(1) This section is made for the purposes of sections 20N and 20Q of the Act.
Note 1: Section 20N of the Act requires credit reporting bodies to take reasonable steps to ensure the information they collect is accurate, up‑to‑date and complete, and that the information they use and disclose accurate, up‑to‑date, complete and relevant (having regard to the purpose of the use or disclosure). Bodies must also enter into agreements with credit providers requiring them to ensure the information they disclose is accurate, up-to-date and complete, and also to obtain independent audits to determine whether those agreements are being complied with.
Note 2: Section 20Q of the Act requires credit reporting bodies to take reasonable steps to protect credit reporting information from misuse, interference and loss, unauthorised access, modification or disclosure. Bodies must also enter into agreements with credit providers requiring them to protect information in this way, and also to obtain independent audits to determine whether those agreements are being complied with.
Programs for monitoring credit providers’ compliance with the Act
(2) To ensure that credit reporting bodies tailor the frequency and extent of the audits required by sections 20N and 20Q of the Act to the credit providers that present the greatest risk of non-compliance, a body must establish a documented, risk-based program to monitor providers’ compliance with their obligations under Part IIIA of the Act (incorporated in their agreements with the body) to ensure:
(a) that credit information that the provider discloses to the body is accurate, up-to-date and complete; and
(b) that credit reporting information that the body discloses to the provider is protected by the provider from misuse, interference and loss and from unauthorised access, modification or disclosure; and
(c) that the provider takes the steps in relation to requests to correct credit-related personal information required by Part IIIA of the Act, the Regulations and this CR Code.
(3) The program established by a credit reporting body under subsection (2) must:
(a) identify and evaluate indicators of risk of non-compliance by credit providers with the obligations referred to in subsection (2); and
(b) assess the risk posed by providers of significant non-compliance with those obligations using those risk indicators and the information available to the body including correction requests and complaints; and
(c) use a reasonable range of monitoring techniques to validate and update those risk assessments from time to time; and
(d) include a program for auditing providers to assess compliance with the obligations referred to in subsection (2).
Note: Credit reporting bodies have obligations to ensure that audits of credit providers are conducted in relation to the quality and security of credit reporting information: see subsections 20N(3)(b) and 20Q(2)(b) of the Act.
Requirements for auditors of credit providers
(4) Subject to subsections (5) and (6), any of the following may be used in audits as part of a credit reporting body’s auditing program for the purposes of paragraph (3)(d) above:
(a) a body’s compliance or auditing team;
(b) consultants engaged by the body;
(c) consultants engaged by the credit provider, where the body is satisfied of the consultant’s independence and expertise; or
(d) an industry funded organisation where the body is satisfied as to that organisation's independence and expertise.
(5) For the purposes of the Act, an auditor is independent of a credit provider (and therefore eligible to conduct audits of that provider under Part IIIA of the Act and programs described in this section) if:
(a) the auditor is not a director or employee of the provider and does not have a significant financial interest in the provider; and
(b) the auditor has not at any time during the previous 12 months had a relationship or interest described in paragraph (a); and
(c) where the auditor is an employee of a credit reporting body – the body’s organisational structure and supervision arrangements achieve functional independence for the auditor; and
(d) where the auditor is an employee of an industry-funded organisation – the organisation’s governance and supervision arrangements achieve functional independence for the auditor; and
(e) the auditor does not have any other association that would impair the perception of the auditor’s independence; and
(f) the auditor has not at any time during the previous 12 months had an association described in paragraph (e).
(6) A credit reporting body must take reasonable steps to ensure that a person who conducts an audit of a credit provider as part of the body’s auditing program referred to in subsection (3) has sufficient expertise for the role including:
(a) knowledge of the requirements of Part IIIA of the Act, the Regulations and this CR Code; and
(b) knowledge of audit methodology and previous experience in conducting audits; and
(c) credit reporting system experience.
(7) A credit reporting body must take reasonable steps to ensure that its audit oversight, including reporting arrangements, is sufficient to enable the body to form a view as to whether the credit provider is complying with the obligations referred to in subsection (2).
(8) A credit provider must permit a person who conducts an audit of the provider as part of a credit reporting body’s auditing program referred to in subsection (3), to have reasonable access to records for the purposes of carrying out the audit.
(9) A credit provider must take reasonable steps to rectify issues identified through an audit undertaken as part of a credit reporting body’s auditing program referred to in subsection (3).
