Explanatory Statement
Privacy (Credit Related Research) Rule 2024
This explanatory statement has been prepared by the Privacy Commissioner (the Commissioner), in accordance with the functions and powers conferred on them by s 12 of the Australian Information Commissioner Act 2010 (the AIC Act).
It explains the purpose and intended operation of the Privacy (Credit Related Research) Rule 2024 (the Rule) made under s 20M(3) of the Privacy Act 1988 (the Privacy Act). The Rule repeals and replaces the Privacy (Credit Related Research) Rule 2014 (Previous Rule).
It also provides background information on Part IIIA of the Privacy Act, which regulates the collection and handling of credit reporting information by credit reporting bodies (CRBs) and credit providers to provide context for the purpose and operation of the Rule.
Authority for the Rule
Section 20M of the Privacy Act provides:
Use or disclosure
(1) If:
a) a credit reporting body holds credit reporting information; and
b) the information (the de-identified information) is de-identified; [sic]
the body must not use or disclose the de-identified information.
(2) Subsection (1) does not apply to the use or disclosure of the de-identified information if:
a) the use or disclosure is for the purposes of conducting research in relation to credit; and
b) the credit reporting body complies with the rules made under subsection (3).
Commissioner may make rules
(3) The Commissioner may, by legislative instrument, make rules relating to the use or disclosure by a credit reporting body of de-identified information for the purposes of conducting research in relation to credit.
(4) Without limiting subsection (3), the rules may relate to the following matters:
a) the kinds of de-identified information that may or may not be used or disclosed for the purposes of conducting the research;
b) whether or not the research is research in relation to credit;
c) the purposes of conducting the research;
d) consultation about the research;
e) how the research is conducted.
Section 6(1) of the Privacy Act defines:
‘Commissioner’ to mean the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010.
‘Credit reporting body’ to mean:
a) an organisation; or
b) an agency prescribed by the regulations;
that carries on a credit reporting business.
‘De-identified’ to mean personal information is de‑identified if the information is no longer about an identifiable individual or an individual who is reasonably identifiable.
As a ‘privacy function’ the Rule can be made by the Privacy Commissioner in accordance with the functions and powers conferred in s 12 of the Australian Information Commissioner Act.
Purpose
In making this Rule, the Commissioner has had regard to the objects of the Privacy Act, in particular:
- to promote the protection of the privacy of individuals (s 2A(a))
- to recognise that the protection of privacy of individuals is balanced with the interests of entities carrying out their functions or activities (s 2A(b))
- to promote responsible and transparent handling of personal information by entities (s 2A(d))
- to facilitate an efficient credit reporting system while ensuring that the privacy of individuals is respected (s 2A(e)).
The purpose of s 20M is to permit the use or disclosure of de-identified information in credit related research, where it is in the public interest. However, as noted in the Explanatory Memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012 (Explanatory Memorandum), CRB’s conduct research in relation to credit to assess and manage the credit system in Australia. To ensure that research is consistent with policy objectives and appropriately limited in scope, the research will only be permitted where it complies with rules that the Commissioner may make under s 20M(3) of the Privacy Act.
The purpose of the Rule is to give effect to s 20M(3) of the Privacy Act. CRBs must comply with the Rule. Although the Commissioner has a discretion to make the Rule, if the Rule is not made, CRBs will not be able to meet their requirements under s 20M(2). Therefore, CRBs would not be able to use or disclose de-identified information for research in relation to credit.
Operation of the Rule
The use or disclosure of de-identified information for the purposes of conducting credit related research must be in accordance with the Rule. Subsection 20M(4) of the Privacy Act provides a non-exhaustive list of matters which the Rule may consider. The list identifies matters that are relevant to ensuring that the permitted research is for the general benefit of the public and in the public interest.[1]
The Rule clearly states that the re-identification of de-identified information is prohibited except where required to do so by Australian law or a court/tribunal.
An explanation of the provisions is set out in Attachment B.
