Privacy (Credit Reporting) Code 2024

EXPLANATORY STATEMENT

Issued by the authority of the Australian Information Commissioner

Privacy Act 1988

This explanatory statement accompanies the Privacy (Credit Reporting) Code 2024 (the CR Code 2024), which replaces the Privacy (Credit Reporting) Code 2014 (Version 2.3) (the Previous Code) varied under s 26T(5) of the Privacy Act 1988 (the Act).

The CR Code 2024 repeals and replaces the Previous Code to include various enhancements made in response to the Office of the Australian Information Commissioner (OAIC) 2021 Independent review of the Privacy (Credit Reporting) Code (the Review), the final report of which was published in September 2022.[1]

The CR Code 2024 implements the following proposals from the Review report:

Proposal 4 – Amend CR Code source notes column and blue row lines
Proposal 6 – Amend CR code to accommodate other entities reporting CCLI
Proposal 13 – Amend CR Code to require CRBs to publish their CP audits and submit these to the OAIC
Proposal 15 – Amend CR Code to clarify the definition of ‘account close’ in respect of CCLI
Proposal 17 – Amend CR Code to clarify definition of ‘month’ to more flexibly accommodate CP reporting practices
Proposal 21 – Amend CR Code to specify that s 21D(3)(d) notice must be a standalone notice
Proposal 24 – Amend CR Code regarding notification obligations
Proposal 29 – Amend CR Code to provide further clarity on the expected level of evidence that a CRB needs to implement a ban and/or extension
Proposal 31 – Amend CR Code to require a CRB to record and alert an individual of access requests during a ban period
Proposal 32 – Amend CR Code to require CRBs to provide information to individuals on how they can access their credit reports held by other CRBs
Proposal 33 – Amend CR Code to specify that CRBs must provide physical copies of credit reports upon request
Proposal 37 – Amend CR Code to introduce a mechanism to correct multiple instances of incorrect information stemming from one event
Proposal 39 – Amend CR Code to include domestic abuse as an example of circumstances beyond the individual’s control
Proposal 40 – Amend CR Code to extend correction requests to include CPs
Proposal 41 – Amend CR Code to expand the categories of information that can be corrected (paragraph 20.5)

The CR Code 2024 also clarifies the definition of ‘maximum amount of credit available’ for reverse mortgages under s 5, to resolve uncertainty around the reporting of consumer credit liability information for such products.

Legislative context and authority

Part IIIA of the Act contains a legal regime which facilitates and dictates the reporting of credit reporting information within Australia. That regime provides for there to be a credit reporting code – a written code of practice about credit reporting – which particularises the provisions of Part IIIA of the Act and the Privacy Regulation 2013 (the Regulations).

The credit reporting code that is included on the Codes Register by the Commissioner under s 26U of the Act is called the ‘registered CR code’. Subsection 26S(4) of the Act requires the Commissioner to ensure that there is one, and only one, registered CR Code at all times.

Under s 26N of the Act, a credit reporting code must:

 set out how one or more of the provisions of Part IIIA are to be applied or complied with; and

 make provision for, or in relation to, matters required or permitted by Part IIIA to be provided for by the registered CR code; and

 bind all credit reporting bodies; and

 specify the credit providers that are bound by the code, or a way of determining which credit providers are bound; and

 specify any other entities subject to Part IIIA that are bound by the code, or a way of determining which of those entities are bound.

Additionally, a credit reporting code may also:

 impose additional requirements to those imposed by Part IIIA, so long as the additional requirements are not contrary to, or inconsistent with, that Part;

 deal with the internal handling of complaints;

 provide for the reporting to the Commissioner about complaints;

 deal with any other relevant matters.

Section 26T(1) of the Act enables the Commissioner to approve a variation of the registered CR Code. Section 26T(5) of the Act requires the Commissioner to register the CR Code, as varied, on the Codes Register kept by the Commissioner in accordance with s 26U of the Act. Section 26M of the Act provides that the CR Code, as varied, is a legislative instrument for the purposes of the Legislation Act 2003 once included on the Codes Register.

The Australian Retail Credit Association (ARCA), the code developer, submitted an application to the OAIC for variation of the Previous Code under s 26T(1)(c) on 18 December 2023. ARCA included with its application copies of the consultation material, detailing their consultation with relevant stakeholders, and submissions that they had received as part of the consultation process. The application was published on the OAIC website on 8 April 2024 for a period of 28 days.

Subsection 26T(3) of the Privacy Act requires that, before deciding whether to approve a variation of the registered CR Code, the Commissioner must:

• make a draft of the variation publicly available (s 26T(3)(a))

• consult any person the Commissioner considers appropriate about the variation (s 26T(3)(b)), and

• consider the extent to which members of the public have been given an opportunity to comment on the variation (s 26T(3)(c)).

The Commissioner, having regard to s 26T of the Act and the OAIC’s Guidelines for developing codes, approved the variations to the Previous Code on 27 September 2024. The CR Code became the registered CR Code on the date that it was included on the Codes Register.

An explanation of the provisions is set out in Attachment B.

Consultation

Before the CR Code 2024 was included on the Codes Register, the Commissioner was satisfied that consultation was undertaken to the extent appropriate and reasonably practicable, in accordance with s 17 of the Legislation Act 2003.

In order to develop the CR Code 2024, ARCA ran a two-stage consultation process, first seeking feedback from interested stakeholders, including industry representative groups, consumer representative groups, External Dispute Resolution (EDR) schemes and ARCA members in May, June and July 2023 before the drafting of variations to the Previous Code commenced. Following that process, and consistent with the requirements of the Part IIIB of the Act and the OAIC’s Guidelines for developing codes, ARCA consulted publicly on a draft of the CR Code 2024 between 18 October and 16 November 2023. At that time, and for a period of time afterwards, a draft of the CR Code 2024 was available on the ARCA website.

In response to ARCA’s public consultation process, a number of changes were made to the draft of the CR Code 2024. These changes included the following:

Changes to section 4 of Schedule 2, relating to notifications given to individuals, to tailor those obligations and add an additional requirement making clear that an individual’s consent to the disclosure of their information is generally not required;
A new requirement in s 17 of Schedule 2 to ensure that a ban notification service aligns with the consent requirements in the Act around credit bans and credit information.
An additional provision in s 20 of Schedule 2 that specifies that correction requests can relate to more than one piece of information.

The OAIC also conducted its own public consultation in relation to this variation application in accordance with the requirements under Part IIIB of the Privacy Act and the OAIC’s Guidelines for developing codes. A 28 day consultation period was conducted between 8 April and 7 May 2024. The variation application was published on the OAIC’s website along with the submissions received by ARCA to its public consultation. The OAIC advised relevant stakeholders, including Financial Rights Legal Centre, Legal Aid Queensland, IDCARE and the Australian Financial Complaints Authority of the application, inviting them to make a submission to the public consultation. The public consultation period, and details of how to make a submission, were also circulated through social media and in the OAIC’s Information Matters publication.

The OAIC received submissions from the Australian Financial Complaints Authority (AFCA), FinTech Australia, IDCARE, Illion, Legal Aid Queensland, the Mortgage & Finance Association of Australia, and a joint submission from Harmoney, MoneyMe, Plenti and Wisr. These submissions were published on the OAIC’s website. The OAIC considered these submissions and following engagement with OAIC staff, the Privacy Commissioner requested that ARCA submit an amended variation application, with the following changes:

Proposal 6
- further clarity around the necessity of a 6-month transition period in the Explanatory Statement; and
- further explanation about the purpose of service reconnection in the Explanatory Statement.
Proposal 13:
- include a requirement for credit reporting bodies to provide the OAIC with a list of the credit providers audited in the CR Code 2024; and
- changing the name of Division 7 of the CR Code 2024.
Proposal 15:
- further clarity around the operation of ‘charging off’ in the Explanatory Statement;
- consider including an additional limb to the ‘account close’ definition in the context of legal proceedings in the CR Code 2024; and
- consider clarifying that a closed account cannot be reported as a debt within the credit reporting system in the Explanatory Statement.
Proposal 17 - further explanation of circumstances eventuating in a 26 day month in the Explanatory Statement.
Proposal 31 – further clarity around the necessity of a 12-month transitional period in the Explanatory Statement.
Proposal 37:
- further explanation of the consultation undertaken by ARCA in the Explanatory Statement; and
- consider expanding the scope of information able to be corrected beyond enquiries in the CR Code 2024.
Proposals 39, 40 and 41 – further explanation of the term ‘domestic abuse’ and the intended scope in the Explanatory Statement.
Additional variations proposed by ARCA – further justification for including additional matters in the Explanatory Statement, including around reverse mortgages.

On 19 September 2024, ARCA submitted an amended application to vary the Previous Code. This application included amendments as requested by the Privacy Commissioner and outlined above.

Documents incorporated by reference

Section 21(3) of the CR Code 2024 incorporates into the law by reference, ISO 10002:2018(E) Quality management - Customer satisfaction - Guidelines for complaints handling in organisations in the form in which it exists on 14 February 2020 and not in the form in which it may exist from time to time.

Section 26M and subsection 26T(5) of the Privacy Act provide the authority, consistent with s 14 of the Legislation Act 2003, to incorporate ISO 10002:2018 into the law by reference.

The incorporated document is available for inspection, upon request, at: Office of the Australian Information Commissioner (NSW Office), 175 Pitt St, Sydney. Phone: 1300 363 992. It is also available at the National Library of Australia and at a number of public libraries, such as the State Libraries of New South Wales and Victoria. It is available for a fee, by visiting the SAI Global web shop at www.saiglobal.com

Statement of Compatibility with Human Rights

A Statement of Compatibility with Human Rights for the purposes of Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 is set out at Attachment A.

Attachment A

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Privacy (Credit Reporting) Code 2024

This Disallowable Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in s 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instrument

Part IIIA of the Privacy Act 1988 (the Privacy Act) regulates the collection and handling of credit reporting information by credit reporting bodies (CRBs) and credit providers. Part IIIA of the Privacy Act provides for there to be a credit reporting code. Under s 26S of the Privacy Act, the Commissioner may register a CR code on the Codes Register, and approve an application to vary that code under s 26T(1) of the Act. Under s 26N, a CR code is a binding written code of practice about credit reporting that which particularises the provisions of Part IIIA of the Privacy Act and the Privacy Regulation 2013.

The Privacy (Credit Reporting) Code 2024 (the CR Code 2024) is the registered CR Code under s 26M of the Privacy Act. The CR Code 2024 implements the intention of Parliament by addressing the matters identified by the Explanatory Memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012, including that every entity within the credit reporting system be bound by a code that deals with essential practical and operational matters for the operation of the credit reporting system.

The CR Code 2024 replaces the Privacy (Credit Reporting) Code 2014 (Version 2.3) (the Previous Code) to include various enhancements made in response to the OAIC 2021 Independent review of the Privacy (Credit Reporting) Code, the final report of which was published in September 2022.[2]

The CR Code 2024 implements the following proposals from the final report:

Proposal 4 – Amend CR Code source notes column and blue row lines
Proposal 6 – Amend CR code to accommodate other entities reporting CCLI
Proposal 13 – Amend CR Code to require CRBs to publish their CP audits and submit these to the OAIC
Proposal 15 – Amend CR Code to clarify the definition of ‘account close’ in respect of CCLI
Proposal 17 – Amend CR Code to clarify definition of ‘month’ to more flexibly accommodate CP reporting practices
Proposal 21 – Amend CR Code to specify that s 21D(3)(d) notice must be a standalone notice
Proposal 24 – Amend CR Code regarding notification obligations
Proposal 29 – Amend CR Code to provide further clarity on the expected level of evidence that a CRB needs to implement a ban and/or extension
Proposal 31 – Amend CR Code to require a CRB to record and alert an individual of access requests during a ban period
Proposal 32 – Amend CR Code to require CRBs to provide information to individuals on how they can access their credit reports held by other CRBs
Proposal 33 – Amend CR Code to specify that CRBs must provide physical copies of credit reports upon request
Proposal 37 – Amend CR Code to introduce a mechanism to correct multiple instances of incorrect information stemming from one event
Proposal 39 – Amend CR Code to include domestic abuse as an example of circumstances beyond the individual’s control
Proposal 40 – Amend CR Code to extend correction requests to include CPs
Proposal 41 – Amend CR Code to expand the categories of information that can be corrected (paragraph 20.5)

Human rights implications

The CR Code 2024 engages Article 17 of the International Covenant on Civil and Political Rights (ICCPR).

Article 17 of the ICCPR provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference and attacks.

This right to privacy is not absolute and there may be circumstances in which the guarantees in Article 17 can be limited to achieve a legitimate objective. Any limitations on privacy must also be authorised by law and not arbitrary. The term ‘arbitrary’ in Article 17(1) of the ICCPR means that any interference with privacy must be in accordance with the provisions, aims and objectives of the ICCPR and should be reasonable in the particular circumstances. The United Nations Human Rights Committee has interpreted ‘reasonableness’ to mean that any limitation must be proportionate and necessary in the circumstances.

