Credit Provider Determination No. 2011-2 (Classes of credit providers)

Administered by Attorney-General's Department

Legislation au F2011L01648 Not in force Legislative Instrument

Legislation content

 

 

 

 

 

 

 

 

Explanatory Statement

Credit Provider Determination

 

 

No. 2011-2 (Classes of Credit Providers)

 

 

August 2011

 

 

 

 

 

 

 

 

Explanatory Statement

Credit Provider Determination No. 2011-2 (Classes of Credit Providers)

This explanatory statement fulfils the Privacy Commissioner’s obligations under section 26(1) of the Legislative Instruments Act 2003 (Cth).

This explanatory statement refers to Credit Provider Determination No. 2011-2 (Classes of Credit Providers) (the Classes of Credit Providers Determination) made under section 11B(1)(b)(v) of the Privacy Act 1988 (Cth) (the Privacy Act).

Purpose and operation

The Classes of Credit Providers Determination has effect from 1 September 2011 to 31 August 2014. It has the same effect as Credit Provider Determination No. 2006-4 (Classes of Credit Providers) (the 2006 Classes of Credit Providers Determination) which expires on 31 August 2011.

The Classes of Credit Providers Determination provides that corporations belonging to the following classes are to be regarded as credit providers for the purposes of the Privacy Act in relation to their specific credit activities:

  • a corporation where, in relation to a transaction, it is considering providing or has provided a loan in respect of the provision of goods or services on terms which allow the deferral of payment, in full or in part, for at least seven days
  • a corporation engaged in the hiring, leasing or renting of goods, where, in relation to a transaction, no amount, or an amount less than the value of the goods, is paid as deposit for return of the goods, and the relevant arrangement is one of at least seven days duration.

The effect of the Classes of Credit Providers Determination is that businesses who on occasions offer loans or credit, but for whom the giving of loans or credit is not a substantial part of their business, can access the credit reporting system in relation to those loans or credit. Those businesses must comply with the obligations imposed by Part IIIA of the Privacy Act and the Credit Reporting Code of Conduct (Code of Conduct)[1].

The purpose of the Classes of Credit Providers Determination is to determine that certain entities are ‘credit providers’ for the purposes of the Privacy Act. By being determined a ‘credit provider’ in relation to a particular loan for the purposes of the Privacy Act, an entity is permitted to conduct credit reporting in accordance with Part IIIA of the Privacy Act and the Code of Conduct. For example, an entity covered by the Classes of Credit Providers Determination may be able to directly access an individual customer’s credit report for the purposes of assessing the loan application, collecting an overdue payment on the loan, listing either an overdue payment or a serious infringement in relation to the loan, or making corrections to information they have previously reported on the loan.

Entities covered by the Classes of Credit Providers Determination must ensure that they understand and comply with their obligations under Part IIIA of the Privacy Act and the Code of Conduct. These instruments impose various obligations and prohibitions on credit providers. This includes the obligation in clause 2.8 of the Code of Conduct which provides that a credit provider must not list a debt with a credit reporting agency where recovery of the debt by the credit provider is barred by a statute of limitations (statutes vary but the period is usually six years).

Authority for making the determination

The authority to make the Classes of Credit Providers Determination is contained in sections 11B(1)(b)(v) and 28A(1)(d) of the Privacy Act.

Section 11B(1)(b)(v) of the Privacy Act states:

(1)   For the purposes of this Act…a person is a credit provider if the person is:

(b)   a corporation (other than an agency):

(v)      that:

(A)     carries on a business or undertaking involving the provision of loans (including the provision of loans by issuing credit cards); and

(B)     is included in a class of corporations determined by the Commissioner to be credit providers for the purposes of this Act.

Section 28A(1) of the Privacy Act states that the Commissioner has the following function in respect of credit reporting:

(d)     to make such determinations as the Commissioner is empowered to make under section 11B or Part IIIA.

Section 6 of the Privacy Act defines ‘Commissioner’ to mean ‘the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010’.

Section 12 of the Australian Information Commissioner Act 2010 (Cth) (AIC Act) provides that the Privacy Commissioner has the ‘privacy functions’ (which are defined in section 9(1)). However, section 12(4)(f) of the AIC Act provides that the Privacy Commissioner may only undertake the making, variation or revocation of a determination for the purposes of paragraph 28A(1)(d) of the Privacy Act with the approval of the Australian Information Commissioner.

The Classes of Credit Providers Determination has been made by the Privacy Commissioner. For the purposes of section 12(4)(f) of the AIC Act, the Australian Information Commissioner has approved the Privacy Commissioner making the Classes of Credit Providers Determination.

Background to the Classes of Credit Providers Determination

The Classes of Credit Providers Determination was first issued in 1991. The determination was re-issued without substantive change in 1993, 1996, 2001, 2002, 2003, February 2006 and August 2006. The current Classes of Credit Providers Determination will expire on 31 August 2011.

At the time of making this Determination, the Senate Finance and Public Administration Committee is conducting an inquiry into exposure drafts of Australian Privacy Amendment Legislation, including an exposure draft of proposed new credit reporting provisions (Senate Committee inquiry).

If the new credit reporting provisions are passed in their current exposure draft form, the Classes of Credit Providers Determination is likely to become redundant because the Australian Government proposes to:

  • remove the Australian Information Commissioner's determination power in relation to the 'credit provider' definition, and
  • designate as 'credit providers' in the legislation itself (exposure draft section 188) those entities currently covered by the Classes of Credit Providers Determination.

Consultation

Prior to making the Classes of Credit Providers Determination, the Office of the Australian Information Commissioner (OAIC) undertook a review of the 2006 Classes of Credit Providers Determination which expires on 31 August 2011.

