Credit Reporting Advice Summaries Office of the Federal Privacy Commissioner 18/4/2001. Table of Contents

Transcription

1 Credit Reporting Advice Summaries Office of the Federal Privacy Commissioner 18/4/2001 Table of Contents Commissioner's Note: For complete Advice Summaries Index see page 26, Meaning of 'credit' and 'credit provider' Combined loans (not edited as subject to review) 1.2 'Credit Provider' 1.3 Privacy Commissioner s determination relating to credit providers 1.4 Substantial meaning - s.11b(1)(b)(iii) 1.5 Rental arrangements Video stores (not edited subject to review) 1.6 Car rental 1.7 Housing and real property rental 1.8 Debit cards Debit facilities and reporting of overdue payments 1.9 Business development loans Residential investment loan (not edited subject to review) 1.10 Commission arrangements 1.11 Fidelity bonds 1.12 Overdrawn cheque accounts 1.13 Commercial credit providers 1.14 Credit providers by assignment, subrogation or other means 1.15 Participants in securitisation schemes 1.16 Insurance 1.17 Insurance companies with credit provision functions 1

2 1.18 Insurance company loans to agents 1.19 Legal Aid Commissions 1.20 Universities and student loan schemes 1.21 Doctors and hospitals 1.22 Pawnbrokers 1.23 Hotels and motels 1.24 Commonwealth agencies 1.25 Public utilities (not edited subject to review) 1.26 Local Councils and rates Local councils and library books 1.27 Newspapers 1.28 Mercantile agents 1.29 School boards 1.30 Small business 1.31 Body corporate management 2 Meaning of 'credit reporting agency' 2.1 General 2.2 Commercial credit reporting 2.3 Mercantile agents 2.4 Statistical/research activities involving personal information 2.5 Provision of information to hotels and motels 2.6 Video hire customer lists 2.7 Real estate databases 2.8 Cheque guarantee business 2

3 2.9 Credit providers 3 Agents of a credit provider 3.1 Agency arrangements 3.2 Access to consumer credit reports 3.3 Agent to obtain a credit report under its own name 3.4 Information exchanges between a credit provider and its agent 3.5 Responsibilities/liabilities of the agent and principal credit provider 3.6 Legal advisers 3.7 Legal advisers preparing mortgage documentation 3.8 Banks as agents of a credit provider 3.9 Loan managers/mortgage originators 3.10 Loan managers and debt collection 3.11 Motor vehicle dealers 4 Agents of an individual 4.1 Section 18H(3) - general policy 4.2 Section 18N(1)(ga) - general policy 4.3 Agent authority 4.4 Real estate agents and builders 4.5 Investment advisers 4.6 Liabilities/responsibilities of a credit provider 4.7 Agent of individual and of credit provider 4.8 Individual unable to operate his/her account 4.9 Interpreters 3

4 4.10 Credit providers as agents 5 Individuals' Access Rights 5.1 Non-credit providers - general policy 5.2 Credit reports in the possession of a credit provider 5.3 Credit reports retained electronically 5.4 Fee for access to credit reports held by credit reporting agency 6 Disclosure by a credit reporting agency to a non-credit provider 6.1 General 6.2 Disclosure to the individual concerned 6.3 Disclosure to an industry regulatory body 6.4 AUSTRAC (formerly CTRA) verification requirements 6.5 Disclosure to law enforcement authorities 6.6 Trustees in bankruptcy 6.7 Disclosure to mortgage insurers of information about guarantors 6.8 Disclosure to a credit enhancer 7 Disclosure by a credit reporting agency to a credit provider 7.1 Assessing an. application for commercial credit 7.2 Assessing on-going trading accounts 7.3 Overdue payments 7.4 Failure to renew a rental agreement as being groundsfor obtaining a credit report 7.5 Review or variation of credit arrangements Interest rate reviews as a groundfor obtaining a credit report 7.6 Review of revolving creditfacilities 7.7 Overdraftfacilities 4