The framework engages the right to privacy by permitting the use and disclosure of credit reporting information where it is directly relevant to an individual’s credit worthiness and ensures credit providers have a fuller picture of the financial situation of a consumer. These amendments support the allocation of credit and the ability of individuals to engage in society, while ensuring the privacy of individuals is respected.[3]

The intrusion on individual privacy posed by the use and disclosure of credit reporting information is mitigated by the safeguards put in place by Part IIIA of the Privacy Act which restricts the types of credit information that may be disclosed by Credit Reporting Bodies (CRBs), the circumstances in which that information may be disclosed by a CRB to Credit Providers (CPs) and affected information recipients and their handling of that information. The CR Code 2024 further defines these protections to ensure that information is only used for certain purposes, by certain entities. The CR Code 2024 facilitates an efficient credit reporting system in accordance with the objects of the Privacy Act, specifically under s 2A(e) of the Privacy Act which states that the objects of the Privacy Act include to facilitate an efficient credit reporting system while ensuring that the privacy of individuals is respected. The CR Code 2024 continues to provide necessary safeguards that ensure credit information is used and disclosed only where it properly reflects the credit worthiness of the individual. These safeguards include:

correct reporting of credit information for victims of fraud and individuals facing circumstances beyond their control,
ensuring the individual has been properly notified of a disclosure of their credit reporting information, and
enhancements to the operation of credit bans intended to protect the privacy of credit information from misuse, interference, loss, unauthorised access, modification and disclosure.

The limitation on the right to privacy authorised by Part IIIA of the Privacy Act and detailed in the CR Code 2024 is considered to pursue a legitimate objective; to ensure that individuals can continue to benefit from an efficient credit reporting system that supports the expanding and shifting credit reporting landscape. The safeguards provided by CR Code 2024 appropriately circumscribes the use or disclosure of credit reporting information to ensure that any limitations on privacy are reasonable, necessary and proportionate.

The CR Code 2024 does not reduce the privacy protections afforded to individuals by the Previous Code, maintains the privacy protections set out in Part IIIA of the Privacy Act and ensures that any limitations on privacy of the individual is appropriately circumscribed.

Conclusion

The CR Code 2024 is compatible with human rights because it promotes the protection of privacy. To the extent that it may limit the right to privacy, it ensures that those limitations are reasonable, necessary and proportionate.

Attachment B

Explanation of provisions

Privacy (Credit Reporting) Code 2024

Part 1—Preliminary

Section 1 – Name

Section 1 provides that the name of the instrument is the Privacy (Credit Reporting) Code 2024.

Section 2 – Commencement

Section 2 provides that the CR Code 2024 commences on the day it is registered on the Federal Register of Legislation, except for Section 5, day on which the consumer credit is entered into (a), day on which the consumer credit is terminated or otherwise ceases to be in force (a), maximum amount of credit available under the consumer credit (e), and Schedule 2, paragraph 17(2). Further explanations about the need for additional transition periods is set out in paragraphs 9(b) and 129 below.

Section 3 – Authority

Section 3 provides that the instrument is a CR Code as described in s 26N of the Act. This section also makes clear that the CR Code 2024 is included on the Codes Register maintained by the Commissioner, therefore making it the ‘registered CR Code’ described in the Act.

Section 4 – This CR Code

Section 4 provides that the operative provisions of the CR Code are set out in Schedule 2. This allows for the numbering from the Previous Code to be retained, reducing the burden of implementing the variations contained in the CR Code for entities bound by the CR Code.

Section 5 – Definitions

Section 5 provides for definitions of numerous terms used throughout the CR Code 2024.

These definitions include Act, which means the Privacy Act 1988, and Regulations, which means the Privacy Regulation 2013. These definitions are needed because several provisions in the CR Code 2024 refer to other parts of the legal framework. Consumer credit is also regulated under the National Consumer Credit Protection Act 2009; this act is defined as the National Credit Act, so that references to it in the CR Code 2024 are streamlined and simple.

Section 4 also explains that some terms used in the CR Code 2024 are defined in the Act. Important terms used in the Code that are defined in the Act are consumer credit liability information, CP derived information, CRB derived information, credit, credit eligibility information, credit information, credit provider, credit reporting body, credit reporting information, default information, financial hardship arrangement, financial hardship information, information request, payment information, regulated information, repayment history information and serious credit infringement. These terms have the same meaning in the CR Code 2024 as in the Act.

Definitions – types of information

The definitions contained in s 5 include definitions for specific types of information disclosed, used or retained as part of the credit reporting system. These include:
1. capacity information, which means information about the individual’s relationship with the credit. This means that the individual is liable for the credit either solely or jointly, or a guarantor in respect of the credit. Operative provisions relating to this definition are in s 5 of Schedule 2.
2. Credit ID information, which are certain numbers (or portions of numbers) allocated by the credit provider for the relevant consumer credit. Operative provisions relating to this definition are in s 5 of Schedule 2.
3. Credit-related personal information, which is a catch-all term which refers to credit information, credit reporting information, credit eligibility information and regulated information.

There are also definitions in s 5 for some kinds of consumer credit liability information (CCLI). These definitions include more precise details to supplement the Act and the Regulations and assist credit providers to disclose consistent information to credit reporting bodies. The definitions of this nature are:
1. Day on which the consumer credit is entered into, which has a meaning based on when the information was disclosed (reflecting previous amendments) and the type of credit entered into. This definition has been varied in the CR Code 2024 to includes a specific definition for credit provided with a telecommunications or utility service – in that context, for CCLI disclosed 6 months after commencement, the day on which the consumer credit is entered into is the day that a telecommunications or utility service is first provided, where the credit provider has generated an active account in their systems. This addition follows Proposal 6 of the Review, which suggested more tailored CCLI definitions for credit in the telecommunications and utility context. For other credit, the relevant day is when the credit is made available (for CCLI disclosed up to 14 February 2021), or when the individual is unconditionally approved and there is an account in the credit provider’s system (for CCLI disclosed from 14 February 2020 onwards)
2. Day on which the consumer credit is terminated or otherwise ceases to be in force, which has also been varied in the CR Code 2024 following Proposal 6 from the Review to include a specific definition for telecommunications and utility credit. In that context, for CCLI disclosed 6 months after commencement, the day on which the consumer credit is terminated or otherwise ceases to be in force is the day that provision of telecommunications or utilities services ceases, when rights of re-activation (e.g. such as re-energisation rights under the National Energy Retail Rules) have ceased. The reference to re-activation is necessary as the laws referred to above effectively require accounts to remain open for a short period after the service has ceased in case the re-energisation rights are relied upon. The ability to subsequently obtain a separate service from the same provider does not prevent an account being terminated/not in force for the purposes of this definition.

This definition only applies 6 months after commencement in order to ensure relevant credit providers have enough time to ensure that the CCLI they are disclosing complies with this definition, and to make any system changes necessary to align with the wording of the CR Code 2024.

For other credit, the day on which the consumer credit is terminated or otherwise ceases to be in force is the earliest of:

the day of repayment with no ability to defer further debt;
the day the debt is waived – this means in that all outstanding payment obligations are discharged and there is no ability for the credit provider to enforce any outstanding debt. As such the debt has been forgiven, and no credit then exists;
the day the debt is ‘charged off’, which means where the debt owed is identified as a ‘loss’ by the credit provider, and it is transferred from the core banking system to the recoveries system. Treating the account as ‘closed’ in this situation is consistent with contract law principle whereby rights to recover outstanding monies owed under a contract will survive termination of that contract. Outstanding monies owed are not credit for the purposes of the Privacy Act and cannot be separately disclosed as such by subsequent parties that purchase the rights to repayment of those debts;
the day on which a judgment is granted for the amount owing under the credit, noting that such a judgment – as distinct from granting possession over property securing the credit – has the effect of terminating the credit at law.

This definition has been varied in the CR Code 2024. The variations include the addition of the limb about judgments for amounts owing under credit, which reflects that at law the credit is terminated when such a judgment is obtained. Additionally, Proposal 15 of the Review suggested that the “earlier of” test apply to the criteria for when an account is treated as closed, to ensure that charged off but not repaid credit must be reported as terminated/otherwise ceased. This change has been incorporated into the CR Code 2024.

Maximum amount of credit available under the consumer credit, which has different meanings based on the type of credit entered into and the date on which the CCLI was disclosed (reflecting previous amendments). This definition has been varied in the CR Code 2024 to include a specific definition for a reverse mortgage (as defined in the National Credit Act). Prior to this amendment, it was not clear what the ‘maximum amount of credit available’ under a reverse mortgage should be. Arca proposed this amendment to provide this clarity, and on the basis the change will be relatively minor and apply prospectively. This change will mean that, for a reverse mortgage, the maximum amount of credit available is the principal amount of credit, whether fully drawn down or not, even where this may differ from the amount owing under the credit.

Definitions – credit bans and correction requests

Section 5 includes a definition for a ban notification service, which is a free-of charge service offered by a credit reporting body where it will notify an individual of requests for credit reporting information relating to them when a ban period (as defined in subsection 20K(3) of the Act) is in effect. This is a new definition to the CR Code 2024, and follows Proposal 31 of the Review which suggested that CRBs offer these types of services. The operative provisions related to ban notification services and ban periods are in s 17 of Schedule 2.

There are also definitions in s 5 for terms relevant to the correction of credit-related personal information. A correction request is a request by an individual for a credit reporting body or a credit provider to correct information under ss 20T or 21V of the Act. The correction period for a correction request is 30 days from the date the correction request is made. The operative provisions relating to corrections are in s 20 of Schedule 2.

Definitions – repayments, agreements and defaults

Section 5 includes a definition of month, which is relevant for the operative provisions relating to the reporting of repayment history information and financial hardship information in ss 8 and 8A of Schedule 2. A month means a period which starts on a given day, and ends on any of the following days determined by the relevant credit provider:
1. Immediately before the start of the corresponding day of the next calendar month
2. Where the day mentioned in a. is a non-business day, the end of the next business day
3. If there is no corresponding day of the next calendar month, the end of that month
4. The end of a day that is between 27 and 30 days after the start day
5. If the day before the first day of the month is a non-business day, the end of a day that is between 25 and 26 days after the start day.

By way of example for a month starting on 3 March, the month could end at:
1. the end of 2 April (under paragraph a. above)
2. the end of 3 April (under paragraph b. above, if 2 April is a non-business day)
3. the end of 31 March, 1, 2 or 3 April (under paragraph d. above); and
4. the end of 29 or 30 March (under paragraph e. above, if 2 March was a non-business day).

The two final limbs of this definition are new to the CR Code 2024, and follow Proposal 17 of the Review which suggested that the definition of month be expanded to more flexibly accommodate information disclosure practices of credit providers. Based on the design of CP systems, the final limb at section (e) is only relevant in very limited situations. The situations where that is likely to occur is where:
1. a credit provider’s ‘months’ for RHI reporting purposes generally end on the same day each calendar month;
2. the month is already short due to a short calendar month; and
3. the start of that month is further delayed by non-business days at the end of the preceding month.

To elaborate further, the example in paragraph 18 is one of the few instances where a ‘month’ running for 25 days after the start day is possible. In the example, if the credit provider’s ‘months’ for RHI reporting purposes generally end on the 29th of each calendar month, then:
1. the lack of a 29 and 30 February in non-leap years means the March ‘month’ cannot start until 1 March at the earliest; and
2. if 1 and 2 March are non-business days, then the March ‘month’ would run from 3 to 29 March – 26 calendar days inclusive.

Section 5 includes other definitions relating to hardship, payments and defaults, which are relevant for the operative provisions in ss 8 and 8A of Schedule 2. These include:
1. Hardship request, which means a financial hardship or payment difficulties notification or request that is regulated under legislation or an industry code. An example of such a piece of legislation is the National Credit Act. A hardship request does not include a once-off, short-term payment extension.
2. Ordinary monthly payment, which means a payment that becomes due in a month, but not overdue payments from previous months.
3. Overdue payment arrangement, which means an arrangement which is not a variation FHA put in place in relation to payments that are or will become overdue.
4. Section 21D(3) notice, which means the notice described in paragraph 21D(3)(d) of the Act, through which a credit provider states that they intend to disclose default information about the notice’s recipient to a credit reporting body.
5. Section 6Q notice, which means the notice described in paragraph 6Q(1)(b) of the Act through which the credit provider informs the individual of an overdue payment and requests that the payment be made.
6. Temporary FHA, which means a financial hardship arrangement involving temporary relief from, or deferral of, the individual’s obligations under the consumer credit.
7. Variation FHA, which means a financial hardship arrangement that involves a permanent change to the terms of the consumer credit, and meets the requirements in subsection 8A(11) of Schedule 2.

Other miscellaneous definitions in se 5 are destroy (the meaning of which is affected by section 1A of Schedule 2) and transfer event (which means an event where a credit provider’s rights to repayment of credit are acquired). Section 5 also clarifies that for the CR Code 2024, certain credit providers are not non-participating credit providers, and therefore are bound by the code; the relevant operative provision is s 1 of Schedule 2.

Section 6 – Schedules

Section 6 provides that each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in that schedule. Other items in schedules have effect according to their terms. This clause is necessary as there are two Schedules to this instrument.

