Privacy (Credit Reporting) Code 2014 (Version 2)

Administered by Attorney-General's Department

Legislation au F2018L00925 Not in force Legislative Instrument

Legislation content

REPLACEMENT EXPLANATORY STATEMENT

 

This Explanatory Statement replaces the Explanatory Statement registered on 28 June 2018 for the Privacy (Credit Reporting) Code 2014 (Version 2) [F2018L00925] to include an additional section on Documents Incorporated by Reference.

Issued by the Authority of the Australian Information Commissioner

Privacy Act 1988

Privacy (Credit Reporting) Code 2014 (Version 2)

 

This explanatory statement relates to the Privacy (Credit Reporting) Code 2014 (Version 2) (the CR Code V2), which replaces the Privacy (Credit Reporting) Code 2014 (Version 1.2) (the Previous Code) varied under s 26T(5) of the Privacy Act 1988 (Privacy Act).

The CR Code V2 repeals and replaces the Previous Code to clarify obligations under the Previous Code, reflect current industry practice and ensure consistency with the provisions in the Privacy Act. The variations are minor in nature.

Authority for registration of the CR Code V2

Section 26T(1) of the Privacy Act 1988 (Privacy Act) enables the Australian Information Commissioner (Commissioner) to approve a variation of the registered CR Code. Section 26T(5) of the Privacy Act requires the Commissioner to register the CR Code, as varied, on the Codes Register kept by the Commissioner in accordance with s 26U of the Privacy Act. Section 26M of the Privacy Act provides that the CR Code, as varied, is a legislative instrument once included on the Codes Register.

The Australian Retail Credit Association (ARCA), the code developer, submitted an application for variation of the Previous Code under s 26T(1)(c) on 26 April 2018, and, following further consultation, a further amended application on 28 May 2018. Both applications were published on the Office of the Australian Information Commissioner (OAIC) website.

The acting Commissioner, having regard to s 26T(3) of the Privacy Act and the OAIC’s Guidelines for developing codes, approved the variations to the Previous Code on 29 May 2018. The CR Code V2 was included on the Codes Register from 1 July 2018, and the Previous Code was removed at the same time. Upon its inclusion on the Codes Register, CR Code V2 became the registered CR code.

Purpose and operation of the CR Code

A CR Code, defined by s 26N of the Privacy Act, is a written code of practice about credit reporting. The CR Code that is included on the Codes Register by the Commissioner under s 26U of the Privacy Act is called the ‘registered CR code’. The Codes Register is kept electronically on the OAIC website. The Commissioner is required by s 26S(4) of the Privacy Act to ensure that there is one, and only one, registered CR Code at all times. The purpose of the registered CR Code is to supplement the provisions of Part IIIA of the Privacy Act and the Privacy Regulation 2013.

Under s 26N of the Privacy Act, a CR Code must perform the following functions:

  • set out how one or more of the credit reporting provisions in Part IIIA of the Privacy Act are to be applied or complied with (s 26N(2)(a))
  • make provision for, or in relation to, matters required or permitted by Part IIIA to be provided for by the registered CR code (s 26N(2)(b))
  • bind all credit reporting bodies (s 26N(2)(c))
  • specify the credit providers that are bound by the CR code, or a way of determining which credit providers are bound (s 26N(2)(d))
  • specify any other entities subject to Part IIIA of the Privacy Act that are bound by the CR code, or a way of determining which of those entities are bound (s 26N(2)(e)).

In addition, a CR code may perform the following functions:

  • impose additional requirements that are not contrary to, or inconsistent with the requirements of Part IIIA of the Privacy Act (s 26N(3)(a))
  • deal with the internal handling of complaints (s 26N(3)(b))
  • provide for the reporting to the Commissioner about complaints (s 26N(3)(c))
  • deal with any other relevant matters (s 26N(3)(d)).