5 7.8 Dishonoured cheques 7.9 Credit assessments on supplementary applicants 7.10 Disclosure of up-to-date address information 8 Notice and Agreement Requirements 8.1 General Notice of disclosure - retention 8.2 Assessing commercial credit applications 8.3 Company directors 8.4 Section 18E(8)(c) notices 8.5 Pre - Act loans and notice requirements 8.6 Overdue payments 8.7 Revocation of authority 8.8 Disclosures between credit providers 8.9 Trade or commercial references 8.10 Telephone applications for credit Applicationsfor credit over the Internet 8.11 Commercial credit refusals 8.12 Refusal of credit card purchases 8.13 Refusals based on a guarantor'scredit report 8.14 Serious credit infringements - commercial 8.15 Finance broker's forms 8.16 Joint loan application 9 Disclosure by a credit provider to a credit reporting agency 9.1 Notice to individual of disclosure 5

6 9.2 Permitted disclosures - information about cheques including dishonoured cheques 9.3 Repeat listings of overdue payments 9.4 Agent disclosure 9.5 Direct marketing 9.6 Reporting amount of credit applied for 9.7 Reporting overdue payments 9.8 Schemes of arrangement 9.9 Reporting arrangements for repayment 9.10 Reporting that an individual is no longer overdue 9.11 Reporting no longer a 'current credit provider' 9.12 Assignment and current credit provider status 9.13 Reporting serious credit infringements 9.14 Forming judgment as to a serious credit infringement 10 Disclosure by a credit provider 10.1 Meaning of 'report' under s.18n(9) 10.2 Name and address details disclosed by a credit provider Name and address disclosedfor marketing purposes to thirdparty suppliers 10.3 Disclosure while seeking a forwarding address 10.4 Disclosure of credit card membership 10.5 Disclosure of cancelled credit card facilities 10.6 Employment verification Disclosure of loan account information to family members 10.7 Cheque dishonouring 10.8 Aggregated or statistical information 10.9 Marketing by a related corporation 6

7 10.10 Publication of advertisements Publicly available information Public press statements by credit providers Commercial information Trade associations Insurance refunds Insurance renewal Insurance renewal - disclosure to a broker Disclosure to an insurer Insurer discharging a loan on individual's death Disclosure to another credit provider Disclosure of joint account information to another credit provider Serious credit infringements Loan managers and debt collection Person in service of a credit provider Legal adviser of a credit provider Lawyers, accountants, auditors, consultants and mailing houses Legal adviser of an individual Financial counsellors Disclosure to a guarantor Disclosure to Guarantors and Indemnifiers Purchase of mortgages Trade insurers Discharge - motor vehicle dealers FBT liability Discharge - insurers 7

8 10.32 Mortgage insurance Mortgage insurers - guarantors' information Bailiff requesting pay-out information Commercial agents repossessing security Debt collection - disclosure to spouse Solicitors - settlement activities Confirmation of discharge - vehicle auctioneers Discharge - consent Required or authorised by or under law - general Auditors Accounting Standards Official Receivers Government Departments/agencies State laws State housing programs Real estate agents and builders Assignment Disclosure between first and subsequent mortgagees Disclosures to persons appointed to settle disputes between credit providers and their customers 11 Use of credit reports by acredit provider 11.1 General 11.2 Commercial credit assessments 11.3 Use of credit reports to collect overdue commercial credit payments 8

9 11.4 Marketing 11.5 Recruitment 11.6 Scorecard building 11.7 Retention of credit reports 11.8 Retention of credit applications 12 Credit Reporting Advice Summaries Index 9

