The Privacy Act
9 Veda's credit reporting business is heavily regulated by the Privacy Act. Both the applicants and Veda relied on provisions of that Act as relevant to the claims in defamation and negligence. However, the applicants did not sue Veda on a cause of action on the statute, that is to say, for breach of an actionable statutory duty said to be owed to them by Veda. The parties agreed that Reprint 6 of that Act (reprinted on 20 January 2005) was the applicable version.
10 The Privacy Amendment Act 1990 (No 116 1990), which commenced on 24 September 1991, inserted new ss 18A and 18B into Pt III, and a new Pt IIIA (ss 18C to 18V) headed "Credit Reporting". The Privacy Amendment (Private Sector) Act 2000 (No 155 of 2000) inserted the heading "Division 5 - Credit Information" before ss 18A and 18B.
11 Section 3 of the Privacy Actprovides:
It is the intention of the Parliament that this Act is not to affect the operation of a law of a State or of a Territory that makes provision with respect to the collection, holding, use, correction, disclosure or transfer of personal information (including such a law relating to credit reporting or the use of information held in connection with credit reporting) and is capable of operating concurrently with this Act.
The applicants rely on this provision as showing an intention that the Privacy Act was not to exclude the operation of the laws of the States and Territories under which the causes of action in defamation and negligence exist.
12 The expression "personal information" is defined in s 6 to mean:
information or an opinion (including information or an opinion forming part of a database) whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.
13 Section 18A(1) referred to above provides:
The Commissioner must, by notice published in the Gazette, issue a Code of Conduct concerning:
(a) the collection of personal information for inclusion in individuals' credit information files; and
(b) the storage of, security of, access to, correction of, use of and disclosure of personal information included in individuals' credit information files or in credit reports; and
(c) the manner in which credit reporting agencies and credit providers are to handle disputes relating to credit reporting; and
(d) any other activities, engaged in by credit reporting agencies or credit providers, that are connected with credit reporting.
Section 6 states that the Commissioner is the Privacy Commissioner. The office of Privacy Commissioner is established by Pt IV of the Privacy Act.
14 Subsection (3) of s 18A requires the Commissioner, in preparing the code of conduct, to have regard to:
· the "Information Privacy Principles" and the provisions of Part IIIA;
· the "National Privacy Principles" and the provisions of Part IIIAA; and
· "the likely costs" to credit reporting agencies and credit providers of complying with the Code of Conduct.
The Information Privacy Principles are discussed at [61] below and the National Privacy Principles at [62] below.
15 Pursuant to s 18A, the Commissioner issued a Credit Reporting Code of Conduct in 1991 (Code). It became fully operational in February 1992. The Code supplements the provisions of Pt IIIA. Part 1 of the Code deals with "Credit reporting agencies" and Pt 2 with "Credit providers".
16 Section 18B provides that a credit reporting agency or credit provider must not do an act, or engage in a practice, that breaches the Code. Accordingly, a breach of the Code is a contravention of s 18B.
17 It is convenient now to address the definitions of some of the expressions used in ss 18A and 18B. They are also used throughout Pt IIIA discussed below.
18 Sections 6(1) and 11A of the Privacy Act define "credit reporting agency" for the purposes of that Act as a "corporation that carries on a credit reporting business". Section 6(1) defines "credit reporting business" to mean, relevantly:
a business or undertaking … that involves the preparation or maintenance of records containing personal information relating to individuals (other than records in which the only personal information relating to individuals is publicly available information), for the purpose of, or for purposes that include as the dominant purpose the purpose of, providing to other persons (whether for profit or reward or otherwise) information on an individual's:
(a) eligibility to be provided with credit; or
(b) history in relation to credit; or
(c) capacity to repay credit;
whether or not the information is provided or intended to be provided for the purposes of assessing applications for credit.
19 The word "record" is defined in s 6(1) to mean, inter alia, "a database (however kept)". The term therefore encompasses a computerised database of the kind that is maintained by Veda.
20 It is not in dispute that at all material times Veda was a corporation that carried on a credit reporting business and was therefore a credit reporting agency. It will be noted that the definition of "credit reporting business" is not limited by reference to the form in which the credit information is to be provided to other persons. It therefore embraces the provision of that information by the granting of access to a database containing the information. The granting by Veda of access to its database to credit providers who subscribe to its system forms the basis of the claims made in these proceedings.