The variations to the Previous Code are minor or technical in nature. The CR Code V2 differs from the Previous Code by:

  • altering the definition of ‘month’ in paragraph 1.2(i) to align with current industry practices
  • removing redundant categories of ‘maximum amount of credit available’ from paragraph 6.2(b)
  • altering the requirement under paragraph 6.2(c) to address concerns about the uncertainty of how account closures are described
  • altering the timing of grace periods under paragraph 8.2(c)(ii) to clarify the application and interpretation of the grace period
  • altering paragraph 9.3(d) to permit delivery of s 21D notices under the Privacy Act by electronic means
  • altering paragraphs 9.3(a), (b), (c), (d) and (f) to address inconsistency between the Previous Code and ss 6Q and 21D of the Privacy Act
  • altering paragraph 18.1 to extend the prohibition on direct marketing activities by a credit reporting body to the use of credit reporting information in both tools and services provided by a credit reporting body to a credit provider
  • altering paragraph 20.9 to require additional information to be included in a correction notice provided to a credit provider by a credit reporting body, to enable the credit provider to match the corrected information to a customer or a customer’s account.

Reasons for decision to approve variations to the Previous Code and register the CR Code V2

In deciding to approve the CR Code V2, the acting Commissioner has had regard to ss 26T(3) and 26T(4) of the Privacy Act and the OAIC’s Guidelines for developing codes.

The acting Commissioner also had regard to the recommendations and observations made in the report, titled Review of Privacy (Credit Reporting) Code 2014 (V1.2) Report dated 8 December 2017 by PricewaterhouseCoopers (PwC). This report was drafted as a result of the independent review of the Previous Code initiated by the former Commissioner as required by paragraph 24.3 of the Previous Code.

In making the decision, the acting Commissioner considered:

         the requirement set out in s 26T(3)(a) of the Privacy Act had been met as ARCA’s application documentation was published on the OAIC’s website from 3 May 2018

         the requirements set out in s 26T(3)(b) of the Privacy Act, the Guidelines for developing codes and s 17 of the Legislation Act 2003 have been met as sufficient consultation had taken place; noting that during the review of the Previous Code, PwC consulted with stakeholders (including industry representatives groups, external dispute resolution schemes, credit reporting bodies and consumer representative groups) and ARCA consulted with this same set of stakeholders about the variations and took submissions on the variations

         the requirement set out in s 26T(3)(c) of the Privacy Act have been met as the public had the opportunity to comment throughout the PwC review process and a public consultation process conducted by ARCA in April 2018

         the list of matters set out in the Guidelines for developing codes in deciding whether to approve a variation to a CR Code.

The acting Commissioner considered that all of these requirements were adequately met.

Documents incorporated by reference

Paragraph 21.1 of the CR Code V2 incorporates into the law by reference, ISO 10002-2006 Customer satisfaction - Guidelines for complaints handling in organizations in the form in which it exists on 1 July 2018 and not in the form in which it may exist from time to time. Sections 26M and 26T(5) of the Privacy Act provide the authority, consistent with section 14 of the Legislation Act 2003, to incorporate ISO 10002-2006, into the law by reference.

The incorporated document is available for inspection, upon request, at: Office of the Australian Information Commissioner (NSW Office), Level 3, 175 Pitt St, Sydney. Phone: 1300 363 992. It is also available at the National Library of Australia and at a number of public libraries, such as the State Libraries of New South Wales and Queensland. It is available for a fee, by visiting the SAI Global web shop at www.saiglobal.com.

Consultation

Consistent with the requirements of s 17 of the Legislation Act 2003, the acting Commissioner has considered the consultation process undertaken by ARCA as the code developer.

Section 26T(3) of the Privacy Act requires that before deciding whether to approve a variation of the registered CR Code, the Commissioner must:

         make a draft of the variation publicly available (s 26T(3)(a))

         consult any person the Commissioner considers appropriate about the variation (s 26T(3)(b)

         consider the extent to which members of the public have been given an opportunity to comment on the variation (s 26T(3)(c)).

The acting Commissioner has also considered the relevant matters set out in the Appendix of the OAIC’s Guidelines for developing codes under s 26T(4) in relation to variation of a registered code.

Minor or technical changes made to the CR Code V2 were made having regard to the following:

  • From 20 September 2017 to 17 October 2017, PwC undertook targeted and public consultation in the drafting of the Report and developing the recommendations under paragraph 24.3 of the Previous Code. The variations ARCA has applied for generally reflect the PwC recommendations.
  • From 3 April 2018 to 17 April 2018, ARCA conducted public consultation as well as targeted consultation with industry (including ARCA’s members), external dispute resolution schemes and consumer advocates, on proposed variations to the Previous Code. ARCA also provided an opportunity for comment to stakeholders by publishing a draft variation on their website from 3 and 17 April 2018.
  • On 3 May 2018, the OAIC published ARCA’s application for variation on the OAIC website. Understanding that the Financial Ombudsman Service and the Financial Rights Legal Centre may have had outstanding concerns about the variation, the OAIC also invited additional comments from these stakeholders on 3 May 2018. The Financial Ombudsman Service provided comments on 8 May 2018, which ARCA responded to on 16 May 2018.
  • The approved CR Code V2 was published on the OAIC website on 30 May 2018.

