The Law Handbook 2024

Chapter 12.2: Privacy and your rights 1107 in the credit-reporting regime) only for the purposes permitted under the credit-reporting regime. There is a general prohibition on credit-related information being used or disclosed by a credit- reporting body for the purposes of direct marketing. However, a credit-reporting body is permitted to use certain types of credit-related information to make a ‘pre-screening assessment’: an assessment about specified individuals’ eligibility to receive direct marketing from credit providers for the purpose of eliminating ineligible individuals from a list provided by a credit provider. The credit provider can then use this pre-screening assessment to conduct direct marketing. Individuals have a right to request that credit-reporting bodies not use information about them to make pre- screening assessments. Credit-reporting bodies are also prohibited from using or disclosing credit-related information if an individual reasonably believes that they have been a victim of fraud, and requests that the information not be disclosed during a ban period (of 21 days, unless extended) unless required to do so by law or if the individual consents. If a credit provider provides consumer credit to the relevant individual during a ban period, the credit provider is not permitted to disclose credit information relating to that consumer credit to a credit-reporting body unless the credit provider has taken reasonable steps to identify the individual. Obligations to notify individuals about the handling of credit-related information The credit-reporting regime imposes an obligation on credit providers and credit-reporting bodies to notify individuals about certain uses and disclosures of their credit-related information. A credit provider is required to notify an individual (at or before the time it collects credit- related information about that individual) of the information that it is likely to disclose to a credit- reporting body. A credit provider is also required to notify the individual of certain additional matters under APP 5 (discussed above) if it collects credit- related information about that individual. Significantly, a credit provider must notify the credit-reporting body if – within 90 days of obtaining a credit report about an individual – it refuses a consumer credit application. The notice must be provided within 10 business days of the credit provider notifying the individual of the refusal. A credit provider must notify an individual before passing on information about their credit defaults to a credit-reporting body. The individual must be given a written notice informing them that their payment is overdue by 60 days or more, and requesting that the overdue amount be paid. The credit provider must then give the individual a separate notice of their intention to disclose the information to a credit-reporting body, and cannot disclose the information until 14 days after the second notice was given. Credit providers and credit-reporting bodies must give notices of decisions about requests by individuals to access/correct their credit-related information. Accessing credit-related information An individual can request to access the credit- related information that a credit provider or credit- reporting body holds about them. Credit providers and credit-reporting bodies must provide access within a reasonable period (credit-reporting bodies must provide access within 10 days; credit providers must provide access within 30 days, unless unusual circumstances apply). Individuals are entitled to access information held by a credit-reporting body at no charge: • once every 12 months; or • at any time within 90 days of being refused credit by a credit provider. Otherwise, credit-reporting bodies can impose access charges, so long as such charges are not excessive. Credit providers may impose a reasonable charge for providing access to credit information. Credit providers and credit-reporting bodies must present information to individuals in a clear and accessible way, and must provide reasonable explanations and summaries to assist the individual to understand how the information impacts on their credit worthiness. Instructions on how to access information held by a credit-reporting body or a credit provider must be included in the credit-reporting body’s or credit provider’s credit-reporting policy, which is usually available on the credit-reporting body’s or credit