REPLACEMENT EXPLANATORY STATEMENT
This Explanatory Statement replaces the Explanatory Statement registered on 28 June 2018 for the Privacy (Credit Reporting) Code 2014 (Version 2) [F2018L00925] to include an additional section on Documents Incorporated by Reference.
Issued by the Authority of the Australian Information Commissioner
Privacy Act 1988
Privacy (Credit Reporting) Code 2014 (Version 2)
This explanatory statement relates to the Privacy (Credit Reporting) Code 2014 (Version 2) (the CR Code V2), which replaces the Privacy (Credit Reporting) Code 2014 (Version 1.2) (the Previous Code) varied under s 26T(5) of the Privacy Act 1988 (Privacy Act).
The CR Code V2 repeals and replaces the Previous Code to clarify obligations under the Previous Code, reflect current industry practice and ensure consistency with the provisions in the Privacy Act. The variations are minor in nature.
Authority for registration of the CR Code V2
Section 26T(1) of the Privacy Act 1988 (Privacy Act) enables the Australian Information Commissioner (Commissioner) to approve a variation of the registered CR Code. Section 26T(5) of the Privacy Act requires the Commissioner to register the CR Code, as varied, on the Codes Register kept by the Commissioner in accordance with s 26U of the Privacy Act. Section 26M of the Privacy Act provides that the CR Code, as varied, is a legislative instrument once included on the Codes Register.
The Australian Retail Credit Association (ARCA), the code developer, submitted an application for variation of the Previous Code under s 26T(1)(c) on 26 April 2018, and, following further consultation, a further amended application on 28 May 2018. Both applications were published on the Office of the Australian Information Commissioner (OAIC) website.
The acting Commissioner, having regard to s 26T(3) of the Privacy Act and the OAIC’s Guidelines for developing codes, approved the variations to the Previous Code on 29 May 2018. The CR Code V2 was included on the Codes Register from 1 July 2018, and the Previous Code was removed at the same time. Upon its inclusion on the Codes Register, CR Code V2 became the registered CR code.
Purpose and operation of the CR Code
A CR Code, defined by s 26N of the Privacy Act, is a written code of practice about credit reporting. The CR Code that is included on the Codes Register by the Commissioner under s 26U of the Privacy Act is called the ‘registered CR code’. The Codes Register is kept electronically on the OAIC website. The Commissioner is required by s 26S(4) of the Privacy Act to ensure that there is one, and only one, registered CR Code at all times. The purpose of the registered CR Code is to supplement the provisions of Part IIIA of the Privacy Act and the Privacy Regulation 2013.
Under s 26N of the Privacy Act, a CR Code must perform the following functions:
- set out how one or more of the credit reporting provisions in Part IIIA of the Privacy Act are to be applied or complied with (s 26N(2)(a))
- make provision for, or in relation to, matters required or permitted by Part IIIA to be provided for by the registered CR code (s 26N(2)(b))
- bind all credit reporting bodies (s 26N(2)(c))
- specify the credit providers that are bound by the CR code, or a way of determining which credit providers are bound (s 26N(2)(d))
- specify any other entities subject to Part IIIA of the Privacy Act that are bound by the CR code, or a way of determining which of those entities are bound (s 26N(2)(e)).
In addition, a CR code may perform the following functions:
- impose additional requirements that are not contrary to, or inconsistent with the requirements of Part IIIA of the Privacy Act (s 26N(3)(a))
- deal with the internal handling of complaints (s 26N(3)(b))
- provide for the reporting to the Commissioner about complaints (s 26N(3)(c))
- deal with any other relevant matters (s 26N(3)(d)).
