Privacy (Credit Reporting) Code 2014 (Version 2.3)

Administered by Attorney-General's Department

Legislation au F2022L00746 Not in force Legislative Instrument

Legislation content

EXPLANATORY STATEMENT

 

Issued by the Authority of the Australian Information Commissioner

Privacy Act 1988

Privacy (Credit Reporting) Code 2014 (Version 2.3)

 

This explanatory statement relates to the Privacy (Credit Reporting) Code 2014 (Version 2.3) (the CR Code V2.3), which replaces the Privacy (Credit Reporting) Code 2014 (Version 2.2) (the Previous Code) varied under subsection 26T(5) of the Privacy Act 1988 (Privacy Act).

 

The CR Code V2.3 repeals and replaces the Previous Code to implement provisions relating to financial hardship reporting introduced under the National Consumer Credit Protection Amendment (Mandatory Credit Reporting and other Measurements) Bill 2019 (amending Bill), in Schedule 2, Part 1 which commenced on 1 July 2021.

 

The Explanatory Memorandum[1] to the amending Bill notes at paragraph 2.18 that variations to the CR Code will be progressed by the OAIC and industry, to provide detailed guidance on the implementation of new credit reporting obligations. Further, Section 26N(2) of the Privacy Act requires the CR Code make provision for, or in relation to, matters required or permitted by Part IIIA of the Privacy Act.

 

This explanatory statement supports the introduction of, and amendment to the following paragraphs of the CR Code:

  • Amendments to paragraphs 1.2, 8.1, 8.2, 19.7(a)
  • Introduction of paragraphs 8A.1, 8A.2, 8A.3, 8A.4, 8A.5, 8A.6, 8A.7, 19.8, 19.9

 

Version 2.3 of the CR Code maintains all of the substantive provisions outlining the rights and obligations of organisations and individuals that were included in Version 2.2 of the CR Code.

 

Version 2.3 of the CR Code outlines the purpose and effect of each paragraph in the blue rows of the table that is the CR Code. This outline constitutes a high-level summary explanation of the provisions of Part IIIA of the Privacy Act that provide the context for the CR code obligations and requirements. 

 

There are also ‘notes’ included in relation to certain provisions of the CR Code to aid in the interpretation of particular concepts and their application.

 

Authority for registration of the CR Code V2.3

 

Subsection 26T(1) of the Privacy Act enables the Australian Information Commissioner (Commissioner) to approve a variation of the registered CR Code. Subsection 26T(5) of the Privacy Act requires the Commissioner to register the CR Code, as varied, on the Codes Register kept by the Commissioner in accordance with section 26U of the Privacy Act. Section 26M of the Privacy Act provides that the CR Code, as varied, is a legislative instrument once included on the Codes Register.

 

On 6 September 2021, the Code developer, the Australian Retail Credit Association (ARCA), submitted an application to the Commissioner to vary version 2.1 and 2.2 of the Privacy (Credit Reporting) Code 2014 (the CR Code) in accordance with section 26T of the Privacy Act 1988 (the Privacy Act).

 

The application followed consultation conducted by ARCA between 5 July 2021 – August 2021 and included changes to the CR Code to implement financial hardship provisions introduced under the National Consumer Credit Protection Amendment (Mandatory Credit Reporting and other Measurements) Bill 2019 which came into effect in July of this year. The application was published on the Office of the Australian Information Commissioner (OAIC) website.

 

The Commissioner conducted her own consultation in relation to this variation application between 13 September and 13 October 2021. The OAIC also engaged with key stakeholders during November and December 2021. On 18 February 2022, ARCA submitted an amended application to vary the CR Code following further consultation with key stakeholders and engagement with the OAIC. This application included further amendments to clarify meaning in the changes to the CR Code and improve readability. The amended application was published on the OAIC’s website.

 

Having regard to subsection 26T(3) of the Privacy Act and the OAIC’s Guidelines for developing codes, the Commissioner approved the variation to the Previous Code on 10 March 2022.

 

The CR Code V2.3 will be included on the Codes Register from 1 July 2022 and the Previous Code will be removed at the same time. Upon its inclusion on the Codes Register, CR Code V2.3 will become the registered CR Code.

