namely:

• incorporating credit reporting provisions into the body of the Privacy Act (as is currently the case under Part IIIA of the Act)—rather than implementing these in regulations, as recommended by the ALRC; and
• permitting the use of credit reporting information for the purpose of pre-screening direct marketing offers by credit providers—rather than prohibiting such use as recommended by the ALRC.

Approach to new credit reporting regulation

The current credit reporting provisions contained in Part IIIA are the only provisions in the Privacy Act that deal in detail with the handling of personal information within a particular industry or business sector. The reasons for this anomaly are to some extent historical in that the credit reporting industry was made subject to privacy regulation before the rest of the private sector. The Exposure Draft would perpetuate this position.

The ALRC concluded in ALRC Report 108 that the best way to implement its recommendations with regard to credit reporting would be to repeal Part IIIA and supplement the Privacy Principles and other general provisions of the Act with new regulations (ALRC Report 108, Rec 54–1).

The ALRC’s preferred regulatory model also included a credit reporting code, developed by industry with input from consumer groups and regulators. This code would provide detailed guidance within the framework provided by the Act and, for example, deal with a range of operational matters relevant to compliance with the permitted content, data quality and dispute resolution obligations set out in the regulations (ALRC Report 108, Rec 54–9).

The reasons for recommending that credit reporting provisions be implemented through subordinate legislation—rather than in the Privacy Act itself—are set out fully in ALRC Report 108 (Part G, Ch 54, paras 54.1–54.67), including that:

• the credit reporting provisions are an unjustified anomaly within the Privacy Act;
• the Act would be significantly simplified by the repeal of Part IIIA;
• the repeal of Part IIIA is consistent with the development of one set of Privacy Principles regulating both the public and private sectors (as with the proposed new Australian Privacy Principles); and
• an equivalent level of privacy protection can be provided to individuals under the Privacy Principles and subordinate legislation.

The Government Response to this recommendation stated that ‘credit reporting information should continue to be regulated primarily under the Privacy Act, with provision for specific regulations to be made where necessary’. The role of the regulations under this model would be confined to prescribing specific thresholds or measures which needed adjusting from time to time, such as ‘the minimum amount at which defaults can be listed with a credit reporting agency’.

More generally, the Government rejected the ALRC’s recommendation (ALRC Report 108, Rec 5–1) that the Privacy Act should authorise the making of regulations modifying the operation of privacy principles to impose different or more specific requirements, including imposing more or less stringent requirements, on agencies and organisations.

The ALRC observes, however, that the Privacy Act could be drafted to contain a regulation-making power specific to the handling of credit reporting information. This would recognise that credit reporting presents a suite of privacy issues that are uniquely deserving of specific treatment, and requires regulation that both strengthens and derogates from the protection afforded by general privacy principles.

Use of credit reporting information for pre-screening

The Exposure Draft would prohibit the use of credit reporting information about individuals for direct marketing (s 110(1)), but provides an exception for the use of that information for pre-screening, by or on behalf of credit providers, to determine whether or not individuals are eligible to receive direct marketing about consumer credit (s 110(2)).

The ALRC closely considered the use of credit reporting information for pre-screening (ALRC Report 108, paras 57.74–57.128) and recommended that credit reporting regulations ‘should prohibit the use or disclosure of credit reporting information for the purposes of direct marketing, including the pre-screening of direct marketing lists’ (Rec 57–3).

The initial Government Response stated that the purpose of permitting the use of credit reporting information for pre-screening was ‘to exclude adverse credit risks from marketing lists’. Encouraging responsible lending may be one rationale for permitting such use—a factor that was considered at length in ALRC Report 108.

Credit providers are subject to responsible lending conduct obligations under the National Consumer Credit Protection Act 2009 (Cth), including an obligation to make reasonable inquiries of the consumer about their requirements and objectives in relation to credit contracts; and to take reasonable steps to verify the consumer’s financial situation (s 130).

While, from one perspective, permitting pre-screening can be seen as consistent with a policy of encouraging or requiring credit providers to assess more fully the financial position of prospective borrowers, pre-screening using credit reporting information could also be used as a ‘half-measure’ in assessing capacity to repay—in substitution for fuller inquiry. In its privacy inquiry, the ALRC heard concerns from consumer groups that pre-screening, by facilitating direct marketing of credit to individuals who have not applied for or expressed an interest in obtaining credit, will result in the granting of excessive amounts of credit. It was suggested, for example, that pre-screening may encourage the offering of ‘pre-approved’ loans or increased credit limits.

Therefore, while pre-screening may be used to assist responsible lending practices, it also has the potential to facilitate more aggressive marketing of credit. Pre-screening is a tool that may be used by credit providers in different ways and, as such, will not automatically result in more responsible lending practices. To ensure that pre-screening does promote responsible lending would require the enforcement of detailed rules relating to the criteria on which pre-screening may take place.

Further, it was common ground among stakeholders in the ALRC privacy inquiry that using credit reporting information in direct marketing more generally should be prohibited. In the ALRC’s view, it is artificial to distinguish between ‘selecting in’ direct marketing prospects (that is, by using credit reporting information to generate a list) and ‘selecting out’ (that is, by pre-screening an existing list, in the way anticipated by the Exposure Draft).

The ALRC concluded that, while pre-screening provides clear commercial advantages for credit providers through the better targeting of marketing, such commercial advantages do not outweigh the privacy and consumer protection concerns raised by pre-screening, and it should not be permitted.

Conclusion

We trust that the Senate Committee will find these comments of value, particularly taken together with the recommendations and supporting research and commentary contained in ALRC Report 108.

If you require any further information please do not hesitate to contact me on (02) 8238 6319 or Bruce Alston on (02) 8238 6307.

Yours sincerely,

Rosalind Croucher