QUICK NOTES ON CREDIT REPORTING LEGISLATION
Credit Reporting Guidelines Under The Privacy Act 1988
Section 11B (7) Debt collection agencies acting as agents of a credit provider
A person may not be the agent of a credit provider whilst the person is engaged in debt collection activities in respect of the loan. Explanatory memoranda a state that a person involved in debt collection activities is not permitted to receive direct from a credit reporting agency information about overdue payments but can receive the information from the credit provider.
Section 18E(8)(c) Notices given and consents obtained
Section 18E(8)(c) requires the credit provider to inform a consumer that they intend to disclose personal information to a Credit reporting agency.
In order to do so the credit provider must first have::
1. notified the individual at the time of or before collecting the personal information that default information may be disclosed to a credit reporting agency; and
2. complied with Paragraph 2.7 of the Code of Conduct which requires a debt to be first 60 days overdue since the payment was due and payable; and
3, notified the debtor of the default by serving a default notice on the individual at the last known address of that individual; and
4. the time specified in the notice has elapsed without payment being forthcoming.
NOTE: This does not apply to personal information in accounts that were obtained prior to 25 February 1992.
Personal information acquired after the 25th February 1992 can be disclosed to a Credit Reporting Agency providing the credit provider has subsequently notified the individual that personal information may be reported to a credit reporting agency. This may be done via a:
(a) Notice in routine communication that information the individual that they may be disclosed to a credit reporting agency – this should inform the person of the types of information that may be disclosed and the circumstances in which the disclosure may occur, or
(b) Notifying the individual before payments become overdue or immediately upon knowing that the payments are overdue, that information about the overdue payments may be disclosed to a credit-reporting agency.
However, the credit provider must also comply with Para 2.7(b) of the Credit Reporting Code of Conduct.
Evidence of giving the required default notice
A default notice must be given to the individual prior to passing the information to a credit reporting agency however the Privacy Act does not prescribe any particular form or time frame to comply with the default notice.
Obtaining Credit report to assist in collecting a debt
Section 18N(1)(c)
This section governs the information a credit provider is permitted to disclose to an agent or debt collection agency.
Credit Reporting Code Of Conduct Issued By The Privacy Commisioner March 1996.
Part 2 ACCURACY OF INFORMATION
Para XX Disclosures to Credit Reporting Agencies
Para 2.3: Discharge of credit commitments
Where a credit provider has informed the agency that it is a current credit provider it must notify the agency within 45 days after ceasing to be a current credit provider.
Para 2.4: Rectifying reporting procedures
Where a credit provider is informed by a credit reporting agency that it has provided information that is not permitted to be provided then the credit provider must take steps to remedy its reporting procedures to comply with the Act in future.
Para 2.5:
Where a credit provider becomes aware that:
(a) it has provided information that is inaccurate at the time of giving the information which has or might in the future adversely effect a credit granting decision; or
(b) it has given information not permitted to be included in a credit file, then the credit provider must advise the credit reporting agency immediately of the inaccuracy or prohibited information.
Para 2.6:
Where a credit provider has been notified by credit reporting agency in accordance with Para 1.4 (inaccurate overdue or default listing) it shall alert the agency of other individuals’ files that may have been similarly dealt with and investigate the accuracy of overdue or default listings on those files and within 30 days advise the privacy commissioner in writing of the action the credit provider has taken to rectify the problem.
Para 2.7, 2.8, 2.9, 2.10: Deals with reporting overdue payments
Para 2.23: Requests for amendments to a credit report
Where a credit provider receives a request from an individual for an amendment, or inclusion of a statement in, a credit report issued by a credit reporting agency the credit provider should within 10 working days:
(a) refer the request to the relevant credit reporting agency incorporating its opinion as to the appropriateness of the amendment sought;
(b) inform the individual in writing of the referral; and
(c) include in any credit report in its possession a note that the information on the individuals credit report is subject to a request for amendment.
Para 3.8: Amendment to a credit information file
Once established as correct an amendment must be completed within 5 working days
Para 3.9: Overdue debts
When it is no longer overdue a credit reporting agency must update its files within 5 working days of being informed of this.
Para 3.10 – 3.13: Inclusion of statements
Individuals have rights to request statement and credit reporting agency must inform individual of outcome within 30 days of receipt.
Para 3.14, 3.15: Deals with advice of dispute outcome
Part 4: Other matters
Para 4.1: Staff Training
Privacy Commissioners Exsplanatory Notes to the Code of Conduct Released 04/04/2002.
Part 1: Credit Reporting Agencies
Para 1: Deals with permitted contents
Para 5: Deletion of information
Section 18F provides time limits for the retention of personal information permitted under Section18E. Credit reporting agency must within 1 month of the expiry of the permitted time period delete the personal information.
Para 7: Accuracy of information
Credit reporting agency must ensure personal information is accurate, up-to-date, complete and not misleading. Where there is doubt as to a credit reporting agency’s ability to comply with these standards such items should be removed from the credit information files. Refer Section18G of the privacy act.