10 Introduction This material has been prepared for the general assistance of persons who are subject to Part IIIA of the Privacy Act 1988 concerning credit reporting. Since the commencement of Part IIIA of the Act in September 1991, the Privacy Commissioner's office has responded to numerous requests for advice from the credit reporting industry and others about the application of the law to specific industry practices. In view of this experience, and the general level of interest in Part IIIA, the Privacy Commissioner felt it would be of value to the industry and those assisting to bring together the written advices given over this period of time into an easily accessible reference. All the advices selected for inclusion are summaries or excerpts from actual written advices given in response to practical examples raised by the credit reporting industry since the start of the Act. The material has been vetted as necessary to avoid identification of companies or unique practices. The advices selected are those considered to be most relevant to a broad audience. It is not intended that the information and views in this document will replace the need for independent advice. It is important to note that the advices given by the Privacy Commissioner's office and reflected in the text are tailored to specific questions after consideration of details which may not be evident from the advice itself. Credit providers and others are encouraged to examine carefully the requirements of the Act and of the Credit Reporting Code of Conduct against their own particular circumstances to avoid the risk of breaching the Act or the Code. This material is not intended to provide a comprehensive guide to the Act or to the Code of Conduct, nor is it to be treated as formal legal advice. Please note that some areas of the Act and the Code have not been the subject of any advices to date. Explanatory material on the Act and the Code is available elsewhere (see the Explanatory Notes to the Credit Reporting Code of Conduct, brochures and information sheets put out by the Office of the Privacy Commissioner). This document is expected to be updated and added to over time to cover new issues as and when they arise. Finally, it should be noted that some persons may be in receipt of advices given by the Privacy Commissioner's office prior to the commencement of amending legislation (Law and Justice Legislation Amendment Act 1991, No , and Law and Justice Legislation Amendment Act (No. 4) 1992, No ). The advices selected for inclusion in this document are regarded as consistent with the state of the law as at 23 June 1994, being the date of proclamation of the Law and Justice Legislation Amendment Act (No. 4) 1994 and with the Credit Reporting Code of Conduct as at 27 March 1995, being the date of effect of amendments issued by the Privacy Commissioner. Users notes This material has been arranged to enable reference according to both the type of issue or practice, and to the section of the Act to which the issue or practice relates. Issues and practices are listed both in the Table of Contents and in the Index provided at the end of the material. References to commentary relating 10

11 to a particular provision of the Act are given in a separate Index to Act references (following the main alphabetical index at the end of the material) ordered by section of the Act. The material is arranged in roughly the same order as the related provisions appear in the Act. Hence, advices relating to definitions appear first (s.6 and s.11), followed by advices relating to individual access rights (s.18h), then disclosure and use issues relating to credit reporting agencies and credit providers (s. 18K, s.18l and s.18n). Users of this material should note that requests for advice on the application of the Act typically involve consideration of a number of different sections of the Act. For example, a question relating to access to a credit report, might involve a consideration of definitions (s.6, s.11b), notice and agreement requirements (s.18e(8), s.18k(1)), limits on disclosure by a credit reporting agency (s.18k(1)) and use limitations (s.18l). Therefore, the text under each of the sub-headings attempts, as far as practicable, to stand alone, making references to the relevant provisions of the Act and of the Credit Reporting Code of Conduct where appropriate. Users should, however, also use the Index to see other relevant references which may fall under a different heading located elsewhere in the material. As a guide, it is suggested that the subject headings in the Table of Contents be used as the first reference point, to be supplemented if necessary by the Index references. For example, issues concerning disclosure by a credit provider in connection with overdue payments are placed under the main heading entitled Disclosure by a credit provider, and supplementary references relevant to overdue payments may be found under the index entry for Overdue payments. Alternatively, users seeking to ascertain if any of the advices direct themselves towards a particular provision of the Act may use the separate Index to Act references in the first instance. The Index to Act references provides references to those places in the text where commentary on the application of a particular provision is considered relevant (i.e. not every occurrence of a section number is indexed). As mentioned above, compliance with the law might involve attention to a number of different sections of the Act, therefore, users should ideally use both the subject and Act section references to make maximum use of this material. 11

