EXPLANATORY STATEMENT

in regard to

Determination 2005 No.1 Privacy Act 1988, s.11B(1)(d)(ii)- concerning Indigenous Business Australia

This explanatory statement has been drafted for the purpose of fulfilling the Office of Privacy Commissioner’s obligations under s. 26(1) of the Legislative Instruments Act 2003.

1. PURPOSE

The purpose of Determination 2005 No.1 Privacy Act 1988, s.11B(1)(d)(ii)- concerning Indigenous Business Australia (Determination 2005 No.1) is to determine that the applicant, Indigenous Business Australia (IBA), is an Australian government agency that carries on the business or undertaking that involves the making of loans and, as such, is a credit provider pursuant to s.11B(1)(d)(ii) of the Privacy Act 1988 (the Privacy Act). 

Determination 2005 No.1 revokes the current determination issued to the Aboriginal and Torres Strait Islander Commission (ATSIC) as it no longer performs lending functions as a credit provider in relation to the Indigenous Housing Fund and the Business development Program, respectively.  The determination being revoked with the coming into effect of Determination 2005 No.1 is:

• Credit Reporting Determination: 1999 No.1 Privacy Act 1988, s.11B(1)(d) – concerning the Aboriginal and Torres Strait Islander Commission. (Note: this determination did not specify an expiry date).

Previous credit provider determinations issued in favour of the Aboriginal and Torres Strait Islander Services (ATSIS) and the Department of Employment and Workplace Relations (DEWR) in relation to lending to indigenous individuals specified that they both lapse on 9 October 2005.

By being granted credit provider status under the terms of the determination, IBA will be permitted to conduct credit reporting in accordance with Part IIIA of the Privacy Act.  In particular, it will be able to directly access an individual’s credit report, held by a credit reporting agency, to assess a loan application.  If it needs to, IBA will also be permitted to directly access a credit report for the purpose of collecting payments that are overdue and list either an overdue payment or a serious credit infringement, with a credit reporting agency.

1.1                         Provisions for Credit Provider Determinations

Section 11B of the Privacy Act defines “credit providers”.  Credit providers that can conduct credit reporting include banks and certain other private sector organisations.  Section 11B(1)(d) also allows the Privacy Commissioner to determine that an Australian Government agency is a credit provider if it carries on a business or undertaking that involves the making of loans.

“Credit” is defined in section 6(1) to mean a loan sought or obtained by an individual from a credit provider in the course of the credit provider carrying on a business or undertaking as a credit provider, being a loan that is intended wholly or primarily for domestic, family or household purposes.

“Commercial credit” is defined in section 6(1) to mean a loan sought or obtained by a person, other than a loan of a kind referred to in the definition of “credit” in the sub-section.

Information on the definition of a “credit provider” and on the provision for making of a credit provider determination in favour of an Australian government agency is provided below at Section 1.2: “Authority for making this determination”.

1.2 Authority for making this determination

Determination 2005 No.1 is made under s.11B(1)(d)(ii) of the Privacy Act.  Section 11B(1)(d) states:

(1)  For the purposes of this Act … a person is a credit provider if the person is:

(d) an agency that:

(i) carries on a business or undertaking that involves the making of loans; and

(ii) is determined by the Commissioner to be a credit provider for the purposes of this Act.
 

Section 28A(1) states that the Commissioner has the following function in respect of credit reporting:

(d) to make such determinations as the Commissioner is empowered to make under section 11B or Part IIIA.

1.3 Application for a Credit Provider Determination

On 22 March 2005 IBA’s solicitors, the Australian Government Solicitor (AGS), applied for a determination, under s.11B(1)(d)(ii) of the Privacy Act, to the effect that IBA carries on the business or undertaking that involves the making of loans and, as such, is a credit provider (Attachment A).  AGS wrote again on 9 May 2005 and 22 August 2005 to clarify aspects of IBA’s application (Attachment B).  As part of the application process, IBA wrote to the Privacy Commissioner on 19 August 2005 responding to privacy issues raised in the Australian National Audit Office (ANAO) report 53 of 2004-05 (Attachment D).

IBA is a statutory authority established under Part 4 of the Aboriginal and Torres Strait Islander Commission Act 1989.  It is also a federal government agency subject to the Privacy Act.  On 16 March 2005 the Commonwealth Parliament passed the Aboriginal and Torres Strait Islander Amendment Bill 2005 giving IBA the Indigenous Housing Fund and Business Development Program formerly administered by ATSIC.  By these measures, IBA assumed the housing and business loan functions formerly performed by ATSIC, ATSIS and DEWR, respectively.  The legislation effecting these changes came into force on 24 March 2005.

ATSIC was abolished by an Act of Parliament on 16 March 2005.  ATSIS was abolished on 1 July 2005.  DEWR no longer performs any function as a credit provider in relation to the Business Development Program. 

For these reasons, AGS advised that the current determinations relating to ATSIC, ATSIS and DEWR respectively (Determinations 1999 No. 1; 2003 No. 3; and 2004 No.1) are no longer required.   AGS is also of the opinion that it is unlikely that any of the three determinations can be transferred legally for the benefit of IBA.

The application is for IBA to be granted credit provider status for a period of five years or until IBA ceases to administer the housing and business loan functions.

1.4 Documents incorporated by reference

The following documents are incorporated by reference to them and are attached as appendices to this statement.

• Letter dated 22 March 2005 from IBA’s solicitors, AGS, applying for a determination under s.11B(1)(d)(ii) of the Privacy Act (Attachment A).
• Letter dated 9 May 2005 from AGS clarifying aspects of the application (Attachment B).
• Letter dated 5 July 2005 from the Aboriginal and Torres Strait Islander Social Justice Commissioner (Social Justice Commissioner) of the Human Rights and Equal Opportunity Commission regarding consultation on the determination (Attachment C).
• Letter dated 19 August 2005 from IBA responding to privacy issues raised in the ANAO report 53 of 2004-05 (Attachment (D).
• Letter dated 22 August 2005 from AGS further clarifying aspects of the application (Attachment E).

2. REASONS FOR MAKING THE DETERMINATION

2.1 Background to the application for a determination

ATSIC, ATSIS and DEWR at various stages shared responsibility as credit providers for the provision of loans under the Indigenous Housing Fund and the Business Development Program, respectively.  Three determinations were issued to these agencies.  Details of these determinations, which no longer apply are as follows.

