Privacy (Credit Related Research) Rule 2024

The Rule centres on a small set of definitional and operational concepts taken from, and linked to, the Privacy Act. Key defined terms in the Rule itself are Aggregated results and De-identified information, and the Rule otherwise adopts the Privacy Act definitions for other relevant expressions (s 4(1) and the Note to s 4).

• De-identified information: defined in the Rule as "credit reporting information that is no longer about an identifiable individual or an individual who is reasonably identifiable" (s 4(2)). That definition tracks the privacy concept of removal of identifiability as a condition for treating information as de-identified.

• Aggregated results: defined as research analysis results that "does not include the individual elements of the de-identified credit reporting information and cannot readily be disaggregated to extract or re-identify that de-identified credit reporting information" (s 4(2)). The Rule treats Aggregated results differently for onward disclosure (s 9(3)).

• Permitted purpose: s 7 enumerates discrete permitted research purposes in relation to credit: assessment or management of current and development of new credit services (s 7(a)); developing methodologies to combat fraud, anti‑money laundering, counter terrorism financing and other unlawful activity involving credit (s 7(b)); assisting responsible lending obligations and other consumer protections (s 7(c)); and "any other purpose for the general benefit of the public" (s 7(d)). The Rule thus limits permitted research to purposes that are presented as credit‑related or broadly public‑benefit.

Operational duties appear in the de-identification provisions (s 8), the disclosure provisions (s 9), and the openness requirement (s 10). The de-identification duties require a credit reporting body to assess the risk of re-identification "either by itself or by the recipients of the de-identified information", to use that risk assessment to determine appropriate technique(s), and to take reasonable steps to ensure the de-identified information cannot be re-identified (s 8(1)(a)-(c)). After de-identifying, a credit reporting body must not re-identify or attempt to re-identify (s 8(2)(a)) and must destroy information if re-identified unintentionally (s 8(2)(b)), subject to a statutory carve‑out where re-identification is required by Australian law or a court/tribunal order (s 8(3)). The disclosure duties require that recipients have an Australian link (s 9(1)), and require the disclosing credit reporting body to take reasonable steps to ensure recipients do not re‑identify, destroy if unintentionally re‑identified, and do not further disclose (s 9(2)), subject to the Aggregated results exception (s 9(3)). The openness requirement compels an explicit statement in the credit reporting body's policy on de‑identified information management that de‑identified information is used or disclosed for credit research (s 10).

The Rule is an instrument made under the Privacy Act to operationalise the exception in s 20M. The Rule does not itself define the enforcement or penalty mechanisms; rather the Rule conditions the statutory exception on compliance with these operational requirements (s 3).

The Rule applies to credit reporting bodies, as that term is used and defined in the Privacy Act (s 4(1) referencing the Privacy Act definitions). The primary obligations fall on credit reporting bodies that wish to use or disclose de-identified credit reporting information for research in relation to credit (s 6). That group will therefore bear the costs of legal compliance work, de-identification processes, risk assessments and policy amendments.

Secondary effects reach entities that receive de-identified information from credit reporting bodies. Before disclosure, a credit reporting body must take steps to ensure the recipient has an Australian link (s 9(1)) and that the recipient will not re-identify, will destroy information if unintentionally re-identified, and will not disclose the de‑identified information to others (s 9(2)). Recipients with an Australian link therefore acquire statutory duties as a condition of receiving the de-identified information, even though the Rule's direct legal obligation is framed as one on the credit reporting body to ensure the recipient satisfies those conditions.

Consumers whose credit reporting information is de-identified are affected indirectly. The Rule addresses the conditions under which their de-identified credit data may be used and disclosed for research purposes (s 6). The Rule also places a public‑facing openness requirement on credit reporting bodies to state that such use or disclosure occurs (s 10), thereby creating an information flow to consumers via an existing policy channel.

Other affected parties include research entities and service providers that work with credit reporting bodies. Where those third parties receive de-identified information, the Rule requires a pre-disclosure enquiry into the recipient's Australian link and assurances about handling and non‑reidentification (s 9). The inclusion of an Aggregated results exception for onward disclosure (s 9(3)) creates a distinct downstream pathway for research results, which may affect how research collaborations are structured.