 

Purpose and operation of the CR Code

 

A Credit Reporting Code (a CR Code), defined by section 26N of the Privacy Act, is a written code of practice about credit reporting. The CR Code that is included on the Codes Register by the Commissioner under section 26U of the Privacy Act is called the ‘registered CR code’.

 

The Codes Register is available on the OAIC website. Subsection 26S(4) of the Privacy Act requires the Commissioner to ensure that there is one, and only one, registered CR Code at all times. The purpose of the registered CR Code is to supplement the provisions of Part IIIA of the Privacy Act and the Privacy Regulation 2013.

 

Under section 26N of the Privacy Act, a CR Code must perform the following functions:

 

  • set out how one or more of the credit reporting provisions in Part IIIA of the Privacy Act are to be applied or complied with (s 26N(2)(a))
  • make provision for, or in relation to, matters required or permitted by Part IIIA to be provided for by the registered CR code (s 26N(2)(b))
  • bind all credit reporting bodies (s 26N(2)(c))
  • specify the credit providers that are bound by the CR code, or a way of determining which credit providers are bound (s 26N(2)(d))
  • specify any other entities subject to Part IIIA of the Privacy Act that are bound by the CR code, or a way of determining which of those entities are bound (s 26N(2)(e)).

In addition, a CR code may perform the following functions:

 

  • impose additional requirements that are not contrary to, or inconsistent with the requirements of Part IIIA of the Privacy Act (s 26N(3)(a))
  • deal with the internal handling of complaints (s 26N(3)(b))
  • provide for the reporting to the Commissioner about complaints (s 26N(3)(c))
  • deal with any other relevant matters (s 26N(3)(d)).

The amending Bill introduced provisions which came into effect on 1 July 2022. These amendments permit the reporting of financial hardship information within the credit reporting system. These amendments were intended to provide credit providers with an indication that a consumer is experiencing hardship, and to prompt prospective lenders to make further inquiries in order to assess a consumer’s situation holistically and potentially offer them a more suitable product.[2]

 

As noted above, the Explanatory Memorandum to the Amending Bill stated that variation to the CR Code would be required to provide detailed guidance on the implementation of these new provisions. In line with this, the CR Code V2.3 differs from the Previous Code by:

 

  • Amending paragraph 1.2 to introduce new definitions that are required to support the financial hardship provisions. These new definitions are:
    • ‘ordinary monthly payments’ and ‘overdue payment arrangements’ to support paragraphs 8A.2 and 8A.4, which relate to the arrangements for a temporary financial hardship arrangement and a variation financial hardship arrangement.
    •  ‘temporary financial hardship arrangement (temporary FHA)’ and ‘variation financial hardship arrangement (variation FHA)’ to reflect s 6QA(1)(d) of the Privacy Act.
  • Amending paragraphs 8.1 and 8.2 of the CR Code to clarify how repayment history information (RHI) is to be reported following a variation FHA or temporary FHA.
  • Introducing a new paragraph 8A which addresses Schedule 2, Part 1 of the amending Bill. These provisions introduce Financial Hardship information into Australia's credit reporting landscape. Paragraph 8A provides detailed guidance on the operation of these amendments, specifically introducing paragraphs:
    • Paragraph 8A.1:
      • 8A.1(a) – (c) to address technical issues for reporting financial history information in accordance with the requirement under s 21EA of the Privacy Act
      • 8A.1(d) to clarify the effective date for FHAs
      • 8A.1(e) to confirm the treatment of joint accounts
      • 8A.1(f) to provide the RHI to accompany FHI in accordance with the requirement under s 21EA of the Privacy Act
      • 8A.1(g) to explain the operation of s 6QA(5) of the Privacy Act
    • Paragraph 8A.2 which sets out the arrangements for when a temporary FHA is formed.
    • Paragraph 8A.3 which sets out the arrangements for when a variation FHA is formed.
    • Paragraph 8A.4 to set out the requirements credit providers must take to explain the impact of financial hardship arrangements to individuals.
    • Paragraph 8A.5 to provide the codes to be used to report against the different types of financial hardship arrangements in accordance with s 21EA of the Privacy Act.
    • Paragraph 8A.6 to set out transitional issues for financial hardship information reporting for arrangements entered into before 01 July 2022 and are carried over or amended after that date.
    • Paragraph 8A.7 to set out the circumstances when a credit provider must not request financial hardship information from a credit reporting body.
  • Inclusion of a note to paragraph 19.7(a), that states that FHI may not be used in the calculation of credit ratings or scores in accordance with s 20E(7) of the Privacy Act. 
  • Introduction of paragraph 19.8 which stipulates the explanations that must be given to access seekers when a CRB provides credit reporting information that includes repayment history information or financial hardship information.
    • Paragraph 19.8(a) which outlines that codes must not be given to the individual requesting the information, other than in certain limited circumstances
    • Paragraph 19.8(b) will require credit reporting bodies to include a consistent explanation of financial hardship information with credit information given to access seekers (if the relevant individual’s credit reporting information included financial hardship information).
  • Introduction of paragraph 19.9 that states if credit reporting bodies give an individual a credit score rating that includes financial hardship information, they must explain that the financial hardship information was not included in the calculation.