2.1.1 ATSIC credit provider determination

On 16 November 1999, Determination 1999 No.1 was made under section 11B(1)(d)(ii) of the Privacy Act to the effect that the ATSIC was a credit provider for the purposes of the Privacy Act (Attachment F).

For the purposes of that Determination, the Office consulted widely on a number of issues and received advice from the Social Justice Commissioner.   Both the issues and the advice received are detailed in the Reasons for Determination forming part of Determination 1999 No. 1.

In making Determination 1999 No.1, a number of factors, as detailed in the Reasons for Determination, were taken into account.  They included that ATSIC:

• has a statutory function of making loans to individuals under the Aboriginal and Torres Strait Islander Commission Act 1989 (the ATSIC Act) and the making of such loans formed a core part of ATSIC's business;

• made loans on a basis that equated with the 'normal commercial practice' of other credit providers and that being a credit provider would greatly improve the efficiency of ATSIC's loans procedures.

2.1.2 ATSIS credit provider determination

On 26 September 2003, Determination 2003 No.3 was made under section 11B(1)(d)(ii) of the Privacy Act to the effect that the ATSIS was a credit provider for the purposes of the Privacy Act (Attachment G).

ATSIS was established as a federal Executive Agency under the Public Service Act 1999, and as a prescribed agency under the Financial Management and Accountability Act 1997 with effect from 1 July 2003.  ATSIS is subject to the provisions of the Privacy Act.

Pursuant to these legislative arrangements, ATSIS:

• had assumed, on a temporary basis, the financial responsibility for many of the programs formerly administered by ATSIC;
• ATSIC, however, retained responsibility for the housing loans program under the ATSIC Act;
• subject to the making of this determination, it was intended that ATSIS would:
  • make all new business loans, which were made previously by ATSIC, on behalf of the Australian Government;
  • make such loans in accordance with sound commercial practice and within the constraints of the definition of 'commercial credit' in section 6 of the Privacy Act; and
  • administer existing ATSIC business loans, under the terms of an agreement between ATSIC and ATSIS, paying all monies recovered regarding ATSIC's pre-July 2003 loans into an ATSIC bank account.

Consultation with Social Justice Commissioner

The views of the Social Justice Commissioner were sought and received regarding the application by ATSIS.  The effect of the Social Justice Commissioner's advice was that:

• the arrangements between ATSIC and ATSIS were temporary, pending a final decision by the Australian Government as to the future of ATSIC and ATSIS;
• the same considerations relating to ATSIC's earlier application for credit provider status then applied to the application by ATSIS; and
• the Social Justice Commissioner supported a similar credit provider determination being made for ATSIS as had been made for ATSIC.
   

Conclusions regarding ATSIS application

On the advice then received, it was concluded, inter alia, that:

• as a result of the transfer of some of ATSIC’s responsibilities to it, ATSIS would be carrying on a business or undertaking that involved the making of loans;
• the same considerations that had supported the making of Determination 1999 No. 1, concerning ATSIC, applied to the application by ATSIS;
• it would be in the interests, then, of both ATSIS and its clients, for ATSIS to have credit provider status in carrying on the business of making loans for the purposes of the Privacy Act; and
• since ATSIS had advised that the arrangements with ATSIC might be temporary, the life of the determination should not be open-ended, but should be the subject of further review when the administrative arrangements of ATSIS were settled   A period of two years commencing 9 October 2003 was considered appropriate for this purpose.

Accordingly, these findings were made:

• ATSIS had satisfied the criteria set out in s.11B(1)(d)(i) of the Privacy Act.
• having regard to the matters identified above, it was substantially in the public interest for the determination sought by ATSIS to be made under s.11B(1)(d)(ii).
• The Determination 2003 No.3 will lapse on 9 October 2005.

2.1.3 Department of Employment and Workplace Relations credit provider determination

On 2 September 2004, Determination 2004 No.1 was made under section 11B(1)(d)(ii) of the Privacy Act to the effect that DEWR was a credit provider for the purposes of the Privacy Act (Attachment H).

It was the Privacy Commissioner’s understanding that in April 2004 the Australian Government announced the following legislative proposals:

• the responsibility for ATSIC and ATSIS programmes and functions would be transferred to “mainstream agencies” including DEWR.
• the Australian Government would abolish ATSIC and ATSIS.
• the responsibility for the Business Development Program formerly administered by ATSIC and (from 1 July 2003) by ATSIS would be transferred to DEWR.
• the administration of the Business Development Program would be transferred to a new statutory corporation, IBA, established under Part 4 of the ATSIC Act.

Since 1 July 2004, ATSIS retained a “residual role” in relation to the Business Development Program.  It continued to administer loans made before 1 July 2003 on behalf of ATSIC, whereas DEWR assumed the function of administering the Business Development Program. 

DEWR applied for separate credit provider status to enable it to perform its loan functions under the Business Development Program.

Consultation with Social Justice Commissioner

For the purposes of DEWR’s application, the Social Justice Commissioner was consulted on the proposed determination.  The Social Justice Commissioner did not express any concerns regarding the making of the determination.

Conclusions regarding DEWR’s Application

On the advice received it was concluded, inter alia, that:

• for the time being, ATSIC and ATSIS should retain their credit provider status under Determination 1999 No.1 and Determination 2003 No.3.
• pending the final resolution of the three agencies future and their loan-making functions and a subsequent review of their credit provider status at an appropriate time, both ATSIC and ATSIS should continue to retain that status.
• similar considerations applied to DEWR’s application as were applied to the previous applications which resulted in the Determinations 1999 No.1 and 2003 No.3. These considerations included the outcomes from the consultations conducted with the then Social Justice Commissioner and with other relevant stakeholders.
• given the reasons advanced in support of the applications by ATSIC and ATSIS and the findings that it was in the public interest for determinations to be made granting credit provider status to ATSIC and ATSIS, it followed that, since DEWR performs those same loan functions, there was adequate support for DEWR’s application.
• since DEWR advised that the arrangements giving rise to the determination were temporary, the determination would be for a period of two years lapsing on 9 October 2005.