Finally, the repeal in Schedule 1 removes the previous Privacy (Credit Related Research) Rule 2014 in its entirety, so any entities operating under the 2014 Rule must transition to compliance with this new Rule when it commences (Schedule 1 item 1).

The Rule creates a limited right for a credit reporting body to use or disclose de-identified credit reporting information for research in relation to credit, but this right is conditional on several duties.

Core conditional right

• The ability to use or disclose de-identified credit reporting information is available only where three cumulative conditions are met: the information has been de-identified, the use/disclosure is for the purpose of conducting research in relation to credit, and the purpose is a permitted purpose in s 7 (s 6). This is framed as operating "for the purposes of section 20M" of the Privacy Act, which otherwise prohibits such use or disclosure (s 3).

De-identification duties (s 8)

• A credit reporting body must assess the risk of re-identification either by itself or by the recipients (s 8(1)(a)). This is an affirmative assessment duty, and the Rule requires the assessment to inform technique selection (s 8(1)(b)).
• The credit reporting body must take steps that are reasonable in the circumstances to ensure the de-identified information cannot be re-identified (s 8(1)(c)). The standard is reasonableness contextualised by circumstances.
• After de-identifying, a credit reporting body must not re-identify or attempt to re-identify the de-identified information (s 8(2)(a)).
• If de-identified information is unintentionally re-identified, the credit reporting body must destroy it (s 8(2)(b)). An exception allows re-identification where required by Australian law or a court/tribunal order (s 8(3)).

Disclosure duties (s 9)

• The credit reporting body must not disclose de-identified information for a permitted purpose unless the recipient has an Australian link (s 9(1)).
• Before disclosure, the credit reporting body must take reasonable steps to ensure the recipient will not re-identify, will destroy if unintentionally re-identified, and will not further disclose (s 9(2)(a)-(c)). The prohibition on onward disclosure does not apply to Aggregated results (s 9(3)).

Openness duty (s 10)

• Each credit reporting body must include a statement in its policy on the management of de-identified information, in accordance with s 20B(3) of the Privacy Act, that it uses or discloses de-identified information for credit research (s 10). That creates a public transparency obligation tied to existing policy obligations under the Privacy Act.

Rights and constraints in practice

• The Rule grants a right to use or disclose de‑identified credit reporting information for specific research purposes, but that right is not absolute. It is constrained by operational duties requiring risk assessment, the adoption of reasonable de‑identification techniques, prohibitions on re‑identification, destruction obligations, and recipient conditions including an Australian link and non‑disclosure covenants (ss 6-9).
• The Rule also limits onward disclosure in most cases, reserving an exception for Aggregated results (s 9(3)) which may be disclosed beyond the initial recipient without triggering the onward-disclosure prohibition.

What the Rule does not specify

• The Rule specifies duties and a conditional right but does not itself set out enforcement mechanisms, penalties, or precise technical standards for de-identification. The Rule therefore leaves the content of "reasonable steps", "risk assessment", and "appropriate techniques" to be determined in context by the credit reporting body, potentially informed by external technical standards or guidance, but such guidance is not contained in the instrument itself.

The Rule imposes substantive obligations but does not itself set out explicit civil or criminal penalties, infringement notices, or administrative enforcement procedures within its text. Its legal effect is to create the conditions under which the statutory prohibition in section 20M of the Privacy Act does not apply (as explained in s 3). That framing means compliance with the Rule is determinative of whether a credit reporting body may lawfully use or disclose de‑identified credit reporting information under the Privacy Act exception. Conversely, failure to comply with the Rule's conditions would mean the statutory prohibition in section 20M remains engaged, but the Rule does not specify what sanctions follow a breach.

The instrument therefore operates through conditioning lawful authority rather than by itself prescribing enforcement pathways. The Rule repeatedly places affirmative duties on credit reporting bodies (ss 6-10). If an entity uses or discloses de‑identified credit reporting information without meeting the Rule's conditions, the credit reporting body would not fall within the s 20M(2)-(3) exception described in the Rule's purpose clause (s 3). The immediate legal effect set out by the Rule is that compliance with the Rule is a precondition for accessing the statutory exception. The Rule also creates duties on recipients insofar as the credit reporting body must take steps to ensure recipient compliance (s 9(2)), but the Rule frames those duties as duties the credit reporting body must ensure are satisfied.