21 The expression "credit", which occurs four times in the definition of "credit reporting business" set out at [18] above, is defined in s 6(1) to mean:
a loan sought or obtained by an individual from a credit provider in the course of the credit provider carrying on a business or undertaking as a credit provider, being a loan that is intended to be used wholly or primarily for domestic, family or household purposes.
Accordingly, the word "credit" may be conceived of as limited to consumer credit.
22 Similarly, s 6 (5A) of the Privacy Act provides:
For the purposes of the definition of credit reporting business in subsection (1), information concerning commercial transactions engaged in by or on behalf of an individual is not to be taken to be information relating to an individual's:
(a) eligibility to be provided with credit; or
(b) history in relation to credit; or
(c) capacity to repay credit.
23 Section 6(1) defines "commercial credit" to mean a loan other than a loan of a kind referred to in the definition of "credit". The Privacy Act therefore distinguishes between "credit" and "commercial credit", the former being a loan for consumer purposes and the latter being a loan of any other kind. It therefore seems appropriate to refer to an individual to whom "credit" has been provided as a "consumer", although the Privacy Act does not use that term.
24 It follows from the definition of "credit" that credit does not mean a loan sought or obtained by a corporation, or a loan sought or obtained by an individual from an entity other than a credit provider, or a loan sought or obtained by an individual (a natural person) from a credit provider but for commercial purposes. Although the Privacy Act is concerned with consumer credit, this does not mean that the provision of commercial credit is irrelevant to these proceedings. In particular, some of the defaults that were entered in Veda's database in respect of some of the applicants were defaults under commercial credit arrangements (see [70] ff below).
25 The expression "loan" is defined in s 6(1) to mean a contract, arrangement or understanding under which a person is permitted to defer payment of a debt, or to incur a debt and defer its payment. The definition also identifies particular forms of transaction that are included within the term "loan".
26 Sections 6(1) and 11B define "credit provider". Relevantly, a "credit provider" includes (s 11B):
(a) a bank; or
(b) a corporation (other than an agency):
(iii) a substantial part of whose business or undertaking is the provision of loans (including the provision of loans by issuing credit cards); or
(iv) that carries on a retail business in the course of which it issues credit cards to members of the public in connection with the sale of goods, or the supply of services, by the corporation; or
(v) that:
(A) carries on a business or undertaking involving the provision of loans (including the provision of loans by issuing credit cards); and
(B) is included in a class of corporations determined by the Commissioner to be credit providers for the purposes of this Act; ...
27 I turn now to Part IIIA (ss 18C-18V) "Credit reporting"
28 Section 18E(1) provides that a credit reporting agency must not include personal information in an individual's credit information file unless at least one of the conditions set out in the various paragraphs of that subsection is satisfied. Those conditions that are of immediate relevance are the following:
(b) the information is a record of:
(i) both
(A) a credit provider having sought a credit report in relation to an individual in connection with an application for credit or commercial credit made by the individual to the credit provider; and
(B) the amount of credit or commercial credit sought in the application; or
…
(vi) credit provided by a credit provider to an individual, being credit in respect of which:
(A) the individual is at least 60 days overdue in making a payment, including a payment that is wholly or partly a payment of interest; and
(B) the credit provider has taken steps to recover the whole or any part of the amount of credit (including any amounts of interest) outstanding; or
(vii) a cheque, for an amount not less than $100, that:
(A) has been drawn by the individual; and
(B) has twice been presented and dishonoured; or
(viii) court judgments made against the individual; or
(ix) bankruptcy orders made against the individual; or
(x) the opinion of a credit provider that the individual has, in the circumstances specified, committed a serious credit infringement; or
(ba) the information is a record of an overdue payment by the individual as guarantor under a guarantee given against default by a person (the borrower) in repaying all or any [sic - any part] of an amount of credit obtained by the borrower from a credit provider, and the following subparagraphs apply:
(i) the credit provider is not prevented under any law of the Commonwealth, a State or a Territory from bringing proceedings against the individual to recover the amount of the overdue payment;
(ii) the credit provider has given the individual notice of the borrower's default that gave rise to the individual's obligation to make the payment;
(iii) 60 days have elapsed since the day on which the notice was given;
(iv) the credit provider has, separately from and in addition to the giving of the notice referred to in subparagraph (ii), taken steps to recover the amount of the overdue payment from the individual.
