The Law Handbook 2024

1106 Section 12: Government and the individual Key aspects of the credit-reporting regime are: • restrictions on the types of information permitted to be exchanged; • restrictions on the use and disclosure by credit providers and credit-reporting bodies of credit- related information; • obligations on credit providers and credit- reporting bodies to notify individuals about their handling of credit-related information; and • rights for individuals to request access to the credit-related information about them, and to seek amendments or to submit complaints. In September 2022, the OAIC completed a major review of the CR Code 2014 to determine whether it remains fit for purpose and provides adequate privacy protections for individuals. The OAIC plans to implement the proposals in its report over the next two years, primarily through further variations to the CR Code and OAIC guidance. Where issues cannot be addressed through amendments to the CR Code or guidance, the OAIC intends to raise them with government for consideration in preparation for the review of Part IIIA of the Privacy Act, required to be completed before 1 October 2024. Information permitted to be exchanged under the credit-reporting regime Broadly, the credit-reporting regime permits credit providers and credit-reporting bodies to collect and disclose certain types of credit-related information. This includes information about: • an individual’s identity; • credit that the individual holds or has previously applied for, including the type and amount of credit, and the dates when the credit account was opened and terminated; • an individual’s repayment history; • credit defaults (that is, payments of $150 or more that are at least 60 days overdue); • certain terms and conditions on which consumer credit is issued, and agreements by an individual to vary those terms; and • court proceedings or personal insolvency, and information about serious credit infringements. Credit information generally appears on a credit report as a number (from zero to seven), showing the age, in months, of the oldest missed payment. This information remains on the credit report for two years. Information about an individual’s repayment history can be quite detailed: it can include whether an individual has met monthly payments, the day on which a payment was due and the day on which it was paid. A credit provider can disclose (and receive from a credit-reporting body or another credit provider) repayment history information only if the credit provider holds an Australian credit licence under the National Consumer Credit Protection Act 2009 (Cth). Credit-reporting bodies can also use and disclose information that they derive from other credit- related information. For example, a credit-reporting body might use other information it collects to give an individual a credit score or risk assessment, and may disclose this to a credit provider who has requested a credit report. A credit provider may in turn use this information (and other information they hold) to derive their own conclusions about credit eligibility. Restrictions on the disclosure of credit-related information The credit-reporting regime permits credit-reporting bodies and credit providers to disclose credit-related information, but only for certain purposes. For example, a credit-reporting body may disclose credit- related information requested by a credit provider for the purpose of assessing an individual’s application for consumer credit, or to collect repayments. A credit-reporting body may also disclose credit- related information to a credit provider for the purpose of assessing an application for commercial credit if the relevant individual has consented to the disclosure for that purpose. Subject to some limitations, a credit provider can disclose to a credit-reporting body credit-related information about an individual that the credit provider reasonably believes is over 18 years old, provided that the credit provider is a member of a recognised external dispute resolution scheme. Additional limitations apply to the disclosure of certain types of information, including information about repayments or credit defaults. A credit provider is permitted to use or disclose credit-related information obtained from a credit- reporting body (called ‘credit-eligibility information’