Part 1How the Act draws the line
The Act does not leave disclosure open and then list exceptions. It works the other way. The OAIC: “Credit reporting bodies are prohibited from disclosing your credit reporting information to third parties, except to particular entities for the particular purposes prescribed by Part IIIA.” Section 20F says a disclosure by a credit reporting body is a permitted disclosure “if: (a) the disclosure is to an entity that is specified in an item of the table and that has an Australian link; and (b) such conditions as are specified for the item are satisfied”.
So a reader the table admits has three things to satisfy: it must be named in the table, it must have an Australian link, and it must meet the conditions written against its item. The table is not the only route, as the last entry in Part 2 shows.
For some items, one of those conditions is your consent. Under item 2 of the table, which names a credit provider, that consent must be given in writing, unless the provider asks for the information to assess an application for commercial credit made to it, and that application was not itself made in writing.
OAIC: what is a credit report?
The line binds the reader as well as the body. An entity commits an offence if it obtains credit reporting information from a credit reporting body when it is neither an entity the body may disclose that information to nor an access seeker for it.
Part 2The readers the OAIC names, and why each one asks
Each entry names a reader the sources describe, then what the law or the OAIC says about why that reader may need your report.
- For set purposesA credit provider you have applied to
- Moneysmart says certain third parties may see your report for specific reasons, one being to assess a credit application you have made. If a credit provider asks for your report during a ban period, the body tells it about the ban.
- For set purposesAnother Australian credit reporting body
- The OAIC lists “another Australian credit reporting body”. The word Australian matters: as Part 3 says, foreign credit reporting bodies may not access your Australian report.
- For set purposesA mortgage insurer
- The Act defines a mortgage insurer as “an organisation, or small business operator, that carries on a business or undertaking that involves providing insurance to credit providers in relation to mortgage credit provided by providers to other persons”. The insurance it provides is to credit providers.
- For set purposesA trade insurer
- The Act says a trade insurer has made an information request about you if it has sought information about you from a credit reporting body in connection with providing insurance to a credit provider for commercial credit given to you or another person.
- For set purposesA debt collector acting for a credit provider
- The OAIC’s wording is “a debt collector acting as an agent for a credit provider”. The National Debt Helpline points out that once you request your own report, your current contact details become available to lenders, creditors and debt collectors who check it.
- In certain situationsA dispute scheme or an enforcement body
- The OAIC adds that, in certain situations, a body may pass regulated information to other third parties too, for example for the work of a recognised external dispute resolution scheme it belongs to, or an enforcement body. How such a scheme fits into a complaint is in Complaints about credit reporting.
Part 3Lease and job applications, and moving overseas
OAIC: who isn’t allowed access
Requests can come from outside the credit system. The OAIC: “Real estate agents and landlords sometimes request a copy of your consumer credit report as part of a lease application process. Employers and recruitment consultants might also request a copy of your credit report in connection with an offer of employment.” Its answer is direct: “The Privacy Act specifically excludes real estate agents and employers from the definition of credit provider and these entities are not permitted to obtain credit reports.”
Borders limit it too. In the OAIC’s words: “If you move overseas, foreign credit providers and credit reporting bodies are not permitted to access your Australian consumer credit report.”
Part 4What a permitted reader can see
Being allowed a copy is not the same as seeing every entry. The National Debt Helpline explains that businesses such as telcos and utility providers can neither record nor see repayment history and financial hardship information. The Act’s own list of who may receive that information is in Who holds your credit information.
Once a credit provider has your information, it carries its own name. The OAIC calls it credit eligibility information: your credit reporting information plus anything further the credit provider derives from it.
Part 5The record of who looked
Every reader leaves a trace. The OAIC says your consumer credit report includes a log of who has accessed it, and that a credit provider or other third party generally can’t view that log. The body’s own duty to note each disclosure in writing is set out in Who holds your credit information.