Background
Introduction of national credit reporting legislation
Part IIIA of the Privacy Act regulates the collection and handling of credit reporting information by CRBs and credit providers. Credit reporting information is used by CRBs to create consumer credit reports and assess an individual’s creditworthiness. Part IIIA was inserted into the Privacy Act by the Privacy Amendment Act 1990 and came into effect on 24 September 1991.
2014 reforms
In 2014, major reforms were made to the Privacy Act in response to the recommendations in the 2008 Australian Law Reform Commission Report For your Information.[2]
The Privacy Amendment (Enhancing Privacy Protection) Act 2012 repealed the former Part IIIA and introduced a new Part IIIA to allow for more comprehensive credit reporting. Five new kinds of information were introduced into the credit reporting system to improve the ability of credit providers to assess an individual’s creditworthiness.[3]
In Part IIIA, Division 2 sets out rules that apply to CRBs and Subdivision D of Division 2 contains a number of protections with regard to credit reporting information. Under s 20M(1), CRBs cannot use or disclose de-identified credit reporting information. Section 20M(2)(b) creates an exception which allows a CRB to use de-identified information when it complies with the rules made under subsection (3). Section 20(3) grants the Commissioner the power to make rules relating to the use or disclosure by a CRB of de‑identified information for the purposes of conducting research in relation to credit.
De-identified information
The concept of de-identified information is important. De-identification of a dataset enables the information to be used by an organisation while preserving the privacy of individuals and ensuring compliance with privacy legislation. Examples included the use of de-identified data to evaluate national immunisation programs.
Subsection 4(2) of the Rule sets out the following definition of de-identified information:
De-identified information means credit reporting information that is no longer about an identifiable individual or an individual who is reasonably identifiable
This definition is consistent with the definition of ‘de-identified’ contained in s 6(1) of the Privacy Act.
Changes made to the Privacy (Credit Related Research) Rule
The Rule has been remade on substantially the same terms as the Previous Rule. Dates have been updated in the Rule to reflect the remaking of the Rule. Minor clarifications have been made to the provisions at Attachment B.
Consultation
The Office of the Australian Information Commissioner (OAIC) has complied with the requirements of the Legislation Act 2003 (Legislation Act) and the recommendations set out in the Explanatory Memorandum, as well as the guidance contained in the Office of Parliamentary Counsel Instruments Handbook.[4]
As a legislative instrument, the Rule must be developed in accordance with the requirements in the Legislation Act. Section 17 of the Legislation Act requires the rule-maker to be satisfied that there has been ‘appropriate’ consultation, which draws on the ‘knowledge of persons having expertise in fields relevant to the proposed instrument’ and ensures that people likely to be ‘affected by the proposed instrument had an adequate opportunity to comment on its proposed content’.[5]
The OAIC undertook a preliminary consultation in April-May 2023 with the Australian Retail Credit Association (ARCA) and the three main CRBs (Equifax, Experian and Illion). The OAIC incorporated the information gained during preliminary consultation and released a draft rule for public consultation on 12 February 2024.
The OAIC conducted a 4-week public consultation during February and March 2024 on the draft Rule. Comment was invited from the public and specific notices were sent to ARCA, the three main CRBs, and consumer advocate groups. Consultation documents were made available on the OAIC’s website during the consultation period.
The OAIC received three written submissions in response to the public consultation documents. The submissions were considered and incorporated where appropriate when finalising the Rule. Following the completion of the ongoing reforms to the Privacy Act, the OAIC will consider whether further amendments to the Rule are necessary to ensure consistency of regulation. The Rule is substantially the same as that provided during the public consultation process.
Policy Impact Analysis
The Office of Impact Assessment (OIA) has assessed the Rule as likely to have only a negligible regulatory impact on individuals, communities or businesses. The OIA has confirmed that the preparation of a detailed Policy Impact Analysis is not required for the Rule. The OIA reference number is OIA24-07465.
A Statement of Compatibility with Human Rights is at Attachment A.