Schedule 1—Repeals

Item 1 of Schedule 1 provides that the Previous Code is repealed. The provisions of the Previous Code have been incorporated, with variations, in the CR Code 2024.

Schedule 2—The CR Code

Division 1—Preliminary

Section 1 – Application of this CR Code

Section 1 of Schedule 2 sets out that the CR Code 2024 binds all credit reporting bodies, all credit providers (other than non-participating credit providers) and all affected information recipients. This provision is unchanged from the Previous Code.

Section 5 makes clear that the following types of credit provider are not non-participating credit providers (and therefore are bound by the CR Code 2024):
1. Credit providers that represent to an individual borrower that they may disclose information about that borrower to a credit reporting body (unless the provider subsequently advised the borrower in writing that they will not make the disclosures and has, in fact, not made any such disclosures); or
2. Credit providers that acquire the rights of another credit provider in relation to the repayment of an amount of credit, unless that second provider was a non-participating credit provider.

Section 1A – Obligations to destroy information

Section 1A of Schedule 2 sets out how entities may comply with obligations to destroy information. This provision is unchanged from the Previous Code.

The provisions relating to credit reporting bodies are set out at subsections 1A(1), 1A(2) and 1A(3) of Schedule 2. Where a credit reporting body is under an obligation to destroy credit information or credit reporting information, this means that it must make sure the information cannot be recovered. If this is not possible to achieve for electronic data, the credit reporting body must satisfy its obligation by taking steps to put the information beyond use. Subsection 1A(3) of Schedule 2 sets out the steps for putting information beyond use, as:
1. irretrievably omitting the information from the database from which it makes disclosures under Part IIIA of the Act;
2. being unable, and not attempting to, use or disclose the information (including to derive CRB derived information);
3. surrounding the information with appropriate technical and organisational security; and
4. committing to irretrievably destroying the information in the future if this becomes possible.

The provisions relating to credit providers are similar, and are set out at subsections 1A(4), 1A(5) and 1A(6) of Schedule 2. Where a credit provider is under an obligation to destroy credit reporting information or credit eligibility information, this means that it must make sure the information cannot be recovered. If this is not possible to achieve for electronic data, the credit provider must satisfy its obligation by taking steps to put the information beyond use. Subsection 1A(6) of Schedule 2 sets out the steps for putting information beyond use, as:
1. being unable, and not attempting to, use or disclose the information (including to derive CP derived information);
2. surrounding the information with appropriate technical and organisational security; and
3. committing to irretrievably destroying the information in the future if this becomes possible.

Division 2—Credit reporting agreements and arrangements

Section 2 – Credit reporting system arrangements

Section 2 of Schedule 2 contains provisions which relate to agreements between credit reporting bodies and credit providers. This provision is unchanged from the Previous Code.

Under subsection 20N(3) of the Act, credit reporting bodies must enter into agreements with credit providers that require the providers to ensure the credit information they disclose to the credit reporting body is up-to-date and complete. Under subsection 20Q(2) of the Act, credit reporting bodies must also enter into agreements with credit providers that require the providers to protect credit reporting information disclosed to them from misuse, interference, loss, unauthorised access, modification or disclosure. Other obligations relevant to these agreements are included in s 20 of Schedule 2.

Subsection 2(2) of Schedule 2 provides that the agreements described above must also oblige both parties to comply with Part IIIA of the Act, the Regulations and the registered CR Code.

To support the practical implementation of these agreements, subsection 2(3) of Schedule 2 requires credit reporting bodies, credit providers, mortgage insurers and trade insurers to take reasonable steps to:

inform employees of the relevant obligations in the Act, Regulations and the CR Code 2024, and
train employees in any of the entity’s practices, procedures and systems aimed at ensuring compliance with such requirements,

where the employees handle credit reporting information or credit eligibility information.

Section 3 – Open and transparent management of credit reporting information

Section 3 of Schedule 2 requires credit reporting bodies to place their policy for the management of credit reporting information on their website. This provision is unchanged from the Previous Code.

Credit reporting bodies are required by subsection 20B(3) of the Act to develop and maintain this policy. The policy must, among other things, describe the kinds of information the body collects and holds, the kinds of personal information it usually derives and the purposes for which it collects, holds and uses information. The policy must also include information relevant to the rights of individuals under Part IIIA of the Act, including restrictions on direct marketing, the ability to request corrections of information and how to make a complaint.

Division 3—Collection of information

Section 4 – Credit providers’ information collection procedures

Section 4 of Schedule 2 expands on, and explains how credit providers may comply with, their notification obligations under s 21C of the Act. Subection 21C(1) of the Act provides that, at or before the time the credit provider is likely to disclose information to a credit reporting body, it must notify the individual (or otherwise ensure they are aware) of the name and contact details of the credit reporting body and any other matters set out in the registered CR Code.

Subsection 4(2) of Schedule 2 provides that, for the avoidance of doubt, compliance with the obligation in subsection 21C(1) of the Act does not require the provider to obtain the individual’s consent to the disclosure of information about them to a credit reporting body. Rather, as is set out in the Act, the obligation is one to notify or otherwise make the individual aware of the likely disclosure and the specified matters. This provision is new in the CR Code 2024. It followed Proposal 24 of the Review, which suggested that the notification obligations in paragraph 4 of the Previous Code be reviewed and amended. This amendment followed evidence that there was confusion about the notification requirements (i.e. that consent is not generally required before a credit provider may disclose information to a credit reporting body). Subsection 4(2) of Schedule 2 is intended to help address this confusion by giving credit providers and others more confidence and clarity about their obligations under subsection 21C(1) of the Act, thereby facilitating simple explanations of these obligations, as well as simple notifications under the Act.

Subsection 4(3) of Schedule 2 specifies matters that a credit provider must notify, or otherwise make an individual aware of. The disclosures must be given at or before the time the credit provider collects personal information that it is likely to disclose to a credit reporting body. The matters that must be notified (or which the individual must otherwise be made aware of) vary depending on the nature of the likely disclosure.

Subsection 4(3) of Schedule 2 requires the provider to notify or make the individual aware of the following matters:
1. Where the likely disclosure is an information request, that the individual’s consent to the disclosure is not required, as well as how the enquiry may be used, disclosed or affect the individual’s credit score or credit rating.
2. That the credit reporting body include the disclosed information in reports requested by other credit providers to assess the individual’s credit worthiness.
3. Failure to make payments or commission of a serious credit infringement may be disclosed to the credit reporting body, as well as information that relates to these matters.
4. How the individual may obtain the credit provider’s and credit reporting body’s policies about the management of credit-related personal information.
5. The individual’s right to access and request to correct their information, and make a complaint.
6. That the individual can request that the credit reporting body not use their information for pre-screening of direct marketing by credit providers.
7. The individual’s right to request a credit ban from the credit reporting body i.e. that the credit reporting body not use or disclose their information for a period of time if the individual believes on reasonable grounds that they have been, or are likely to be, a victim of fraud.

This list of matters in subsection 4(3) of Schedule 2 is the same as those set out in the Previous Code, with the exception of the disclosures about information requests. This item is new to the CR Code 2024, and follows Proposal 24 of the Review. The intention of the notification is to:
1. address confusion about the potential effect of an information request on the individual credit score or credit rating; and
2. clarify that individual does not need to specifically consent to the enquiry being made under subsection 21C(1) of the Act.

Credit providers can elect to give the disclosures under subsections 4(3) and 4(4) of Schedule 2 in the time and manner that best reflects their likely disclosure of information for different purposes to a credit reporting body, with a form and manner that is most likely to ensure the individual is effectively notified.

Subsection 4(4) of Schedule 2 sets out how a credit provider may comply with its obligations under subsection 21C(1) of the Act and this section to notify or otherwise ensure the individual is aware of the matters described above. Those steps are:
1. publishing a longer statement of all the matters mentioned above on their website;
2. notifying or making the individual aware of the information on the website;
3. providing details of the website, and ensuring that the longer statement is prominently displayed on the website; and
4. making clear that the individual can request the longer statement in another form, such as hard copy.

Section 5 – Practices, procedures and systems

Section 5 of Schedule 2 contains information on the practices, procedures and systems of credit reporting bodies and credit providers. This provision is unchanged from the Previous Code.

Restrictions on information which may be collected, disclosed and used

Subsections 5(1), 5(2), 5(3) and 5(4) of Schedule 2 contain a series of restrictions on credit reporting bodies and credit providers relating to information that is not within the scope of the regime under Part IIIA of the Act (i.e. is not credit-related personal information). The overarching effect of these restrictions is that credit reporting bodies cannot collect, use or disclose other types of information which are not credit-related personal information.

Subsection 5(1) of Schedule 2 sets out that a credit reporting body must not do the following:
1. collect personal information about an individual’s activities in relation to consumer credit that is not credit information;
2. use personal information about an individual’s activities in relation to consumer credit that is not credit information to derive CRB derived information; and
3. disclose personal information about an individual’s activities in relation to consumer credit that is not credit information or credit reporting information.

The only exceptions to these requirements are set out in subsections 5(3) and 5(4) of Schedule 2, namely that the personal information is either credit ID information or capacity information, and is collected or disclosed at the same time as credit information or credit reporting information. An example of information permitted under these exceptions would be information that the individual is solely liable for the credit (i.e. a kind of capacity information) that accompanies credit information.

Subsection 5(2) of Schedule 2 sets out that a credit provider must not disclose personal information about an individual’s activities in relation to consumer credit that was disclosed to the provider by a credit reporting body - but is not credit reporting information. The same restriction prohibiting disclosure also applies to information derived from such information. The only exception to these prohibitions is set out in subsection 5(4) of Schedule 2; that provision allows capacity or credit ID information to be disclosed at the same time as credit information or credit reporting information.

Restrictions on standardisation of consumer credit numbering conventions

Subsection 5(6) of Schedule 2 prohibits a credit reporting body and credit provider from agreeing or implementing procedures to standardise the provider’s numbering conventions for consumer credit. This prohibition is intended to address privacy concerns from some parties about standardised numbering practices.

Practices, procedures and systems

Subsections 5(6), 5(7), 5(8) and 5(9) of Schedule 2 set out practices, procedures and systems that credit reporting bodies and credit providers are required to have. These provisions are intended to operationalise the obligations on credit reporting bodies under s 20N of the Act to take reasonable steps to ensure that the information it collects is accurate, up-to-date and complete and the information it discloses is accurate, up-to-date, complete and relevant. The CR Code 2024 creates the framework for credit reporting bodies to comply with this obligation by imposing data integrity obligations on credit providers.

Subsections 5(6) and 5(7) of Schedule 2 set out that a credit provider must have reasonable practices, procedures and systems, given the size and complexity of its business, that are designed to cover obligations under Part IIIA of the Act, the Regulations and the CR Code 2024. Those practices, procedures and systems must require the credit provider to:
1. ensure it does not disclose information to a credit reporting body that it is prohibited from disclosing (or, if that occurs, to advise the credit reporting body as soon as practicable);
2. ensure that it only discloses credit information that is accurate, up-to-date and complete (or, if prohibited disclosure occurs, advise the credit reporting body and take reasonable steps to address the disclosure);
3. advise a credit reporting body if it becomes aware that the body has disclosed to it information that is not accurate, up-to-date, complete and relevant (having regard to the purpose of the disclosure);
4. review, upon request from a credit reporting body, its practices, procedures and systems to assess whether the information it has disclosed to credit reporting bodies is accurate, up-to-date and complete;
5. take reasonable steps to rectify any issues identified in a review, and advise the credit reporting body that requested the review of the issues and action(s) taken to rectify issues; and
6. take reasonable steps to assist a credit reporting body to ensure that its credit reporting information is accurate, up-to-date, complete and relevant (having regard to the purposes for which it is used or disclosed), and to rectify any issues that are detected.

Subsection 5(8) of Schedule 2 sets out that a credit reporting body must have reasonable practices, procedures and systems designed to cover obligations under Part IIIA of the Act, the Regulations and the CR Code 2024. Certain matters that those practices, procedures and systems must require the credit reporting body to do are specified in subsection 5(9) of Schedule 2.

Division 4—Credit information

Section 6 – Consumer credit liability information

Section 6 of Schedule 2 contains provisions relating to the meaning and disclosure of consumer credit liability information (CCLI). CCLI is defined in subsection 6(1) of the Act to include:
1. the name of the credit provider;
2. whether the provider is a licensee;
3. the type of consumer credit;
4. the day on which the consumer credit is entered into;
5. the terms or conditions of the consumer credit that relate to repayment of the amount of the credit; and that are prescribed by the Regulations;
6. the maximum amount of credit available under the consumer credit; and
7. the day on which the consumer credit is terminated or otherwise ceases to be in force.

The provisions of s 6 of Schedule 2 are unchanged from the Previous Code. However, the dictionary of the CR Code 2024 in s 5 contains definitions of some components of CCLI which have been varied following proposals from the Review.

Subsection 6(2) of Schedule 2 requires credit reporting bodies, in conjunction with other credit reporting bodies and credit providers, to contribute to the development and maintenance of common descriptors of types of consumer credit (an aspect of CCLI). Under subsection 6(3) of Schedule 2, credit providers must then use these descriptors when disclosing information to credit reporting bodies.

