Credit Reporting Privacy Code (CR code)

Administered by Attorney-General's Department

Legislation au F2014L00170 Not in force Legislative Instrument

Legislation content

Explanatory Statement

Issued by the Authority of the Information Commissioner

CR code

This explanatory statement fulfils the Information Commissioner’s obligations under s 26(1) of the Legislative Instruments Act 2003 (the Legislative Instruments Act).

This explanatory statement relates to the Credit Reporting Privacy Code (CR code) registered under s 26(1) of the Privacy Act 1988 as amended by the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (the Privacy Act).

Authority for the registration of the CR code

The Information Commissioner is required by s 26S(4) of the Privacy Act to ensure that there is one, and only one, registered CR code at all times after Part IIIB of the Privacy Act commences.

If an application for registration of a CR code is made by a code developer under s 26Q of the Privacy Act, the Information Commissioner is empowered by s 26S(1) of the Privacy Act to register that CR code. 

On 20 December 2012, pursuant to s 26P, the Privacy Commissioner, consistent with s 12(5) of the Australian Information Commissioner Act 2010, requested the Australian Retail Credit Association (ARCA) to develop a CR code and apply for its registration.

On 19 December 2013 ARCA submitted a final version of the CR code for registration.

Under s 4 of the Acts Interpretation Act 1901 the Information Commissioner has the power to make the decision to register the CR code under s 26S(1) of the Privacy Act before that section commences, where the legal obligations that the CR code imposes do not take effect before the commencement date.

Purpose and operation of the CR code

The CR code is a written code of practice about credit reporting (s 26N(1)).

The purpose of the CR code is to supplement the provisions of Part IIIA of the Privacy Act and the Privacy Regulation 2013. The CR code will, on its commencement, replace the current Credit Reporting Code of Conduct, issued under s 18A of the Privacy Act 1988 before it was amendment by the Privacy Amendment (Enhancing Privacy Protection) Act 2012.

In accordance with s 26N of the Privacy Act, the CR code performs the following functions:

  • sets out how one or more of the credit reporting provisions in Part IIIA of the Privacy Act are to be applied or complied with (s 26N(2)(a))
  • makes provision for, or in relation to, matters required or permitted by Part IIIA to be provided for by the registered CR code (s 26N(2)(b))
  • binds all credit reporting bodies (s 26N(2)(c))
  • specifies the credit providers that are bound by the CR code, or a way of determining which credit providers are bound (s 26N(2)(d)), and
  • specifies any other entities subject to Part IIIA of the Privacy Act that are bound by the CR code, or a way of determining which of those entities are bound (s 26N(2)(e)).

In addition, the CR code:

  • imposes additional requirements that are not contrary to, or inconsistent with the requirements of Part IIIA of the Privacy Act (s 26N(3)(a))
  • deals with the internal handling of complaints (s 26N(3)(b))
  • provides for the reporting to the Commissioner about complaints (s 26N(3)(c)), and
  • deals with any other relevant matters (s 26N(3)(d)).

Reasons for the decision to register the CR code

In deciding to register the CR code, the Information Commissioner has had regard to the objects of the Privacy Act, in particular:

  • to promote the protection of the privacy of individuals (s 2A(a))
  • to promote responsible and transparent handling of personal information by entities (s 2A(d)), and
  • to facilitate an efficient credit reporting system while ensuring that the privacy of individuals is respected (s 2A(e)).

In addition, the Information Commissioner has had regard to the Guidelines for developing codes (the Guidelines) issued under s 26V of the Privacy Act. The Appendix to those Guidelines sets out a non-exhaustive checklist of the primary matters that the Information Commissioner will consider when deciding whether to register a code, including a CR code. Those matters include:

  • whether the code satisfies the requirements in Part IIIA
  • whether there are appropriate governance arrangements in place to administer the code
  • whether there are appropriate reporting mechanisms
  • whether entities bound by the code are clearly identified
  • whether there are standardised internal privacy complaint handling procedures
  • whether there was initial notification of, and updates on, the code’s development
  • whether a code developer satisfied the public consultation requirements and considered views of stakeholders obtained during the consultation (set out in more detail below)
  • whether the code meets the drafting style requirements
  • whether the openness and transparency matters have been addressed, and
  • any matters raised by any person whom the Information Commissioner consults.

The Information Commissioner is satisfied that the CR code adequately addresses those criteria.