Attachment A
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Privacy (Credit Related Research) Rule 2024
This Disallowable Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in s 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the Legislative Instrument
Part IIIA of the Privacy Act 1988 (the Privacy Act) regulates the collection and handling of credit reporting information by credit reporting bodies (CRBs) and credit providers. Under s 20M(1) of the Privacy Act, CRBs are prohibited from using or disclosing de-identified credit reporting information. Section 20M(2) provides an exception to this prohibition which allows CRBs to use or disclose de-identified credit reporting information if done for the purposes of conducting research in relation to credit and in accordance with any rules made by the Commissioner. Section 20M(3) of the Privacy Act grants the Commissioner the power to make rules, by legislative instrument, relating to the use or disclosure by CRBs of de-identified information for the purposes of conducting research in relation to credit.
The purpose of the Privacy (Credit Related Research) Rule 2024 (the Rule) is to give effect to ss 20M(2) and (3) of the Privacy Act. The Rule implements the intention of Parliament by addressing the matters identified by the Explanatory Memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012, including that the research be in the public interest and appropriately limited in scope and that the risk of re-identification is minimised.
The Rule repeals and replaces the Privacy (Credit Related Research) Rule 2014 and is made in substantially the same terms following feedback received from stakeholders during the consultation process.
Human rights implications
The Rule engages Article 17 of the International Covenant on Civil and Political Rights (ICCPR).
Article 17 of the ICCPR provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference and attacks.
This right to privacy is not absolute and there may be circumstances in which the guarantees in Article 17 can be limited to achieve a legitimate objective. Any limitations on privacy must also be authorised by law and not arbitrary. The term ‘arbitrary’ in Article 17(1) of the ICCPR means that any interference with privacy must be in accordance with the provisions, aims and objectives of the ICCPR and should be reasonable in the particular circumstances. The United Nations Human Rights Committee has interpreted ‘reasonableness’ to mean that any limitation must be proportionate and necessary in the circumstances.
The Rule engages the right to privacy by permitting the use and disclosure of de-identified credit reporting information by CRBs to conduct research in relation to credit.
The intrusion on individual privacy posed by this limited use of de-identified credit reporting information is justified by the general benefit to the public, CRBs and credit providers, that can be obtained through allowing credit related research in specific circumstances. By ensuring that credit reporting products and services are informed by actual credit reporting information and tailored to the evolving needs of individuals in the Australian credit reporting system, the Rule improves competition and efficiency in the credit market, as well as reducing the cost of credit for individuals. Further, ongoing research activities assist in the development of new credit products, services and improve the effectiveness of existing products. Enabling these activities is in accordance with the objects of the Privacy Act, specifically under section 2A(e) of the Privacy Act, to facilitate an efficient credit reporting system while also ensuring that the privacy of individuals is respected.
The use and disclosure of de-identified credit reporting information by CRBs must be a proportionate means by which to achieve an efficient and tailored credit reporting system that benefits the general public. Part IIIA and s 20M of the Privacy Act ensure that the intrusion on individual privacy is appropriately circumscribed.
The use and disclosure provisions for CRBs contained in Part IIIA of the Privacy Act are prescriptive and do not permit any secondary uses or disclosures of credit reporting information. Section 20M(1) of the Privacy Act also sets out a specific prohibition on the use or disclosure of de-identified credit reporting information held by CRBs. Section 20M(2) of the Privacy Act provides an exception to this prohibition only where the use or disclosure of de-identified credit reporting information by a CRB is for the purposes of conducting credit related research and the CRB complies with the Rules. This narrow circumstance where de-identified credit reporting information can be used or disclosed by CRBs provides a proportionate framework that ensures use or disclosure and the interference with privacy only occurs where it is reasonably necessary.
The Rules serve to provide additional safeguards and oversight to guide the use and disclosure of de-identified credit reporting information when used in credit related research. The Rule seeks to further curtail the circumstances in which the right to privacy can be limited to permitted credit related research activities that are in the public interest, including for:
- the assessment or management of current, and development of new, credit services
- developing methodologies to combat fraud, anti-money laundering, counter terrorism financing and other unlawful activity involving credit
- assisting responsible lending obligations and other consumer protections, or
- any other purpose for the general benefit of the public.