Subsection 6(4) of Schedule 2 requires that the definitions for various types of CCLI be used when collecting, using and disclosing this information. As noted above, the CR Code 2024 includes some changes to the meanings of terms such as the maximum amount of credit available under the consumer credit and the day on which the consumer credit is terminated or otherwise ceases to be in force.

Subsection 6(5) of Schedule 2 relates to subparagraph (b)(iii) of the definition of the day on which the consumer credit is terminated or otherwise ceases to be in force. In general terms, that subparagraph relates to consumer credit which has been ‘charged off’, which may occur after the credit provider decides that the outstanding balance is a loss due to the likelihood that the amount may not be recoverable, although the legal ability to take enforcement action in respect to any outstanding debt is retained. Subsection 6(5) of Schedule 2 makes clear that where a credit provider discloses the day on which the consumer credit was charged off, that the individual cannot incur any further debt (other than arising from interest, fees and charges) under that credit.

Subsections 6(6) and 6(7) of Schedule 2 provide options for how credit providers may disclose CCLI to a credit reporting body. Under subsection 6(6) of Schedule 2, credit providers may either:
1. in a single disclosure, disclose all the information listed in the definition of CCLI that is reasonably available, other than the date on which the consumer credit is terminated or otherwise ceases to be in force; or
2. in a single disclosure, disclose their name and the day on which the consumer credit was entered into – thereby disclosing that they have provided credit to the individual.

These options are subject to subsection 6(7) of Schedule 2, which provides that where a credit provider chooses to disclose CCLI and the relevant consumer credit is terminated or otherwise ceases to be in force, the provider must disclose the date on which the credit is terminated or ceases to be in force within 45 days. This requirement is intended to ensure that information about credit that has closed is disclosed promptly; a failure to disclose such information promptly could affect an individual’s ability to obtain further credit.

Section 7 – Information requests

Section 7 of Schedule 2 contains provisions relating to information requests. Under s 6N of the Act, the following kinds of information that relate to information requests in some way are credit information (and therefore retained within the credit reporting system):
1. statements that an information request has been made in relation to the individual by a credit provider, mortgage insurer or trade insurer (see s 6N(d) of the Act); and
2. the type and amount of consumer credit sought in an application in connection to which the relevant credit provider has made an information request (see s 6N(e) of the Act).

Subsection 7(2) of Schedule 2 provides that where the amount of credit sought in an application is unknown, credit information of the kind described in subsection 6N(e) of the Act that a credit reporting body may collect and disclose can include that an unspecified amount of credit was sought. Put another way, the fact that the amount of credit sought was unknown or incapable of being specified does not prevent the other information described in subsection 6N(e) of the Act from being collected and used as credit information. This could occur where, for instance, the individual applies for credit early in the overall process before they have determined the amount of credit they require.

Subsection 7(2) of Schedule 2 is unchanged from the Previous Code.

Section 8 – Repayment history information

Section 8 of Schedule 2 contains provisions relating to repayment history information (RHI). RHI is a type of credit information, and therefore retained within the credit reporting system. The Act contains additional restrictions (relative to some other kinds of credit information) about when RHI can be collected and disclosed. This provision is unchanged from the Previous Code.

RHI includes information that an individual has met an obligation to make a monthly payment in relation to the consumer credit. However, for these purposes it is relevant whether the payment obligation is determined by reference to the consumer credit contract (as varied from time to time), or whether it is determined by reference to a temporary FHA. The provisions in s 8 of Schedule 2 deal with these two situations separately.

In the first situation (i.e. where the payment obligation for a month is not determined by reference to a temporary FHA), subsection 8(2) of Schedule 2 sets out when an individual is considered ‘overdue’. An individual is overdue if, on last day of the month to which RHI relates, there is at least one overdue payment in relation to which the grace period has expired. Credit providers’ grace periods must be at least 14 days long, beginning from the point at which the credit providers systems first treated the payment as being in arrears.

Where RHI is not determined by reference to a temporary FHA, subsection 8(3) of Schedule 2 requires that credit providers take reasonable steps to ensure they only disclose that the individual is overdue or not. The form of that disclosure is then set out in subsection 8(4) of Schedule 2. The permitted disclosures include an indication that the consumer is ‘current’ (i.e. not overdue). If the individual is overdue, the credit provider must report either a numeral (“1” to “6”) based on the age of the oldest outstanding payment, or, if the consumer is 180 or more days overdue, an “X”.

Where a payment obligation in a month is affected by a temporary FHA, subsection 8(3) of Schedule 2 requires that credit providers take reasonable steps to ensure they only disclose whether the individual has met their obligations under the FHA or not. Subsection 8(2) provides that, in this circumstance, the individual will have met their obligations under the FHA if, after any payments are considered and on the last day of the month to which the RHI relates, there are no overdue payments as determined by reference to the FHA (rather than the contract).

Subsection 8(5) of Schedule 2 then sets the form of disclosure for RHI where there is a temporary FHA in place. Where the individual has met their obligations under the FHA, the credit provider must report that the individual is current. Where the individual has not met their obligations, the provider must report a “1” (i.e. that the individual is one or more days overdue).

In either case, subsection 8(3) of Schedule 2 also requires that credit providers take reasonable steps to ensure that they do not disclose RHI more frequently than once each month (noting that month, for the purposes of RHI, is defined in s 5).

Section 8A – Financial hardship information

Section 8A of Schedule 2 contains provisions relating to financial hardship information (FHI). FHI is a type of credit information, and therefore retained within the credit reporting system.

Section 6QA of the Act sets out the definition of financial hardship arrangement and financial hardship information. A financial hardship arrangement exists where a credit provider and an individual (who is or will be unable to meet their obligations under the credit received from the provider) make an arrangement affecting the individual’s monthly payment obligations. These arrangements can be either a permanent variation to the terms of the credit (a variation FHA) or temporary relief or deferral of the individual’s obligations (a temporary FHA). When a FHA is in place, RHI is calculated by reference to the affected payment obligations, and FHI exists to provide additional context to that FHA. For a variation FHA, FHI exists for the first monthly payment affected by the arrangement. For a temporary FHA, FHI exists for each monthly payment affected by the arrangement.

The provisions in section 8A support the operation of the provisions relating to FHAs and FHI in the Privacy Act; they are unchanged from the Previous Code.

Subsections 8A(2), 8A(3) and 8A(4) of Schedule 2 provide technical detail to supplement the requirement in section 21EA of the Act to disclose FHI alongside RHI if FHI exists. Those provisions provide that FHI may be disclosed if the individual’s payment obligation for a month is affected by an FHA: see section 8A(2) of Schedule 2. For those purposes, a payment obligation is affected if the FHA is active on the later of the last day of the month the RHI relates to, or the expiry of a grace period should one exist: see section 8A(3) of Schedule 2. As outlined above, subsection 8A(4) of Schedule 2 then provides that a FHA is active if:
1. for a variation FHA – it is the first monthly payment obligation affected; and
2. for a temporary FHA – a payment in the month was affected and there were no payments due that weren’t affected.

It is possible that two or more FHAs could be active on the day mentioned in subsection 8A(3) of Schedule 2. This could cause confusion about what RHI and FHI a credit provider would need to disclose. In this case, subsection 8A(5) of Schedule 2 clarifies that the credit provider should disclose RHI determined by reference to the FHA that requires the lowest payment obligation for that month, and FHI that relates to that FHA should be disclosed as well.

It is possible that multiple individuals can hold the same credit – for instance, through a joint account. Subsection 8A(6) of Schedule 2 clarifies that where that occurs, the existence of a FHA between the CP and any one individual who holds the account will mean that FHI can be disclosed for all the individuals.

As noted above, section 21EA of the Act requires a credit provider who discloses RHI to also disclose FHI if it exists. Subsection 8A(7) of Schedule 2 addresses the reverse scenario: it provides that if a credit provider discloses FHI, they must also disclose (the related) RHI. This requirement is subject to the transitional provisions in subsections 8A(14) and 8A(15) of Schedule 2, which specify that certain hardship arrangements made before 1 July 2022 and carried over or extended are permitted to not be treated as FHAs (so FHI need not exist and/or doesn’t need to be disclosed).

Subsection 8A(8) of Schedule 2 explains the operation of subsection 6QA(5) of the Privacy Act. That section provides that information about a temporary FHA is not FHI where the individual met their payment obligation (as affected by the temporary FHA) for the month, and the amount paid was at least the amount they would have been obliged to pay had the temporary FHA not been in place. Subsection 8A(8) of Schedule 2 sets out that that second requirement (relating to the amount paid) is met if the individual pays all the amounts that would have been owing by the end of the relevant month.

As a general concept, FHAs commence when the credit provider and the individual agree to the arrangement, not when the individual first requests hardship assistance (which is the usual precursor to a FHA being made). However, subsection 8A(9) of Schedule 2 provides the commencement of a FHA to be backdated in certain circumstances. The commencement of a FHA can be backdated to when the individual requested hardship assistance where:
1. the credit provider has unreasonably and unnecessarily delayed assessing the individual’s request for hardship assistance; and
2. the credit provider considers that backdated commencement more accurately reflects the date the FHA ought to have commenced.

Additionally, under paragraph 8A(9)(b) of Schedule 2, a FHA can be backdated further if the individual requests the credit provider to do so, on the basis that the individual could not request hardship assistance earlier than they did due to the unavoidable consequences of circumstances beyond the individual’s control, and the provider agrees. Examples of the types of circumstances that could justify this backdating include a natural disaster or illness. This mechanism provides credit providers and individuals with flexibility to establish an appropriate commencement date for FHAs.

Subsection 8A(10) of Schedule 2 sets out detail for determining when a temporary FHA is formed, as opposed to an overdue payment arrangement that is not a FHA. If an overdue payment arrangement is not a FHA, RHI is determined with reference to the individual’s contractual obligations.

Paragraph 8A(10)(a) of Schedule 2 sets out a presumption that an overdue payment arrangement is a temporary FHA where under the arrangement the individual will not pay at least their ordinary monthly payments within the next month. This presumption does not apply if: the credit provider reasonably believes that the individual’s inability to meet their obligations is the result of a short term mismanagement of funds, the individual has not provided the information the credit provider has asked for to make such an assessment, or the individual states they do not want to make a request for hardship assistance.

It is possible to have an overdue payment arrangement under which an individual is required to pay at least their normal monthly payment (for instance, due to previously unpaid payments). Where this is the case, under paragraph 8A10(b) of Schedule 2, the arrangement is presumed not to be a temporary FHA unless:
1. the arrangement follows, and is in response to, an earlier temporary FHA – this includes ‘serviceability’ or ‘payment test’ periods, which can follow a temporary FHA (before a contract is potentially varied);
2. the individual making the payments under the arrangement is still likely to be overdue in 7 months; or
3. the credit provider and the individual agree the arrangement is a temporary FHA.

It is possible that a credit provider will not agree to a hardship request by an individual. Where this happens, paragraph 8A(10)(c) of Schedule 2 makes clear that an overdue payment arrangement directly following that refusal is presumed to be a temporary FHA unless the provider tells the individual that the arrangement is not a financial hardship arrangement. The note below the section explains the interaction of these requirements (for credit reporting purposes) with the obligations under the National Credit Act.

Subsection 8A(11) of Schedule 2 provides clarity about what constitutes a variation FHA. A variation FHA is an agreement made following and in response to a temporary FHA, or in response to a hardship request, and where the variation does one or more of the following things:
1. reduces the monthly payment obligations, so that if those varied obligations are satisfied, the credit provider would not consider the consumer to be overdue with reference to the terms of the credit;
2. treats overdue payments as no longer being overdue;
3. extends the term of the credit;
4. waives debt, including where efforts to collect the debt are permanently ceased;
5. reduces the interest rate, fees or charges (so long as this is not an incidental part of an overdue payment arrangement); or
6. changes the repayment terms from principal and interest to interest only, or extending a current interest only period.

Subsection 8A(12) of Schedule 2 requires credit providers to take steps to explain FHAs to individuals, as well as the RHI and any FHI which may be disclosed as a result. The information they must take steps to give needs to relate to the type of arrangement put in place (e.g. temporary FHA, variation FHA or other type of arrangement that is not a financial hardship arrangement). The information is to be given when the arrangement is put in place or as soon as practicable afterwards. The key exceptions are:
1. if the credit provider’s grace period would make the information redundant, in which case it does not need to be given at all; and
2. if the arrangement is a variation FHA that is the last step to finalise the individual’s hardship arrangements following an earlier temporary FHA, in which case the information can be given earlier when the temporary FHA is made (alongside the information required for that FHA).

Subsection 8A(13) of Schedule 2 sets out the codes for FHI to be used by credit providers: FHI about a variation FHA is represented by a “V”, while FHI about a temporary FHA is represented by an “A”.

Subsection 8A(16) of Schedule 2 provides that credit providers and mortgage insurers must not seek the disclosure of FHI in circumstances where a credit reporting body cannot disclose that information. This supports the operation of subsection 20E(4A) of the Act, which prohibits credit reporting bodies from disclosing FHI to a credit provider for the purpose of collecting overdue payments and for certain other purposes.

