4 Credit providers’ information collection procedures
(1) This section is made for the purposes of subsection 21C(1) of the Act.
Note: Subsection 21C(1) of the Act requires credit providers, at or before they collect personal information about an individual that they likely to disclose to a credit reporting body, to
(a) notify the individual of the name and contact details of the credit reporting body, as well as any other matters specified in the registered CR code, or
(b) otherwise ensure that the individual is aware of those matters.
Notification does not require consent
(2) For the avoidance of doubt, a credit provider’s obligation under subsection 21C(1) of the Act to notify an individual of certain matters does not require the provider to obtain the individual’s consent to the disclosure of information to a credit reporting body.
Matters that credit providers must notify or otherwise make individuals aware of
(3) At or before the time a credit provider collects personal information about an individual that the provider is likely to disclose to a credit reporting body, the provider must notify or otherwise ensure that the individual is made aware of the following matters:
(a) if the likely disclosure is an information request:
(i) that the individual’s consent to the disclosure being made is not required;
(ii) that a record of the information request may be used and, as relevant, disclosed for the purposes of the credit reporting body or a credit provider assessing the individual's credit worthiness, including calculation of a credit score or credit rating (subject to any other use or disclosure limitations under the Act, the Regulations or this CR Code); and
(iii) in general terms, how the information request may affect a credit score or credit rating calculated by a credit reporting body in relation to the individual;
(b) the credit reporting body may include the information in reports provided to credit providers to assist them to assess the individual’s credit worthiness;
(c) that if the individual fails to meet their payment obligations in relation to consumer credit or commits a serious credit infringement, the credit provider may be entitled to disclose this to the credit reporting body;
(d) how the individual may obtain:
(i) the credit provider’s policy about the management of credit-related personal information required by section 21B of the Act; and
(ii) the credit reporting body’s policy about the management of credit-related personal information required by section 20B of the Act; and
(e) the individual’s rights to:
(i) access the information from the credit provider; and
(ii) request the credit provider to correct the information; and
(iii) make a complaint to the credit provider.
(f) the individual’s rights to request the credit reporting body:
(i) not to use their credit reporting information for the purposes of pre-screening of direct marketing by a provider; and
(ii) not to use or disclose credit reporting information about the individual, if the individual believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud.
How credit providers may notify individuals
(4) A credit provider may comply with its obligations under subsection 21C(1) of the Act and this section to notify or ensure an individual is aware of specified matters (the notifiable matters) by:
(a) publishing a clearly expressed statement of the notifiable matters on its website; and
(b) at or before the time of collection of the personal information from the individual, notifying the individual or otherwise making the individual aware of the following:
(i) that the credit provider’s website includes information about credit reporting, including the credit reporting bodies to which the provider is likely to disclose the individual’s credit information; and
(ii) a brief description of the key issues contained in the statement of notifiable matters; and
(c) providing details of the credit provider’s website and ensuring that the notifiable matters are prominently displayed on the website; and
(d) making it clear to the individual that they can request to have the statement of notifiable matters provided in an alternative form – such as a hard copy.
5 Practices, procedures and systems
Restrictions on the collection, use and disclosure of personal information
(1) A credit reporting body must not:
(a) collect personal information about an individual’s activities in relation to consumer credit that is not credit information;
(b) use personal information about an individual’s activities in relation to consumer credit that is not credit information to derive CRB derived information; or
(c) disclose personal information about an individual’s activities in relation to consumer credit that is not credit information or credit reporting information
unless subsections (3) or (4) apply to the information.
(2) A credit provider must not disclose to a credit reporting body or another provider personal information about an individual’s activities in relation to consumer credit that:
(a) was disclosed to the provider by a credit reporting body and that is not credit reporting information; or
(b) was derived (wholly or in part) from personal information about an individual’s activities in relation to consumer credit that was disclosed to the provider by a credit reporting body and that is not credit reporting information
unless subsection (4) applies to the information.
Note: A credit provider includes an organisation or small business operators that is acting as an agent of a credit provider in some circumstances: see section 6H of the Act.