Of the nine applicants, Mr McGary and Ms Shields were guarantors, and therefore persons to whom para (ba) was relevant. Paragraph (b) was relevant to the remaining seven applicants.
29 The Code elaborates on subpara (b)(i) of s 18E(1) by stating that a credit reporting agency recording an enquiry made by a credit provider in connection with an application for credit may include, within the record of the enquiry, a general indication of the nature of the credit being sought. Veda's database recorded enquiries made by credit providers in connection with applications to them for consumer credit or commercial credit by the applicants.
30 The expression "credit information file" is defined in s 6(1) to mean:
In relation to an individual, … any record that contains information relating to the individual and is kept by a credit reporting agency in the course of carrying on a credit reporting business (whether or not the record is a copy of the whole or part of, or was prepared using, a record kept by another credit reporting agency or any other person).
I referred to the definitions of "record" at [19] above and "credit reporting agency" at [18] above.
31 The expression "serious credit infringement" is defined in s 6(1) to mean:
"… an act done by a person:
(a) that involves fraudulently obtaining credit, or attempting fraudulently to obtain credit; or
(b) that involves fraudulently evading the person's obligations in relation to credit, or attempting fraudulently to evade those obligations; or
(c) that a reasonable person would consider indicates an intention, on the part of the first‑mentioned person, no longer to comply with the first‑mentioned person's obligations in relation to credit."
Paragraph (c) assumed importance because Veda, and therefore its subscribing credit providers, characterised the act of any individual who had left his or her last known address and could not, after reasonable efforts, be located by the credit provider, as falling within that paragraph.
32 Section 18E(2) provides that a credit reporting agency must not include in an individual's credit information file personal information relating to, relevantly at para (f), the individual's lifestyle, character or reputation.
33 Section 18E(8) provides:
A credit provider must not give to a credit reporting agency personal information relating to an individual if:
(a) a credit reporting agency is prohibited, under subsection (1), from including the information in the individual's credit information file; or
(b) the credit provider does not have reasonable grounds for believing that the information is correct; or
(c) the credit provider did not, at the time of, or before, acquiring the information, inform the individual that the information might be disclosed to a credit reporting agency.
34 Certain aspects of the effect of the provisions of s 18E in the circumstances of the present cases are noteworthy. First, the obligation that s 18E(1) imposes on the credit reporting agency is absolute, even though the credit reporting agency will not ordinarily know the facts of the dealings between the credit provider and the consumer (hence, the "primary" obligation imposed on the credit provider by s 18E(8)).
35 Second, under s 18E(1) the relevant time is the time when the credit provider enters the personal information in Veda's database. Under subpara (b)(vi), for example, at that time the personal information must be information that is a record of (consumer) credit that was provided by the credit provider to the individual in respect of which, as at that time, the individual is at least sixty days overdue in making a payment and the credit provider has taken "steps" to recover the whole or any part of the amount of the credit. In the ordinary course, the credit reporting agency will have no way of knowing whether these conditions are satisfied.
36 Third, under subpara (b)(x), at the time of listing, the information must be a record of an opinion then held by the credit provider who entered the information in Veda's database that the individual has, in the circumstances specified in the information entered, committed a "serious credit infringement" as defined in s 6(1) (see the definition of "serious credit infringement" set out at [31] above). In the ordinary course, the credit reporting agency will have no way of knowing whether the credit provider did hold the opinion described in s 18E(1)(b)(x).
37 Fourth, under para (ba), at the time of listing, the personal information must be a record of an overdue payment by the individual as guarantor under a guarantee given against a default by a borrower in repaying all or any part of an amount of consumer credit obtained by the borrower from a credit provider, and all four of the circumstances identified in subparas (i)-(iv) of para (ba) must be satisfied. These include the lapse of sixty days since the day on which the credit provider gave the guarantor notice of the consumer's default and the taking by the credit provider of other steps to recover the amount of the overdue payment from the guarantor. Again, in the ordinary course the credit reporting agency will have no way of knowing if these conditions are satisfied.
38 It is important to recall s 6(1)'s definition of "personal information" (see [12] above). It refers to information whether true or not. The reference to the "information" in the opening words of paras (b) and (ba) of s 18E(1) is a reference back to the "personal information" mentioned in the chapeau to that subsection. The word "record" in paras (b) and (ba) does not, therefore, imply correctness. Accordingly, what paras (b) and (ba) except from the general prohibition in s 18E(1) is information, true or false, that satisfies a description in those paragraphs. That is to say, paras (b) and (ba) are directed to kinds, classes or categories of information, whether the actual information is true or false.