Section 9 – Default information

Section 9 of Schedule 2 contains provisions relating to default information, which is a type of credit information, and therefore retained within the credit reporting system.

Subsection 9(1) of Schedule 2 sets out restrictions on when an overdue payment can be disclosed as default information. Specifically, default information cannot be disclosed where the individual has made a hardship request and the credit provider is still making a decision on the request (including where the provider is waiting for the individual to provide information they need to make a decision). If the credit provider has decided to refuse the request, then default information cannot be disclosed for 14 days after the individual is notified of that decision. These rules align with the treatment of defaults and the enforcement of credit contracts under the National Credit Act.

Subsection 9(2) of Schedule 2 contains exceptions to the rules above. If the credit provider reasonably believes the relevant hardship request is made on the same basis as a request made in the previous four months, the restrictions do not apply (and default information may otherwise be able to be disclosed). This provision is intended to prevent an individual from making repeat hardship requests that do not raise new issues as a way of deferring the disclosure of default information. This position also aligns with the treatment under the National Credit Act. These provisions are unchanged from the Previous Code.

Subsections 9(3) and 9(4) of Schedule 2 clarifies the procedural requirements that a credit provider must meet before they can disclose default information. Before default information can be listed, the credit provider must give the individual a s 6Q notice which informs the individual of the overdue payment and requesting that that payment be made. The credit provider must then separately give a s 21D(3) notice which informs the individual of the credit provider’s intention to disclose default information. The s 21D(3) notice must not be given within 30 days of the s 6Q notice, and must be sent to the individual’s last known address at the time of despatch.

Paragraph 9(3)(d) of Schedule 2 includes a requirement that the s 21D(3) notice not be accompanied by any other correspondence which a reasonable person would conclude materially reduces the prominence of the messages in the notice. This is a new requirement to CR Code 2024, and follows Proposal 21 from the Review, which was that the s 21D(3) notices not be sent with other correspondence. The form of words chosen imposes an objective standard, intended to avoid the risk that a s 21D(3) notice is invalidated by a minor technicality such as the inclusion of a return envelope. The definition of s 21D(3) notice in s 5, and the notes below, make clear that such a notice can include information about seeking assistance for hardship or financial difficulty; such information does not mean the notice is inconsistent with paragraph 9(3)(d) of Schedule 2. However, it is important that the notice raises an individual’s awareness about the fact that a default is about to be listed. The variation is this regard is intended to ensure this awareness is achieved and correspondence is not bundled unnecessarily resulting in that awareness being diluted.
Once the notice requirements have been complied with, subsection 9(4) of Schedule 2 sets out when default information may be disclosed. Disclosure can occur no sooner than 14 days of the date on which the s 21D(3) notice was given. This provides the individual with time to take action after they have received the s 21D(3) notice. The credit provider has 3 months from the date on which the s 21D(3) notice is given to disclose default information. These provisions are unchanged from the Previous Code.

Subsection 9(5) provides information about the amount that may be disclosed as overdue as part of the default information. This amount must not exceed the amount on the relevant s 21D(3) notice, plus any interest, fees or other amounts owing at the time of disclosure because the payment is overdue (other than the acceleration of the entire liability), less any part payments received between the sending of the s 21D(3) notice and the time of disclosure. With the exception of the interest, fees and other amounts, all of these amounts must have been overdue for at least 60 days.

Where default information is disclosed, the rules in subsection 9(6) of Schedule 2 apply to that disclosure. These rules deal with the updating of amounts specified as overdue, as well as how the disclosure of overdue payments that include the acceleration of the entire liability are to be treated.

The general rule set out in paragraph 9(5)(c) of Schedule 2 is that an amount specified as overdue in disclosed default information must not include an amount that was previously disclosed. However, under subsection 9(6) of Schedule 2, credit providers may subsequently update the amount specified as overdue to reflect the accrual of interest, fees and other amounts as a result of the payment being overdue, but not the acceleration of the entire liability. Where these updates are made, the retention period of the default information is unchanged. The retention period is the amount of time the Act permits the credit reporting body to hold the information, and continues to be calculated with reference to the date the information was first collected, not the date of the update.

Where a credit provider wishes to disclose default information including an amount that relates to the acceleration of the entire liability, the credit provider may do so, but must request that the credit reporting body destroy the previously disclosed default information. The credit reporting body is then required by paragraph 9(6)(c) of Schedule 2 to destroy the information. The retention period for the new information will be the date it is collected by the credit reporting body. These provisions are unchanged from the Previous Code.

Section 10 – Payment information

Section 10 of Schedule 2 contains provisions relating to payment information, which is a type of credit information, and therefore retained within the credit reporting system. In general terms, payment information is information that a previously disclosed overdue payment (i.e. in default information) has been paid.

Under subsection 10(1) of Schedule 2, the amount of the overdue payment to which the default information relates is taken to be paid when one of three things occurs. The first is when the credit provider receives cleared funds covering the payment, including any fees, interest or other amounts included in the default information. The second is when the credit provider receives a partial payment but accepts this in full settlement of the amount included in the default information. The third is when the payment is waived.

Section 21E of the Act requires credit providers to disclose payment information within a reasonable period after the payment is made. However, as this can take some time, subsection 10(2) of Schedule 2 provides a mechanism through which an individual can request that the payment information be disclosed more promptly. Where such a request is made, the credit provider must take reasonable steps to disclose the payment information within 3 business days of the individual’s request and the date the payment is made (whichever is later). The only situation where the credit provider need not take such steps is where they have reasonable grounds for requiring a longer period to disclose the payment information.

These provisions are unchanged from the Previous Code. The Previous Code also contained a transitional provision (at paragraph 10.3 of that Code) which is now redundant and has not been included in the CR Code 2024.

Section 11 – Publicly available information

Section 11 of Schedule 2 contains provisions relating to publicly available information. Some types of publicly available information are credit information, and therefore retained within the credit reporting system. Specifically, publicly available information is credit information if it relates to both the individual’s activities in Australia (or an external Territory) and the individual’s credit worthiness, and is not court proceedings information or information on the National Personal Insolvency Index.

For the purposes of this definition, subsection 11(2) of Schedule 2 puts beyond doubt that certain types of information are not publicly available information because they do not relate to the individual’s credit worthiness. The types of information specified are originating processes issued by a Court or Tribunal, judgments or proceedings where the individual’s rights have been subrogated to an insurer, and judgments or proceedings that are unrelated to credit.

Subsection 11(3) of Schedule 2 then contains rules about the types of publicly available information that credit reporting bodies may collect. These rules are intended to ensure that credit reporting bodies collect information that is likely to be reliable and consistent with the scope of information which is credit information (and therefore may be collected). Under subsection 11(3) of Schedule 2, credit reporting bodies must only collect publicly available information from an agency or State or Territory authority, which relates to activities with Australia or its external Territories and the individual’s credit worthiness, and which is generally available to the public. Information satisfies the ‘generally available to the public’ criterion even if it is only available to the public in a different form (e.g. a PDF document) or for a fee.

The provisions in Section 11 are unchanged from the Previous Code.

Section 12 – Serious credit infringements

Section 12 of Schedule 2 contains provisions relating to serious credit infringements. A credit provider’s opinion that an individual has committed a serious credit infringement is credit information, and therefore may be retained within the credit reporting system. The Act defines three kinds of serious credit infringement, and the provisions in s 12 of Schedule 2 provide more information about what a credit provider needs to be able to show to substantiate each type of infringement before they can disclose an opinion that an infringement has been committed.

The first type of serious credit infringement is an act done by an individual that involves fraudulently obtaining, or attempting to obtain, consumer credit. Subsection 12(2) of Schedule 2 sets out the matters that a credit provider must be able to reasonably establish before it discloses opinions in relation to these types of infringements. In this instance, the credit provider must be able to establish that the individual made a false statement, arranged for someone else to make a material false statement, or knowingly allowed the credit provider to rely upon a material false statement or premise. The credit provider must also be able to show that the individual did so knowing the statement (or premise) was untrue, had the intent to deceive the credit provider and was aware that the statement (or premise) would be likely to materially affect the credit provider’s decision about whether to provide the credit sought.

The second type of serious credit infringement is an act done by an individual that involves fraudulently evading, or attempting to evade, the individual’s obligations in relation to the consumer credit. In this instance, the credit provider must be able to establish that the individual made a false statement, arranged for someone else to make a false statement, or knowingly allowed the credit provider to rely upon a false statement or premise. Under subsection 12(3) of Schedule 2, the credit provider must also be able to show that the individual did so knowing the statement (or premise) was untrue, and had the intent to evade the individual’s obligations by deceiving the credit provider.

The third type of serious credit infringement involves several elements. The individual must do an act that a reasonable person would consider indicates an intention to no longer comply with the obligations under the consumer credit. The credit provider must then take reasonable steps to contact the individual about the act, and the credit provider must have been unsuccessful in contacting the individual. The third element is that at least six months must have passed since the provider last had contact with the individual. These infringements typically involve an attempt to no longer comply with an obligation to repay the credit.

Subsection 12(4) of Schedule 2 provides that a credit provider can only disclose an opinion about the third type of serious credit infringement if they have disclosed default information about the consumer credit. This means the individual would have received a s 6Q notice and a s 21D(3) notice and the other obligations relating to default information must have been complied with.

Subsection 12(5) sets out the types of reasonable steps that a credit provider must take to attempt to contact the individual for the definition of the third type of serious credit infringement to be satisfied. Credit providers must, where possible, attempt contact via phone, email and mail. Where the attempts suggest the contact details are no longer current, the credit provider must take reasonable steps to obtain new contact details (and, should they be successful, repeat their contact attempts using the new details). Credit providers should also take reasonable steps to ensure phone messages and emails contain their contact details and request the individual contact them urgently. Any mailed letters must also set out the details of the default, the credit provider’s intention to disclose their opinion about a serious credit infringement as well as explain the effect of that disclosure. Finally, credit providers are also required to retain evidence of their contact attempts.

Subsection 12(6) of Schedule 2 provides more detail about how the six-month period since contact can be calculated. If the individual makes contact with the credit provider during the six-month period starting on the later of the date of s 6Q notice and the date of last contact, then the six month period for the purposes of the third type of serious credit infringement re-starts.

Subsection 12(7) of Schedule 2 provides that if, after an opinion about the third type of serious credit infringement is disclosed, the credit provider subsequently discloses new arrangement information or payment information related to the amount that was the subject of the infringement, the credit reporting body must destroy the credit information about the infringement. This reflects the fact that, in these circumstances, the obligation that the consumer was purportedly intending to not comply with has been satisfied.

The provisions in Section 12 are unchanged from the Previous Code.

Division 5—Dealing with credit information

Section 13 – Transfer of rights of credit provider

Section 13 of Schedule 2 imposes certain notification obligations when a credit provider’s right of repayment is transferred to another provider. The law generally treats the acquiring credit provider as a credit provider. The provisions in s 13 are unchanged from the Previous Code.

The notification obligations apply in the circumstances set out in subsection 13(2) of Schedule 2. Specifically, the notifications must be given where an acquirer acquires repayment rights of the original credit provider to an amount of credit, the relevant individual is notified by the original credit provider of the transfer, and CCLI or default information has been previously disclosed about the credit to which the right to repayment has been acquired.

Under subsection 13(3) of Schedule 2, both the original credit provider and the acquirer must ensure that a notification is provided to credit reporting bodies to which CCLI or default information has been disclosed about the transfer of the credit. The notification must be made within 45 days from the date of transfer and is intended to ensure the accuracy of the credit reporting body’s records.

Afterwards, both parties must ensure the credit reporting body is notified of any matters which must be disclosed under the Part IIIA of the Act, the Regulations and the CR Code 2024. For the purposes of disclosures after the transfer, subsection 13(4) of Schedule 2 makes clear that the acquirer is treated as having made any disclosures to the credit reporting body prior to the transfer.

Section 14 – Permitted CRB disclosures

Section 14 of Schedule 2 deals with disclosures of information by credit reporting bodies. The provisions in s 14 of Schedule 2 are unchanged from the Previous Code.

Subsection 14(2) of Schedule 2 requires credit reporting bodies to take reasonable steps to notify credit providers, mortgage insurers and trade insurers to whom they intend to disclose credit reporting information of the requirements of the legal framework (including the limits on use and disclosure of information). The notification requirement is intended to ensure that credit reporting bodies educate their customer bases about the credit reporting requirements.

Subsections 14(3), 14(4) and 14(5) of Schedule 2 address the possibility that, following an information request, information is disclosed about someone other than the person who was the subject of the request. Subsection 14(3) of Schedule 2 sets out when the operative provisions in subsections 14(4) and 14(5) of Schedule 2 apply, and makes clear that those rules operate irrespective of which type of entity made or received the disclosure.