The Rule contains further safeguards that ensures any limitation on the right to privacy is proportionate, including:
- ensuring CRBs assess the risk of re-identification when determining an appropriate de-identification technique and take such steps as are reasonable in the circumstances to ensure information cannot be re-identified
- prohibiting the re-identification of de-identified credit reporting information
- limiting the disclosure of de-identified information to entities with an Australian link
- emphasising that de-identified information which is unintentionally re-identified must be destroyed.
The limitation on the right to privacy authorised by s 20M of the Privacy Act and the Rule is considered to pursue a legitimate objective; to ensure that individuals can continue to benefit from an efficient and tailored credit reporting system supported by robust credit related research. The safeguards provided by s 20M and further specified by the Rule appropriately circumscribe the use or disclosure of de-identified credit reporting information to ensure that any limitations on privacy are reasonable, necessary and proportionate.
Conclusion
The Rule is compatible with human rights because, to the extent that it may limit the right to privacy, it ensures that those limitations are reasonable, necessary and proportionate.
Attachment B
Explanation of provisions
Privacy (Credit Related Research) Rule 2024
- Name of Rule
Section 1 provides that the title of the Rule is the Privacy (Credit Related Research) Rule 2024.
2. Commencement
Section 2 provides that the Rule commences on the day it is registered on the Federal Register of Legislation.
3. Purpose
Section 3 sets out the purpose of the Rule.
4. Definitions
Section 4 provides for the definitions of words and expressions used in the Rule, including a definition of ‘de-identified information’ and ‘aggregated results’.
Subsection 4(2) sets out the following definition of de-identified information:
De-identified information means credit reporting information that is no longer about an identifiable individual or an individual who is reasonably identifiable.
This definition is consistent with the definition of ‘de-identified’ contained in s 6(1) of the Privacy Act set out below.
De‑identified: personal information is de‑identified if the information is no longer about an identifiable individual or an individual who is reasonably identifiable.
The majority of definitions of words and expressions used in the Rule are the same as defined in s 6(1) of the Privacy Act, in particular: Australian law; Australian link; Commissioner; court/tribunal order; credit; credit reporting body; credit reporting information; entity; personal information.
5. Schedules
Section 5 provides for the inclusion of Schedules to amend or repeal any instruments as required.
6. Conducting research in relation to credit
Section 6 sets out the conditions under which a CRB may use or disclose credit reporting information to conduct research in relation to credit.
Subsection 6(a) requires that the credit reporting information be de-identified.
Subsection 6(b) requires that the use and/or disclosure of the credit reporting information is for the purpose of the CRB conducting research in relation to credit.
In subsection 6(b), the ‘purpose of conducting research in relation to credit’ should be given its ordinary meaning and interpreted broadly to capture all purposes that relate to the credit worthiness of individuals.
Subsection 6(c) requires that the purpose for conducting the research in relation to credit be a permitted purpose as described in Section 6 of this Rule.
7. Permitted purposes of conducting research
Section 7 sets out a list of permitted purposes under which a CRB may use or disclose de-identified information for the purposes of conducting research in relation to credit.
In general, the permitted purposes under section 7 are defined at a broad level to allow sufficient flexibility for CRBs to conduct necessary research where this is for the general benefit of the public and in the public interest, while also ensuring privacy is protected.
Subsection 7(a) allows research in relation to credit to assess and manage current, and the development of new, credit services.
Subsection 7(b) allows research in relation to credit to develop methodologies to combat fraud, anti-money laundering, counter terrorism financing and other unlawful activity involving credit.
Subsection 7(c) allows research in relation to credit to assist in the implementation of responsible lending obligations and other consumer protections.
Subsection 7(d) allows research in relation to credit for any other purpose for the general benefit of the public.