Reasons for decision to approve variations to the Previous Code and register the CR Code V2.3

 

In deciding to approve the CR Code V2.3, the Commissioner has had regard to subsections 26T(3) and 26T(4) of the Privacy Act and the OAIC’s Guidelines for developing codes.

 

The Commissioner also had regard to the financial hardship reporting provisions introduced under the National Consumer Credit Protection Amendment (Mandatory Credit Reporting and other Measurements) Bill 2019, which came into effect on 1 July 2022.

 

In making the decision, the Commissioner considered that:

 

  • The requirement set out in paragraph 26T(3)(a) of the Privacy Act had been met as ARCA’s original application documentation was published on the OAIC’s website on 13 September 2021 and the amended application was published on 22 February 2022.

 

  • The requirements set out in paragraph 26T(3)(b) of the Privacy Act, the Guidelines for developing codes and section 17 of the Legislation Act 2003 have been met as sufficient consultation had taken place; noting that ARCA consulted with stakeholders including industry representative groups, consumer representative groups, external dispute resolution (EDR) schemes, the Attorney-General’s Department, the Australian Securities and Investments Commission (ASIC) and ARCA members about its application between 5 July – 11 August 2021.

 

  • The requirement set out in paragraph 26T(3)(c) of the Privacy Act has been met as the OAIC conducted its own public consultation between 13 September – 13 October 2021 and the public had an opportunity to comment on the draft changes to the CR Code. The OAIC also conducted targeted consultation throughout November and December 2021.

 

  • The list of matters set out in the Guidelines for developing codes in deciding whether to approve a variation to a CR Code have been addressed.

Documents incorporated by reference

 

Existing paragraph 21.1 of the CR Code V2.3 incorporates into the law by reference, ISO 10002:2018(E) Quality management - Customer satisfaction - Guidelines for complaints handling in organisations in the form in which it exists on 14 February 2020 and not in the form in which it may exist from time to time.

 

Section 26M and subsection 26T(5) of the Privacy Act provide the authority, consistent with section 14 of the Legislation Act 2003, to incorporate ISO 10002:2018 into the law by reference.

 

The incorporated document is available for inspection, upon request, at: Office of the Australian Information Commissioner (NSW Office), 175 Pitt St, Sydney. Phone: 1300 363 992. It is also available at the National Library of Australia and at a number of public libraries, such as the State Libraries of New South Wales and Victoria. It is available for a fee, by visiting the SAI Global web shop at www.saiglobal.com

 

Consultation

 

Consistent with the requirements of section 17 of the Legislation Act 2003, the Commissioner has considered the consultation process undertaken by ARCA as the code developer.

 

Subsection 26T(3) of the Privacy Act requires that, before deciding whether to approve a variation of the registered CR Code, the Commissioner must:

 

•         make a draft of the variation publicly available (s 26T(3)(a))

•         consult any person the Commissioner considers appropriate about the variation (s 26T(3)(b))

•         consider the extent to which members of the public have been given an opportunity to comment on the variation (s 26T(3)(c)).

The Commissioner has also considered the relevant matters set out in the Appendix of the OAIC’s Guidelines for developing codes under subsection 26T(4) in relation to variation of a registered code.

