Explanatory Statement

Credit Provider Determination

No. 2011-2 (Classes of Credit Providers)

August 2011

Explanatory Statement

Credit Provider Determination No. 2011-2 (Classes of Credit Providers)

This explanatory statement fulfils the Privacy Commissioner’s obligations under section 26(1) of the Legislative Instruments Act 2003 (Cth).

This explanatory statement refers to Credit Provider Determination No. 2011-2 (Classes of Credit Providers) (the Classes of Credit Providers Determination) made under section 11B(1)(b)(v) of the Privacy Act 1988 (Cth) (the Privacy Act).

Purpose and operation

The Classes of Credit Providers Determination has effect from 1 September 2011 to 31 August 2014. It has the same effect as Credit Provider Determination No. 2006-4 (Classes of Credit Providers) (the 2006 Classes of Credit Providers Determination) which expires on 31 August 2011.

The Classes of Credit Providers Determination provides that corporations belonging to the following classes are to be regarded as credit providers for the purposes of the Privacy Act in relation to their specific credit activities:

• a corporation where, in relation to a transaction, it is considering providing or has provided a loan in respect of the provision of goods or services on terms which allow the deferral of payment, in full or in part, for at least seven days
• a corporation engaged in the hiring, leasing or renting of goods, where, in relation to a transaction, no amount, or an amount less than the value of the goods, is paid as deposit for return of the goods, and the relevant arrangement is one of at least seven days duration.

The effect of the Classes of Credit Providers Determination is that businesses who on occasions offer loans or credit, but for whom the giving of loans or credit is not a substantial part of their business, can access the credit reporting system in relation to those loans or credit. Those businesses must comply with the obligations imposed by Part IIIA of the Privacy Act and the Credit Reporting Code of Conduct (Code of Conduct)[1].

The purpose of the Classes of Credit Providers Determination is to determine that certain entities are ‘credit providers’ for the purposes of the Privacy Act. By being determined a ‘credit provider’ in relation to a particular loan for the purposes of the Privacy Act, an entity is permitted to conduct credit reporting in accordance with Part IIIA of the Privacy Act and the Code of Conduct. For example, an entity covered by the Classes of Credit Providers Determination may be able to directly access an individual customer’s credit report for the purposes of assessing the loan application, collecting an overdue payment on the loan, listing either an overdue payment or a serious infringement in relation to the loan, or making corrections to information they have previously reported on the loan.

Entities covered by the Classes of Credit Providers Determination must ensure that they understand and comply with their obligations under Part IIIA of the Privacy Act and the Code of Conduct. These instruments impose various obligations and prohibitions on credit providers. This includes the obligation in clause 2.8 of the Code of Conduct which provides that a credit provider must not list a debt with a credit reporting agency where recovery of the debt by the credit provider is barred by a statute of limitations (statutes vary but the period is usually six years).

Authority for making the determination

The authority to make the Classes of Credit Providers Determination is contained in sections 11B(1)(b)(v) and 28A(1)(d) of the Privacy Act.

Section 11B(1)(b)(v) of the Privacy Act states:

(1)   For the purposes of this Act…a person is a credit provider if the person is:

(b)   a corporation (other than an agency):

(v)      that:

(A)     carries on a business or undertaking involving the provision of loans (including the provision of loans by issuing credit cards); and

(B)     is included in a class of corporations determined by the Commissioner to be credit providers for the purposes of this Act.

Section 28A(1) of the Privacy Act states that the Commissioner has the following function in respect of credit reporting:

(d)     to make such determinations as the Commissioner is empowered to make under section 11B or Part IIIA.

Section 6 of the Privacy Act defines ‘Commissioner’ to mean ‘the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010’.

Section 12 of the Australian Information Commissioner Act 2010 (Cth) (AIC Act) provides that the Privacy Commissioner has the ‘privacy functions’ (which are defined in section 9(1)). However, section 12(4)(f) of the AIC Act provides that the Privacy Commissioner may only undertake the making, variation or revocation of a determination for the purposes of paragraph 28A(1)(d) of the Privacy Act with the approval of the Australian Information Commissioner.

The Classes of Credit Providers Determination has been made by the Privacy Commissioner. For the purposes of section 12(4)(f) of the AIC Act, the Australian Information Commissioner has approved the Privacy Commissioner making the Classes of Credit Providers Determination.

Background to the Classes of Credit Providers Determination

The Classes of Credit Providers Determination was first issued in 1991. The determination was re-issued without substantive change in 1993, 1996, 2001, 2002, 2003, February 2006 and August 2006. The current Classes of Credit Providers Determination will expire on 31 August 2011.

At the time of making this Determination, the Senate Finance and Public Administration Committee is conducting an inquiry into exposure drafts of Australian Privacy Amendment Legislation, including an exposure draft of proposed new credit reporting provisions (Senate Committee inquiry).

If the new credit reporting provisions are passed in their current exposure draft form, the Classes of Credit Providers Determination is likely to become redundant because the Australian Government proposes to:

• remove the Australian Information Commissioner's determination power in relation to the 'credit provider' definition, and
• designate as 'credit providers' in the legislation itself (exposure draft section 188) those entities currently covered by the Classes of Credit Providers Determination.

Consultation

Prior to making the Classes of Credit Providers Determination, the Office of the Australian Information Commissioner (OAIC) undertook a review of the 2006 Classes of Credit Providers Determination which expires on 31 August 2011.

The OAIC released a consultation paper[2] for public comment as part of the review. The purpose of the consultation was to obtain stakeholders’ views regarding whether or not a new determination in relation to Classes of Credit Providers should be made, whether the terms of the determination should be amended, and the duration of any such determination.

Comment was invited from industry participants, peak industry bodies, consumer groups and Government departments. The consultation paper was available on the OAIC’s website during the consultation period.

The OAIC received 10 written submissions in response to the questions in the consultation paper relating to the Classes of Credit Providers Determination. The submissions are available on the OAIC website[3].

Reasons for the decision

In making the Classes of Credit Providers Determination, the Privacy Commissioner took account of:

• the operation of the 2006 Classes of Credit Providers Determination
• the submissions received in response to the consultation paper, and
• the Senate Committee inquiry and the potential impact of the exposure draft of new credit reporting provisions on the Classes of Credit Providers Determination.

The Privacy Commissioner was satisfied that there was no reason not to make a new determination in relation to classes of credit providers and no reason to amend the terms of the 2006 Classes of Credit Providers Determination. The Privacy Commissioner therefore decided to make the Classes of Credit Providers Determination, with the same effect as the 2006 Classes of Credit Providers Determination, for a period of three years.

The Privacy Commissioner noted that:

• nine of the 10 submissions received by the OAIC supported the making of a new Classes of Credit Providers Determination, and
• a number of submissions referred to the Senate Committee inquiry.

[1] Credit Reporting Code of Conduct and Explanatory notes issued by the Privacy Commissioner under section 18A of the Privacy Act, September 1991 and including all amendments as at March 1996.

[2] Review of Credit Provider Determination: Consultation Paper No. 1 – Assignees and Classes of Credit Providers is available at http://www.oaic.gov.au/publications/papers.html.

[3] http://www.oaic.gov.au/news/consultations.html#previous_consultations.