Explanatory Statement

Privacy (Credit Reporting) Code 2014 (Version 1.2)

Issued by the authority of the Information Commissioner

This explanatory statement fulfils the Information Commissioner’s obligations under s 26(1) of the Legislative Instruments Act 2003 (the LI Act) in relation to the lodgement for registration on the Federal Register of Legislative Instruments (FRLI) of the Privacy (Credit Reporting) Code 2014 (Version 1.2) (CR code v1.2).  

Authority for the registration on the FRLI of the CR code v1.2

A CR code is a written code of practice about credit reporting under s26N of the Privacy Act 1988 (Privacy Act). The CR code that is included on the Codes Register kept by the Information Commissioner under s26U of the Privacy Act is called the ‘registered CR code’. The Information Commissioner keeps the Codes Register electronically on the OAIC website. The registered CR code is a legislative instrument (s 26M(2) of the Privacy Act) and therefore must be registered on the FRLI as well as on the Codes Register.

The Information Commissioner is required by s 26S(4) of the Privacy Act to ensure that there is one, and only one, registered CR code on the Codes Register at all times after Part IIIB of the Privacy Act commences (ie 12 March 2014).

On 24 April 2014 the Information Commissioner approved a variation of the CR code included on the Codes Register on his own initiative. CR code v1.2 was included on the Codes Register at noon AEST on 24 April 2014, and the previous CR code was removed at the same time. Upon inclusion on the Codes Register, CR code v1.2 became the ‘registered CR code’.

Purpose and operation of the CR code v1.2

The primary purpose of the CR code v1.2 is to supplement the provisions of Part IIIA of the Privacy Act and the Privacy Regulation 2013. In accordance with s 26N of the Privacy Act, the CR code v1.2 performs the following functions:

• sets out how one or more of the credit reporting provisions in Part IIIA of the Privacy Act are to be applied or complied with (s 26N(2)(a))
• makes provision for, or in relation to, matters required or permitted by Part IIIA to be provided for by the registered CR code (s 26N(2)(b))
• binds all credit reporting bodies (s 26N(2)(c))
• specifies the credit providers that are bound by the CR code, or a way of determining which credit providers are bound (s 26N(2)(d)), and
• specifies any other entities subject to Part IIIA of the Privacy Act that are bound by the CR code, or a way of determining which of those entities are bound (s 26N(2)(e)).

In addition, the CR code v1.2:

• imposes additional requirements that are not contrary to, or inconsistent with the requirements of Part IIIA of the Privacy Act (s 26N(3)(a))
• deals with the internal handling of complaints (s 26N(3)(b))
• provides for the reporting to the Commissioner about complaints (s 26N(3)(c)), and
• deals with any other relevant matters (s 26N(3)(d)).

The CR code v1.2 maintains all of the substantive provisions containing the obligations and rights in relation to organisations and individuals that were included in the original CR code (registered on the Codes Register between 22 January 2014 and 3 April 2014) and the first variation (registered on the Codes Register between 3 April 2014 and 24 April 2014).

The first varied CR code contained only one variation to the original CR code, namely the substitution of the numeral ‘5’ by the numeral ‘14’ in clause 8.1(b). The original CR code required a minimum grace period of 5 days before an overdue payment could be classified as overdue for the purposes of a credit provider (CP) disclosing repayment history information (RHI) to a credit reporting body (CRB). Under the variation, this grace period was extended to 14 days.

The CR code v1.2 contains some minor technical variations to the CR code that it replaces including the insertion of a repeal provision to properly effect repeals of the original CR code (titled the Credit Reporting Privacy Code (CR code)) and the first variation (titled the Credit Reporting Privacy Code (CR code) v1.1).

The CR code v1.2 also adds a few provisions usually included in legislative instruments, for example to name the instrument and to have a commencement provision.

The explanatory text on the front page of the original and first variation CR codes has been slightly amended for clarity and re-inserted under headings titled ‘Overview’ and ‘Reading the table’. A couple of additional definitions have been added under ‘Reading the table’ and the terms ‘current Code’ and ‘existing Code’ throughout the code have been replaced by the term ‘the pre-reform code’ to clarify which code those terms referred to. As well, a ’referencing’ provision has been inserted and the title of the code has been brought closer into line with best practice in legislative instrument naming. All these variations are minor in nature and aid referencing and reading the CR code.

Consultation

The Information Commissioner consulted with Australian Retail Credit Association (ARCA) the original CR code developer, in relation to these minor variations.

Apart from that consultation the Information Commissioner did not consider it necessary to undertake other consultation for the purposes of s 26T(3) of the Privacy Act and s 17 of the Legislative Instruments Act 2003 (LIA Act) because the effect of the proposed variations are minor in nature and do not affect the obligations or rights of individuals or organisations (see s 18 of the LIA Act).

The proposed variation was added to the OAIC’s Codes Register webpage on 22 April 2014 pursuant to s 26T(3)(a) of the Privacy Act.

Statement of compatibility with human rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

CR code v1.2

The Privacy (Credit Reporting) Code 2014 (Version 1.2) (CR code v1.2) is compatible with the human rights and freedoms recognised or declared in the international instruments listed in s 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Operation

The CR code v1.2 is a binding written code of practice about credit reporting. The purpose of the CR code v1.2 is to supplement the provisions of Part IIIA of the Privacy Act 1988 (Privacy Act) and the Privacy Regulation 2013.

Human rights implications

The CR code v1.2 engages Article 17 of the International Covenant on Civil and Political Rights (ICCPR). Article 17 provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference or attacks. 

The varied CR code has no implication for the prohibition against arbitrary interference with privacy because the variation from the original CR code does not reduce the privacy protections afforded to individuals by the original CR code.

Conclusion

The CR code v1.2 is compatible with human rights because the only amendment that has been made to the original CR code does not reduce the privacy protections afforded to individuals.