In subsection 7(d), in the context of conducting research in relation to credit under this Rule, the phrase ‘for the general benefit of the public’ may be interpreted to mean:
- research conducted by a CRB to support the enhancement of existing credit services, and the development of new credit services
- research conducted by a CRB and provided to a credit provider under a commercial arrangement to support the enhancement of existing credit services, and the development of new credit services
Further, in subsection 7(d), ‘for the general benefit of the public’ does not preclude where there may also be some private benefit to a party involved in the research as long as the private benefit is a necessary consequence of the research and does not constitute the primary purpose of the research. The purpose of research being for the public benefit should be paramount.
8. De-identification of credit reporting information
Subsection 8(1) sets out the provisions a CRB must take to ensure credit reporting information is adequately de-identified.
Subsection 8(1)(a) requires a CRB to assess the risk of re-identification of the credit reporting information it intends to use or disclose for research purposes, either by itself or by the recipients of the de-identified information.
Subsection 8(1)(b) requires a CRB to use the risk assessment referred to in subsection 8(1)(a) to determine the de-identification technique or techniques appropriate to the circumstances.
Subsection 8(1)(c) requires a CRB to take reasonable steps to ensure the de-identified information cannot be re-identified.
Subsection 8(2) provides for a prohibition on the re-identification of de-identified information. Subsection 8(2)(a) requires a CRB not to re-identify or attempt to re-identify de-identified information. Subsection 8(2)(b) requires a CRB to destroy any information that it intentionally re-identifies.
Subsection 8(3) provides for the only exception to the prohibition in subsection 8(2). Subsection 8(3) states subsection 8(2) does not apply if the re-identification of de-identified information is required by Australian law or a court/tribunal order.
The terms Australian law and court/tribunal order are defined in the Privacy Act.
9. Disclosure of de-identified information
Subsection 9(1) provides that a CRB only disclose de-identified information for a permitted purpose if the receiving entity has an Australian link. Australian link is as defined in the Privacy Act.
Subsection 9(2) provides that before disclosing de-identified information, a CRB must take reasonable steps to ensure the entity receiving the information meets several obligations. These obligations include that entity will not re-identify or attempt to re-identify de-identified information (subsection 9(2)(a)), that the entity destroy any information that it unintentionally re-identifies (subsection 9(2)(b)) and that the entity will not disclose the de-identified information to any other entity (subsection 9(2)(c)).
Subsection 9(3) clarifies that subsection 9(2)(c) does not apply to the disclosure of the aggregated results of any analysis done on that de-identified information. The effect of subsection 9(3) is to distinguish the disclosure of de-identified information, which is prohibited due to risk of re-identification, and the disclosure of any analysis performed on de-identified information presented as aggregated results. Aggregation of the results is considered to minimise the risk of re-identification and is thus permitted by subsection 9(3).
Note that the term ‘aggregated results’ is defined in subsection 4(2).
10. Openness
Section 10 provides that a CRB must include a statement on the management of de-identified information in its ‘credit reporting’ privacy policy (under s 20B(3) of the Privacy Act). The statement must specify that de-identified information is used or disclosed for the purposes of conducting credit related research.
Schedule 1 – Repeals
Schedule 1 provides for the repeal of the Privacy (Credit Related Research) Rule 2014.
[1] Explanatory Memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 144.
[2] Australian Law Reform Commission, For Your Information: Australian Privacy Law and Practice, ALRC Report 108, ALRC, Sydney, 2008.
[3] The 5 types are: the date the credit account was opened; the type of credit account opened; the date the credit account was closed; the current limit of each open credit account; and repayment performance history about a person over the last two years and the number of repayment cycles that person was in arrears. A further category of financial hardship information was introduced as part of the National Consumer Credit Protection Amendment (Mandatory Credit Reporting and Other Measures) Act 2021.
[4] Office of Parliamentary Counsel, Instruments Handbook, Document release [3.7], September 2022.
[5] See Federal Register of Legislation - Legislation Act 2003.