(3) This subsection applies to personal information that:
(a) is either credit ID information or capacity information; and
(b) is collected at the same time as the credit information or credit reporting information.
(4) This subsection applies to personal information that:
(a) is either credit ID information or capacity information; and
(b) is disclosed at the same time as the credit information or credit reporting information.
Restrictions on standardisation of consumer credit numbering conventions
(5) A credit reporting body and a credit provider must not agree or implement procedures to standardise the provider’s numbering conventions for consumer credit.
Practices, procedures and systems of credit providers
(6) A credit provider must have reasonable practices, procedures and systems, given the size and complexity of its business, that are designed to cover obligations under Part IIIA of the Act, the Regulations and this CR code.
(7) The practices, procedures and systems described in subsection (6) must require the credit provider to:
(a) ensure it does not disclose information to a credit reporting body that it is prohibited from disclosing;
(b) advise the relevant credit reporting body as soon as practicable if the provider becomes aware that it has disclosed information to the body that it is prohibited from disclosing;
(c) ensure that it only discloses credit information that is accurate, up-to-date and complete;
(d) if it identifies that credit information that it has disclosed to a credit reporting body is not accurate, up-to-date and complete:
(i) advise the body of this as soon as is practicable; and
(ii) take reasonable steps to address the disclosure;
(e) if it becomes aware that credit reporting information disclosed to it by a credit reporting body is not accurate, up-to-date, complete and relevant having regard to the purpose of the disclosure, advise the body of that fact as soon as practicable;
(f) where requested by a credit reporting body:
(i) take reasonable steps to review its credit-related personal information management practices, procedures and systems to assess whether credit information it has disclosed to credit reporting bodies is accurate, up-to-date and complete;
(ii) take reasonable steps to rectify any issues that are identified; and
(iii) advise the body of the results of the review and the action taken to rectify issues.
(g) take reasonable steps to assist a credit reporting body to ensure that its credit reporting information is accurate, up-to-date, complete and relevant, having regard to the purposes for which it is used or disclosed, and to rectify any issues that are detected.
Practices, procedures and systems of credit reporting bodies
(8) A credit reporting body must have reasonable practices, procedures and systems that are designed to cover obligations under Part IIIA of the Act, the Regulations and this CR Code.
(9) The practices, procedures and systems described in subsection (8) must require the credit reporting body to:
(a) use the information disclosed by credit providers in relation to individuals’ dates of birth to identify any information disclosed by a provider that:
(i) relates to an act, omission, matter or thing that occurred or existed before the relevant individual turned 18; and
(ii) that the provider is prohibited from disclosing.
(b) identify, as soon as practicable, whether collected information includes information that the body is prohibited from collecting and, if so, to destroy the prohibited information;
(c) where the body destroys information on the basis that its collection was prohibited, notify the relevant credit provider of the destruction as soon as practicable;
(d) undertake regular testing of the credit information and credit reporting information that the body uses and discloses to ensure that it is accurate, up-to-date, complete and relevant, having regard to the purpose for which it is used or disclosed;
(e) take reasonable steps to initiate, as soon as practicable, targeted testing of its credit reporting information, where the body is informed, or identifies, that credit reporting information in relation to an individual is not accurate, up-to-date, complete and relevant, having regard to the purpose for which it is used or disclosed;
(f) where the body identifies that credit reporting information in relation to an individual is not accurate, up-to-date, complete and relevant, having regard to the purpose for which the information is used or disclosed, rectify the situation, including by destroying any information in accordance with its obligations;
(g) where the body identifies credit information that is not accurate, up-to-date and complete, raise this, where reasonable, with the credit provider that disclosed the information and request that provider:
(i) take reasonable steps to review its credit information management practices, procedures and systems;
(ii) rectify any issues that are identified; and
(iii) advise the body of the results of the review; and
(h) report about its testing, undertaken in accordance with paragraph (d), and any material findings or material changes to procedures, to credit providers with which it has an agreement of the kind referred to in subsections 20N(3) or 20Q(2) of the Act.