Accordingly, these findings were made:

• DEWR satisfied the criteria set out in section 11B(1)(d)(i) of the Privacy Act.
• it is substantially in the public interest for the determination sought by DEWR to be made under section 11B(1)(d)(ii) to the effect that it is a credit provider for the purposes of the Privacy Act.
• this determination will be referred to as Determination 2004 No.1 Privacy Act 1988 s.11B(1)(d)(ii).
• the determination should lapse, unless continued by a further determination by the Privacy Commissioner, on 9 October 2005.
• subject to any application under s.11B(1)(d)(ii) of the Privacy Act before 9 October 2005 appropriate community consultations into the on-going applicability and suitability of this determination and the related Determinations 1999 No.1 and 2003 No. 3 would be conducted.

2.2 Consultation with the Social Justice Commissioner

For the purposes of IBA’s application, the Privacy Commissioner consulted with the Social Justice Commissioner on the proposed determination.  The Social Justice Commissioner responded on 5 July 2005 and supported the Privacy Commissioner’s proposal to conduct community consultations on the appropriateness of issuing IBA with a longer term determination of credit provider status (Attachment C). 

With regard to the Privacy Commissioner’s proposal to issue an interim 12 month determination the Social Justice Commissioner expressed the following main points:

• IBA, which was known as the Commercial Development Corporation prior to 2001, has a sound reputation for financial management.
• IBA has not previously administered programs which necessitate the collection of personal data.
• There is potential for inconsistencies to exist in the treatment of personal information between regional Indigenous Coordination Centres unless there are clear administrative processes.
• The Home Ownership Program (HOP) as administered until recently by ATSIS on behalf of ATSIC was audited by the ANAO (Performance Audit Report 53, 2004-05) (ANAO audit report).  This report found that “the management and protection of client information did not meet the requirements of the Privacy Act 1988” and that new arrangements for administering the program need to be finalised to ensure compliance with the Act.
• IBA has agreed with the recommendations made in the report regarding privacy and is committed to their implementation.

During the duration of the new determination the Privacy Commissioner proposes to undertake consultation with indigenous and other community groups on any new issues that may be relevant to the appropriateness of a longer term determination being issued.  Such review will be completed prior to the expiry of the new interim determination.

2.3 Issues raised by the Applicant

2.3.1 Credit provider determinations

IBA’s lawyers advised that it in its view IBA could not legally take the benefit of the existing credit provider determinations by transfer.  It submitted that without a credit provider determination, or any delay in granting credit provider status, can be expected to slow the approval of loans by six to eight weeks.  In that event customers will be asked by IBA to apply to a credit reporting agency to obtain a copy of their credit report which the individual must then forward to IBA.  Without a determination, or a delay in being granted credit provider status, IBA considered that its ability to administer its functions is significantly constrained.

IBA submitted that the Privacy Commissioner could issue a determination that it is a credit provider in relation to both housing and business loans and set that determination to expire once the Office has conducted a consultation process with indigenous and other groups. 

The application is for IBA to be granted credit provider status for a period of five years or until IBA ceases to administer the housing and business loan functions.

2.3.2 Response to privacy issues in the ANAO audit report

IBA advised that it assumed the loans functions after the field work for the ANAO audit report was completed.  In relation to the following privacy findings in the ANAO audit report, IBA made the following response to the Privacy Commissioner:

• ANAO recommended that HOP management includes detailed statements on all forms collecting personal information by potential or actual applicants about the purpose and authority for the collection of the information.  (ANAO recommendation No 2 (point 1):

IBA response: Agreed. IBA will incorporate purpose and authority statements on all forms which collect customer information.  These statements will meet the specifications in IPP 2 of section 14 of the Privacy Act.  The statements will include a notice advising individuals that information may be disclosed to a credit reporting agency, as required by paragraph 18E(8)(c) of the Privacy Act.

• ANAO recommended that HOP management establishes with the Indigenous Coordination Centres, where Housing Loans Units operate, appropriate arrangements for the storage and security of HOP client information.  (ANAO recommendation No 2 (point 2).

IBA response: Agreed.  IBA has written to the Office of Indigenous Policy Coordination to reiterate the programme’s requirements in relation to the Privacy Act and the need to have appropriate facilities for the collection and storage of customer information.

• ANAO noted that appropriate training critical in ensuring HOP staff use the ATSIC Loans System (ALS) database capabilities and provide the best possible service to indigenous clients (paragraph 4.38 of the audit report).  With the proposed update of HOP’s funding procedures manual, there will be a need to review the ALS operating guide and to provide training to loans officers in the specific application of the revised HOP policies and procedures (paragraph 4.45 of the audit report).

IBA response:  IBA is conscious of the need to ensure its staff are well trained in the use of its loan systems, including ALS.  Any update to the HOP funding procedures manual and subsequent revision to the ALS operating guide will be accompanied by appropriate training for staff that use the ALS.

2.4 Public interest and other relevant considerations

In considering the application, the Privacy Commissioner took account a number of factors:

a)      IBA is a newly established federal government agency performing the same lending functions in relation to the Indigenous Housing Fund and Business Development Program that ATSIC, ATSIS and DEWR, respectively, performed.  The same public interest considerations that were deliberated in the previous determinations (Determinations 1999 No. 1, 2003 No. 3 and 2004 No.1 respectively) continue to be relevant to IBA’s application;

b)     Part IIIA of the Privacy Act regulates consumer credit and, in limited circumstances, commercial credit.  Given that a majority of IBA’s business is to lend money to individuals for housing purposes and also for commercial purposes, the provision of a credit provider determination to IBA will enable it to undertake credit reporting in respect of both consumer and commercial credit;

c)      If IBA is not granted credit provider status there will be a delay of six to eight weeks while customers apply to a credit reporting agency to obtain a copy of their credit report which the individual must then forward to IBA.  If an individual falls into arrears IBA will be dependant on the individual to provide it with a copy of a credit report (with attendant delays) and IBA will not be able to compel its production.  Lastly, IBA will not be able to list an individual with a credit reporting agency that he or she is overdue with a payment or has committed a serious credit infringement;

d)     It is in the public interest that IBA have direct access to the credit reporting system regulated by Part IIIA of the Privacy Act for the following reasons.  IBA’s prudent lending policy is facilitated, inter alia, by timely access to a customer’s credit report when it assesses a loan application and in cases where it is necessary to collect payments that are overdue.  The timely provision of a customer’s credit report to IBA assists a customer in establishing to the satisfaction of the lender that that individual has an established credit history and is an acceptable credit risk.  The timely approval of a loan application in this way by IBA assists individuals compete with other buyers on an equal footing in purchasing homes or businesses on the open market;

e)      As many of IBA’s customers live in remote locations it is likely that approval of their loan applications by IBA will be slowed by six to eight weeks while they seek access to their credit reports from a credit reporting agency during the period while the Office conducts community consultation on IBA’s application.  After consulting with the Social Justice Commissioner, the Privacy Commissioner has formed the view that the determination should be issued for 12 months.  This determination of 12 months duration will enable IBA to access the credit reporting system to conduct its business.  It will also minimise inconvenience to loan applicants.