Under subsections 14(4) and 14(5) of Schedule 2, the entity that identifies the error must advise the other party of the error as to the identity of the individual. Subsection 14(4) of Schedule 2 then requires the recipient of information to destroy it (consistent with the requirements of section 1A of Schedule 2), and also to take reasonable steps to ensure that information derived from that incorrect information is not then disclosed or used. Subsection 14(5) of Schedule 2 requires the entity that discloses the information to take reasonable steps to review its disclosure practices and systems so that similar errors are minimised in the future. This requirement is intended to help address any systemic issues which may have contributed to the error.

Section 15 – Security of credit reporting information

Section 15 of Schedule 2 sets out an additional information security obligation; the provisions in s 15 are unchanged from the Previous Code.

Subsection 15(2) of Schedule 2 provides that credit providers and credit reporting bodies must maintain reasonable practices, procedures and systems to ensure the security of electronic transmission and storage of credit reporting information and credit eligibility information. This obligation, which is focused on electronic transmission and storage, supplements the general obligations in s 20Q of the Act as well as the requirement for security to be addressed through the agreements between credit reporting bodies and credit providers.

Section 16 – Use and disclosure of credit-related personal information by CPs and affected information recipients

Section 16 contains provisions relating to the use and disclosure of credit-related personal information by credit providers and affected information recipients. The provisions in section 16 of Schedule 2 are unchanged from the Previous Code.

Subsections 16(2), 16(3) and 16(4) of Schedule 2 set out a framework which restricts the use of credit eligibility information or regulated information for marketing purposes. Section 21H of the Act sets out that a permitted CP use of credit eligibility information includes ‘internal management purposes … directly related to the provision or management of consumer credit’. Because such a use could be construed as allowing marketing, the provisions mentioned above address this gap. The same obligations apply to affected information recipients and regulated information.

Subsection 16(2) of Schedule 2 provides that a credit provider or affected information recipient must not use or disclose credit eligibility information or regulated information to assess the likelihood that the relevant individual (to whom the information relates) would accept an offer to apply for credit or insurance in relation to mortgage or commercial credit. The same restrictions apply to variations of the amount or terms of those products, as well as targeting or inviting an individual to apply for those products or variations thereof. Use and disclosure of this information for direct marketing is also prohibited.

Subsection 16(3) of Schedule 2 makes clear that the only exceptions to these restrictions are the ones set out in subsection 16(4) of Schedule 2. The permitted exceptions are using credit eligibility information or regulated information to assess an application for credit or insurance, to invite an applicant to apply for a different product where the original product sought is unsuitable, or to exclude an individual from other direct marketing on the basis that they are at risk of defaulting on credit they have entered into. The effect of the exceptions is that these three activities are permitted.

Sections 20F and 21H of the Act operate together to allow credit providers to access and use credit reporting information (from credit reporting bodies) for the purpose of assisting an individual to avoid defaulting on their obligations under consumer credit. Subsection 16(5) of Schedule 2 imposes limitations on the means and purpose of accessing and using credit reporting information. It does so by restricting when a credit reporting body can disclose information for this purpose to two situations. The first is where the credit provider confirms they have reason to believe the individual is at significant risk of default (i.e. the risk of default is identified by the provider based on their own data). The second is where the credit reporting body is aware of an event of the kind the credit provider has identified could reasonably indicate a significant risk of default (i.e. the risk of default is identified by the credit reporting body based on previously specified parameters provided by the credit provider which have been satisfied).

Disclosures to individuals where credit reporting information is used to assess an application for credit

Subsections 16(6) and 16(7) of Schedule 2 supports the operation of s 21P of the Act, which requires credit providers who refuse applications for consumer credit wholly or partially on the basis of credit eligibility information to provide the relevant individual(s) with a written notice. Subsection 16(6) of Schedule 2 effectively extends this requirement to any application refusal where credit reporting information was accessed in the previous 90 days, avoiding complexity and ambiguity associated with the extent to which a refusal was ‘on the basis of’ certain pieces of information.

Subsection 16(6) of Schedule 2 also includes a number of other matters the notice must include beyond those listed in the Act. The notice must explain that the individual can access their credit reporting information free of charge for the next 90 days, and how to request that information from a credit reporting body. It must also advise individuals that it is important to proactively check the accuracy of their credit reporting information – this statement may educate consumers and could indirectly help to address incorrect information within the credit reporting system. The notice must also provide information about the factors that are often considered when refusing credit applications. Some examples are listed, such as income, indebtedness, security of employment and previous credit history, but scope is left for credit providers to ensure the list reflects the factors they consider. Finally, the notice must also refer to the credit provider’s process for correcting the information they hold (credit eligibility information), and making complaints.

Subsection 16(7) of Schedule 2 specifies when the notice must be given. This must occur when the credit application is refused, or within ten business days of the refusal date.

Section 17 – Protections for victims of fraud

Section 17 of the Schedule 2 contains provisions to support credit bans under section 20K of the Act. Section 20K of the Act allows individuals to request, and credit reporting bodies to extend, credit bans in certain circumstances. When a credit ban is in place, the credit reporting body cannot use or disclose that individual’s information without the individual’s written consent. Credit bans are the credit reporting system’s mechanism for addressing the risk of fraud or identity theft.

Subsections 17(2) and 17(6) of Schedule 2 relate to ban notification services, and are new provisions in the CR Code 2024. Proposal 31 from the Review suggested that credit reporting bodies be required to make a record of access requests during a period and alert individuals of any attempts to access information pertaining to them during this period. In substance these provisions, and the associated definitions in s 5, mean credit reporting bodies:
1. must offer a ban notification service, which is a free of charge service where the credit reporting body notifies an individual of requests for credit reporting information relating to them;
2. may require the individual’s written consent before providing notifications – this may be needed to comply with the credit ban provisions in s 20K of the Act associated with the use of information when a credit ban is in place;
3. may collect contact details for the provision of notifications under a ban notification service; and
4. must, if an individual has requested to receive notifications, use the collected contact details to notify them of attempts to access credit reporting information relating them when a credit ban is in place.

The obligations relating to ban notification services in subsection 17(2) of Schedule 2 applies 12 months after commencement. An additional period beyond the commencement date of the CR Code 2024 is necessary for credit reporting bodies to build the functionality needed to offer ban notification services and put in place processes for collecting, storing and passing-on the individual’s contact details in the manner permitted by this subsection.

Subsection 17(3) of Schedule 2 sets out the steps a credit reporting body must take when an individual requests a credit ban, providing a level of detail beyond that set out in s 20K of the Act. When a ban is requested, the credit reporting body must immediately make a note of the request which is retained with the consumer’s information for the duration of the ban period. The credit reporting body must also explain several matters to the individual, such as the effect of the ban (including, for instance, that the credit ban means that any subsequent attempts to obtain credit may be unsuccessful while the ban is in place, as a prospective credit provider will not be able to use the individual’s credit information). The credit reporting body must also explain the availability of a ban notification service once the provisions requiring such a service to be operated have commenced.

The requirement to explain also addresses the potential need for the individual’s credit reporting information held by other credit reporting bodies to be protected. For this reason, under subsection 17(3) of Schedule 2 the credit reporting body must explain that the individual can similarly request bans with other credit reporting bodies. They must also explain that they can facilitate such bans being put in place, by notifying other credit reporting bodies that the individual specifies, that the individual has requested those bodies not use or disclose the individual’s credit reporting information. These requests are referred to subsection 17(3) of Schedule 2 as additional ban period requests. This same mechanism can also be used to request a ban notification service from the other specified credit reporting bodies. The mechanism removes the need for the individual to separately contact each credit reporting body to request a credit ban be put in place.

Subsection 17(4) of Schedule 2 gives effect to the additional ban period request mechanism. It requires the credit reporting body that the individual contacted to pass on the requests, and then requires a credit reporting body that receives the additional ban period request to treat it as though it was received directly from the individual. The only exception to this second requirement is the obligation to explain that bans may be requested or facilitated with other credit reporting bodies, as this requirement is redundant in the context of an individual who has already made use of the mechanism once.

Where a credit reporting body receives a request for credit reporting information about an individual who has a ban period in effect, subsection 17(5) of Schedule 2 requires the credit reporting body to advise the credit provider, mortgage insurer or trade insurer who requested the information of the ban. In these circumstances, s20K of the Act prohibits the credit reporting body from providing the information sought without the individual’s express written consent.

Subsections 17(7), 17(8), 17(9) and 17(10) of Schedule 2 deal with the extension of credit bans. Under the Act, a credit ban is in place for 21 days unless it is extended. Subsection 17(7) of Schedule 2 requires credit reporting bodies to notify consumers of the upcoming end of a credit ban, their right to seek an extension, no less than 5 days before that ban would finish. Subsections 17(8) and 17(9) of Schedule 2 replicate the additional ban period request mechanism for ban extensions. If an individual makes an additional ban period request, they can then request the credit reporting body they originally dealt with request the extension of the ban with other credit reporting bodies. As with the additional ban period requests, the other credit reporting bodies are then required to treat the request as though it came straight from the individual.

Subsection 17(10) of Schedule 2 is a new provision in the CR Code 2024. It follows Proposal 29 of the Review, which suggested that the CR Code provide clarity on the level of evidence a credit reporting body needs to place or extend a ban.

For a credit ban to be placed, the individual must have reasonable grounds to believe they have been, or are likely to be, a victim of fraud. For a ban to be extended, the credit reporting body must have reasonable grounds to believe the individual has been, or are likely to be, a victim or fraud. Subsection 17(10) outlines that, to form this view about extending a ban, a credit reporting body may ask the individual why they are extending a ban and why they believe they have been the victim of fraud. The credit reporting body may only ask for additional information after that if the responses received, or the circumstances of the request, suggest there are reasonable grounds to believe the consumer has not been the victim of fraud. Credit reporting bodies should make an assessment on the circumstances of each case, but should not require unduly onerous evidence from an individual to support a request for an extension to the ban period. It is not expected that an individual would ordinarily need to, for example, present documentary evidence to support their belief that they are a victim of fraud and that an extension is required to the ban period.

Section 18 - Use by a CRB of credit reporting information to facilitate a CP’s direct marketing

Section 18 of Schedule 2 contains provisions to support restrictions in the Act, and elsewhere in the CR Code 2024, around the use of credit related personal information for marketing purposes. The provisions are unchanged from the Previous Code.

Subsection 18(2) of Schedule 2 prohibits credit reporting bodies from using credit reporting information to develop a tool for credit providers or affected information recipients that would help them to either determine how likely an individual would be to accept an offer of credit or insurance, or help them target such offers. Subsection 18(3) of Schedule 2 then applies an additional prohibition on any such tool being offered by a credit reporting body.

Subsection 18(4) of Schedule 2 supports the operation of subsections 20G(2) and 20G(3) of the Act. In effect, those provisions in the Act allow credit reporting bodies to assist credit providers undertake direct marketing by screening out individuals that do not meet specified eligibility requirements. Subsection 18(4) of Schedule 2 prevents credit providers from nominating eligibility criteria that an individual is under financial stress, unless those criteria are to exclude them from the direct marketing. This means that a credit provider could not use section 20G of the Act to target consumers who are experiencing, or may experience, financial difficulty with offers of new credit.

Subsections 18(5) and 18(6) of Schedule 2 support the ability of individuals to request their credit reporting information not be used for direct marketing purposes under subsection 20G(5) of the Act. Under the subsections, these requests must be given effect to as soon as practicable (irrespective of the form in which the individual makes the request), and the credit reporting body must keep a confidential register of individuals who have made requests of this nature.

Division 6—Access to, and correction of, credit information

Section 19 - Access

Section 19 of Schedule 2 deals with individuals accessing their credit-related personal information (either directly or through an access seeker). Subsections 19(3), 19(6), 19(7) and 19(8) of Schedule 2 are new or varied under the CR Code 2024; the other provisions in s 19 of Schedule 2 are unchanged from the Previous Code.

Under the Act, credit reporting bodies and credit providers must provide access to credit reporting information to the access seeker (the individual or an authorised person assisting them) on request. Access must be provided in a reasonable period. A credit reporting body is not permitted to charge for access if the individual (whether directly or through an access seeker) has not made a request for access within the preceding 3 months; any charges for access that are allowed must not be excessive. When providing access to credit reporting information, the credit reporting bodies must also give the individual’s credit rating with an explanation (assuming they derive such ratings). Most credit providers may impose a reasonable charge for providing access to credit information.

Subsection 19(2) of Schedule 2 requires credit reporting bodies and credit providers to obtain reasonable evidence of a person’s identity and entitlement to access information before providing them with credit reporting information or credit eligibility information.

Subsection 19(3) of Schedule 2 imposes requirements on credit reporting bodies in respect of the service they provide to allow an individual (either directly, or through an access seeker) to obtain their credit reporting information. The two requirements imposed are:
1. credit reporting bodies must provide information about how the individual can obtain their credit reporting information from other credit reporting bodies. This is a new requirement in the CR Code 2024, and follows Proposal 32 of the Review. The intention is that, by providing basic contact details for other credit reporting bodies, it improves individuals’ awareness of other credit reporting bodies and makes it easier for them to access all the information pertaining to them within the credit reporting system.
2. credit reporting bodies must provide a means for the individual to request their credit reporting information other than through the credit reporting body’s website. This is a new requirement in the CR Code 2024, and supplements Proposal 33 of the Review, which suggested that credit reporting bodies provide the information in hard copy on request. By also requiring a credit reporting body to have a non-online means through which an individual can request their information, the whole process of obtaining credit reporting information is made more accessible to individuals for whom online access would be difficult.