 

Changes made to the CR Code V2.3 were made having regard to the following:

 

  • The CR Code amendments address legislative amendments to the Privacy Act under the amending Bill which were subject to extensive consultation with relevant stakeholders.

 

  • From 1 February – 1 July 2021, ARCA conducted early engagement with stakeholders, including industry representative groups, consumer representative groups, External Dispute Resolution (EDR) schemes, and ARCA members, to seek input on the key issues to be included in a draft variation for public consultation.

 

  • From 5 July – 11 August 2021, in preparation for its variation application, ARCA conducted public consultation with stakeholders including industry representative groups, consumer representative groups, External Dispute Resolution (EDR) schemes, the Attorney General’s Department, ASIC, and ARCA members about its variation. Stakeholders were given an opportunity to comment on the draft variation published on the ARCA website from 5 July – 11 August 2021.

 

  • On 13 September 2021, the OAIC published the variation application on its website. The OAIC, advised relevant stakeholders that the variation application had been published and also specifically notified the Attorney General’s Department, the Treasury, Financial Rights Legal Centre, the Australian Banking Association (ABA), IDCARE, Legal Aid Queensland and the Australian Securities and Investments Commission (ASIC) of the application.

 

  • The OAIC received submissions directly from the Financial Rights Legal Centre, Legal Aid Queensland and the ABA.

 

  • Through December and January 2022, the OAIC engaged in further consultation with key stakeholders and discussions with ARCA. Following these discussions, ARCA submitted an amended variation application to the OAIC on 18 February 2022.

 

  • On 22 February 2022, the OAIC published a copy of ARCA’s amended variation application on its website.

The information submitted to the OAIC by ARCA on 6 September 2021 in support of its application included correspondence showing that ARCA members that will be bound by the CR Code V2.3 were notified about the public consultation. Further, ARCA provided the OAIC with copies of the consultation material, detailing their consultation with relevant stakeholders, and submissions that they had received as part of the consultation process. ARCA detailed their response to concerns raised in the application for variation.

 

The Commissioner is satisfied, for the reasons set out above, that the consultation process undertaken by ARCA adequately addresses the statutory criteria required by section 26T of the Privacy Act and section 17 of the Legislation Act 2003.

 

The Office of Best Practice Regulation (OBPR) was consulted and advised that a Regulation Impact Statement is not required. The OBPR reference is ID: 44598.

 

The CR Code V2.3 commences on 1 July 2022.

 

The CR Code V2.3 is a legislative instrument for the purposes of the Legislation Act 2003.

 

Authority: Section 26T
Privacy Act 1988


Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

 

Privacy (Credit Reporting) Code 2014 (Version 2.3)

This legislative instrument is compatible with the human rights and freedoms recognised or declared in international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instrument

The Privacy (Credit Reporting) Code 2014 (Version 2.3) (CR Code V2.3) is a binding written code of practice about credit reporting. The purpose of the CR Code V2.3 is to supplement the provisions of  Part IIIA of the Privacy Act 1988 (Privacy Act) and the Privacy Regulation 2013.

The CR Code V2.3 repeals and replaces the Privacy (Credit Reporting) Code 2014 (Version 2.2) (the Previous Code) to clarify obligations under the Previous Code, reflect current industry practice and ensure consistency with the provisions in the Privacy Act.

The CR Code V2.3 differs from the Previous Code by:

 