The OAIC released a consultation paper[2] for public comment as part of the review. The purpose of the consultation was to obtain stakeholders’ views regarding whether or not a new determination in relation to Classes of Credit Providers should be made, whether the terms of the determination should be amended, and the duration of any such determination.

Comment was invited from industry participants, peak industry bodies, consumer groups and Government departments. The consultation paper was available on the OAIC’s website during the consultation period.

The OAIC received 10 written submissions in response to the questions in the consultation paper relating to the Classes of Credit Providers Determination. The submissions are available on the OAIC website[3].


Reasons for the decision

In making the Classes of Credit Providers Determination, the Privacy Commissioner took account of:

  • the operation of the 2006 Classes of Credit Providers Determination
  • the submissions received in response to the consultation paper, and
  • the Senate Committee inquiry and the potential impact of the exposure draft of new credit reporting provisions on the Classes of Credit Providers Determination.

The Privacy Commissioner was satisfied that there was no reason not to make a new determination in relation to classes of credit providers and no reason to amend the terms of the 2006 Classes of Credit Providers Determination. The Privacy Commissioner therefore decided to make the Classes of Credit Providers Determination, with the same effect as the 2006 Classes of Credit Providers Determination, for a period of three years.

The Privacy Commissioner noted that:

  • nine of the 10 submissions received by the OAIC supported the making of a new Classes of Credit Providers Determination, and
  • a number of submissions referred to the Senate Committee inquiry.

 

[1] Credit Reporting Code of Conduct and Explanatory notes issued by the Privacy Commissioner under section 18A of the Privacy Act, September 1991 and including all amendments as at March 1996.

[2] Review of Credit Provider Determination: Consultation Paper No. 1 – Assignees and Classes of Credit Providers is available at http://www.oaic.gov.au/publications/papers.html.

[3] http://www.oaic.gov.au/news/consultations.html#previous_consultations.

Overview

The Credit Provider Determination No. 2011-2 (Classes of Credit Providers) was enacted under the authority of sections 11B(1)(b)(v) and 28A(1)(d) of the Privacy Act 1988 (Cth), and it was introduced to address the need for a clear and consistent definition of 'credit providers' for the purposes of the Privacy Act, particularly in relation to credit reporting. This determination, effective from 1 September 2011 to 31 August 2014, identifies specific classes of corporations that are considered credit providers when they engage in credit-related activities, such as offering loans or credit with deferred payment terms, or leasing goods without an upfront deposit. The enacting body for this determination is the Privacy Commissioner, who is empowered to make such determinations with the approval of the Australian Information Commissioner under the Australian Information Commissioner Act 2010. The policy objective of this legislation is to ensure that businesses involved in occasional credit activities comply with privacy obligations and credit reporting standards, thereby facilitating effective credit management while protecting consumer privacy.

Scope and Application

The Classes of Credit Providers Determination No. 2011-2 applies to corporations that provide credit in the form of loans or leases, provided certain conditions are met. Specifically, the determination covers corporations that consider or have provided loans allowing for the deferral of payment for at least seven days, or those engaged in hiring, leasing, or renting goods without a deposit where the arrangement lasts for at least seven days. These corporations are considered credit providers for the purposes of the Privacy Act 1988. The determination mandates that such entities comply with the obligations outlined in Part IIIA of the Privacy Act and the Credit Reporting Code of Conduct. The Classes of Credit Providers Determination is in effect from 1 September 2011 to 31 August 2014, mirroring the provisions of its predecessor, the 2006 Classes of Credit Providers Determination, which expired on 31 August 2011. The authority to make this determination lies within sections 11B(1)(b)(v) and 28A(1)(d) of the Privacy Act, with the Privacy Commissioner authorised to make such determinations, subject to the approval of the Australian Information Commissioner as required by section 12(4)(f) of the Australian Information Commissioner Act 2010.

Key Provisions

The primary operative sections of Credit Provider Determination No. 2011-2 (Classes of Credit Providers) (the Determination) are those that define the specific classes of corporations that are considered credit providers under the Privacy Act 1988 (Cth) (the Privacy Act). The Determination identifies corporations that, in relation to a transaction, are considering providing or have provided a loan with deferred payment terms, or are engaged in hiring, leasing, or renting goods with a deposit less than the value of the goods and for a duration of at least seven days, as credit providers (sections 2(1)(a) and (b)). These corporations can access the credit reporting system for their credit activities as if they were significant credit providers, subject to the obligations outlined in Part IIIA of the Privacy Act and the Credit Reporting Code of Conduct (sections 2(2) and (3)). The Determination imposes specific obligations on the identified classes of credit providers. These entities must ensure they understand and comply with the obligations under Part IIIA of the Privacy Act and the Credit Reporting Code of Conduct. This includes, but is not limited to, the prohibition against listing a debt with a credit reporting agency if recovery of the debt is barred by a statute of limitations (section 2.8 of the Code of Conduct). These obligations require credit providers to handle personal information responsibly and to ensure that any credit reporting activities are conducted in accordance with the prescribed standards. Any breach of the obligations under Part IIIA of the Privacy Act and the Code of Conduct may result in civil or criminal consequences. For example, under section 13E of the Privacy Act, an entity that knowingly or recklessly contravenes the Act may be subject to enforcement action by the Australian Information Commissioner. Civil penalties for serious or repeated contraventions can include pecuniary penalties of up to $210,000 for a corporation (section 13G). Additionally, under section 13H, the Privacy Act empowers the Australian Information Commissioner to seek court orders to remedy breaches, including orders for the cessation of unlawful conduct. Criminal penalties may also apply for more severe breaches, with maximum penalties varying depending on the nature and extent of the contravention.

Legal classification tags

Area of Law
Privacy Law
Instrument
Determination
Concepts
Definitions & Interpretation
Regulatory Standards
Compliance Obligations

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.