f)       IBA has agreed to comply with the ANAO’s audit report findings into privacy (see 2.3.2 above).  The ANAO also recommended that IBA undertake an assessment of the impacts, to client’s privacy, associated with the inappropriate access or disclosure of information collected by HOP (recommendation No 1 (point 1)).  Although IBA did not comment directly to the Privacy Commissioner on this recommendation it agreed with the recommendation in the published ANAO audit report (paragraph 2.33 of the audit report).  Having carefully considered the findings and recommendations made in the ANAO audit report regarding privacy and IBA’s commitments to implement them, the Privacy Commissioner was persuaded that IBA’s undertakings coupled with the public interest meant that a credit provider determination should not be refused solely on the grounds of the findings in the ANAO audit report.  The Office will review progress in the implementation of these undertakings by IBA prior to the consideration of a longer term credit provider determination.  

On all the material outlined in the conclusions regarding IBA’s application for a determination, the Privacy Commissioner concluded that it was substantially in the public interest for IBA to have credit provider status in carrying on the business of making loans for the purposes of the Privacy Act.

The Privacy Commissioner also concluded that Credit Reporting Determination 1999 No.1 should be revoked as ATSIC was abolished on 24 March 2005 by the Aboriginal and Torres Strait Islander Commission Amendment Act 2005.

3. LIST OF ATTACHMENTS

Attachment A: Letter dated 22 March 2005 from IBA’s solicitors, AGS, applying for a determination under s.11B(1)(d)(ii) of the Privacy Act.

Attachment B: Letter dated 9 May 2005 from AGS clarifying aspects of the application.

Attachment C: Letter dated 5 July 2005 from the Aboriginal and Torres Strait Islander Social Justice Commissioner (Social Justice Commissioner) of the Human Rights and Equal Opportunity Commission regarding consultation on the determination.

Attachment D: Letter dated 19 August 2005 from IBA responding to privacy issues raised in the ANAO report 53 of 2004-05.

Attachment E: Letter dated 22 August 2005 from AGS further clarifying aspects of the application.

Attachment F: Credit Reporting Determination: 1999 No 1 Privacy Act 1988, s.11B(1)(d) – concerning the Aboriginal and Torres Strait Islander Commission.

Attachment G: Determination 2003 No.3 Privacy Act 1988, s.11B(1)(d)(ii) – concerning the Aboriginal and Torres Strait Islander Services.

Attachment H: Determination 2004 No.1 Privacy Act 1988, s.11B(1)(d)(ii) – concerning the Department of Employment and Workplace Relations.

4. ATTACHMENTS

ATTACHMENT A

ATTACHMENT B

ATTACHMENT C

[Letter dated 5 July 2005 from the Aboriginal and Torres Strait Islander Social Justice Commissioner of the Human Rights and Equal Opportunity Commission regarding consultation on the Determination]

5 July 2005

Ms Karen Curtis

Privacy Commissioner

Level 8, 133 Castlereagh Street

Sydney NSW 2000

Dear Ms Curtis

Re: Application by Indigenous Business Australia for credit provider status under S.11B(1)(d)(ii) of the Privacy Act 1988 (Your ref: 2005-0104-01/bk)

I understand that Indigenous Business Australia (IBA) has recently applied for credit provider status in accordance with the provisions of the Privacy Act 1988.

IBA has assumed housing and business loan functions previously administered by ATSIC, ATSIS and DEWR. My understanding is that ATSIC made an application for credit provider status for these programs in 1999. Recent changes in the administration of Indigenous affairs have resulted in a series of applications for credit provider status by ATSIS in 2003 and then DEWR in 2004 as the responsibility for these programs was transferred by regulation.

The recent amendments to the ATSIC Act have legislatively transferred responsibility for these programs to IBA. Whereas arrangements with ATSIS and DEWR were transitional in nature, the transfer of responsibility for these programs to IBA is intended to be of a more permanent nature. I support your proposal to conduct consultations on the appropriateness of issuing a longer term Determination of Credit Provider Status on this basis.

In terms of issuing an interim determination of twelve months duration, I note the following regarding IBA and the administration of these programs:

• Indigenous Business Australia, which was known as the Commercial Development Corporation prior to 2001, has a sound reputation for financial management.
• Prior to the ATSIC Amendment Act of 2005, its operations have centred on large scale commercial development. It has not previously administered programs, such as the Home Ownership Programme, which necessitate personal data collection.
• As a result of the recent changes to Indigenous affairs, the Home Ownership Programme is now run through the network of regional Indigenous Coordination Centres (ICCs). As I note in my Social Justice Report 2004, these new arrangements are yet to be fully locked into place and there remain challenges to ensure consistent administration of programs. While I did not consider the impact of the new arrangements in terms of privacy protection, I consider that there is potential for inconsistencies to exist in the treatment of personal information between ICCs unless there are clear administrative processes.
• The Home Ownership Programme, as administered until recently by ATSIS on behalf of ATSIC, has been audited by the Australian National Audit Office (Performance Audit Report 53 / 2004-05). This report found that “the management and protection of client information did not meet the requirements of the Privacy Act 1988” and that new arrangements for administering the program need to be formalised to ensure compliance with the Act (para 11).
• The Australian National Audit Office has made six recommendations concerning the administration of this programme, one of which relates to ensuring compliance with the Privacy Act 1988. I note that IBA has agreed with these recommendations and is committed to ensuring compliance with the Act.
• I note the importance of the programme in supporting home ownership among Indigenous people, and that significant delays in processing IBA’s application could impact on the ability of the program to meet its objectives.
• I am not aware of any concerns with the Indigenous Business Development Programme, as previously run by DEWR.