(10) A credit reporting body must:
(a) provide to the Commissioner by 31 August each year, a list of the credit providers audited as part of the body’s audit program referred to in subsection (3); and
(b) on request by the Commissioner, provide the Commissioner with the auditor’s report produced as part of the body’s auditing program referred to in subsection (3).
Obligations on credit reporting body to take action where credit providers have not met their obligations
(11) A credit reporting body must take action as is reasonable in the circumstances (which may include termination of the agreement) where a credit provider fails to meet its contractual obligations to the body to comply with Part IIIA of the Act, the Regulations and this CR Code and in particular fails to:
(a) ensure that the credit information that the provider discloses to the body is accurate, up-to-date and complete; or
(b) protect credit reporting information disclosed to the provider by the body from misuse, interference or loss, or unauthorised access, modification or disclosure.
(12) A credit reporting body may only terminate an agreement with a credit provider under subsection (11) if the body gives the provider:
(a) reasonable notice of its intention to terminate the agreement; and
(b) and an opportunity to trigger the dispute resolution procedures in subsection (13).
(13) Where disputes arise between two or more credit reporting bodies, credit providers and affected information recipients in relation to actions undertaken or required to fulfil their obligations under Part IIIA of the Act, the Regulations or this CR Code, the parties to the dispute must endeavour to resolve the dispute in a fair and efficient way.
Obligations on credit reporting bodies to publish information about audit program
(14) A credit reporting body must publish on its website, by 31 August each year, a report for the financial year ending on 30 June of the same year about its audit program, including:
(a) how the body identifies and evaluates indicators of risk of non-compliance by credit providers with the obligations referred to in subsection (2); and
(b) what types of risk indicators and information are used to assess the risk posed by providers of significant non-compliance with those obligations; and
(c) a description of:
(i) the role which the audit program plays in managing the risks mentioned above; and
(ii) the basis on which the body determined the number, type and manner of audits that was conducted during the relevant financial year (with reference to the other material in the report); and
(d) de-identified information about the number of audits conducted, and significant findings and measures taken in response by either the body or the relevant provider.
Obligations on credit reporting bodies to publish annual report on specified matters
(15) A credit reporting body must publish on its website, by 31 August each year, a report for the financial year ending on 30 June of the same year that includes information about the following:
(a) individuals given access to their credit information without charge, including a percentage calculated using the formula:
AI(C) is the number of individuals given access to their credit reporting information by the body during the reporting period where the individual used a fee-based service.
(c) correction requests received by the body, including a percentage calculated using the formula:
CR is the number of correction requests received by the body during the reporting period.
(d) successful correction requests, being requests received by the body where the body is satisfied that a correction should be made, including a percentage calculated using the formula:
CR is the number of correction requests received by the body during the reporting period.
CR(S) the number of correction requests received by the body during the reporting period where the body was satisfied that a correction should be made.
(e) the mean number of days taken to finalise a correction calculated using the formula:
D(CR) is the total number of calendar days taken from receipt to finalisation for all correction requests finalised by the body during the reporting period.
TC is the total number of corrections finalised by the body during the reporting period.
(f) other corrections made, including a percentage calculated using the formula:
CR(O) is the number of corrections made by the body during the reporting period that were not made in response to a correction request from the relevant individual.
(g) the types of corrections made, including:
(i) the types of correction requests received and corrections made during the reporting period (including a percentage figure for each correction type against all types); and
(ii) the industry sectors from which the information that was corrected originated from;
(h) complaints received, including a percentage calculated using the formula:
C is the number of complaints received by the body during the reporting period.
(i) the types of complaints that were received by the body during the reporting period (including a % figure for each complaint type against all types);
(j) complaints finalised, including a percentage calculated using the formula:
SCI is the total number of times during the reporting period that a provider disclosed an opinion to the body that an individual committed a serious credit infringement.
(n) serious credit infringements disclosed by sector, including, for each sector, a percentage calculated using the formula:
SCI is the total number of times during the reporting period that a provider disclosed an opinion to the body that an individual committed a serious credit infringement.
SCI(S) is the total number of times during the reporting period that a provider from the relevant sector disclosed an opinion to the body that an individual committed a serious credit infringement.
(o) disclosure of consumer credit liability information, including a percentage calculated using the formula: