Privacy Act 1988 - Section 18A - Credit Reporting Code of Conduct - Amendments

Administered by Department of the Prime Minister and Cabinet

Legislation au F2009B00171 Not in force Legislative Instrument

Legislation content

CREDIT REPORTING:   CODE OF CONDUCT

PRIVACY ACT 1988 SECTION 18A

  1. Under section 18A of the Privacy Act 1988, I ISSUE amendments to the Code of
    Conduct for Credit Reporting, as attached.
  2.           These amendments to the Code of Conduct shall take effect as from 27 March 1995.

Dated 6th March   1995

 

KEVIN PATRICK O'CONNOR Privacy Commissioner

Further information about the amendments to the Code of Conduct can be obtained from the Office of the Privacy Commissioner on 02-2849600 (telephone) or 02-2849666 (facsimile).

 

CREDIT REPORTING CODE OF CONDUCT - AMENDMENTS

PART 1 - CREDIT REPORTING AGENCIES

Existing paragraphs 1.7 to 1.12 of the Code of Conduct are being deleted and replaced with new paragraphs as outlined below. The replacement paragraphs consist of two new paragraphs (1.7 and 1.8), two paragraphs which have been modified slightly from the original version (1.9 and 1.11), and three paragraphs which are essentially the same as the original paragraphs but with changes to their numbering (1.10, 1.12, and 1.12A).

Paragraphs 1.7 to 1.12A will now read as follows:

"1.7 A credit reporting agency must ensure that an individual is given access to his or her

personal credit information file in circumstances where the request for access

(a)          relates to refusal of the individual's application for credit, or

(b)         is otherwise related to the management of the individual's credit arrangements.

1.8 Where a credit reporting agency receives a request from an individual for access to his
or her credit information file, and:

(a)          it appears to the credit reporting agency that the access is not related to either of
the purposes described in paragraph 1.7, above; and

(b)          the processing of the request would impact unreasonably on the ability of the
credit reporting agency to process requests made in accordance with paragraph
1.7;

the credit reporting agency may:

(i)     refuse the request for access;

(ii)    defer the request for access; or

(iii)   charge a fee for access to offset the impact of the request on its operations, as described in (b), above.

1.9                            Where a credit reporting agency refuses or defers a request by an individual or his/her
authorised agent for access to the individual's credit information file, or charges a fee
for such access, the individual or his/her authorised agent may complain to the Privacy
Commissioner, who may order the credit reporting agency to provide access to that
person (including an order that access be provided free of charge).

1.10                        In meeting an individual's request for access to his or her credit information file, a
credit reporting  agency  should require  such evidence as  is  reasonable  in the
circumstances to satisfy itself as to the identity of the individual.

 

1.11 A credit reporting agency in receipt of a request by an individual for access to his or
her credit information file, for purposes described in paragraph 1.7 above, must give
access within 10 working days of having received the request for access.

 

Fees for Access

1.12 A credit reporting agency may not charge a fee for access by an authorised agent of an

individual unless the agency believes on reasonable grounds that the agent has requested a copy of the individual's credit information file while acting as a business intermediary between the individual and the credit provider.

1.12A     Where a credit reporting agency denies access to an individual or his or her authorised agent because the individual or the agent has refused to pay the fee, the agency should advise the individual concerned that he or she may refer the matter to the Privacy Commissioner."

PART 2 - CREDIT PROVIDERS

Reporting of Schemes of Arrangement

Delete paragraph 2.10 and replace it with the following:

"2.10       Where a credit provider has previously listed with a credit reporting agency an overdue payment or a serious credit infringement against an individual in respect of an amount outstanding, and the credit provider subsequently enters into an arrangement with the individual for the repayment of the outstanding amount, the credit provider may contact the credit reporting agency to advise that a note should be included in the individual's credit information file to the effect that an arrangement has been entered into with the individual for repayment of the outstanding amount."

Disclosure Between Credit Providers

Add the following paragraph immediately after paragraph 2.14:

"2.14A    A record which is made by a credit provider in accordance with paragraph 2.14 should be retained for a minimum period of 12 months from the date on which it is made."

Overview

The Credit Reporting: Code of Conduct was enacted to amend the existing Code of Conduct for Credit Reporting under Section 18A of the Privacy Act 1988. These amendments, issued by the Privacy Commissioner, Kevin Patrick O'Connor, on 6th March 1995, were designed to address the need for more stringent privacy protections in the handling of personal credit information by credit reporting agencies and credit providers. The amendments reflect a policy objective to ensure that individuals have appropriate access to their personal credit information while maintaining the operational efficiency of credit reporting agencies. The changes introduced new provisions that mandate credit reporting agencies to provide access to personal credit information under specific circumstances, allow for the refusal or deferral of such access requests under certain conditions, and establish procedures for complaints regarding denied access. These amendments highlight the legislative intent to balance the rights of individuals with the legitimate interests of credit reporting agencies and credit providers in the efficient management of credit-related information.

Scope and Application

The legislative instrument F2009B00171, issued under section 18A of the Privacy Act 1988, concerns amendments to the Code of Conduct for Credit Reporting. These amendments apply to credit reporting agencies and credit providers, both of which are entities that manage and provide credit information. The geographic and jurisdictional reach of this legislation is national, as it pertains to credit reporting practices across Australia. There are no stated exclusions or exemptions within the scope of these amendments, meaning that all credit reporting agencies and credit providers must adhere to the new standards set forth by the amendments. The application of this Act may be further defined or restricted through subordinate instruments, ensuring that the regulatory framework can adapt to changes in industry practices and technology. The amendments aim to protect individuals' privacy while ensuring that credit reporting agencies and credit providers can effectively manage and share credit information.

Key Provisions

The amendments to the Code of Conduct for Credit Reporting, effective from 27 March 1995, primarily involve changes to the obligations of credit reporting agencies and credit providers under the Privacy Act 1988 section 18A. The key operative sections (1.7 to 1.12A) detail the conditions under which credit reporting agencies must grant access to an individual's personal credit information file. For example, section 1.7 mandates that agencies must provide access if the request relates to a refusal of credit application or is otherwise connected to credit management. Section 1.8 allows agencies to refuse, defer, or charge a fee for access if the request does not meet these criteria and would unreasonably impact their operations. Credit reporting agencies have specific obligations under these amendments. They must ensure individuals can access their credit information file if the request is related to a credit refusal or credit management, as outlined in section 1.7. Agencies can refuse, defer, or charge a fee if the request does not meet these criteria and processing the request would unreasonably impact their operations, as specified in section 1.8. Section 1.9 provides a mechanism for individuals to complain to the Privacy Commissioner if their request is refused or deferred, or if a fee is charged, enabling the Commissioner to order the agency to provide access. Additionally, agencies must require reasonable evidence of identity to verify an individual's request, as per section 1.10, and must provide access within 10 working days if the request meets the criteria in section 1.7. There are also specific provisions regarding fees for access. Section 1.12 prohibits agencies from charging fees for access by an individual's authorised agent unless the agency reasonably believes the agent requested the file while acting as a business intermediary. If access is denied due to an unpaid fee, section 1.12A advises the individual that they may refer the matter to the Privacy Commissioner. In terms of credit providers, the amendments modify their reporting and record-keeping obligations. For example, section 2.10 allows credit providers to notify credit reporting agencies of repayment arrangements, which should be reflected in the individual's credit file. Section 2.14A mandates that records made in accordance with section 2.14 must be retained for a minimum period of 12 months. Failure to comply with the provisions of the amended Code of Conduct can lead to various consequences. Credit reporting agencies may face orders from the Privacy Commissioner to provide access to credit information, potentially free of charge, if they improperly refuse, defer, or charge a fee for access. Similarly, credit providers may face scrutiny if they fail to report repayment arrangements accurately or maintain required records. These amendments underscore the importance of adherence to privacy laws and the rights of individuals regarding their credit information.

Legal classification tags

Area of Law
Privacy Law
Instrument
Legislative Instrument
Concepts
Definitions & Interpretation
Compliance Obligations
Reporting & Disclosure Obligations

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.