The variations to the Previous Code are minor or technical in nature. The CR Code V2 differs from the Previous Code by:
- altering the definition of ‘month’ in paragraph 1.2(i) to align with current industry practices
- removing redundant categories of ‘maximum amount of credit available’ from paragraph 6.2(b)
- altering the requirement under paragraph 6.2(c) to address concerns about the uncertainty of how account closures are described
- altering the timing of grace periods under paragraph 8.2(c)(ii) to clarify the application and interpretation of the grace period
- altering paragraph 9.3(d) to permit delivery of s 21D notices under the Privacy Act by electronic means
- altering paragraphs 9.3(a), (b), (c), (d) and (f) to address inconsistency between the Previous Code and ss 6Q and 21D of the Privacy Act
- altering paragraph 18.1 to extend the prohibition on direct marketing activities by a credit reporting body to the use of credit reporting information in both tools and services provided by a credit reporting body to a credit provider
- altering paragraph 20.9 to require additional information to be included in a correction notice provided to a credit provider by a credit reporting body, to enable the credit provider to match the corrected information to a customer or a customer’s account.
Reasons for decision to approve variations to the Previous Code and register the CR Code V2
In deciding to approve the CR Code V2, the acting Commissioner has had regard to ss 26T(3) and 26T(4) of the Privacy Act and the OAIC’s Guidelines for developing codes.
The acting Commissioner also had regard to the recommendations and observations made in the report, titled Review of Privacy (Credit Reporting) Code 2014 (V1.2) Report dated 8 December 2017 by PricewaterhouseCoopers (PwC). This report was drafted as a result of the independent review of the Previous Code initiated by the former Commissioner as required by paragraph 24.3 of the Previous Code.
In making the decision, the acting Commissioner considered:
the requirement set out in s 26T(3)(a) of the Privacy Act had been met as ARCA’s application documentation was published on the OAIC’s website from 3 May 2018
the requirements set out in s 26T(3)(b) of the Privacy Act, the Guidelines for developing codes and s 17 of the Legislation Act 2003 have been met as sufficient consultation had taken place; noting that during the review of the Previous Code, PwC consulted with stakeholders (including industry representatives groups, external dispute resolution schemes, credit reporting bodies and consumer representative groups) and ARCA consulted with this same set of stakeholders about the variations and took submissions on the variations
the requirement set out in s 26T(3)(c) of the Privacy Act have been met as the public had the opportunity to comment throughout the PwC review process and a public consultation process conducted by ARCA in April 2018
the list of matters set out in the Guidelines for developing codes in deciding whether to approve a variation to a CR Code.
The acting Commissioner considered that all of these requirements were adequately met.
Documents incorporated by reference
Paragraph 21.1 of the CR Code V2 incorporates into the law by reference, ISO 10002-2006 Customer satisfaction - Guidelines for complaints handling in organizations in the form in which it exists on 1 July 2018 and not in the form in which it may exist from time to time. Sections 26M and 26T(5) of the Privacy Act provide the authority, consistent with section 14 of the Legislation Act 2003, to incorporate ISO 10002-2006, into the law by reference.
The incorporated document is available for inspection, upon request, at: Office of the Australian Information Commissioner (NSW Office), Level 3, 175 Pitt St, Sydney. Phone: 1300 363 992. It is also available at the National Library of Australia and at a number of public libraries, such as the State Libraries of New South Wales and Queensland. It is available for a fee, by visiting the SAI Global web shop at www.saiglobal.com.
Consultation
Consistent with the requirements of s 17 of the Legislation Act 2003, the acting Commissioner has considered the consultation process undertaken by ARCA as the code developer.
Section 26T(3) of the Privacy Act requires that before deciding whether to approve a variation of the registered CR Code, the Commissioner must:
make a draft of the variation publicly available (s 26T(3)(a))
consult any person the Commissioner considers appropriate about the variation (s 26T(3)(b)
consider the extent to which members of the public have been given an opportunity to comment on the variation (s 26T(3)(c)).
The acting Commissioner has also considered the relevant matters set out in the Appendix of the OAIC’s Guidelines for developing codes under s 26T(4) in relation to variation of a registered code.
Minor or technical changes made to the CR Code V2 were made having regard to the following:
- From 20 September 2017 to 17 October 2017, PwC undertook targeted and public consultation in the drafting of the Report and developing the recommendations under paragraph 24.3 of the Previous Code. The variations ARCA has applied for generally reflect the PwC recommendations.