Subsections 19(4) and 19(5) of Schedule 2 expands the circumstances in which a credit reporting body must give an individual free access to their credit reporting information. Subsections 20R(5) and (6) of the Act provide that a credit reporting body may charge for access to this information where a request for access has been made in the previous 3 months. However, under subsection 19(4) and 19(5) of Schedule 2, free access must be given if the individual provides evidence that they had an application for consumer credit refused in the previous 90 days. This applies even where the request is made through a different access seeker, or where free access has been given in the previous 3 months.

Subsection 19(6) of Schedule 2 imposes requirements on free of charge access to credit reporting information by credit reporting bodies. When such access is provided, the credit reporting body must:
1. provide access to all credit information they hold in the databases they use for disclosure, as well as all derived information and a credit score;
2. provide information clearly and accessibly, and with reasonable explanations;
3. only provide marketing where the relevant person has actively opted in to these communications;
4. provide the information in physical form on request (this requirement is new to the CR Code 2024 and gives effect to Proposal 33 described above).

Subsection 19(7) of Schedule 2 imposes requirements on a credit reporting body’s paid services for access to credit reporting information. Those requirements are:
1. the information provided under the paid services must prominently disclose the free of charge services and when they are available;
2. the free of charge services must be as available and easy to identify as the paid services; and
3. the information provided under the paid services must be in physical form on request (this requirement is new to the CR Code 2024 and gives effect to Proposal 33 described above).

Subsection 19(8) of Schedule 2 imposes requirements on a credit provider’s services for access to credit eligibility information. The credit provider must take reasonable steps to provide an accessible means to provide access to that information. They must also:
1. provide access within 30 days unless unusual circumstances apply – this longer period (relative to services offered by credit reporting bodies) reflects that provision of this information is not core business for credit providers;
2. provide information clearly and accessibly, and with reasonable explanations;
3. advise the individual that to obtain the most up-to-date information, they should also request credit reporting information, and how they may do so (this last requirement is new to the CR Code 2024 and ensures consistency with subsection 19(3) of Schedule 2 and reflects Proposal 32 of the Review).

These provisions can require credit reporting bodies and credit providers to provide access to derived information. Where this occurs, subsection 19(9) of Schedule 2 makes clear that the information can be provided in a way that retains the confidentiality of the way in which it was produced or derived.

Credit ratings

Credit reporting bodies can derive credit ratings about an individual. These are a rating of the individual on a scale or range of credit scores. There can be multiple ratings derived – for instance, based on different sets of credit information, potentially reflecting different participation levels within the credit reporting system.

Subsection 19(10) of Schedule 2 provides that the credit rating to be disclosed to an individual in response to a request is one used to provide ratings or scores for credit providers based on the broadest range of information. If there is more than one score like this, the most accurate and up-to-date one is to be provided. If another credit rating is provided through a paid service, the individual must be given the option to receive that other rating for free once every 3 months.

Subsection 19(11) of Schedule 2 deals with services using third parties. Those services may, for a fee, offer to give the access seeker the individual’s credit rating more often than once every 3 months. Where this is the case, credit reporting bodies referring access seekers to the third party services must prominently disclose the right to receive a credit rating for free every 3 months, and make their free services as available and easy to identify as their referrals to the third party services.

If a credit reporting body does not have enough information to derive a credit rating for an individual, then when giving access to their information, subsection 19(12) of Schedule 2 requires them to explain this fact, along with an explanation of what information they would need to derive a rating.

Subsection 19(13) of Schedule 2 imposes requirements on credit reporting bodies giving credit ratings to access seekers. Credit reporting bodies must:
1. explain the nature of a credit score and how the rating given relates to the score;
2. use at least five bands for the ratings, and use appropriate descriptors for those bands (and the scores within them) that are relevant to the credit worthiness of individuals within each band;
3. indicate which band the individual is within – giving the rating is sufficient, but can also involve providing a precise credit score; and
4. give the disclosure required by subsection 19(14) of Schedule 2.

The disclosure required by subsection 19(14) of Schedule 2 is intended to provide additional context to the credit rating or credit score. It must include:
1. a general description of the kinds of information held by the credit reporting body and how that information affects the individual’s credit score;
2. a description of the types of information the credit reporting body reasonably believes are the most important for individuals within that band – for instance, by describing 3-5 types of information which have the biggest effect on the credit score of individuals within that band;
3. a statement about things the individual within that band can do to improve their credit rating (unless the individual is in the highest band); and
4. a description of how credit providers may access and use a credit rating or score.

Under subsection 19(15) of Schedule 2, the assumptions used in developing the disclosure above must be reviewed yearly, or otherwise when there is a significant change to the calculations used to derive credit ratings. This requirement helps ensure the disclosures to individuals remain up-to-date.

Subsection 19(16) of Schedule 2 clarifies how RHI and FHI can be disclosed to an access seeker. The general requirement is that the codes disclosed by the credit provider should be used, although RHI may be represented in a graphical form (such as a tick for RHI Code “0”), and codes that the credit reporting body reasonably believes will help the access seeker may also be used. FHI must be accompanied by tailored statements which effectively explain what the codes for variation FHAs and temporary FHAs mean in practical terms.

Subsection 19(17) of Schedule 2 requires credit reporting bodies that hold FHI about an individual to include an additional disclosure when providing access to that individual’s credit rating or credit score to an access seeker. The credit reporting body must explain that the FHI was not used in the calculation of the credit rating or credit score.

Section 20 – Correction of information

Section 20 of Schedule 2 expands upon and supports the provisions within the Act which deal with the correction of credit information.

By way of overview, the Act requires credit reporting bodies and credit providers to take reasonable steps to correct information if:
1. they are satisfied that the information is inaccurate, out-of-date, incomplete, irrelevant or misleading for a purpose for which it is held (i.e. correction on their own volition or following notification from another credit reporting body or credit provider): see ss 20S and 21U of the Act; and
2. in similar situations as above but upon the request of the individual: see s 20T and 21V of the Act.

An individual may make a correction request to any credit provider and credit reporting body that holds credit information (or derived information), irrespective of the source of the information they are seeking to correct. Credit reporting bodies may consult to form a view about whether a correction needs to occur. Correction requests, and correcting information as a result, must be free for the individual. Decisions on corrections requests must be made within 30 days; the period for making these decisions is defined as the correction period in s 5 of the CR Code 2024.

Subsections 20(6), 20(9), 20(10) and 20(11) of Schedule 2 are new to the CR Code 2024, and Subsections 20(12) and 20(13) have been varied. The other provisions are unchanged from the Previous Code.

Subsections 20(2) and 20(3) of Schedule 2 deal with correction requests to credit providers who do not participate in the credit reporting system. Those providers can meet their obligation to consult (if they cannot form a view on a correct request otherwise) and to notify an individual that a correction has not been made by taking a series of steps within 30 days. The provider must consult to identify who holds the information, and then advise the individual that the correction has not been made because they do not participate in credit reporting. The notice given to the individual must identify an entity that holds the information that was the subject of the correction request, and include that entity’s contact details. It must also include a description of the individual’s rights to access external dispute resolution.

Subsection 20(4) of Schedule 2 provides additional detail on the steps that the entity that receives a complaint (the first responder) must take when consulting on a correction request. Those steps are as follows:
1. the first responder must take reasonable steps to consult within 5 business days of receiving the request, and must tell the entity they’re consulting with when the correction period ends.
2. consulted entities must take reasonable steps to respond with at least 5 days remaining in the correction period (or as soon as practicable if they are consulted with fewer than 5 days to go).
3. where the consulted entity cannot respond before the correction period ends, they must advise the first responder of the delay, the reasons for it and with a reasonable timeframe within which they can respond. The advice must be given with at least 5 days remaining in the correction period (or as soon as practicable if they are consulted with fewer than 5 days to go).

Subsection 20(5) deals with credit reporting bodies and credit providers seeking to extend a correction period. Where they will not be able to resolve a correction request within the 30-day correction period, they must notify the individual that made the request of the delay, the reasons for it and seek the individual’s agreement to a reasonable extension. The notification also needs to advise the individual of their external dispute resolution rights. Where the individual does not agree, the entity considering the correction request must respond within the extension timeframe they sought (although they may risk not complying with the Act if they do not respond within the correction period).

Subsection 20(6) of Schedule 2 makes clear that a correction request can relate to one piece of information, or multiple pieces of information. This is a new provision in the CR Code 2024, and follows Proposal 37 of the Review that there be a simpler mechanism for individuals seeking to correct multiple pieces of information stemming from a single event. Subsection 20(6) of Schedule 2 makes clear that a request can relate to multiple pieces of information, and that as such the normal requirements around consultation, timeframes, and the ability to make the request of any credit reporting body or credit provider will apply. This section creates the mechanism suggested in Proposal 37.

The substance of the ‘simpler process’ created in response to Proposal 37 is contained in subsections 20(9), 20(10) and 20(11) of Schedule 2. Subsection 20(9) specifies which correction requests these additional obligations apply to – specifically, requests that relate to specified credit enquiries where credit was not ultimately approved, and the individual states those enquiries were caused by fraud.

Subsection 20(10) of Schedule 2 requires entities that receive these requests to consider specific matters when considering what evidence to ask for to determine if the relevant information should be corrected. Those entities must consider the burden on the individual of providing evidence, the availability of other information which could be used, and the information they may need to consult with other parties on the request. These requirements are intended to reduce the burden on individuals associated with making a request to correct multiple pieces of information stemming from a single event, especially as providing similar information multiple times can be difficult or traumatising.

For the same reason, under subsection 20(11) of Schedule 2, entities consulted on these specific multiple requests must consider similar matters before they ask the individual for more evidence. Those entities must consider evidence already provided, the burden on the individual of providing any more evidence, the availability of other information which could be used and any views about the initial fraud event expressed by the entity that received the request.
The provisions drafted in response to Proposal 37 of the Review were developed in close consultation with affected stakeholders, including credit reporting bodies, credit providers and consumer advocacy bodies. This consultation occurred between 9 June 2023 and 16 November 2023. This included the opportunity to provide written submissions on multiple occasions, as well as multiple workshops and conversations. The consultation undertaken ensures the Review’s expectation that the approach be developed in consultation with stakeholders was met. The provisions limit the scope of the multiple corrections requests after fraud to enquiries only, reflecting that the majority of these types of requests will relate to enquiry information only.

Subsections 20(7) and 20(8) set out the general steps that all credit reporting bodies and credit providers who receive, and are consulted on, a correction request must take. The entity that receives the correction request must determine as soon as practicable whether information needs to be corrected. Where an entity is satisfied that a correction should occur, obligations under the Act to take reasonable steps to correct the information will be met where:
1. the information is corrected – for corrections in response to a correction request this must occur within five days, otherwise it must occur as soon as practicable;
2. the entity takes reasonable steps to ensure that any future derived information is based on the corrected information; and
3. the entity takes reasonable steps to ensure any derived information based on the uncorrected information is not disclosed or used to assess the individual’s creditworthiness.

Corrections of information that exists due to circumstances beyond the individual’s control

Subsections 20(12) and 20(13) of Schedule 2 allow for the correction of specific types of credit information that only exists because of circumstances beyond the individual’s control. These provisions are materially varied in the CR Code 2024; the corresponding provision in the Previous Code is paragraph 20.5. The variations follow Proposals 39-41 of the Review, which suggested that paragraph 20.5 of the Previous Code be amended to:
1. include domestic abuse as an example of the circumstances that allow such corrections to be made;
2. allow the correction requests to be made to credit providers; and
3. potentially expand the types of information that can be corrected (beyond certain new arrangement information and payment information).

Under the provisions, where an individual makes a correction request on the basis that specific forms of credit information exist because of circumstances beyond the individual’s control, the entity that receives the request must consider whether the information is inaccurate, out-of-date, incomplete, irrelevant or misleading, having regard to the purpose for which the information is held. If the entity that received the request is not the credit provider that originally disclosed the information, they must consult with that credit provider. Where the first responder determines that the information is inaccurate, out-of-date, incomplete, irrelevant or misleading, having regard to the purpose for which the information is held, they must agree to correct it.

To help explain the scope of the mechanism, s 20(12) includes examples of circumstances beyond the individual’s control. Those examples are natural disaster, domestic abuse, or an error in processing a direct debt or fraud. This provides an indication of the extent to which the circumstances must be beyond the individual's control, without specifying a precise list. The new term in that list – domestic abuse – is intended to be interpreted widely, and not intended to be limited to conduct by e.g. a spouse or partner or conduct which involves physical violence. By contrast, domestic abuse is intended to encompass different types of abuse including financial abuse, emotional abuse, and other forms of coercive control.

The mechanism is not available for all types of credit-related personal information. Corrections under s 20(12) of Schedule 2 can be requested in respect of default information, payment information, new arrangement information of the kind described in subsection 6S(1) of the Act, RHI (where the relevant monthly payment obligations have been met or varied) and FHI.