39 Section 18E(1) prohibited Veda from including in its database kinds of information falling outside the kinds described in, relevantly, subpara (b)(vi) and (b)(x) and para (ba) of that subsection. If information, even information that proved to be false, was of those kinds, s 18E(1) did not prohibit Veda from including it in its database.
40 This construction of s 18E(1) is consistent with Veda's lack of means of knowledge of the true facts and with the more extensive obligation imposed on credit providers by s 18E(8) referred to above. It is also consistent with the nature of the obligations respectively imposed on credit reporting agencies and credit providers by ss 18F, 18G and 18J referred to below.
41 The Code provides in cl 1.3 as follows:
To ensure that only permitted information is included in a credit information file, a credit reporting agency must take the following steps:
(a) Where a credit reporting agency receives information from a credit provider for creation of, or inclusion in, a credit information file, and it appears to the credit reporting agency that the information being supplied by the credit provider may not be permitted to be included in a credit information file, the credit reporting agency must:
(i) refuse to accept the information; and
(ii) notify the credit provider, in writing, that the inclusion of the information may be in breach of the Act.
(b) Where a credit reporting agency becomes aware that information supplied by a credit provider and included in a credit information file appears to be of a type not permitted to be included in the file, the credit reporting agency must:
(i) remove the information from the credit information file;
(ii) notify the credit provider in writing that the information may not be permitted to be included in the file; and
(iii) make a written record of its actions in relation to (i) and (ii) above.
Clause 1.3(a) would be enlivened if, for example, it appeared to a credit reporting agency that the information supplied to it by the credit provider may not be of a permitted kind (cf s 18E(1) set out at [28] above). It is an interesting question whether cl 1.3(a) would also be enlivened if it appeared to a credit reporting agency that the credit provider may be prohibited from giving it the information by s 18E(8)(b) or (c).
42 Clause 1.3(b) is concerned with information already included in a credit information file that appears to the credit reporting agency not to be of a kind permitted to be included, and is therefore referable to the obligation imposed directly on the credit reporting agency by s 18E(1) (see [28]-[40] above).
43 Clause 1.4 (discussed at [58] below) expressly addresses the inaccuracy of information in the special circumstances described in that clause.
44 Section 18F(1) provides that a credit reporting agency must delete from an individual's credit information file maintained by the agency any personal information of a kind referred to in, relevantly, s 18E(1)(b), within one month after the end of the maximum permissible period for the keeping of personal information of that kind. Subsection (2) of s 18F defines the "maximum permissible period". For s 18E(1)(b)(vi) information, the period is five years, for s 18E(1)(b)(x) information it is seven years, and for s 18E(1)(ba) information it is five years. The commencement date varies according to the category.
45 Subsection (3) of s 18F obliges a credit provider who has given information to a credit reporting agency that an individual is overdue in making a payment in respect of credit provided by the credit provider, "as soon as practicable" to inform the agency once the individual has ceased to be overdue in making the payment or contends that he or she is not overdue in making it. On being so informed, the credit reporting agency must include in the individual's credit information file a note to that effect: subs (4).
46 Subsection (5) of s 18F provides that where a credit provider ceases to be a current credit provider in relation to an individual, the credit provider must, as soon as practicable, give notice of that cessation to any credit reporting agency that was previously informed that the credit provider was a current credit provider in relation to the individual.
47 Section 18G provides:
A credit reporting agency in possession or control of a credit information file, or a credit provider or credit reporting agency in possession or control of a credit report, must:
(a) take reasonable steps to ensure that personal information contained in the file or report is accurate, up-to-date, complete and not misleading; and
(b) ensure that the file or report is protected, by such security safeguards as are reasonable in the circumstances, against loss, against unauthorised access, use, modification or disclosure, and against other misuse; and
(c) if it is necessary for the file or report to be given to a person in connection with the provision of a service to the credit reporting agency or credit provider, ensure that everything reasonably within the power of the credit reporting agency or credit provider is done to prevent unauthorised use or disclosure of personal information contained in the file or report.
Clearly, what are "reasonable steps" of the kind referred to in para (a) will depend on all the circumstances, including the respective roles played by credit provider and credit reporting agency.