12 1 Meaning of 'credit' and 'credit provider' Distinction between consumer and commercial credit (not edited as subject to review) The Privacy Act scheme of protection relates to credit information concerning individuals, and 'credit', for the purposes of the Privacy Act is defined under s.6 of the Act to mean: a loan sought or obtained by an individual from a credit provider... being a loan that is intended to be used wholly or primarily for domestic, family or household purposes; Commercial credit' is defined in s.6 of the Privacy Act to mean: a loan sought or obtained by a person, other than a loan of a kind referred to in the definition of 'credit'... An example of how this distinction might be applied is in the case of a person applying for a loan for the purpose of purchasing real estate. If the individual is applying in a personal, or private capacity, for example, to purchase a real estate property that will be owner-occupied, then he or she would be considered to be applying for consumer credit. If the application for a loan for real estate property was on behalf of a business, or a sole trader, then the individual would be acting in abusiness capacity and the transaction would be considered to be a commercial credit transaction. It is acknowledged that there will be some borderline cases where it is difficult to make the distinction between consumer and commercial credit with absolute certainty. In these cases, credit providers will obviously have to rely on the customer's advice about whether credit was sought primarily for domestic or business purposes. The Privacy Commissioner has indicated that, in the event of a dispute, reasonable business judgment as to the nature of the transaction would be supported. For the purposes of credit assessment, however, credit providers will in either case be able to obtain access to both consumer and commercial credit reports on applicants, with the proviso that to obtain a commercial report on an applicant for consumer credit, or to obtain a consumer report on an applicant for commercial credit, the individual's written agreement will be needed (see Part 8 concerning 'Notice and Agreement Requirements') Combined loans (not edited as subject to review) A combined loan is a loan product that combines a home and investment loan into one. Credit providers need to determine whether either portion of a combined loan constitutes "credit" (consumer credit) for the purposes of the Privacy Act. In situations where one portion of the loan is credit and the other is for commercial purposes, the credit provider will also then need to assess whether the combined loan, in its entirety, is for consumer credit purposes. The process of assessing whether a combined loan is for consumer or commercial purposes for the purposes of the Privacy Act is largely similar to assessing ordinary (that is, non-combined) loans. Relevant factors for a credit provider to consider when assessing whether a loan is consumer or commercial under the Privacy Act include the relative proportion of the consumer and commercial components, as well as the stated or apparent purpose of the loan. The credit provider will usually need to seek the individual's advice about the purpose of the loan. This is to give the credit provider some 12

13 indication as to what the individual proposes to do with the loan so that the credit provider has a basis on which to exercise its reasonable business judgement when determining the nature of the transaction. If the individual's stated purpose of the loan is contrary to the reasonable business judgement of the credit provider, or if the proportions favour an alternative analysis, the credit provider should treat the loan in accordance with that judgement. (See paragraphs 1.1 and 1.9. L) 1.2 'Credit Provider' Businesses considering whether they fulfil the Privacy Act definition of 'credit provider' for the purposes of being permitted to receive consumer credit reports concerning individuals from a credit reporting agency, or consumer credit information (including credit reports) from credit providers, will need to examine carefully their operations against the definition of 'credit provider' under s. 11B of the Privacy Act. Section 11B(1) lists a range of categories of businesses which are defined as credit providers for the purposes of the Act. The principal categories are as follows: (a) a bank; or (b) a corporation (other than an agency): (i) that is a building society; or (ii) that is a credit union; or (iii) a substantial part of whose business or undertaking is the provision of loans (including the provision of loans by issuing credit cards); or (iv) that carries on a retail business in the course of which it issues credit cards to members of the public in connection with the sale of goods, or the supply of services, by the corporation. In relation to category (iii) in paragraph (b), businesses will need to consider whether they provide 'loans' within the meaning given in s.6 of the Privacy Act. The definition of 'loan' includes arrangements for hire, lease or renting of goods. If the loan granting activities of a business do not fall within the description of s.11b(1)(b)(iii), they may fall within the scope of the Privacy Commissioner's determination relating to credit providers (see paragraph 1.3). 1.3 Privacy Commissioner s determination relating to credit providers The Privacy Commissioner has a power under s. 11B(1)(b)(v)(B) of the Act to determine certain classes of corporations to be credit providers for the purposes of the Act. Exercising this power, the Privacy Commissioner on 11 September 1991 issued a determination providing for a further category of businesses to be classified as credit providers under the Act. The most recent extension of this determination was issued by the Privacy Commissioner as Determination 1996 No. 1 which has the effect of continuing the original determination until 25 August The determination states that any corporation which provides goods or services and then allows deferral of payment for them for 7 days or more is a credit provider in relation to those transactions. As such, the determination enables the credit provider to obtain access to consumer credit reports from credit reporting agencies, or consumer credit references from other credit providers, in relation to that particular transaction. (The full text of the determination appears in this section of the Handbook.) The Privacy Commissioner has indicated that for the purpose of interpreting the 7 day term used in the determination, the following guide is appropriate: (a) Day 1 is the day on which the goods or services are provided. 13