The information submitted to the OAIC by ARCA on 26 April 2018 in support of its application, included correspondence showing that ARCA members that will be bound by the CR Code V2 were notified about the public consultation. Further, ARCA provided copies of the consultation material, detailing their consultation with relevant stakeholders, and submissions that they had received as part of the consultation process. ARCA detailed their response to concerns raised in the application for variation.

The acting Commissioner was satisfied, for the reasons set out above, that the consultation process undertaken by ARCA adequately addresses the statutory criteria required by s 26T of the Privacy Act and s 17 of the Legislation Act 2003.

The Office of Best Practice Regulation (OBPR) was consulted and advised that a Regulation Impact Statement is not required. The OBPR reference is ID: 23885.

The CR Code V2 commences on 1 July 2018.

The CR Code V2 is a legislative instrument for the purposes of the Legislation Act 2003.

 

Authority: Section 26T
Privacy Act 1988

 


Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

 

Privacy (Credit Reporting) Code 2014 (Version 2)

This legislative instrument is compatible with the human rights and freedoms recognised or declared in international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

 

Overview of the Legislative Instrument

The Privacy (Credit Reporting) Code 2014 (Version 2) (CR Code V2) is a binding written code of practice about credit reporting. The purpose of the CR Code V2 is to supplement the provisions of Part IIIA of the Privacy Act 1988 (Privacy Act) and the Privacy Regulation 2013.

The CR Code V2 repeals and replaces the Privacy (Credit Reporting) Code 2014 (Version 1.2) (the Previous Code) to clarify obligations under the Previous Code, reflect current industry practice and ensure consistency with the provisions in the Privacy Act. The variations are minor or technical in nature.

The CR Code V2 differs from the Previous Code by:

  • altering the definition of ‘month’ in paragraph 1.2(i) to align with current industry practices
  • removing redundant categories of ‘maximum amount of credit available’ from paragraph 6.2(b)
  • altering the requirement under paragraph 6.2(c) to address concerns about the uncertainty of how account closures are described
  • altering the timing of grace periods under paragraph 8.2(c)(ii) to clarify the application and interpretation of the grace period
  • altering paragraph 9.3(d) to permit delivery of s 21D notices under the Privacy Act by electronic means
  • altering paragraphs 9.3(a), (b), (c), (d) and (f) to address inconsistency between the Previous Code and ss 6Q and 21D of the Privacy Act
  • altering paragraph 18.1 to extend the prohibition on direct marketing activities by a credit reporting body to the use of credit reporting information in both tools and services provided by a credit reporting body to a credit provider
  • altering paragraph 20.9 to require additional information to be included in a correction notice provided to a credit provider by a credit reporting body, to enable the credit provider to match the corrected information to a customer or a customer’s account.

Human rights implications

The CR Code V2 engages Article 17 of the International Covenant on Civil and Political Rights (ICCPR). Article 17 provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference or attacks.

The CR Code V2 has no implication for the prohibition against arbitrary interference with privacy because the variations from the Previous Code are minor in nature and do not reduce the privacy protections afforded to individuals by the Previous Code and maintain the privacy protections set out in the Privacy Act.

The CR Code V2 supplements and strengthens the provisions in the Previous Code through the introduction of additional, privacy enhancing requirements for the handling of credit information by the entities that it binds.

Conclusion

The CR Code V2 engages the right to privacy. It is compatible with human rights because it promotes the protection of privacy.

 

Angelene Falk
Australian Information Commissioner
Office of the Australian Information Commissioner

 

Overview

The Privacy (Credit Reporting) Code 2014 (Version 2) was enacted to refine and update the existing framework for credit reporting practices in Australia, as set out under the Privacy Act 1988. This code was developed to address the need for a more precise and up-to-date set of guidelines that reflect current industry practices, thereby ensuring that credit reporting entities operate in compliance with the law while also protecting the privacy of individuals. The Australian Information Commissioner, exercising the powers granted under the Privacy Act, approved and registered the updated code, which serves to clarify obligations, eliminate redundancy, and harmonise with the privacy provisions outlined in the Privacy Act. The primary objective of this legislative instrument is to supplement the existing privacy laws, ensuring that credit reporting practices are both transparent and protective of personal information.