- From 3 April 2018 to 17 April 2018, ARCA conducted public consultation as well as targeted consultation with industry (including ARCA’s members), external dispute resolution schemes and consumer advocates, on proposed variations to the Previous Code. ARCA also provided an opportunity for comment to stakeholders by publishing a draft variation on their website from 3 and 17 April 2018.
- On 3 May 2018, the OAIC published ARCA’s application for variation on the OAIC website. Understanding that the Financial Ombudsman Service and the Financial Rights Legal Centre may have had outstanding concerns about the variation, the OAIC also invited additional comments from these stakeholders on 3 May 2018. The Financial Ombudsman Service provided comments on 8 May 2018, which ARCA responded to on 16 May 2018.
- The approved CR Code V2 was published on the OAIC website on 30 May 2018.
The information submitted to the OAIC by ARCA on 26 April 2018 in support of its application, included correspondence showing that ARCA members that will be bound by the CR Code V2 were notified about the public consultation. Further, ARCA provided copies of the consultation material, detailing their consultation with relevant stakeholders, and submissions that they had received as part of the consultation process. ARCA detailed their response to concerns raised in the application for variation.
The acting Commissioner was satisfied, for the reasons set out above, that the consultation process undertaken by ARCA adequately addresses the statutory criteria required by s 26T of the Privacy Act and s 17 of the Legislation Act 2003.
The Office of Best Practice Regulation (OBPR) was consulted and advised that a Regulation Impact Statement is not required. The OBPR reference is ID: 23885.
The CR Code V2 commences on 1 July 2018.
The CR Code V2 is a legislative instrument for the purposes of the Legislation Act 2003.
Authority: Section 26T
Privacy Act 1988
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
Privacy (Credit Reporting) Code 2014 (Version 2)
This legislative instrument is compatible with the human rights and freedoms recognised or declared in international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the Legislative Instrument
The Privacy (Credit Reporting) Code 2014 (Version 2) (CR Code V2) is a binding written code of practice about credit reporting. The purpose of the CR Code V2 is to supplement the provisions of Part IIIA of the Privacy Act 1988 (Privacy Act) and the Privacy Regulation 2013.
The CR Code V2 repeals and replaces the Privacy (Credit Reporting) Code 2014 (Version 1.2) (the Previous Code) to clarify obligations under the Previous Code, reflect current industry practice and ensure consistency with the provisions in the Privacy Act. The variations are minor or technical in nature.
The CR Code V2 differs from the Previous Code by:
- altering the definition of ‘month’ in paragraph 1.2(i) to align with current industry practices
- removing redundant categories of ‘maximum amount of credit available’ from paragraph 6.2(b)
- altering the requirement under paragraph 6.2(c) to address concerns about the uncertainty of how account closures are described
- altering the timing of grace periods under paragraph 8.2(c)(ii) to clarify the application and interpretation of the grace period
- altering paragraph 9.3(d) to permit delivery of s 21D notices under the Privacy Act by electronic means
- altering paragraphs 9.3(a), (b), (c), (d) and (f) to address inconsistency between the Previous Code and ss 6Q and 21D of the Privacy Act
- altering paragraph 18.1 to extend the prohibition on direct marketing activities by a credit reporting body to the use of credit reporting information in both tools and services provided by a credit reporting body to a credit provider
- altering paragraph 20.9 to require additional information to be included in a correction notice provided to a credit provider by a credit reporting body, to enable the credit provider to match the corrected information to a customer or a customer’s account.
Human rights implications
The CR Code V2 engages Article 17 of the International Covenant on Civil and Political Rights (ICCPR). Article 17 provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference or attacks.
The CR Code V2 has no implication for the prohibition against arbitrary interference with privacy because the variations from the Previous Code are minor in nature and do not reduce the privacy protections afforded to individuals by the Previous Code and maintain the privacy protections set out in the Privacy Act.
The CR Code V2 supplements and strengthens the provisions in the Previous Code through the introduction of additional, privacy enhancing requirements for the handling of credit information by the entities that it binds.
Conclusion
The CR Code V2 engages the right to privacy. It is compatible with human rights because it promotes the protection of privacy.
Angelene Falk
Australian Information Commissioner
Office of the Australian Information Commissioner