14 (b) Day 8 is the day on which the payment is due. The Privacy Commissioner issued a further determination which came into effect on 24 February 1995 which states that a corporation which acquires the rights of a credit provider with respect to the repayment of a loan (whether by assignment, subrogation or other means) shall, in relation to that loan, be regarded as a credit provider for the purposes of the Privacy Act. (Again, the full text of this determination appears in this section in the Handbook). 1.4 Substantial meaning - s.11b(1)(b)(iii) It is considered that the word 'substantial' in the definition of credit provider under s.11b(1)(b)(iii) of the Act connotes both value and proportion. Therefore, a corporation could satisfy this aspect of the definition of a credit provider where its lending activities involved substantial amounts of money, even if its lending activities did not constitute the dominant part of the corporation's overall business. 1.5 Rental arrangements Most businesses which rent out goods or equipment to the public would be likely to fall within the Privacy Act meaning of a credit provider by virtue of the definition of loan under s.6 of the Privacy Act. For the purposes of the Privacy Act, the renting of goods constitutes a loan unless an amount greater than or equal to the value of the goods is paid as a deposit for the return of the goods Video stores (not edited subject to review) Video stores may fall within the definition of "credit provider" for the purposes of the Privacy Act. The definition in section 1 lb includes businesses a substantial part of whose activities involve the provision of loans. In addition Determination 1996 No. 1 provides a further category of businesses classified as credit providers under the Act. The Determination provides that any corporation which provides goods or services and then allows deferral of payment for them for seven days or more is a credit provider in relation to those transactions. Video stores have expressed the desire to exchange information about customers' failure to return videos or payment of late fees. However, if video stores satisfy the definition of credit provider, they would be required under section 18N(1)(b) to obtain the prior written consent of the individual to disclosure(s) for specified purposes. The most appropriate point at which to obtain such consent would be at the time the individual enters into a relationship with the video store by becoming a member. Even if a video store is not caught by the definition of credit provider in Part IIIA of the Privacy Act it would be preferable that individuals have the opportunity to consent to disclosures of personal information, or at least to be notified at the outset that these disclosures may occur. 14

15 1.6 Car rental Paragraph (b) of the definition of 'loan' in s.6 of the Act states that arrangements for the hire, lease or renting of goods or services are included within the meaning of 'loan', other than arrangements under which: (i) full payment is made before, or at the same time as, the goods or services are provided; and (ii) in the case of a hiring, leasing or renting of goods - an amount greater than or equal to the value of the goods is paid as a deposit for the return of the goods. Whilst payment of the car hire fee may be made at the outset, the customer incurs a debt by virtue of the obligation to return the vehicle after the agreed period, and that debt is not fully discharged until the vehicle is returned. On this interpretation, the car hire could be construed as an arrangement whereby a person is permitted to defer payment of a debt, thereby falling within the above definition of a loan. Specifically, it would be covered by paragraph (b) of the definition of 'loan', as neither of the two exceptions to paragraph (b) would apply under this interpretation. 1.7 Housing and real property rental Housing rental agreements are not considered to involve the provision of loans as defined by s.6 of the Privacy Act. The definition of 'loan' in s.6 refers to the provision of goods and services, and not real property. Real estate agents and landlords are not, therefore, considered to be credit providers for the purposes of the Privacy Act and are not permitted to obtain access to consumer credit information held by a credit reporting agency or a credit provider. 1.8 Debit cards (not edited subject to review) The ordinary characteristic of debit facilities (such as a debit card) is that the credit provider is not offering credit nor is the individual intending to apply for credit. The individual intends to access only their own funds in their account. There is no contract, arrangement or understanding by which the individual is permitted to either defer payment of the debt, or to incur a debt and then defer its payment in which case it does not meet the definition of "loan" in section 6 of the Privacy Act. However, there may be limited circumstances where the debit facility does involve a contract, arrangement or understanding for the deferral of payment of the debt, or for a debt to be incurred and have the payment deferred. If a particular debit facility is treated by the credit provider as an application for credit, the credit provider must also ensure that the individual is aware of this at the time he or she is applying for the particular debit facility. In other words, it must be the intention of both the credit provider and the individual that an application for credit is being made. The circumstances are described below. 1. A credit provider may offer a debit facility that includes a nominal line of credit. This, in effect, is providing the individual with a 'cushion' in situations where the individual overdraws on the account by withdrawing more funds than he or she actually has in the account. The credit provider is offering the individuava' combined debit and credit facility. It would be lawful for the credit provider to obtain a consumer credit report for the purposes of assessing the application for the facility, subject to the notice 15