On the basis of these factors, it appears that IBA now has responsibility for programmes which (at least in the case of the Home Ownership Programme) may not have been administered in recent times in compliance with the Privacy Act 1988. Their administration of these programmes is also complicated by the location of staff administering them in regional ICC’s.

In my view, both of these factors necessitate that the Privacy Commission inquire into the steps that have been taken by IBA to ensure compliance with the Privacy Act 1988 prior to any short term or interim determination being made. As noted above, IBA has a solid reputation for its financial management and these comments are therefore not intended to suggest that it would be inappropriate for IBA to be provided with credit provider status. Rather, I consider that the Privacy Commission should be satisfied that IBA is expeditiously taking steps to address the complex situation that it has inherited.

I also note that there is the potential for delays in assisting Indigenous people in securing home ownership that could result from a lengthy consideration of these issues by the Privacy Commission. I would urge that inquiries into the steps taken by IBA to ensure compliance with the Act also be conducted as swiftly as possible. 

I would also suggest that the Privacy Commission consider utilising available audit powers to assess the compliance of the programmes as administered by IBA after a suitable time period but prior to considering the issuance of a longer term Determination.

Please do not hesitate to contact my office if you have any queries.

Yours sincerely

Tom Calma

ATTACHMENT D

ATTACHMENT E

ATTACHMENT F

Credit Reporting Determination: 1999 No. 1 Privacy Act 1988, s.11B(1)(d) - concerning the Aboriginal and Torres Strait Islander Commission

Under section 11B(1)(d) of the Privacy Act 1988, I DETERMINE that:

1. The Aboriginal and Torres Strait Islander Commission is a credit provider for the purposes of the Privacy Act 1988.
2. This determination shall take effect fifteen sitting days following 22 November 1999.

Dated 16 November 1999.

MALCOLM CROMPTON

Privacy Commissioner

[Note: The above determination took effect on Friday 10 March 2000]

DETERMINATION 1999 No 1 PRIVACY ACT s11B(1)(d) - CONCERNING THE ABORIGINAL AND TORRES STRAIT ISLANDER COMMISSION - REASONS FOR DETERMINATION

1. Attached is a determination issued under section 11B(1)(d) with the effect that, for the purposes of the Privacy Act, the Aboriginal and Torres Strait Islander Commission (ATSIC) is a 'credit provider'.
2. Under section 11B(4) of the Privacy Act, the determination is a disallowable instrument for the purposes of the Acts Interpretation Act 1901.

BACKGROUND:

3.       Section 11B (1) (d) of the Privacy Act 1988 provides: For the purposes of this Act a person is a credit provider if the person is:

(d) an agency that:

(i) carries on a business or undertaking that involves the making of loans; and

(ii) is determined by the Commissioner to be a credit provider for the purposes of this Act.

4.       In 1998, the Aboriginal and Torres Strait Islander Commission (ATSIC) applied for a determination under section 11B(1)(d) of the Privacy Act 1988.

5.       ATSIC advised in its application that it meets the criteria contained in s.11B(1)(d)(i) for the following reasons:

• it has a statutory function of making loans under the Aboriginal and Torres Strait Islander Commission Act 1989 (the "ATSIC Act");
  • making loans is a core part of ATSIC's business; and
     

• it makes loans on a basis that equates with the 'normal commercial practice' of other credit providers.
   

6.       ATSIC considers that being a credit provider would greatly improve the efficiency of its loan assessment procedures as it would be able to obtain credit reports directly from a credit reporting agency. There is currently a delay of up to six weeks in obtaining copies of applicants' credit reports, as clients have to obtain their own reports and then provide them to ATSIC.

7.       ATSIC is also concerned that in some cases, clients may neglect to provide certain identifying information to the credit reporting agency which may result in an inaccurate report. This also means that there is no record of loan applications made to ATSIC by individuals recorded on their credit reports. This can mean that other credit providers are disadvantaged, as they have no indication of the financial relationships between ATSIC and the individuals. This could also work to the detriment of individuals, as it may allow them to become more and more burdened by debt, to the point of possibly losing their home or business as a result.

8.       With the permission of ATSIC, the former Privacy Commissioner, Moira Scollay, consulted widely and the following issues were raised in response:

• As a result of the determination, ATSIC may be able to use credit information for matters unrelated to credit.
• The identification of individuals as Aborigines or Torres Strait Islanders as a result of ATSIC appearing on their credit reports may lead to discrimination.
• The fact that ATSIC is already protected from false or misleading statements in relation to loan applications by section 197 of the ATSIC Act makes access to CRL unnecessary.

9.       ATSIC was advised of these issues and after a considerable interim, it responded as follows.

• All information provided to ATSIC by applicants in relation to a loan, grant or guarantee is subject to the secrecy provisions contained in section 90 of the ATSIC Act. Any release of loan information by a staff member or other officer listed in section 90 would constitute a criminal offence.
• While the majority of ATSIC funding is to Aboriginal and Torres Strait Islander people, ATSIC may provide funds, under its Home and Business Loan programs, to other individuals and organisations as well. A notation of ATSIC on a Credit Report would not of itself necessarily identify the person as an Aboriginal or Torres Strait Islander person. ATSIC also argues that it is not primarily a welfare-oriented body and that two private credit unions have recently been established to provide services to Aboriginal and Torres Strait Islander people. These credit unions are, by their nature, credit providers and have access to CRL.
• The fact that ATSIC may have recourse under its own legislation against applicants who provide false and misleading information does not lessen the need to have access to CRL. Such false or misleading information could be detected only after the loan is made and this may expose the applicant, other credit providers and ATSIC to disadvantage and detriment.