Scope and Application

The Privacy (Credit Reporting) Code 2014 (Version 2) (CR Code V2) is a legislative instrument that applies to credit reporting bodies and credit providers as defined under Part IIIA of the Privacy Act 1988. The CR Code V2 is intended to supplement the Privacy Act by providing a set of binding practices and standards for the handling of credit information. It applies throughout the Commonwealth of Australia and is registered on the Codes Register maintained by the Australian Information Commissioner under section 26U of the Privacy Act. The CR Code V2 includes minor variations from the previous version to clarify obligations, reflect current industry practice, and ensure consistency with the Privacy Act. The CR Code V2 incorporates by reference ISO 10002-2006, a standard for customer satisfaction in complaint handling, as a means of ensuring robust complaint management practices. The CR Code V2 was developed following a consultation process involving industry stakeholders, consumer advocates, and other relevant parties, in accordance with the statutory requirements set out in the Privacy Act and the OAIC’s Guidelines for developing codes. The variations approved for the CR Code V2 are minor and do not reduce the privacy protections afforded to individuals, rather they enhance the handling of credit information by credit reporting bodies and credit providers. The Privacy (Credit Reporting) Code 2014 (Version 2) is a Commonwealth legislative instrument that binds credit reporting bodies and credit providers, aiming to enhance privacy protections by setting out specific practices for the handling of credit information. The code was developed through a comprehensive consultation process and is compatible with human rights, particularly the right to privacy under Article 17 of the International Covenant on Civil and Political Rights. It is applicable across Australia and supplements the Privacy Act by providing additional, privacy-enhancing requirements for entities involved in credit reporting.

Key Provisions

The Privacy (Credit Reporting) Code 2014 (Version 2) (CR Code V2) is a legislative instrument that sets out a written code of practice for credit reporting. This code is designed to supplement the Privacy Act 1988 and Privacy Regulation 2013, providing a framework for how credit reporting provisions are applied and ensuring consistency with the Privacy Act. The CR Code V2 replaces the previous version (Version 1.2) with minor variations aimed at clarifying obligations, reflecting current industry practices, and aligning with the Privacy Act. Under section 26N of the Privacy Act, the CR Code must set out how credit reporting provisions are to be applied or complied with, bind all credit reporting bodies, specify which credit providers and other entities are bound, and may impose additional requirements, handle complaints, report to the Commissioner about complaints, and deal with other relevant matters. The CR Code V2 includes changes such as updating the definition of 'month' to align with industry practices, removing redundant categories of 'maximum amount of credit available', clarifying account closures, adjusting grace periods, permitting electronic delivery of notices, extending the prohibition on direct marketing activities, and requiring additional information in correction notices. The CR Code V2 imposes several obligations on credit reporting bodies and credit providers, including adherence to the updated definitions and procedures outlined in the code. These entities must ensure compliance with the code's provisions regarding the handling and reporting of credit information, including the electronic delivery of notices and the prohibition on certain direct marketing activities. They are also required to provide specific information in correction notices to credit providers, facilitating the matching of corrected information to customer accounts. Breaches of the CR Code V2 may have legal consequences. While the explanatory statement does not detail specific penalties, breaches of the Privacy Act or the CR Code can lead to enforcement actions by the Office of the Australian Information Commissioner (OAIC), including notices, compliance orders, and legal proceedings. The Privacy Act itself provides for penalties, including fines, for non-compliance with its provisions, which the CR Code V2 supplements. In summary, the CR Code V2 serves to clarify and refine the requirements for credit reporting bodies and credit providers, ensuring that credit information is handled in a manner consistent with privacy protections set out in the Privacy Act. The minor variations introduced in Version 2 aim to enhance the effectiveness and clarity of the original code, thereby supporting the protection of individual privacy rights.

Legal classification tags

Area of Law
Privacy Law
Instrument
Code
Concepts
Definitions & Interpretation
Reporting & Disclosure Obligations
Compliance Obligations
Exemptions & Exclusions

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.