{"id":"F2024L00888","name":"Privacy (Credit Related Research) Rule 2024","slug":"privacy-credit-related-research-rule-2024","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":105299,"registerId":"commonwealth-F2024L00888-current","compilationNumber":null,"startDate":"2026-04-03","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Privacy (Credit Related Research) Rule 2","sectionType":"part","heading":"Privacy (Credit Related Research) Rule 2024","content":"## Privacy (Credit Related Research) Rule 2024\n\nI, Carly Kind, Privacy Commissioner, make this Rule under section 20M(3) of the Privacy Act 1988.\n\nDated: 9 July 2024\n\n\\[Signed\\]\n\nCarly Kind  \nAustralian Privacy Commissioner","sortOrder":0},{"sectionNumber":"Part 1","sectionType":"subdivision","heading":"Preliminary","content":"#### Part 1 — Preliminary\n\n    1 Name of Rule\n\nThis Rule is the Privacy (Credit Related Research) Rule 2024.\n\n    2 Commencement\n\nThis Rule commences on the day it is registered on the Federal Register of Legislation.\n\n    3 Purpose\n\nThis Rule applies for the purposes of section 20M of the Privacy Act which prohibits a credit reporting body from using or disclosing de-identified credit reporting information (s 20M(1)). Sections 20M(2)–(3) provide that this prohibition does not apply if the use or disclosure is for the purpose of conducting research in relation to credit and the credit reporting body complies with rules made by the Commissioner by legislative instrument.\n\n  \n\n    4 Definitions\n    (1) Unless this Rule states otherwise, any word or expression used in this Rule which is defined in the Privacy Act, has the same meaning as in that Act.\n    (2) In this Rule:\n\nAggregated results means the results of de-identified credit reporting information research analysis which does not include the individual elements of the de-identified credit reporting information and cannot readily be disaggregated to extract or re-identify that de-identified credit reporting information\n\nDe-identified information means credit reporting information that is no longer about an identifiable individual or an individual who is reasonably identifiable\n\nPrivacy Act means the Privacy Act 1988\n\nRule means the Privacy (Credit Related Research) Rule 2024\n\nNote: The following expressions are defined in Section 6(1) of the Privacy Act: Australian law; Australian link; Commissioner; court/tribunal order; credit; credit reporting body; credit reporting information; entity; personal information\n\n    5 Schedules\n    Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.","sortOrder":1},{"sectionNumber":"Part 2","sectionType":"subdivision","heading":"Operational provisions","content":"#### Part 2 — Operational provisions\n\n    6 Conducting research in relation to credit\n\nA credit reporting body may use or disclose credit reporting information if:\n\n    (a) the credit reporting information has been de-identified,\n    (b) the use and/or disclosure of the credit reporting information is for the purpose of conducting research in relation to credit, and\n    (c) the purpose for conducting the research in relation to credit is a permitted purpose as described in section 7 of this Rule.\n\n    7 Permitted purposes of conducting research\n\nA credit reporting body may only use or disclose de-identified information for the purposes of conducting research in relation to credit for:\n\n    (a) the assessment or management of current, and development of new, credit services, or\n    (b) developing methodologies to combat fraud, anti-money laundering, counter terrorism financing and other unlawful activity involving credit, or\n    (c) assisting responsible lending obligations and other consumer protections, or\n    (d) any other purpose for the general benefit of the public.\n\n    8 De-identification of credit reporting information\n    (1) When de-identifying credit reporting information, a credit reporting body must:\n    (a) assess the risk of re-identification of the credit reporting information either by itself or by the recipients of the de-identified information,\n    (b) use that risk assessment to determine the de-identification technique or techniques appropriate to the circumstances, and\n    (c) take such steps as are reasonable in the circumstances to ensure the de-identified information cannot be re-identified.\n    (2) If a credit reporting body de-identifies credit reporting information, the credit reporting body must:\n    (a) not re-identify or attempt to re-identify the de-identified information, and\n    (b) destroy the information if it is re-identified unintentionally.\n    (3) Sub-section 8(2)(a) does not apply if the re-identification of de-identified information is required by Australian law or a court/tribunal order.\n\n  \n\n    9 Disclosure of de-identified information\n    (1) A credit reporting body must only disclose de-identified information for a permitted purpose if the entity receiving the information has an Australian link.\n    (2) Before disclosing de-identified information, a credit reporting body must take such steps as are reasonable in the circumstances to ensure the entity receiving the information:\n    (a) does not re-identify or attempt to re-identify the de-identified information,\n    (b) destroys the information if it is re-identified unintentionally, and\n    (c) does not disclose the de-identified information to any other entity.