  • Amending paragraph 1.2 to introduce new definitions that are required to support the financial hardship provisions. These new definitions are:
    • ‘ordinary monthly payments’ and ‘overdue payment arrangements’ to support paragraphs 8A.2 and 8A.4, which relate to the arrangements for a temporary financial hardship arrangement and a variation financial hardship arrangement.
    •  ‘temporary financial hardship arrangement (temporary FHA)’ and ‘variation financial hardship arrangement (variation FHA)’ to reflect s 6QA(1)(d) of the Privacy Act.
  • Amending paragraphs 8.1 and 8.2 of the CR Code to clarify how repayment history information (RHI) is to be reported following a variation FHA or temporary FHA.
  • Introducing a new paragraph 8A which addresses Schedule 2, Part 1 of the amending Bill. These provisions introduce Financial Hardship information into Australia's credit reporting landscape. Paragraph 8A provides detailed guidance on the operation of these amendments, specifically introducing paragraphs:
    • Paragraph 8A.1:
      • 8A.1(a) – (c) to address technical issues for reporting financial history information in accordance with the requirement under s 21EA of the Privacy Act
      • 8A.1(d) to clarify the effective date for FHAs
      • 8A.1(e) to confirm the treatment of joint accounts
      • 8A.1(f) to provide the RHI to accompany FHI in accordance with the requirement under s 21EA of the Privacy Act
      • 8A.1(g) to explain the operation of s 6QA(5) of the Privacy Act
    • Paragraph 8A.2 which sets out the arrangements for when a temporary FHA is formed.
    • Paragraph 8A.3 which sets out the arrangements for when a variation FHA is formed.
    • Paragraph 8A.4 to set out the requirements credit providers must take to explain the impact of financial hardship arrangements to individuals.
    • Paragraph 8A.5 to provide the codes to be used to report against the different types of financial hardship arrangements in accordance with s 21EA of the Privacy Act.
    • Paragraph 8A.6 to set out transitional issues for financial hardship information reporting for arrangements entered into before 01 July 2022 and are carried over or amended after that date.
    • Paragraph 8A.7 to set out the circumstances when a credit provider must not request financial hardship information from a credit reporting body.
  • Inclusion of a note to paragraph 19.7(a), that states that FHI may not be used in the calculation of credit ratings or scores in accordance with s 20E(7) of the Privacy Act. 
  • Introduction of paragraph 19.8 which stipulates the explanations that must be given to access seekers when a CRB provides credit reporting information that includes repayment history information or financial hardship information.
    • Paragraph 19.8(a) which outlines that codes must not be given to the individual requesting the information, other than in certain limited circumstances
    • Paragraph 19.8(b) will require credit reporting bodies to include a consistent explanation of financial hardship information with credit information given to access seekers (if the relevant individual’s credit reporting information included financial hardship information).
  • Introduction of paragraph 19.9 that states if credit reporting bodies give an individual a credit score rating that includes financial hardship information, they must explain that the financial hardship information was not included in the calculation.

Human rights implications

The CR Code V2.3 engages Article 17 of the International Covenant on Civil and Political Rights (ICCPR). Article 17 provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home, or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference or attacks.

The CR Code V2.3 has negligible implication for the prohibition against arbitrary interference with privacy as it operationalises the new credit reporting obligations under the National Consumer Credit Protection Amendment (Mandatory Credit Reporting and Other Measures) Act 2021, which has been declared to be compatible with human rights.

The framework is intended to allow for the use and disclosure of personal information where it is directly relevant to an individual’s credit worthiness, and ensures credit providers have a fuller picture of the financial situation of a consumer, including when they may be experiencing hardship. These amendments support the allocation of credit and promote certain rights including the right to an adequate standard of living.[3]

We consider that the handling of personal information is necessary and proportionate and engages the right to privacy by limiting the use and disclosure of financial hardship information. The Privacy Act and CR Code provide necessary safeguards that ensure the information is only used for certain purposes, including a prohibition on the use of financial hardship information in calculating an individual’s credit score and restricting the retention of financial hardship information to 12 months.

The CR Code V2.3 does not reduce the privacy protections afforded to individuals by the Previous Code and maintains the privacy protections set out in the Privacy Act.

Conclusion

The CR Code V2.3 engages the right to privacy. It is compatible with human rights because it  promotes the protection of privacy.

 

 

Angelene Falk

Australian Information Commissioner

Office of the Australian Information Commissioner

[1] https://parlinfo.aph.gov.au/parlInfo/download/legislation/ems/r6476_ems_a8a35448-9c4c-4a56-b390-e9a1e03f1886/upload_pdf/723653.pdf;fileType=application%2Fpdf

[2] https://parlinfo.aph.gov.au/parlInfo/download/legislation/ems/r6476_ems_a8a35448-9c4c-4a56-b390-e9a1e03f1886/upload_pdf/723653.pdf;fileType=application%2Fpdf at paragraph 2.12.

[3] National Consumer Credit Protection Amendment (Mandatory Credit Reporting and Other Measures) Bill 2019 Statement of Compatibility with Human Rights at [3.30].

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.