48 The expression "credit report" is defined in s 6(1) of the Privacy Act to mean:
any record or information, whether in a written, oral or other form, that:
(a) is being or has been prepared by a credit reporting agency; and
(b) has any bearing on an individual's:
(i) eligibility to be provided with credit; or
(ii) history in relation to credit; or
(iii) capacity to repay credit; and
(c) is used, has been used or has the capacity to be used for the purpose of serving as a factor in establishing an individual's eligibility for credit.
It is not necessary that Veda send a record or information to its subscribing credit providers before it can be said to have supplied them with a credit report. By reference to the definition of "record" as being, inter alia, a database, if Veda "prepares" its database or information and grants access to it to its subscribers, it is in control or possession of a "credit report". Veda does "prepare" the record (database) or information in question. The record or information that an accessing credit provider obtains is not simply that which another credit provider fed into the database. It is a body of data supplied by credit providers (virtually always in the plural) which Veda's computer system has combined and arranged in a composite report. The data will have been entered by subscribers, but Veda, through its computer system, will have composed the data into a new form.
49 Section 18H is directed to ensuring that an individual can obtain access to a credit information file or a credit report concerning him or her. A credit reporting agency in possession or control of such a file must take reasonable steps to ensure that the individual can obtain access to it (s 18H(1)). Similarly, s 18H(2) requires a credit provider or a credit reporting agency that is in possession or control of such a credit report containing personal information concerning an individual to take all reasonable steps to ensure that the individual can obtain access to the report.
50 Finally, subs (3) provides that an individual's rights of access under subs (1) and subs (2) may also be exercised by a person (other than a credit provider, mortgage insurer or trade insurer) authorised in writing by the individual to exercise those rights on his or her behalf in connection with:
(a) an application, or a proposed application, by the individual for a loan; or
(b) the individual having sought advice in relation to a loan.
A company named DR Capital Pty Ltd (DR Capital), which carried on a business of representing persons in their dealings with credit reporting agencies and credit providers, was so authorised by the nine applicants. Richard George Symes, a director of DR Capital, gave evidence in support of the applicants' claims.
51 Section 18J is directed to ensuring that credit information files and credit reports are amended to reflect the true position as known. Subsection (1) of s 18J provides:
A credit reporting agency in possession or control of a credit information file, or a credit provider or credit reporting agency in possession or control of a credit report, must take reasonable steps, by way of making appropriate corrections, deletions and additions, to ensure that the personal information contained in the file or report is accurate, up-to-date, complete and not misleading.
Subsection (2) of s 18J provides that where an individual requests a credit reporting agency or credit provider to make a correction, deletion or addition to personal information contained in a credit information file or credit report but the credit reporting agency or credit provider does not do so, and the individual requests the credit reporting agency or credit provider to include in the file or report a statement provided by the individual of a correction, deletion or addition sought by him or her, the credit reporting agency or credit provider must take reasonable steps to include the statement that has been provided by the individual in the file or report within 30 days after being requested to do so.
52 Section 18K imposes limits on disclosure of personal information by credit reporting agencies. Relevantly, s 18K(1) provides that a credit reporting agency that is in possession or control of an individual's credit information file must not disclose personal information contained in the file (disclosure to the individual is excepted) unless:
(a) the information is contained in a credit report given to a credit provider who requested the report for the purpose of assessing an application for credit made by the individual to the credit provider; or
(ab) … ;or
(ac) …; or
(b) the information is contained in a credit report given to a credit provider who requested the report for the purpose of assessing an application for commercial credit made by a person to the credit provider, and the individual to whom the report relates has specifically agreed to the report being given to the credit provider for that purpose; or
…
(my emphasis)
As indicated earlier, by allowing its subscribers access to its database, Veda did, in my view, give "credit reports" to them for the purposes of the Privacy Act. Paragraph (a) refers to an application for consumer credit. In that case the prior consent of the individual to disclosure is not required. Paragraph (b) refers to an application for commercial credit. In that case the individual's prior consent to disclosure is required, and subs (1A) of s 18K provides that the individual's consent must be in writing unless a certain exception applies.
53 To be distinguished from s 18K(1) is s 18E(8)(c) referred to at [33] above. One effect of s 18E(8) is that a credit provider must not list a default, whether a consumer default or a commercial default, unless the conditions set out in that subsection are met. One of these is that the credit provider informed the individual, before obtaining information from him or her that, relevantly, a default might be listed with a credit reporting agency. No doubt a desirable precaution would be to obtain the individual's signed acknowledgment and consent. Apparently this practice is followed by some credit providers. Section 18K(1), on the other hand, is concerned with disclosure by credit reporting agencies, and requires, as one alternative, the individual's specific consent to a disclosure to a credit provider to whom the individual has applied for commercial credit.
