Privacy Act 1988 - Determination No. 1991-2 (s.18E(3))

Overview

The Privacy Act 1988, enacted by the Australian Parliament, was introduced to address the growing concerns over the protection of personal information, particularly in the context of credit reporting. The 1991 Determination under the Privacy Act 1988 concerning identifying particulars permitted to be included in a credit information file, made by the Privacy Commissioner Kevin Patrick O'Connor, specifies the types of personal information that can be included in credit reports to ensure they are both identifiable and useful for credit assessment purposes. This determination aims to balance the need for accurate identification with the protection of personal privacy, setting out specific details such as full name, aliases, sex, date of birth, addresses, employment, and driver’s licence number, while ensuring these inclusions are both necessary and reasonable.

Scope and Application

The Legislative Instrument F2009B00172, which is a determination under the Privacy Act 1988, specifies the kinds of identifying particulars that are permitted to be included in an individual's credit information file. This determination applies to credit reporting agencies and any entity involved in the collection, storage, or use of credit information in Australia. It is a Commonwealth-level determination, applicable across the nation, and is intended to ensure that credit information files contain only the necessary identifying information to facilitate accurate credit reporting while respecting privacy concerns. The specified information includes the individual's full name, including any known aliases, sex, date of birth, up to three addresses, the name of the current or last known employer, and driver's licence number. This determination took effect on 24 September 1991, and it does not specify any exclusions or exemptions, but rather sets the parameters for what information is considered reasonably necessary for credit reporting purposes.

Key Provisions

The legislative instrument (F2009B00172) under the Privacy Act 1988 specifies the types of identifying particulars that can be included in an individual's credit information file. According to section 18E(3), the information required to identify an individual must include their full name (including any known aliases), sex, date of birth, a maximum of three addresses (comprising a current or last known address and two immediately previous addresses), the name of their current or last known employer, and their driver's licence number. This determination was made by the Privacy Commissioner on 11 September 1991 and took effect on 24 September 1991. Entities responsible for maintaining credit information files are obligated to ensure that they include only the specified types of information necessary for identification purposes. They must not include any additional personal information beyond what is stipulated unless it is required for a specific purpose that is authorised under the Privacy Act. This includes financial institutions, credit providers, and any other entities involved in the credit reporting process. Failure to comply with the requirements set out in this determination could result in legal consequences. The Privacy Act 1988 provides for various penalties for breaches, including fines and potential civil action. The specific penalties depend on the nature and severity of the breach, but they can be significant, reflecting the importance of protecting personal information and maintaining privacy standards. The Act also allows for enforcement actions by the Office of the Australian Information Commissioner, which can include investigations and the imposition of penalties.