10.    On receiving ATSIC's response, my office sought the views of Mr Bill Jonas, the Aboriginal and Torres Strait Islander Social Justice Commissioner in the Human Rights and Equal Opportunity Commission. Commissioner Jonas advised that, in his view:

• there is nothing intrinsic in the structure of ATSIC that makes it more likely to misuse credit information than any other organisation. Moreover, there are provisions in both the ATSIC Act and the Privacy Act prohibiting such misuse.
• given that ATSIC has indicated that it provides loans to non-Aboriginal and Torres Strait Islander people, it is inappropriate for the Privacy Commissioner to assume that an individual who takes out a loan with ATSIC is necessarily an Aboriginal or Torres Strait Islander person. Concerns about discrimination are not relevant to the suitability of ATSIC as a credit provider. ATSIC should not be denied credit provider status on the basis that other persons or organisations might commit unlawful discrimination. The Commissioner also raised the prospect that such a denial might raise questions about the compliance of my office with the Race Discrimination Act.
• as ATSIC suggested, the existence of other mechanisms for recourse against misleading statements by applicants is beside the point.

 FINDINGS

11.    Given the response of ATSIC and Commissioner Jonas to the issues raised concerning the determination, I find that ATSIC does satisfy the criteria set out in section 11B(1)(d)(i) of the Privacy Act 1988. I also find that it would be substantially in the public interest for the requested determination to be made.

CONCLUSIONS

I have consequently made the attached determination.

Malcolm Crompton
Privacy Commissioner

16 November 1999

ATTACHMENT G

DETERMINATION 2003 No.3 PRIVACY ACT 1988, s.11B(1)(d)(ii) - concerning the Aboriginal and Torres Strait Islander Services

Under s.11B(1)(d)(ii) of the Privacy Act 1988, I DETERMINE that:

1. The Aboriginal and Torres Strait Islander Services is a credit provider for the purposes of the Act.
2. This determination shall take effect on 9 October 2003 and shall lapse, unless continued by a further determination of the Privacy Commissioner, on 9 October 2005.

TIMOTHY PILGRIM
Deputy Federal Privacy Commissioner

26 September 2003

DETERMINATION 2003 No. 3 UNDER s.11B(1)(d) - CONCERNING THE ABORIGINAL AND TORRES STRAIT ISLANDER SERVICES: REASONS FOR DETERMINATION

Background

1. Section 11B(1)(d) Privacy Act 1988 ('the Act') provides:

(1) For the purposes of this Act a person is a credit provider if the person is:

(d) an agency that:
(i) carries on a business or undertaking that involves the making of loans; and
(ii) is determined by the Commissioner to be a credit provider for the purposes of this Act.

2. On 16 November 1999, Determination 1999 No.1 was made under section 11B(1)(d)(ii) of the Act to the effect that the Aboriginal and Torres Strait Islander Commission (ATSIC) was a credit provider for the purposes of the Act.

3. In the Reasons for Determination forming part of Determination 1999 No.1, a number of factors were taken into account, which included:

• That ATSIC has a statutory function of making loans to individuals under the Aboriginal and Torres Strait Islander Commission Act 1989 (the 'ATSIC Act') and the making of such loans formed a core part of ATSIC's business;
• That ATSIC made loans on a basis that equated with 'normal commercial practice' of other credit providers and that being a credit provider would greatly improve the efficiency of ATSIC's loans procedures.

4. After wide consultation, several outstanding issues were referred for advice to the Aboriginal and Torres Strait Islander Social Justice Commissioner in the Human Rights and Equal

Opportunity Commission. Both the issues and the advice received from the Commissioner are detailed in the Reasons for Determination forming part of Determination 1999 No. 1.

5. The following findings were made:

• That ATSIC satisfied the criteria set out in section 11B(1)(d)(i) of the Act; and
• That it would be substantially in the public interest for the requested determination to be made.

The Establishment of ATSIS

6. On 11 August 2003, the Aboriginal and Torres Strait Islander Services (ATSIS) applied for a determination under section 11B(1)(d)(ii) of the Act.

7. In its application for credit provider status, ATSIS advised that on 28 May 2003 ATSIS was established as a federal Executive Agency under the Public Service Act 1999, and as a prescribed agency under the Financial Management and Accountability Act 1997 with effect from 1 July 2003. ATSIS is subject to the provisions of the Act.

8. Pursuant to these legislative arrangements, ATSIS advised that:

• ATSIS has assumed, on a temporary basis, the financial responsibility for many of the programs formerly administered by ATSIC;
• ATSIC, however, retains responsibility for the housing loans program under the ATSIC Act;
• Subject to the making of this determination, it is intended that ATSIS will:
• make all new business loans, which were made previously by ATSIC, on behalf of the Australian Government;
• Make such loans in accordance with sound commercial practice and within the constraints of the definition of 'commercial credit' in section 6 of the Act;
• Administer existing ATSIC business loans, under the terms of an agreement between ATSIC and ATSIS, paying all moneys recovered regarding ATSIC's pre-July 2003 loans into an ATSIC bank account.

Consultation with Social Justice Commissioner

9. The views of the Aboriginal and Torres Strait Islander Social Justice Commission were sought and received regarding the application by ATSIS. The effect of the Commissioner's advice was that:

• The arrangements between ATSIC and ATSIS are temporary, pending a final decision by the Australian Government as to the future of ATSIC and ATSIS;
• The exact considerations relating to ATSIC's earlier application for credit provider status now apply to ATSIS and its relevant functions;
• The Commissioner supports a similar credit provider determination being made for ATSIS as was made for ATSIC.

Analysis

10. On the advices received, the following conclusions are made:

• It is clear that, apart from housing loans which remain the responsibility of ATSIC, the conduct of, and the responsibility, for many ATSIC programs, have been transferred to ATSIS;
• There is no need to review Determination 1999 No. 1 concerning the credit provider status of ATSIC, as it continues to be a credit provider by virtue of the housing loans it offers;
• As a result of the transfer of some responsibilities to it, ATSIS will be carrying on a business or undertaking that involves the making of loans;
• The same considerations that supported the making of Determination 1999 No. 1, concerning ATSIC, apply to the application by ATSIS. It will, therefore, be in the interests of both ATSIS, and its clients, for ATSIS to have credit provider status in carrying on the business of making loans for the purposes of the Act;
• As to the life of the determination, having been advised by ATSIS that the current arrangements may be temporary, I take the view that it should not be open-ended, but should be the subject of further review when the administrative arrangements of ATSIS are settled. I consider that a period of two years, commencing on 9 October 2003, is appropriate for this purpose.
• Under sections 11B(3) & (4), the determination under section 11B(1)(d)(ii) is a disallowable instrument for the purposes of section 46A of the Acts Interpretation Act 1901.