54 Subsection (2) of s 18K prohibits a credit reference agency from disclosing personal information where, generally speaking, the credit reporting agency would be prohibited by s 18E from including the information in the individual's credit information file, or would be required by s 18F to delete it from that file.
55 Subsection (4) of s 18K provides that a credit reporting agency that intentionally contravenes, relevantly, subs (1) or (2) of s 18K, is guilty of an offence punishable, on conviction, by a fine not exceeding $150,000.
56 Section 18M provides that if a credit provider refuses an application by an individual for credit and the refusal is based wholly or partly on information derived from a credit report relating to that individual that a credit reporting agency has supplied, the credit provider must give the individual a written notice stating that the application has been refused; that the refusal was so based; the name and address of the credit reporting agency; and that the individual has a right under the Privacy Act to obtain access to his or her credit information file maintained by the credit reporting agency.
57 Section 18R of the Privacy Act provides:
(1) A credit reporting agency or credit provider must not give to any other person or body (whether or not the other person or body is a credit reporting agency or credit provider) a credit report that contains false or misleading information.
(2) A credit reporting agency or credit provider that intentionally contravenes subsection (1) is guilty of an offence punishable, on conviction, by a fine not exceeding $75,000.
Section 18R(1) imposes an absolute obligation on Veda not to make available to its enquiring credit providers information contained in its database that is "false or misleading". On its face, this provision is to be contrasted with the qualified obligations imposed on the credit reporting agencies by ss 18E(1) and 18G discussed above. However, the provision raises a question of whether information contained in an extract from Veda's database is false or misleading where the enquiring credit provider, being also a subscriber to Veda's system, understands the information to be, and it is in fact, an accurate reproduction of information that had been fed into that database by other subscribing credit providers. Contravention of s 18R(1) is an offence only if that subsection is contravened intentionally.
58 Clause 1.4 of the Code provides:
Where a credit reporting agency:
(a) becomes aware that information supplied by a credit provider relating to an overdue payment or a serious credit infringement may be inaccurate; and
(b) reasonably believes that other credit information files may contain similar inaccurate listings, the credit reporting agency must, as soon as practicable:
(i) notify the credit provider concerned, in writing, that it may have listed an inaccurate overdue payment or serious credit infringement against the individual concerned;
(ii) request the credit provider to ascertain whether other individuals' credit information files may be similarly affected, and to investigate the accuracy of any overdue payment or serious credit infringement listing in those other individuals' files; and
(iii) advise the Privacy Commissioner in writing of the above actions.
Clause 1.4 may be compared with cl 1.3 of the Code discussed at [41]-[42] above.
59 In the present cases, Veda became aware that listed particulars of defaults may have been inaccurate as a result of challenges made to their accuracy by the individuals concerned or by DR Capital on their behalf. The gravamen of the applicants' complaint is not that Veda did not respond appropriately or with sufficient speed to the challenges. Their complaint is in respect of the listing of the defaults at all. In any event, any tardiness on the part of Veda would assume relevance only in relation to an inaccurate listing.
60 It remains to refer to the "Information Privacy Principles" and the "National Privacy Principles".
61 The Information Privacy Principles are the privacy principles numbered 1 to 11 set out in s 14 of the Privacy Act. I will not set them out here. Section 13 provides, relevantly, that for the purposes of the Privacy Act, an act or practice is an interference with the privacy of an individual if the act or practice, in the case of an act or practice engaged in by, relevantly a credit reporting agency or credit provider, breaches an Information Privacy Principle in relation to personal information that relates to the individual.
62 The National Privacy Principles are set out in Schedule 3 to the Privacy Act. They impose obligations on "organisations". Section 6C of the Privacy Act defines an "organisation" to mean relevantly, a body corporate that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State or Territory. The expression "agency" is defined in s 6 and does not include either a credit reporting agency or a credit provider. The National Privacy Principles therefore apply to Veda: it is an organisation and is not within the exclusion. I will not set out the National Privacy Principles here.
