This section is made for the purposes of sections 20T and 21V of the Act.
Note 1: Section 20T of the Act sets out a regime for individuals to seek correction of information relating to them from credit reporting bodies. A credit reporting body must correct the information if it is inaccurate, out‑of‑date, incomplete, irrelevant or misleading for a purpose for which it is held. The body may consult in order to form a view about these matters. Correction requests, and correcting information as a result, must be free for the individual.
Note 2: Section 21V of the Act sets out a substantially similar regime for correction requests to credit providers.
Correction requests to credit providers that do not participate in the credit reporting system
(2) Where:
(a) a credit provider received a correction request from an individual; and
(b) that provider does not:
(i) disclose credit information to a credit reporting body; or
(ii) request a body to disclose information to it; and
(c) the correction request relates to information that the provider does not hold;
the provider is able to comply with subsections 21V(3) and 21W(3) of the Act by taking the steps outlined in subsection (3).
(3) For the purposes of subsection (2), the credit provider may, within 30 days of the individual’s correction request:
(a) consult with other credit reporting bodies or providers to identify an entity that holds the relevant information; and
(b) give the individual a written notice:
(i) explaining that it does not hold the relevant information and does not participate in the credit reporting system and so the correction has not been made; and
(ii) informing the individual of an entity that holds the information to which the correction request relates and providing contact details for that entity; and
(iii) stating that if the individual is not satisfied with the response to the request the individual may access a recognised external dispute resolution scheme of which the provider is a member or to which it is subject, or make a complaint to the Commissioner.
Consulting on correction requests – necessary steps
(4) When a credit reporting body or credit provider (the first responder) consults another body or provider (the consulted entity) in the context of a correction request:
(a) the first responder must take reasonable steps to provide the consultation request to the consulted entity within five business days of the correction request being made; and
(b) the first responder must, when making the consultation request, notify the consulted entity of the date on which the correction period ends; and
Section 20 - Privacy (Credit Reporting) Code 2024 - Correction of information | Zoe
(c) the consulted entity must take reasonable steps to respond to the consultation request as soon as practicable, and not less than five business days before the end of the correction period (unless the consultation request is made less than five business days before the end of correction period, in which case the response must be provided as soon as practicable); and
(d) where the consulted entity will be unable to respond to the consultation request by the end of the correction period:
(i) it must advise the first responder of the delay, the reasons for the delay and the timeframe within which it expects to respond to the consultation request; and
(ii) the advice in sub-paragraph (i) must be provided at least five business days before the end of the correction period, unless the correction request is made after this time, in which case the advice must be provided as soon as practicable; and
(iii) the expected timeframe nominated under sub-paragraph (i) must be reasonable.
Requesting extensions to correction periods
(5) If a credit reporting body or credit provider forms the view that it will not be able to resolve an individual’s correction request within the correction period, the body or provider must as soon as practicable:
(a) notify the individual of the delay, the reasons for the delay and the timeframe within which it expects to respond to the consultation request; and
(b) seek the individual’s agreement to an extension for a period that is reasonable in the circumstances; and
Note: Under the Act, a credit reporting body or a credit provider must correct information within a period of 30 days that starts on the day on which the individual requests correction, or such longer period the individual has agreed to in writing: see subsections 20T(2) and 21V(2) of the Act.
(c) advise that the individual may complain to:
(i) a recognised external dispute resolution scheme of which the body or provider is a member or to which it is subject – and provide the contact details for that scheme; or
(ii) in the case of a provider that is not a member of, or subject to, such a scheme, to the Commissioner; and
(d) if the individual has not agreed to the requested extension, provide a response to the correction request within the timeframe sought for extension.
Correcting credit-related personal information - general
(6) A correction request may relate to a single piece of credit-related personal information, or multiple pieces of credit-related personal information.
Note 1: A credit provider or credit reporting body may need to consult with more than one other provider or body if the correction request relates to multiple pieces of information: see subsection (4) and subsections 20T(3) and 21V(3) of the Act.
Note 2: There are further requirements for certain correction requests relating to multiple pieces of information: see subsections (9), (10) and (11).
(7) If a credit reporting body or credit provider receives a correction request, they must determine whether the credit-related personal information needs to be corrected as soon as practicable.
(8) If a credit reporting body or credit provider is satisfied that credit-related personal information needs to be corrected (whether in response to a correction request, or under sections 20S or 21U of the Act), the relevant obligation to take reasonable steps to correct the information will be satisfied where the body, provider, or body or provider consulted in relation to the correction request (as applicable):
(a) corrects the credit information, where this correction is in response to a correction request, within five business days of determining the correction should occur and otherwise as soon as practicable; and
(b) takes reasonable steps to ensure that any future derived information is based on the corrected credit information; and
(c) takes reasonable steps to ensure that any derived information based on the uncorrected credit information is not disclosed or used for the purpose of assessing the credit worthiness of the individual to whom the information relates.
Correcting credit information – corrections about multiple enquiries
(9) Subsections (10) and (11) apply to correction requests where:
(a) the request relates to one or more statements that an information request has been made in relation to the individual, where credit was not approved by the credit provider following the information request(s); and
(b) the individual states:
(i) which piece or pieces of credit-related personal information are the subject of the correction request; and
(ii) that the relevant information requests referred to in paragraph (a) were caused by fraud (including identity fraud).