Determination

11. I find that:

• ATSIS satisfies the criteria set out in section 11B(1)(d)(i) of the Act;
• Having regard to the matters identified above, it is substantially in the public interest for the determination sought by ATSIS to be made under section 11B(1)(d)(ii);
• I have included in Determination 2003 No. 3 that it is to lapse, unless continued by a further determination, on 9 October 2005.

TIMOTHY PILGRIM
Deputy Federal Privacy Commissioner

26 September 2003

ATTACHMENT H

DETERMINATION 2004 No. 1 PRIVACY ACT 1988, s.11B(1)(d)(ii) - concerning the Department of Employment and Workplace Relations

Under s.11B(1)(d)(ii) of the Privacy Act 1988, I DETERMINE that:

1. The Australian Government Department of Employment and Workplace Relations is a credit provider for the purposes of the Act.
2. This determination shall take effect on 8 September 2004 and it shall lapse, unless continued by a further determination of the Privacy Commissioner, on 9 October 2005.

KAREN CURTIS
Federal Privacy Commissioner

2 September 2004

DETERMINATION 2004 NO.1 UNDER s.11B(1)(d)(ii) - CONCERNING THE DEPARTMENT OF EMPLOYMENT AND WORKPLACE RELATIONS: REASONS FOR DETERMINATION

The Reasons for making Determination 2004 No.1 are set out below.

Section 11B(1)(d) of the Privacy Act 1988 (the Act) provides:

(1) For the purposes of this Act a person is a credit provider if the person is:

(d) an agency that:

1. carries on a business or undertaking that involves the making of loans; and
2. is determined by the Commissioner to be a credit provider for the purposes of this Act.

Application by ATSIC

1. On 16 November 1999, Determination 1999 No.1 was made under section 11B(1)(d)(ii) of the Act to the effect that the Aboriginal and Torres Strait Islander Commission (ATSIC) was a credit provider for the purposes of the Act. A copy of Determination 1999 No.1 is Attachment A.

2. For the purposes of that Determination, the Office consulted widely on a number of issues and received advice from the Aboriginal and Torres Strait Islander Social Justice Commissioner (the Social Justice Commissioner) in the Human Rights and Equal Opportunity Commission. Both the issues and the advice received are detailed in the Reasons for Determination forming part of Determination 1999 No. 1.

3. In making Determination 1999 No.1, a number of factors, as detailed in the Reasons for Determination, were taken into account They included:

• That ATSIC has a statutory function of making loans to individuals under the Aboriginal and Torres Strait Islander Commission Act 1989 (the ATSIC Act) and the making of such loans formed a core part of ATSIC's business; That ATSIC made loans on a basis that equated with the 'normal commercial practice' of other credit providers and that being a credit provider would greatly improve the efficiency of ATSIC's loans procedures.

Application by ATSIS

5. On 11 August 2003, the Aboriginal and Torres Strait Islander Services (ATSIS) applied for a determination under section 11B(1)(d)(ii) of the Act. In its application for credit provider status, ATSIS advised that, on 28 May 2003, it was established as a federal Executive Agency under the Public Service Act 1999, and as a prescribed agency under the Financial Management and Accountability Act 1997 with effect from 1 July 2003. ATSIS is subject to the provisions of the Act.

6. Pursuant to these legislative arrangements, ATSIS advised that:

• ATSIS had assumed, on a temporary basis, the financial responsibility for many of the programs formerly administered by ATSIC;
• ATSIC, however, retained responsibility for the housing loans program under the ATSIC Act;
• Subject to the making of this determination, it was intended that ATSIS would:
  • make all new business loans, which were made previously by ATSIC, on behalf of the Australian Government;
  • make such loans in accordance with sound commercial practice and within the constraints of the definition of 'commercial credit' in section 6 of the Act; and
  • administer existing ATSIC business loans, under the terms of an agreement between ATSIC and ATSIS, paying all monies recovered regarding ATSIC's pre-July 2003 loans into an ATSIC bank account.

Consultation with Social Justice Commissioner

7. The views of the Social Justice Commissioner were sought and received regarding the application by ATSIS. The effect of the Social Justice Commissioner's advice was that:

• the arrangements between ATSIC and ATSIS were temporary, pending a final decision by the Australian Government as to the future of ATSIC and ATSIS;
• the same considerations relating to ATSIC's earlier application for credit provider status then applied to the application by ATSIS; and
• the Social Justice Commissioner supported a similar credit provider determination being made for ATSIS as had been made for ATSIC.

Conclusions regarding ATSIS application

8. On the advice then received, it was concluded, inter alia, that:

• as a result of the transfer of some of ATSIC's responsibilities to it, ATSIS would be carrying on a business or undertaking that involved the making of loans;
• the same considerations that had supported the making of Determination 1999 No. 1, concerning ATSIC, applied to the application by ATSIS;
• it would be in the interests, then, of both ATSIS and its clients, for ATSIS to have credit provider status in carrying on the business of making loans for the purposes of the Act; and
• since ATSIS had advised that the arrangements with ATSIC might be temporary, the life of the determination should not be open-ended, but should be the subject of further review when the administrative arrangements of ATSIS were settled A period of two years commencing 9 October 2003 was considered appropriate for this purpose.

9. Accordingly, these findings were made:

• ATSIS had satisfied the criteria set out in s.11B(1)(d)(i) of the Act.
• Having regard to the matters identified above, it was substantially in the public interest for the determination sought by ATSIS to be made under s.11B(1)(d)(ii).
• The Determination 2003 No.3 would lapse on 9 October 2005, unless continued by a further determination.

10. A copy of Determination 2003 No.3 is Attachment B.

Application by Department of Employment and Workplace Relations

11. On 22 July 2004, the Department of Employment and Workplace Relations (the Department) applied for a Determination under s.11B(1)(d)(ii) of the Act.

12. In its application, the Department advised that in April 2004 the Australian Government announced the following legislative proposals:

• The responsibility for ATSIC and ATSIS programmes and functions would be transferred to "mainstream agencies" including the Department.
• The Australian Government would abolish ATSIC and ATSIS.
• The responsibility for the Business Development Programme (the BDP) formerly administered by ATSIC and (from 1 July 2003) by ATSIS would be transferred to the Department.
• The administration of the BDP would be transferred to Indigenous Business Australia (IBA), a new statutory corporation established under Part 4 of the ATSIC Act.