Consultation

Consistent with the requirements of s 17 of the Legislative Instruments Act, the Information Commissioner has given consideration to the consultation process undertaken by ARCA as code developer.

Section 26Q of the Privacy Act requires that before a CR code developer makes an application to register a CR code, it must:

  • make a draft of the CR code publicly available
  • invite the public to make submissions to the developer about the draft within a specified period (which must run for at least 28 days), and
  • give consideration to any submissions made within the specified period.

On 5 April 2013 ARCA released a draft of the CR code for public consultation. That consultation ran for a period of 31 days, thereby satisfying the requirement in s26Q that the consultation run for a period of at least 28 days.

Since that public consultation process, ARCA engaged closely with ARCA members and with consumer advocates in relation to the CR code submitted to the Information Commissioner for registration on 19 December 2013.  

The Information Commissioner was advised that ARCA is the industry association for a majority of the organisations that participate most in the Australia credit reporting system. Further, that ARCA membership includes the three major Australian credit reporting bodies (Veda, Dunn & Bradstreet and Experian Australia) and all of the major credit providers. Further, that ARCA’s membership represents around 80 per cent, by volume, of the credit-related personal information held in the Australian credit reporting system. In addition, the information provided by ARCA about its consultation process shows that all those entities that will be bound by the CR code have either been involved in the development process, or had the opportunity to provide comments. 

The Information Commissioner is satisfied, for the reasons set out above, that the consultation process undertaken by ARCA was appropriate.


Statement of compatibility with human rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

CR code

The Credit Reporting Privacy Code (CR code) submitted by the Australian Retail Credit Association to the Information Commissioner for registration on 19 December 2013 (hereinafter referred to as the CR code) is compatible with the human rights and freedoms recognised or declared in the international instruments listed in s 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Operation

The CR code is a binding written code of practice about credit reporting. The purpose of the CR code is to supplement the provisions of Part IIIA of the Privacy Act 1988, as amended by the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (the amended Privacy Act), and the Privacy Regulation 2013.

The CR code will, on commencement, replace the current Credit Reporting Code of Conduct, issued under s 18A of the Privacy Act 1988 before it was amended.

Human rights implications

The CR code has implications for the prohibition against arbitrary interference with privacy.

The CR code engages Article 17 of the International Covenant on Civil and Political Rights (ICCPR). Article 17 provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference or attacks. 

The CR code supplements the provisions of Part IIIA of the amended Privacy Act (the new Part IIIA), which implements the Australian Law Reform Commission’s (ALRC) recommendations in its Report 108 For Your Information: Australian Privacy Law and Practice (ALRC Report) and the subsequent commitment by the Australian Government (in its 2009 first stage response to the ALRC Report) to move to a more comprehensive credit reporting system.

The shift to more comprehensive credit reporting is intended to enable credit providers to make a more balanced and accurate assessment of an individual’s credit situation by permitting a limited number of new types of credit-related personal information to be held in the Australian credit reporting system. The new Part IIIA also introduces enhanced privacy protections relating to notifications, data quality, access and corrections, and complaints. In doing so, the new Part IIIA recognises that it is important to achieve a balance between privacy protection and the efficient operation of the Australian credit reporting system.

Accordingly, to the extent that the CR code supports the introduction of more comprehensive credit reporting under new Part IIIA, it will impact the prohibition on arbitrary interference with privacy. However, to the extent that the CR code supplements the privacy enhancing provisions of the new Part IIIA, it is consistent with the prohibition on arbitrary interference with privacy.

Further, under s 26N of the amended Privacy Act, the CR code can impose additional requirements provided that they are not contrary to, or inconsistent with the requirements of the new Part IIIA. As outlined in the Explanatory Statement, when making the decision to register the CR code under s 26S(1) of the amended Privacy Act, the Information Commissioner was satisfied that the provisions of the CR code are not contrary to, or inconsistent with, the requirements of the new Part IIIA. In reaching this conclusion, the Information Commissioner had regard to the objects of the Privacy Act, particularly the need to facilitate an efficient credit reporting system while ensuring that the privacy of individuals is respected. Accordingly, the Information Commissioner is satisfied that the CR code achieves this balance whilst not derogating from the privacy protections afforded by the new Part IIIA.

Conclusion

The CR code is compatible with human rights because, in line with the new Part IIIA of the amended Privacy Act, it ensures that any limitations on the prohibition against arbitrary interference with privacy are reasonable, necessary and proportionate.  

 

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.