\n    (3) Sub-section 9(2)(c) does not apply to Aggregated results.\n\n    10 Openness\n\nA credit reporting body must include a statement in its policy on the management of de-identified information, in accordance with s 20B(3), that de-identified information is used or disclosed by that credit reporting body for the purpose of conducting research in relation to credit.","sortOrder":2},{"sectionNumber":"Schedule 1","sectionType":"subdivision","heading":"Repeals","content":"#### Schedule 1 – Repeals\n\nPrivacy (Credit Related Research) Rule 2014\n\n1 The whole of the instrument\n\nRepeal the instrument.","sortOrder":3}],"analysis":{"kimi_summary":{"content_quality":"ok","complexity_score":3,"scope_assessment":{"changed":false,"description":"The Rule remains tightly scoped to its original purpose under section 20M of the Privacy Act—permitting research uses of de-identified credit information under strict conditions. It does not expand beyond the credit reporting context or the specific research purposes enumerated in section 7."},"complexity_factors":["Short instrument: only 10 operative sections plus preliminary matters and a single repeal schedule","Minimal defined terms: only 4 explicit definitions in section 4(2), with reliance on existing Privacy Act definitions","Simple conditional structure: primarily 'if-then' requirements without nested exceptions (only two explicit carve-outs in sections 8(3) and 9(3))","No cross-referencing maze: references limited to the parent Privacy Act (section 20M, section 6) and internal sections","Straightforward operational flow: de-identify → check permitted purpose → disclose with restrictions → maintain transparency","Single amendment: only repeals one previous instrument (the 2014 Rule)"],"plain_english_summary":"This Rule creates a safe harbour allowing credit reporting bodies to use and share de-identified credit data for specified research, exempting them from section 20M of the Privacy Act when strict conditions are met.\n\nIt affects credit bureaus, researchers with an Australian link, and consumers; requires robust de‑identification, limits allowable research purposes, binds recipients not to re‑identify or re‑share data, and mandates privacy‑policy disclosure—balancing research benefits against re‑identification privacy risks."},"flash_summary":{"complexity_score":4,"scope_assessment":{"changed":true,"description":"This instrument repeals the Privacy (Credit Related Research) Rule 2014 and replaces it with a new framework. It defines specific permitted research purposes (s7), sets de-identification and recipient safeguards (s8–9), and mandates a policy disclosure (s10). As a result, the operational scope and the compliance requirements governing use and disclosure of de-identified credit reporting information are modified from the prior instrument."},"complexity_factors":["Statutory linkage to s20M of the Privacy Act — the Rule operates as an exception to a statutory prohibition (affects interpretation and enforcement).","De-identification requirements (s8): mandated risk assessment, selection of techniques, reasonable steps to prevent re-identification, prohibition on re-identifying and destruction obligations — 'reasonable in the circumstances' standard adds interpretive uncertainty.","Disclosure constraints (s9): recipient must have an Australian link and must not re-identify, must destroy if re-identified, and must not onward-disclose (with an exception for Aggregated results), creating compliance and contractual oversight duties.","Broadness of permitted purposes (s7), especially item (d) 'any other purpose for the general benefit of the public', which is open-textured and may require case-by-case assessment.","Operational obligations (s10) to update public policy on de-identified information, adding transparency but also administrative burden.","Repeal of the 2014 Rule (Schedule 1) — removes the prior instrument and may create transitional or interpretation issues where practices relied on the old text.","Cross-border and recipient identification risk: requiring an 'Australian link' for recipients raises questions for international research collaborations and data handling.","Enforcement and oversight ambiguity: duties to ensure recipients comply (s9(2)) create monitoring and contractual compliance costs without detailed procedural guidance."],"plain_english_summary":"This Rule allows credit reporting bodies to use or disclose de-identified credit reporting information for specified credit-related research if they follow set safeguards. It lists permitted research purposes, requires a documented risk assessment and de-identification steps, limits recipients to entities with an Australian link, and requires a public policy statement about such uses.\n\nCredit reporting bodies bear the compliance costs (risk assessment, de-identification, destruction obligations) and control disclosures; recipients must not re-identify or onward-disclose the data."},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"}},"importantCases":[],"_links":{"self":"/api/acts/privacy-credit-related-research-rule-2024","history":"/api/acts/privacy-credit-related-research-rule-2024/history","analysis":"/api/acts/privacy-credit-related-research-rule-2024/analysis","conflicts":"/api/acts/privacy-credit-related-research-rule-2024/conflicts","importantCases":"/api/acts/privacy-credit-related-research-rule-2024/important-cases","documents":"/api/acts/privacy-credit-related-research-rule-2024/documents"}}