63 Part V (ss 36-70B) of the Privacy Act is headed "Investigations". Section 36, the first section in Div 1 (ss 36-51) in Pt V, provides, relevantly, that, subject to exceptions, an individual may complain to the Commissioner about an act or practice that may be an interference with the privacy of the individual. Clause 3.2 of the Code provides that where a credit reporting agency is unable to resolve a dispute, it must immediately inform the individual concerned of this fact and of the fact that the individual may complain to the Commissioner.
64 Section 40(1) provides that subject to subs (1A), the Commissioner must investigate an act or practice if:
(a) the act or practice may be an interference with the privacy of an individual; and
(b) a complaint about the act or practice has been made under section 36.
Subsection (1A), however, provides that the Commissioner must not so investigate a complaint if the complainant did not first complain to the respondent, unless the Commissioner decides that it was not appropriate for the complainant to complain to the respondent first.
65 Section 41(1) provides, relevantly, that the Commissioner may decide not to investigate, or not to investigate further, an act or practice about which complaint has been made under s 36 if the Commissioner is satisfied that:
(a) ... ;
[there is no (b)]
(c) ... ;
(d) ... ;
(e) the act or practice is the subject of an application under another Commonwealth law, or a State or Territory law, and the subject-matter of the complaint has been, or is being, dealt with adequately under that law; or
(f) another Commonwealth law, or a State or Territory law, provides a more appropriate remedy for the act or practice that is the subject of the complaint.
66 The first section in Div 2 (ss 52-53B) of Pt V, s 52 provides, relevantly, as follows:
(1) After investigating a complaint, the Commissioner may:
(a) make a determination dismissing the complaint; or
(b) find the complaint substantiated and make a determination that includes one or more of the following:
(i) a declaration:
(A) …
(B) … - that the respondent has engaged in conduct constituting an interference with the privacy of an individual and should not repeat or continue such conduct;
(ii) a declaration that the respondent should perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant;
(iii) a declaration that the complainant is entitled to a specified amount by way of compensation for any loss or damage suffered by reason of the act or practice the subject of the complaint;
(iv) a declaration that it would be inappropriate for any further action to be taken in the matter.
(1A) The loss or damage referred to in paragraph (1)(b) includes injury to the complainant's feelings or humiliation suffered by the complainant.
(1B) A determination of the Commissioner under subsection (1) is not binding or conclusive between any of the parties to the determination.
(2) …
(3) …
(3A) …
(3B) A determination may include an order that:
(a) an agency or respondent make an appropriate correction, deletion or addition to a record, or to a credit information file or credit report, as the case may be; or
(b) …
67 Division 3 (ss 54-55B) of Pt V provides for enforcement of determinations made under s 52. Section 55 provides:
Determination under section 52
(1) An organisation that is the respondent to a determination made under section 52:
(a) must not repeat or continue conduct that is covered by a declaration that is included in the determination under sub-subparagraph 52(1)(b)(i)(B); and
(b) must perform the act or course of conduct that is covered by a declaration that is included in the determination under subparagraph 52(1)(b)(ii).
Determination under approved privacy code
(2) An organisation that is the respondent to a determination made under an approved privacy code:
(a) must not repeat or continue conduct that is covered by a declaration that is included in the determination and that corresponds to a declaration mentioned in paragraph (1)(a); and
(b) must perform the act or course of conduct that is covered by a declaration that is included in the determination and that corresponds to a declaration mentioned in paragraph (1)(b).
68 Section 55A provides for proceedings in this Court or the Federal Magistrates Court of Australia to enforce a determination. The section provides in subs (1) for the persons who may commence proceedings for an order to enforce a determination. They include the complainant and, if the determination was made under s 52, the Commissioner. Section 55A provides in subss (2)-(5) as follows:
(2) If the court is satisfied that the respondent has engaged in conduct that constitutes an interference with the privacy of the complainant, the court may make such orders (including a declaration of right) as it thinks fit.
(3) The court may, if it thinks fit, grant an interim injunction pending the determination of the proceedings.
(4) The court is not to require a person, as a condition of granting an interim injunction, to give an undertaking as to damages.
(5) The court is to deal by way of a hearing de novo with the question whether the respondent has engaged in conduct that constitutes an interference with the privacy of the complainant.
69 As appears at [90] ff below, I do not find it necessary to address the question whether the provisions in Pt V of the Privacy Act noted above are inconsistent with the continued subsistence of causes of action in defamation and negligence. The provisions are relevant, however, to Veda's contention that the common law did not impose on Veda a duty of care in respect of the accuracy of default listings (see [374] ff below).