Corrections of information about statute-barred debts

Under subsection 20(14) of Schedule 2, an individual may request a credit reporting body to destroy default information about payments relating to credit which cannot be recovered due to a statute of limitations. Where these requests are made, the credit reporting body must destroy the default information.

Notification obligations following correction

Subsection 20(15) of Schedule 2 contains detailed requirements about the notifications that must be given to the individual after information is corrected. The notification that must be sent to consumers must include all the relevant information held by the entity that made the correction, as well as a description of their right to obtain free access to their credit reporting information as a result of the correction that has been made. If the entity has an obligation to then on-notify another credit reporting body, credit provider or affected information recipient – which could occur if the corrected information had been previously disclosed – the entity must state who they intend to notify and ask the individual if there are any other credit providers or affected information recipients they would like to have notified.

Subsections 20(16) and 20(17) of Schedule 2 deal with the notifications that must be made to previous recipients of corrected information. Subsection 20(16) of Schedule 2 provides that no notification is needed if the information is identity information, unless requested by the individual (i.e. in response to the notice detailed in subsection 20(15) of Schedule 2). Subsection 20(17) outlines what steps an entity should take to provide notifications. Unless it would be unlawful to do so, obligations to notify previous recipients are met where, within 7 days, the entity:
1. notifies all credit reporting bodies that received the information;
2. notifies all credit providers and affected information recipients that either received the information within the previous 3 months, or which received the information at an earlier time and were nominated by the individual (i.e. in response to their notification under subsection 20(15) of Schedule 2); and
3. provides any revised derived information to any notified credit provider and affected information recipient (i.e. where previously provided derived information is now incorrect because the correction has occurred).

Subsection 20(18) of Schedule 2 provides that the complaint handling provisions in the Act do not apply to correction requests. This reflects that corrections requests can involve a degree of dissatisfaction with the situation, and avoids confusion that would result from the overlap of the corrections and complaint handling obligations for the same communication.

Division 7—Complaints, record keeping, system integrity and administration

Section 21 – Complaints

Section 21 of Schedule 2 expands upon the complaint-handling obligations in the Act. The provisions of section 21 of Schedule 2 are unchanged from the Previous Code.

Credit reporting bodies and credit providers may be subject to complaint handling requirements under other laws, licences or enforceable codes. Subsection 21(2) of Schedule 2 provides that where that is the case, those requirements must be applied to complaints under Part IIIA of the Act.

For credit reporting bodies and credit providers who are not otherwise subject to complaint handling requirements, subsection 21(3) of Schedule 2 sets out the requirements that must be followed for complaints under Part IIIA of the Act. Those requirements involve compliance with specific sections of ISO 10002:2018(E) Quality management - Customer satisfaction - Guidelines for complaints handling in organisations.

Subsection 21(4) of Schedule 2 provides that credit reporting bodies must be members of, or subject to, a recognised external dispute resolution scheme.

Under subsection 23B(2) of the Act, if the entity that receives a complaint considers it necessary to consult with a credit reporting body or credit provider, they must proceed to consult. Subsection 21(5) of Schedule 2 supports this requirement by imposing an obligation on the recipient of a consultation request to take reasonable steps to respond as soon as practicable.

Under section 23B of the Act, an entity that receives a complaint has 30 days, or such longer period of time the individual agrees to, to make a decision on the complaint. Subsection 21(6) of Schedule 2 provides that where the entity believes it will not be able to respond within that 30 day period, it must advise the individual, explain the delay and seek their agreement to a reasonable extension. The entity must also advise the individual of their right to complain to the relevant external dispute resolution scheme (or the Commissioner if the entity is not a member of, or subject to, such a scheme).

Subsections 21(7) and 21(8) of Schedule 2 deal with notification requirements that apply where an individual complains about an act or practice that may breach ss 20S and 21U of the Act (which relate to corrections). The relevant provisions in the Act state that the entity that received the complaint must advise others who hold the information to which the complaint relates, as well as notify them of the decision about the complaint once it is made. For example, if a credit provider receives a complaint about credit reporting information that a credit reporting body holds, the credit provider must notify the credit reporting body.

Subsection 21(7) of Schedule 2 sets out which credit providers a credit reporting body must notify. It is sufficient for credit reporting bodies to notify the credit provider that disclosed the credit information to them, any credit provider the credit reporting body disclosed the information to in the previous 3 months, and any credit provider nominated by the individual. Similarly, subsection 21(8) of Schedule 2 sets out who a credit provider must notify. It is sufficient for credit providers to notify the credit provider or credit reporting body that disclosed the credit information to them, any credit provider or credit reporting body to whom they disclosed the information in the previous 3 months, and any credit provider nominated by the individual.

Section 22 – Record Keeping

Section 22 of Schedule 2 contains record keeping obligations for credit reporting bodies and credit providers. This section is unchanged from the Previous Code.

Subsections 22(1) and 22(2) of Schedule 2 set out the records which must be kept. Entities must maintain adequate records which evidence their compliance with the Act, the Regulations and the CR Code. This requires them to retain records of the following matters:
1. where information is destroyed in order to meet their obligations (if the records are possible to keep);
2. for credit providers that receive credit eligibility information from another credit provider, the date of disclosure, the type of information, the identity of the person who disclosed the information and evidence to suggest the relevant consent obligations had been met;
3. for each disclosure of credit reporting information or credit eligibility information, the date of disclosure, the type of information, the identity of the person the disclosure was made to and evidence to suggest the disclosure was permitted;
4. any consent provided by an individual;
5. any written notice given to an individual about the refusal of a consumer credit application within 90 days of receiving credit reporting information about that individual; and
6. correspondence and actions about credit bans, corrections, complaints, pre-screen requests as well as monitoring and auditing of credit providers.

Subsections 23(3) and 22(4) of Schedule 2 deal with the retention period for records. Records must generally be retained for five years, although records that include information that is subject to a retention period under the Act need only be retained for that retention period. For example, this means records containing RHI would only need to be retained for 2 years.

Section 23 – Credit reporting system integrity

Section 23 of Schedule 2 expands upon the requirements for agreements between credit reporting bodies and credit providers mentioned in sns 20N and 20Q the Act. Those agreements require credit providers to ensure that the credit information they disclose is accurate, up-to-date and complete, and to protect the credit reporting information disclosed to them from misuse, interference and loss as well as unauthorised access, modification and disclosure. The agreements must also ensure that regular audits are conducted to determine whether the agreements are being complied with.

Section 23 is unchanged from the Previous Code, except for subsections 23(10) and 23(14), which are new to the CR Code 2024. There has also been a minor flow-on amendment to subsection 23(15) of Schedule 2.

Subsection 23(2) requires credit reporting bodies to set up documented, risk-based programs (the risk-based programs) to monitor credit provider compliance with their obligations under Part IIIA of the Act. The risk-based programs are intended to ensure:
1. that audits are tailored and targeted to the greatest risks of non-compliance; and
2. that credit providers comply with obligations related to data quality, data security and corrections.

Subsection 23(3) of Schedule 2 specifies the matters that a risk-based program must include. Risk-based programs must identify and evaluate indicators of risks of credit provider non-compliance, assess the risks posed using those risk indicators and the available data, and use monitoring techniques to validate and update risk assessments. Risk-based programs must also include a program for auditing credit providers to assess compliance.

Subsections 23(4), 23(5) and 23(6) of Schedule 2 outlines which independent persons may conduct an audit. The general requirements are that the audits may be conducted by the credit reporting body’s compliance or auditing team, or consultants engaged by the credit reporting body. Consultants engaged by the credit provider or industry-funded organisations may conduct audits if the credit reporting body is satisfied of their independence and expertise.

In addition to these general requirements, subsection 23(5) of Schedule 2 sets out when an auditor is independent of the credit provider (and therefore eligible to conduct an audit). The auditor must not be a director or employee of the credit provider, or have a significant financial interest in the credit provider or any other association with the credit provider which impairs the perception of their independence. The auditor must also not have had any such relationship, interest or association in the last 12 months. Additionally, auditors employed by the credit reporting body or an industry-funded organisation must have functional independence.

Furthermore, subsection 23(6) of Schedule 2 includes expertise requirements. The credit reporting body must take reasonable steps to ensure the auditor has sufficient expertise, including knowledge of the law and audit methodology and experience with conducting audits and the credit reporting system.

Credit reporting bodies must have oversight of audits, as well as reporting arrangements. Under subsection 23(7) of Schedule 2, these matters must be sufficient for the credit reporting body to form a view about whether credit providers are complying with their obligations.

Subsections 23(8) and 23(9) of Schedule 2 impose obligations on credit providers in respect of audits. Credit providers must provide auditors with reasonable access to their records, and must take reasonable steps to rectify issues identified through audits.

Subsection 23(10) of Schedule 2 requires credit reporting bodies to give the Commissioner a list of and credit providers audited each year. This information is provided by credit reporting bodies in confidence, and is not included in the report required by Subsection 23(14) of Schedule 2. Subsection 23(10) of Schedule 2 also requires credit reporting bodies to give copies of audit reports to the Commissioner on request. These requirements are new to the CR Code 2024, and follows Proposal 13 from the Review which suggested that credit reporting bodies publish audit reports and provide them to the OAIC.

The publication obligation which follows Proposal 13 is contained in subsection 23(14) of Schedule 2. That subsection requires credit reporting bodies to publish a report each year about its risk-based programs. Those reports must set out:
1. how the credit reporting body identifies and evaluates indicators of risks of non-compliance;
2. what types of indicators and information are used to assess the risks of credit provider non-compliance;
3. a description of the role audits play in managing these risks;
4. how the credit reporting body determines the number, type and manner of audits to conduct; and
5. de-identified information about audits as well as significant findings and responses.

Subsections 23(11), 23(12) and 23(13) of Schedule 2 deal with matters that may occur if a credit provider fails to comply with its obligations (particularly obligations related to data quality and data security). In that case, a credit reporting body must take reasonable action in the circumstances. That may include termination of their agreement with the credit provider, but only where the credit reporting body gives reasonable notice, along with an opportunity to trigger a dispute resolution procedure.

Where disputes arise between credit reporting bodies, credit providers and affected information recipients in relation to actions undertaken or requirements under the law, the parties to the dispute must endeavour to resolve it in a fair and efficient way.

Subsection 23(15) of Schedule 2 requires credit reporting bodies to publish an annual report. That report must include statistical information about access requests, correction requests, corrections, complaints, serious credit infringements, disclosure of CCLI and RHI, and any other information requested by the Commissioner. A requirement to publish information about audits has been removed from the annual report because of the existence of the new obligation to publish an audit-specific report in subsection 23(14) of Schedule 2.

Section 24 – Information Commissioner’s role

Section 24 provides for the Commissioner to do certain things relevant to the operation of the CR Code 2024. Section 24 is unchanged from the Previous Code.

Subsection 24(1) allows the Commissioner to vary the time limits imposed by the CR Code. This may occur on request from a credit reporting body, credit provider or affected information recipient. Time limits can be varied where the relevant entity is unable to comply with the specified time limit.

Subsections 24(2) and 24(3) of Schedule 2 relate to independent reviews of credit reporting bodies. These reviews, which are to be conducted to assess the credit reporting body’s compliance with the Act, must occur every three years. The Commissioner can request that these reviews happen more frequently. The credit reporting body must consult with the Commissioner about choice of reviewer, their expertise and the scope of the review. The review’s report, and the credit reporting body’s response, must be provided to the Commissioner and made publicly available.

The Commissioner must commission an independent review of the operation of the CR Code every 4 years. Two such reviews have occurred since a CR Code was first registered in 2014.

[1] Office of the Australian Information Commissioner, ‘2021 Independent review of the Privacy (Credit Reporting) Code 2014’ (September 2022).

[2] Office of the Australian Information Commissioner, ‘2021 Independent review of the Privacy (Credit Reporting) Code 2014’ (September 2022).

[3] See Explanatory Memorandum to Privacy Amendment (Enhancing Privacy Protection) Bill 2012 under ‘Clause 20R’.

Administered by Attorney-General's Department

Definitions – types of information

Definitions – credit bans and correction requests

Definitions – repayments, agreements and defaults

Restrictions on information which may be collected, disclosed and used

Restrictions on standardisation of consumer credit numbering conventions

Practices, procedures and systems

Disclosures to individuals where credit reporting information is used to assess an application for credit

Credit ratings

Corrections of information that exists due to circumstances beyond the individual’s control

Corrections of information about statute-barred debts

Notification obligations following correction

Interactions

Legislation content

Definitions – types of information

Definitions – credit bans and correction requests

Definitions – repayments, agreements and defaults

Restrictions on information which may be collected, disclosed and used

Restrictions on standardisation of consumer credit numbering conventions

Practices, procedures and systems

Disclosures to individuals where credit reporting information is used to assess an application for credit

Credit ratings

Corrections of information that exists due to circumstances beyond the individual’s control

Corrections of information about statute-barred debts

Notification obligations following correction

Interactions

Authorises

All Versions