13. On 27 May 2004, the Aboriginal and Torres Strait Islander Commission Amendment Bill 2004 (the Bill) was introduced into the House of Representatives and was passed on 2 June 2004. The Senate has referred the Bill to the Select Committee on the Administration of Indigenous Affairs to report by 31 October 2004.

14. Since 1 July 2004, ATSIS has retained a "residual role" in relation to the BDP. It continues to administer loans made before 1 July 2003 on behalf of ATSIC (see paragraph 6 above), whereas the Department has assumed the function of administering the BDP. All new business loans continue to be made by the Australian Government, which is now represented by the Department.

15. The Department has applied, therefore, for separate credit provider status to enable it to perform its loan functions under the BDP.

Factors advanced in support of the application by the Department

16. ATSIS staff, including senior management, with experience in the administration of the BDP were transferred to the Department on 2 July 2004 pursuant to s.72 of the Public Service Act 1999. The Department intends to liaise with the IBA so as to avail itself of the expertise developed by the IBA in administering the relevant provisions of the ATSIC Act.

17. The Department claims considerable experience and expertise in the administration and management of Indigenous Australian programmes, which include the Indigenous Employment Programme. These schemes, the Department notes, complement financial assistance initiatives already administered by the Department.

18. Under the BDP, loans come within the definition of 'commercial credit' in the Act and will be made, the Department notes, in accordance with sound commercial practice and with the financial management obligations imposed on Australian Government agencies.

19. In effect, the Department will be making loans on a basis that equates with the 'normal commercial practice' of other credit providers and that being a credit provider would greatly improve the efficiency of the Department's loans procedures. With credit provider status, Departmental staff will be able to gain access to credit records of applicants for business loans and to use this information to administer those loans.

Analysis

20. Regarding the history of the Credit Provider Determinations made in favour of ATSIC and ATSIS respectively, the matters outlined in the preceding paragraphs 2 to 9 (inclusive) are taken into account in considering the Department's application under s.11B(1)(d)(ii) of the Act.

21. Regarding the Department's application, the following conclusions are drawn:

• For the time being, ATSIC and ATSIS should retain their credit provider status under Determination 1999 No.1 and Determination 2003 No.3.
• The present arrangements involving the three relevant agencies and their loan-making functions need to be resolved. Pending the final resolution of these arrangements and a subsequent review of their credit provider status at an appropriate time, both ATSIC and ATSIS should continue to retain that status.
• The statutory obligations relating to the administration of the BDP are now shared between ATSIS and the Department, in much the same way as those functions were shared between ATSIC and ATSIS after 1 July 2003. Furthermore, ATSIS and ATSIC maintain a relationship of agency regarding the administration of certain loans.
• Similar considerations should be applied to the Department's application as were applied to the previous applications which resulted in the Determinations 1999 No.1 and 2003 No.3. These considerations include the outcomes from the consultations conducted by the Office with the then Social Justice Commissioner and with other relevant stakeholders.
• For the purposes of the Department's application, the Office consulted with the Aboriginal and Torres Strait Islander Social Justice Commissioner on the proposed determination. Commissioner Calma did not express any concerns regarding the making of the determination.
• Given the reasons advanced in support of the applications by ATSIC and ATSIS and the findings that it was in the public interest for determinations to be made granting credit provider status to ATSIC and ATSIS, it follows then that, since the Department now performs those same loan functions, there is adequate support for the Department's application.
• The business of making loans for the purposes of the BDP will be conducted by Departmental personnel who are experienced in the field of managing financial programmes for the benefit and assistance of indigenous persons and who, in large part, have been transferred from ATSIS.
• On all the material outlined in these Reasons for Determination, it is open to me to conclude, therefore, that it will be in the interests of ATSIS, the Department and their respective clients for the Department to have credit provider status in carrying on the business of making loans for the purposes of the Act.

22. Regarding the life of any determination to be made in favour of the Department, the following matters are noted:

• In its application, the Department requests that the determination lapse approximately two years from the date of the making of the determination.
• The Department has advised that the legislative intentions of the Australian Government (as described in paragraph 12 above), as yet, have not been realised.
• As concluded above, the current arrangements under which credit provider status for the purposes of the Act is enjoyed by ATSIC and ATSIS, and which the Department seeks, appear to be temporary.
• The temporary state of these arrangements indicates a need for me to review the two existing Determinations and any determination made in favour of the Department within a reasonable and definite period of time.
• I note that Determination 2003 No.3 is to lapse on 9 October 2005, unless continued by a further determination. Until that date, I find that there are no factors which prevent the continuation of the existing credit provider determinations in favour of ATSIC and ATSIS.
• Given that 9 October 2005 is the date by which an application needs to be made for a further determination in favour of ATSIS, I find it is also an appropriate date on which any determination in favour of the Department should lapse, unless continued by a further determination.
• Subject to any further applications being made regarding these determinations, I intend to review, pursuant to ss.28A(1)(d) and s.28A(2) of the Act, the two existing determinations and any determination made in favour of the Department. Any such review will be conducted on or before 9 October 2005.
• Similarly, subject to any application made regarding these determinations, any review will involve appropriate community consultation, including consulting with the Social Justice Commissioner.

Findings

23. I make the following findings:

• The Department satisfies the criteria set out in section 11B(1)(d)(i) of the Act in that it is an agency that carries on the business or undertaking that involves the making of loans.
• Having regard to the matters identified above, it is substantially in the public interest for the determination sought by the Department to be made under section 11B(1)(d)(ii) to the effect that it is a credit provider for the purposes of the Act.
• This determination will be referred to as Determination 2004 No.1 PRIVACY ACT 1988 s.11B(1)(d)(ii).
• This determination shall lapse, unless continued by a further determination by the Privacy Commissioner, on 9 October 2005.
• Subject to any application under s.11B(1)(d)(ii) of the Act before 9 October 2005, I intend to conduct appropriate community consultations into the on-going applicability and suitability of this determination and the related Determinations 1999 No.1 and 2003 No. 3.

KAREN CURTIS
Federal Privacy Commissioner

2 September 2004