Part 1The two holders, side by side
A credit provider
Among the organisations the Privacy Act defines as a credit provider, the OAIC lists “an organisation or small business operator that supplies goods and services where payment is deferred for 7 days or more (for example, a telecommunications carrier, an energy utility or a water utility)”.
A small business operator that is a credit provider must still comply with the credit reporting laws.
Its part in the file: it discloses your credit-related information to credit reporting bodies, and it may get a copy of your report, including a credit score, to help decide whether to give you credit or to manage credit already given.
A credit reporting body
The Act’s definition is short: “credit reporting body means: (a) an organisation; or (b) an agency prescribed by the regulations; that carries on a credit reporting business”.
A credit reporting business is one that involves collecting, holding, using or disclosing personal information about individuals in order to give an entity information about their credit worthiness, whether or not that information is provided for profit or reward.
Its part in the file: it compiles the information it receives into a credit report and derives a credit score.
Some organisations may not obtain your credit report at all. Real estate agents and employers are kept outside the Privacy Act’s definition of credit provider, and the OAIC says they may not obtain credit reports.
Part 2How information reaches the file
The law gives you notice at the point where your information starts to move. The OAIC puts it this way: “Section 21C of the Privacy Act requires credit providers to notify you that they are likely to provide your personal information to credit reporting bodies for credit reporting purposes.” When you apply for credit, your credit provider must also tell you which credit reporting bodies it shares your information with.
When you apply, the credit provider will ask for a copy of your credit report to assess your creditworthiness, and that request is recorded on your report as a credit enquiry. It does not need your consent to do this; the requirement is that it notifies you.
Information also flows the other way, from provider to body. Under mandatory consumer credit reporting rules, some credit providers must give your personal information to credit reporting bodies. Not every provider can see every kind of entry: the National Debt Helpline notes that credit providers holding an Australian Credit Licence, banks being one example, can add and see repayment history and hardship information, and Part 3 below gives the Act’s own list of who may receive it.
Because each body compiles what it receives, the files can differ. The OAIC notes that the bodies may not hold the same information about you, which is why it says you may need to ask each one for a copy.
Part 3What a credit reporting body must do
Most of Part IIIA’s duties fall on the body that keeps the file. The margin names the section or page each comes from.
OAIC: correct your credit report
Keep it accurate
The OAIC: “A credit reporting body must take reasonable steps to ensure that the information on your credit report is accurate, up to date, complete and for the use and disclosure of that information, relevant.”
Collect fairly, and only what the law lists
Credit information may be collected by a credit reporting body only by lawful and fair means. It is not permitted to handle any information about your consumer credit activities beyond the types the OAIC lists for a credit report. The OAIC’s example is income: a credit provider may ask about your income when you apply, but it cannot give that to a credit reporting body for your report.
Publish its policy, free
A credit reporting body must take reasonable steps to make its credit reporting policy available free of charge, in an appropriate form. Under section 20B(4), the policy must contain, among other things, how you can get at the credit reporting information it holds about you and ask for it to be corrected, how you can complain if the body fails to comply with that Division of the Act or the registered CR code, and how it will handle such a complaint.
Disclose only as the Act allows, and keep a note
A credit reporting body may not pass your credit reporting information to third parties, the OAIC says, except to the particular entities, for the particular purposes, that Part IIIA prescribes. For repayment history and financial hardship information the Act narrows some of those disclosures further, to a mortgage insurer, or to “a credit provider who is a licensee or is prescribed by the regulations”.
When a credit reporting body discloses credit reporting information under section 20E, it must make a written note of that disclosure. Who may look at your report, and the log it keeps of who did, are in Who else may see your credit report.
Not for direct marketing, except as section 20G provides
A credit reporting body that holds credit reporting information about you must not use or disclose it for direct marketing, a rule the Act backs with a civil penalty of 2,000 penalty units. The same section goes on to provide, in subsection (2) and only where the conditions listed there are met, for a body to use credit information to assess whether you are eligible to receive a credit provider’s direct marketing; in that assessment it must have regard to the eligibility requirements the provider nominates. The body must make a written note of any use of credit information under that subsection, and the assessment itself is not credit reporting information about you.