The Rule references external legal constraints in two ways relevant to enforcement and compliance. First, s 8(3) recognises there may be circumstances in which re‑identification is required by Australian law or a court/tribunal order; in that case the prohibition on re‑identification in s 8(2)(a) does not apply. Second, s 10 requires a statement in the credit reporting body's policy "in accordance with s 20B(3)", linking the Rule's transparency requirement to an existing Privacy Act provision. The Rule does not itself provide an enforcement mechanism against recipients who breach the non‑reidentification or non‑disclosure conditions; it requires credit reporting bodies to take reasonable steps to ensure recipients comply (s 9(2)).

In short, the Rule is procedural and conditional: it defines conditions for lawful activity under the Privacy Act exception, but does not enumerate penalties or specify administrative enforcement processes in the instrument text. The Rule leaves remedy and sanctioning pathways to the broader statutory framework of the Privacy Act and any enforcement mechanisms contained there, while placing affirmative compliance responsibilities on credit reporting bodies.

The Rule is explicitly drafted to operate in relationship with the Privacy Act 1988. The preamble states the Rule is made under section 20M(3) of the Privacy Act and applies for the purposes of section 20M, which prohibits use or disclosure of de‑identified credit reporting information except where the use or disclosure is for credit research and the credit reporting body complies with rules made by the Commissioner (s 3). This linkage has several operational implications.

Incorporation of Privacy Act definitions

• The Rule adopts the Privacy Act's definitions for unspecified terms: "Unless this Rule states otherwise, any word or expression used in this Rule which is defined in the Privacy Act, has the same meaning as in that Act" (s 4(1)). The Note to s 4 identifies particular expressions defined in s 6(1) of the Privacy Act, including "credit reporting body", "credit reporting information", "Australian link", "court/tribunal order", and others. Consequently, the Rule relies on the Privacy Act for the meaning of several foundational terms.

Conditioning the s 20M exception

• The Rule operates as the instrument of conditions for the s 20M exception. It does not create a freestanding power to use or disclose de-identified information; rather compliance with the Rule is the statutory condition under which the prohibition in s 20M does not apply (s 3). Therefore the Rule functions as an adjunct to the Privacy Act, specifying how the exception may be satisfied.

Interaction with lawful compulsion and court orders

• The Rule includes an express carve‑out for situations where re‑identification is required by Australian law or a court/tribunal order (s 8(3)). The Rule therefore contemplates interaction with other legal obligations that might compel re‑identification and states that the prohibition on re‑identification does not apply in those circumstances.

Cross-border and jurisdictional linkage via Australian link

• The disclosure provision requires that a recipient have an Australian link (s 9(1)). Because "Australian link" is a term defined in the Privacy Act, the Rule delegates the assessment of cross‑border jurisdictional connection to the Privacy Act definition. The Australian link requirement narrows permissible recipients to those identified under the Privacy Act definition, thereby linking the Rule to broader cross‑border data transfer considerations embedded in the Act.

Policy obligations under the Privacy Act

• The Rule's openness requirement references "policy on the management of de-identified information, in accordance with s 20B(3)" (s 10). That cross‑reference ties the Rule's transparency obligation into the Privacy Act's existing policy‑making framework for credit reporting bodies.

Replacement of the 2014 Rule

• Schedule 1 repeals the Privacy (Credit Related Research) Rule 2014 in its entirety. Practically, this transition means entities previously operating under the 2014 instrument must now operate under this Rule and any interpretive or definitional differences will be governed by the 2024 text. The Rule itself does not set transitional mechanics; it simply repeals the prior instrument (Schedule 1 item 1).

Matters the Rule does not resolve

• The Rule sets standards using context‑sensitive language such as "reasonable in the circumstances" and requires risk assessments and appropriate techniques but does not itself set technical standards for de-identification, nor does it articulate how conflicts with other statutory data obligations beyond court orders should be reconciled. Those interactions will therefore be determined by reference to the Privacy Act, other statutory regimes, and potentially by courts or guidance issued by the Commissioner.

This instrument is the Privacy (Credit Related Research) Rule 2024. The Rule expressly repeals the prior Privacy (Credit Related Research) Rule 2014 in full (Schedule 1, item 1: "The whole of the instrument: Repeal the instrument"). The Rule therefore replaces the earlier legislative instrument governing the use and disclosure of de-identified credit reporting information for credit research.