(10) When a credit provider or credit reporting body receives a correction request of the kind described in subsection (9), the provider or body must, in considering what evidence to ask for to determine whether the information should be corrected, have regard to:
(a) the burden on the individual of providing the evidence;
(b) the availability of other information which could be used to determine whether the information needs to be corrected; and
(c) information which is likely to be needed for consultation with other providers and bodies under subsection (4).
(11) When a credit provider or credit reporting body is consulted on a correction request of the kind described in subsection (9), the provider or body must, before seeking additional evidence to determine whether one or more pieces of information should be corrected, have regard to:
(a) the information the individual who made the request provided along with that request;
(b) the burden on the individual of providing any additional evidence;
(c) the availability of other information which could be used to determine whether any credit-related personal information needs to be corrected; and
(d) views (if any) formed by the provider or body who received the request about whether a fraud (including identity fraud) event has occurred.
Correcting credit information – information that exists due to circumstances beyond the individual’s control
(12) If an individual makes a correction request on the basis that credit information of the kind specified in subsection (13) only exists because of unavoidable consequences of circumstances beyond the individual’s control, such as natural disaster, domestic abuse, or bank error in processing a direct debit or fraud, the credit provider or credit reporting body that receives that request must:
(a) consider whether the relevant information is inaccurate, out-of-date, incomplete, irrelevant or misleading, having regard to the purpose for which the information is held; and
(b) if the correction request is made to a credit reporting body or a credit provider other than the provider that disclosed the information to a body, consult with the provider that disclosed the information for the purposes of the considerations in paragraph (a); and
(c) if the body or provider is satisfied that the information is inaccurate, out-of-date, incomplete, irrelevant or misleading, having regard to the purpose for which the information is held, agree to correct the information.
(13) For the purposes of subsection (12), individuals may request correction of the following kinds of information on the basis that the information only exists due to unavoidable consequences of circumstances beyond the individual’s control:
(a) default information;
(b) payment information;
(c) new arrangement information of the kind described in subsection 6S(1) of the Act;
(d) repayment history information, where the monthly payment obligations that gave rise to the repayment history information have been complied with or varied; and
(e) financial hardship information.
Corrections of default information for statute-barred debts
(14) On request by an individual, a credit reporting body must correct the credit reporting information it holds in relation to the individual by destroying any default information that relates to a payment that the individual is overdue in making to a credit provider if, at the time of the correction request, the provider is prevented by a statute of limitations from recovering the amount of the overdue payment.
Notifying individuals of decisions to correct credit information
(15) A credit reporting body or credit provider must notify an individual of a decision about a correction request made by the individual under section 20T or section 21V of the Act within 5 business days of the decision. Where the decision is to correct the information, the notice must:
(a) include all relevant credit reporting information or credit eligibility information (as applicable) held by the body or provider (as applicable) so that the individual can check that the information has been appropriately corrected; and
(b) explain:
(i) that the individual has a right to obtain their credit reporting information from a credit reporting body free of charge if the access request relates to a decision by a body or a provider to correct information about the individual; and
(ii) how that right may be exercised; and
(c) if the body or provider (as applicable) is proposing to rely upon subsection (17):
(i) explain who the body or provider is intending to notify to fulfil its notification obligations under Part IIIA of the Act, the Regulations and this CR Code; and
(ii) ask the individual if there is any other provider or affected information recipient that the individual would like the notified of the correction.
(16) Where a credit reporting body or credit provider corrects credit-related personal information by updating identification information about an individual, the body or provider (as applicable) is not obliged to notify any previous recipient of the information about the updating of that information, unless requested by the individual.
(17) Where a credit reporting body or credit provider corrects credit-related personal information and this gives rise to an obligation under Part IIIA of the Act to give notice to a body, provider or affected information recipient, unless it is impracticable or illegal to give that notice, the notification obligation is taken to be met where:
(a) the correcting body or provider gives notice of the correction to:
(i) all bodies to which it disclosed the pre-corrected information; and
(ii) all providers and affected information recipients to which it disclosed the pre-corrected information within the previous 3 months; and
(iii) any other provider or affected information recipient that has been nominated by the individual and to which it disclosed the pre-corrected information more than 3 months previously; and
(b) if notice is given in accordance with paragraph (a) to a credit provider or affected information recipient that previously received CRB derived information or CP derived information that is no longer correct by reason of the correction, the notice includes revised CRB derived information or CP derived information (as applicable) that has been derived using the corrected information and such identification information or credit ID information necessary to identify the individual and their consumer credit to the provider; and
(c) the notice is given within 7 business days of the correction.
Non-application of complaint handling provisions
(18) Where an individual makes a correction request, the complaint handling provisions in the Act will not apply to that request, even if the correction request includes an expression of dissatisfaction by the individual about an act or practice by the credit reporting body or credit provider.
Note: Division 5 of Part IIIA of the Act and section 21 contain requirements relating to the handling of complaints.