NOTE: Para 1.3 provides a Credit reporting agency must refuse to accept information where it appears that information being supplied may not be permitted to be included and must notify the credit provider that the inclusion may be in breach
Para 26, 27: Commercial information and consumer credit
A credit reporting agency must observe Section 18K(6) which prohibits a credit reporting agency from including in the report any information about the individuals commercial activities, other than commercial information that the credit reporting agency is permitted under Section 18 E to include.
Examples of permitted commercial information include: - enquiries by a commercial credit provider in connection with commercial credit, trade insurer in respect to commercial credit.
Para 29 –32: Notice of disclosure to a credit-reporting agency
Notice of intention to disclose personal information to a credit reporting agency should be given at the time or before the individual applies for credit with the credit provider.
Para 39: Use of credit reports
Section 18L of Privacy Act allows a credit provider to use personal information to collect overdue payments in respect of credit provided to the individual by the credit provider.
Para xx: Overdue payments
Para 47: No longer overdue
Where a credit provider has previously listed an individual as overdue the credit provider must notify the credit reporting agency that the debt is no longer overdue when paid and if contested that the individual contends that he or she is not overdue in making the payment.
Para 51: Ceasing to be a current credit provider
A credit provider ceases to be a current credit provider where it assigns the debt to a third party or the individual’s debt is unenforceable due to the statute of limitations.
Para 53: Reporting overdue payments to a credit reporting agency
A credit provider must not give to a credit reporting agency personal information about an individual unless the credit provider has reasonable grounds for believing that the information is correct.
Para 55B:
Care and judgement should be exercised by a credit provider when reporting an overdue payment to a credit reporting agency to ensure that such reporting accords with the requirement that information in credit information files, is accurate, up to date, complete and not misleading.
Para 55F:
This Para deals with arrangements rendering the individual no longer overdue under the loan. We need to explore this and its meaning.
Section 2.7 (b)
Relates to sending a default notice to the last known address. This paragraph appears to deal with “Current” debt as it refers to once 60 days has elapsed since the day the payment was due and payable.
The draftsman of the Privacy Act appears not to have contemplated an old debt being sold such as was the case in the recent Telstra debt sale to Alliance Factoring. In this case Telstra sold debts as old as 5 and 6 years old where in some cases the debtor had moved away from the address last recorded by Telstra in the ordinary course of business. It is hard to imagine that the draftsman would have allowed a default notification to be sent to an address that was 5 years old and more particularly had not been contacted by the credit provider for several years.
Nevertheless the Privacy Commissioners office ahs indorsed Alliance Factorings actions in this respect which has left thousands of consumers listed as defaulters despite not having received a default notice at their current address.
Para 56 Providing information to another credit provider.
A credit provider may report an overdue debt to another credit provider only where an individual’s specific written permission to the credit provider for exchanging such information has been obtained.
Section 2.12, 2.13, 2.14
In respect to Telstra debt does this mean that once the assignment to AF has taken place and the information handed over that any further correspondence and request for information by AF to Telstra about an individual must be accompanied by a specific authorisation by the individual to Telstra and AF. Further, where AF refers the individual to Telstra to obtain information that Telstra cannot provide the information to AF directly it must refer the correspondence directly to the person? In some instances AF is seeking information in respect to invoices, accounts other than the one that was sold to resolve a dispute does Telstra require specific authorisation from the individual as it is providing information on accounts other than the one sold to AF.
Para 57 Providing personal information to a debt collection agency
While a credit provider may use an entire credit report it has obtained from a credit reporting agency for in-house debt collection activities the credit provider is excluded under the Credit Reporting Code of Conduct from disclosing certain information contained in a credit report to a debt collection agency.
While a debt collection agency may be an agent of the credit provider unrelated to debt collection activity, as soon as the agent engages in debt collection activity it is no longer an agent of the credit provider but a mercantile agent. As such the mercantile agent is not permitted to access the credit bureau or use information contained in a consumer credit report.
Section 18N(1)(c) of the Privacy Act allows only identifying information to be provided by a credit provider to a debt collection agent.
Amendment of a credit information file or credit report
Clause 3.8 where the bureau establishes that an amendment to personal information on a person’s file this must be made within 5 working days.
Clause 3.9
Where the Bureau is informed that an individual is no longer overdue in making a payment or a person contends that he or she is not overdue in making payment the Bureau must add the information to the file within 5 working days.
Provision of loans by a business is a pre-requisite
Under Section 11B(1)(b)(v)(A) the Act access to credit reporting is reserved to those corporations that carry on a business or undertaking involving the provision of loans.
Under Section 11B(1)(b)(v)(B) of the Act concerning assignees, the commissioner determined that a corporation which acquires the rights of a credit provider with respect to the repayment of a loan shall in relation to that loan be regarded as the credit provider for the purposes of the Act.
As such the commissioner states that the determination does not extend to debt collection agents who take assignment of loans unless they are engaged in the provision of loans.
Notice and consents on assignment of debts
The Privacy Commissioners Determination No 2 provides that a debt collection agency that purchases debts is assigned all of the rights including any notices given by the original credit provider.