The preamble records that the Rule was made by the Privacy Commissioner, Carly Kind, under section 20M(3) of the Privacy Act 1988 and dated 9 July 2024. The Rule's commencement is immediate upon registration on the Federal Register of Legislation (s 2).

No other amendments or historic modifications are contained within the instrument text. The Rule contains a standard Schedules clause that states each instrument specified in a Schedule is amended or repealed as set out in the applicable items in the Schedule, and that any other item in a Schedule has effect according to its terms (s 5). In the present instrument, Schedule 1 contains a single item repealing the 2014 Rule entirely, and no other schedules or amending items are included.

The Rule does not include transitional provisions, savings clauses, or staged implementation mechanisms in the instrument itself. It therefore appears to operate as a direct replacement of the 2014 Rule from the date of commencement. Entities that had arrangements or processes structured under the 2014 Rule should therefore review whether those existing processes meet the 2024 Rule's requirements around risk assessment, de‑identification technique selection, the Australian link requirement for recipients, destruction obligations on re‑identification, and the openness statement required by s 10.

Because the instrument does not set out a timetable for the repeal or transitional arrangements, the practical effect is that the 2014 Rule ceases to operate once the 2024 Rule commences, and compliance must be with the 2024 Rule's terms thereafter.

The instrument itself contains no record of litigation, and it does not cite or summarise any judicial or tribunal decisions. The text does, however, use defined terms drawn from the Privacy Act that include the expression "court/tribunal order" (s 4 note; referring to s 6(1) of the Privacy Act). The Rule also contemplates that a court or tribunal could require re‑identification in certain circumstances, creating a statutory exception to the Rule's prohibition on re‑identification obligations (s 8(3)). That reference indicates the Rule anticipates interaction with judicial or tribunal processes, but the instrument does not document any litigation applying or interpreting it.

Because the Rule replaces the Privacy (Credit Related Research) Rule 2014 (Schedule 1), past litigation, if any, under the 2014 Rule would not be recorded in this instrument. The Rule does not include an express saving clause preserving prior determinations or administrative decisions, nor does it include explicit transitional judicial or administrative handling provisions.

The absence of litigation history in the instrument has practical implications for legal certainty. The Rule establishes duties expressed in context‑dependent terms such as "reasonable in the circumstances", "appropriate technique or techniques", and "risk of re-identification". These terms are traditionally matters for factual and, where contested, judicial determination. The instrument therefore leaves potential disputes over the sufficiency of de‑identification methods, adequacy of risk assessments, and the proper content of recipient assurances to be resolved through compliance oversight by the Commissioner or by litigation, neither of which is elaborated in the Rule.

In short, the Rule contains no reported litigation history, and it does not set out mechanisms for adjudicating disputes over compliance beyond what is available under the Privacy Act and general judicial processes. Entities planning to rely on the Rule should therefore anticipate that questions of compliance may be subject to future administrative action or judicial interpretation, but details of such litigation are not contained in the instrument.

The Rule contains a number of drafting features that create practical traps for credit reporting bodies and for recipients of de-identified information. The following points identify places where obligations, delegations, or exceptions may produce unintended legal or operational consequences if they are not carefully managed.

Shared or shifting responsibility for risk assessment

• Section 8(1)(a) requires a credit reporting body to "assess the risk of re-identification ... either by itself or by the recipients of the de-identified information." The phrasing allows a credit reporting body to rely on the recipient to perform the risk assessment, but s 9(2) then requires the credit reporting body to take reasonable steps to ensure the recipient does not re-identify and will destroy if re-identified. That creates a potential coordination gap: if the credit reporting body delegates the risk assessment to the recipient, the credit reporting body nonetheless remains responsible for ensuring the recipient's subsequent compliance steps. Practically, the credit reporting body will need documented proof of the recipient's assessment and commitments to satisfy the s 9(2) obligations.

Ambiguity of "reasonable in the circumstances" and "appropriate technique or techniques"

• The Rule repeatedly uses contextually qualified standards: take "such steps as are reasonable in the circumstances" to ensure non‑reidentifiability (s 8(1)(c)), and use the risk assessment to determine "the de-identification technique or techniques appropriate to the circumstances" (s 8(1)(b)). There is no technical definition in the Rule of what techniques are "appropriate" or what steps are "reasonable", leaving the credit reporting body to make judgments that may be second‑guessed by the Commissioner or a court. This ambiguity increases compliance risk because technical standards and threats of re‑identification evolve.

The Australian link requirement and cross‑border research collaborations

• Section 9(1) prohibits disclosure unless the recipient has an Australian link. The Rule does not define "Australian link" itself but relies on the Privacy Act's definition (s 4(1) and Note). Entities planning international research collaborations must therefore assess whether partner entities meet the Privacy Act's Australian link test. Because the Rule itself does not set out mechanisms for cross‑border protections or put explicit equivalence frameworks in place, international transfers may be constrained.

Onward disclosure prohibition and Aggregated results exception

• Section 9(2)(c) requires the credit reporting body to ensure recipients "does not disclose the de-identified information to any other entity." Section 9(3) then carves out Aggregated results from that prohibition. The drafting therefore distinguishes between de‑identified datasets and aggregated research outputs. A practical pitfall arises if recipients derive hybrid outputs that contain aggregated statistics yet retain disclosable granular elements. Determining whether an output is an Aggregated result under the Rule is fact specific, and the Rule provides only a functional definition (s 4(2)) that such results "do not include the individual elements" and "cannot readily be disaggregated to extract or re-identify" the underlying de‑identified information. Failure to properly assess whether an output meets that threshold could expose a credit reporting body to claims that it did not satisfy the s 9(2)(c) obligation.

Destruction obligations on unintentional re-identification, and limited statutory carve-out

• Sections 8(2)(b) and 9(2)(b) require destruction if the information is unintentionally re-identified. But s 8(3) allows re-identification where required by Australian law or a court/tribunal order. The Rule therefore contemplates that legal compulsion may override the destruction obligation. Entities must therefore be prepared to navigate three competing imperatives: the Rule's destruction duty, legal compulsion to produce identifiable data, and the credit reporting body's other statutory obligations. This raises operational complexity in responding to statutory notices or orders.

Openness statement linked to s 20B(3)

• Section 10 requires inclusion of a statement in the credit reporting body's policy on the management of de-identified information, "in accordance with s 20B(3)". The Rule therefore ties its transparency requirement to an existing Privacy Act obligation, but the Rule does not itself reproduce s 20B(3) or specify the content or location of the policy. Credit reporting bodies must therefore ensure their policies comply with both the Privacy Act provision and the Rule's specific statement requirement.

No technical standards or record-keeping requirements

• The Rule mandates actions and assessments but includes no explicit record-keeping obligations or detailed technical de‑identification standards. This absence is a practical gotcha: if a credit reporting body is later required to demonstrate that it took "reasonable steps" or used "appropriate techniques", the lack of mandated documentation in the Rule means the credit reporting body will need to rely on internal governance, contracts, and contemporaneous evidence to establish compliance.

Full repeal of the 2014 Rule with no transitional guidance

• Schedule 1 repeals the 2014 Rule in full. There is no transitional regime in this instrument. Entities that structured arrangements or contractual templates around the 2014 Rule will need to map how those arrangements align with the new Rule and where modifications to contractual terms, data transfer agreements, or research protocols are necessary.

The Rule prescribes a sequence of concrete steps and decision points. The compliance pathway below follows the Rule's structure and cites the relevant provisions. The Rule does not mandate technical de‑identification standards or specific documentation, but it does require that actions be reasonable in the circumstances and that certain preconditions be met prior to use or disclosure.

1. Confirm you are a credit reporting body and that the information is credit reporting information

• The Rule applies to credit reporting bodies as defined in the Privacy Act (s 4(1)). Confirm that the dataset falls within the scope of "credit reporting information" under the Privacy Act before applying the Rule.

2. Establish that the research purpose is within the Rule's permitted purposes (s 6, s 7)

• Before any use or disclosure, determine whether the proposed research is "research in relation to credit" and whether its purpose fits one of the permitted purposes listed in s 7: assessment or development of credit services (s 7(a)); developing methodologies to combat fraud, AML, CTG and other unlawful activity involving credit (s 7(b)); assisting responsible lending obligations and consumer protections (s 7(c)); or another purpose for the general benefit of the public (s 7(d)). If the purpose does not align with s 7, the s 20M prohibition remains engaged.

3. De‑identify the information consistent with s 8

• Carry out a risk assessment of re-identification "either by itself or by the recipients" (s 8(1)(a)). If assessing risk by the recipient, obtain evidence that the recipient has performed the assessment and the results of that assessment to satisfy s 8(1)(a) obligations.
• Use the risk assessment to determine the de‑identification technique or techniques "appropriate to the circumstances" (s 8(1)(b)). Select techniques and document rationale linking technique choice to the specific re‑identification risks identified.
• Take such steps as are reasonable in the circumstances to ensure the de‑identified information cannot be re‑identified (s 8(1)(c)). Practically, this involves applying controls, technical transformations, and organisational safeguards proportionate to the assessed risk.
• Do not re‑identify or attempt to re‑identify the de‑identified information after de‑identification (s 8(2)(a)).
• Put in place procedures to destroy the information if it is unintentionally re‑identified (s 8(2)(b)), and also have an escalation process in case lawful re‑identification is required by Australian law or a court/tribunal order (s 8(3)).

4. Vet and document recipient eligibility and commitments (s 9)

• Before disclosure, verify that the recipient has an Australian link as defined under the Privacy Act (s 9(1); see s 4(1) Note). Obtain documentary evidence supporting that Australian link assessment.
• Take reasonable steps to secure recipient commitments that they will not re-identify or attempt to re-identify the de-identified information, will destroy the information if unintentionally re-identified, and will not disclose the de-identified information to other entities (s 9(2)(a)-(c)). These steps are likely to include contractual terms, technical safeguards, and audits or certifications. Where the recipient will only receive Aggregated results as defined in s 4(2), the prohibition on onward disclosure does not apply (s 9(3)), but the credit reporting body should confirm that the output meets the Aggregated results definition.

5. Update public policy statements and transparency materials (s 10)

• Include in the credit reporting body's policy on the management of de‑identified information the statement required by s 10 that de-identified information is used or disclosed for the purpose of conducting research in relation to credit. That statement must be included "in accordance with s 20B(3)" of the Privacy Act, so align the policy text with any requirements in s 20B(3).

6. Document the compliance decision trail

• Although the Rule does not prescribe record‑keeping obligations, the Rule conditions lawful use and disclosure on actions that are judged by "reasonableness" and technical adequacy. Retain contemporaneous records of the risk assessment, the de‑identification techniques chosen and the rationale, copies of recipient assessments or commitments, contracts implementing recipient obligations, and evidence of the Australian link for recipients. These materials will be necessary to demonstrate compliance if queried by the Commissioner or another regulator.

7. Prepare operational procedures for re‑identification events and legal compulsion

• Implement incident response procedures requiring immediate action to destroy unintentionally re‑identified data (ss 8(2)(b), 9(2)(b)). Also prepare protocols for responding to lawful compulsion to re‑identify, including legal review, notification workflows, and documentation, consistent with the exception in s 8(3).

8. Review collaborative research governance for cross‑border work

• If research involves non‑Australian entities or cross‑border processing, carefully assess whether collaborators meet the Privacy Act's Australian link test. Structure agreements to ensure that only eligible recipients receive de‑identified information, or alternatively provide only Aggregated results that meet the Rule's definition for onward disclosure (s 9(3), s 4(2)). Document the analysis showing how the Aggregated results cannot be readily disaggregated or re‑identified.

9. Align commercial terms and contracts with the Rule's obligations

• Where recipients are independent research institutions or service providers, incorporate contractual clauses reflecting the s 9(2) obligations: prohibitions on re‑identification, destruction obligations on unintentional re‑identification, restrictions on onward disclosure except in accordance with s 9(3), and audit or verification rights as appropriate to demonstrate the "reasonable steps" required by the Rule. Where risk assessment is to be performed by the recipient (s 8(1)(a)), require recipient documentation and specific representations and warranties.

10. Monitor developments and be prepared to adapt

• The Rule uses evolving technical concepts and context‑sensitive standards. Establish periodic review of de‑identification techniques, threat models, and contractual safeguards to maintain the "reasonable in the circumstances" standard. Update the policy statement under s 10 as research use evolves.

Following these steps aligns operational practice with the Rule's textual obligations. The Rule leaves technical judgments to credit reporting bodies and their recipients, but conditions lawful use and disclosure on meeting the statutory checkpoints in ss 6-10.