16 and agreement requirements under the Privacy Act being met. The credit provider must also ensure that the individual understands that the facility being applied for includes a nominal line of credit, and that the arrangement permits the deferral of payment of a debt, and is therefore considered to be 'credit' for the purposes of the Privacy Act. 2. The usual terms and conditions of a debit facility state that the individual is only able to access their account balance. However, 1he terms and conditions of the debit facility may also provide for situations where the facility becomes overdrawn (for example, if the individual uses a debit card at an off-line terminal). At the time the individual is applying for the debit facility, the terms and conditions may provide that if the individual overdraws his or her account, the credit provider will treat the resulting debt to the credit provider as an application for credit from the credit provider. Credit providers must note that the individual's application for credit only occurs at the time the individual overdraws their debit account and goes into debt to the credit provider. Only at that stage would it be lawful for the credit provider to obtain a consumer credit report for the purposes of assessing an application for credit. From a practical perspective, however, the notice and agreement requirements under the Privacy Act would normally be given and obtained at the time the individual was applying for the debit facility. It would not be lawful for the credit provider to obtain a credit report for the purposes of assessing the initial application for the debit facility, as the 'credit' characteristic of the facility only arises at the time the individual incurs the debt; that is, overdraws his or her account Debit facilities and reporting of overdue payments Explanatory Note 55 of the Credit Reporting Code of Conduct states as follows: A credit provider may report an overdue payment to a credit reporting agency in respect of a savings account, or a similar facility which has been overdrawn, provided that the credit provider has first notified the individual of the disclosure. Credit providers should be aware that reporting an overdue payment in respect of a savings account (or other debit facility) would be permitted, provided that the requirements of the Privacy Act have been met, in the limited circumstances discussed above (that is, with a combined debit and credit facility, or if the terms and conditions provide that overdrawing of the account is to be treated by the parties as an application for credit). 1.9 Business development loans For the purposes of the Privacy Act, 'commercial credit' includes all loans which are not intended to be used wholly or primarily for domestic, family or household purposes. Where an individual is applying for a loan provided by a State Government under a business development program, such a loan would be considered to constitute the giving of commercial credit for the purposes of the Privacy Act if the loans are intended to be used by the individual to start a business enterprise. It should be noted that under the Privacy Act a credit provider can only obtain consumer credit reports about an individual in relation to the provision of commercial credit if the individual has specifically agreed in writing to the disclosure for the particular purpose. This condition applies both to obtaining a consumer credit report from a credit reporting agency and obtaining a consumer credit reference from another credit provider (see s.18k(1) (b) and s.18n(1)(b)). The Act does not affect a commercial credit provider's access to commercial credit information which may be in the possession of a credit reporting agency or a credit provider. 16

17 1.9.1 Residential investment loan (not edited subject to review) Where a person obtains a loan to purchase a residential property while acting in a personal capacity, rather than a business capacity, then the loan would be generally regarded as 'credit' (i.e. consumer credit) for the purposes of the Privacy Act; for example, where an individual seeks a loan with the intention of buying a property that will be owner-occupied. This is subject to the following. The intention behind Part IIIA of the Act is that it confers protection only on information about an individual obtaining credit wholly or primarily in a domestic, family or household capacity. The critical factor in deciding whether a loan is 'credit' is the stated or apparent primary purpose of a loan (refer advice at paragraph 1.9). The primary purpose of a loan can vary in the circumstances. For example,a loan for outright investment property would be considered for commercial purposes; whereas a loan to purchase a holiday home that the buyer uses in the prime time and lets off-season would be for consumer purposes. The fact that a loan is being sought to purchase an asset that may be income-producing does not automatically mean that the loan cannot also be for a domestic, family or household purpose. In cases of doubt about whether a particular transaction is for consumer or commercial purposes, a credit provider should be able to obtain access to both the consumer and commercial credit reports of the applicant, subject to the applicant's consent in relation to the consumer credit report. In the event that a mistake is made in distinguishing the application, the Privacy Commissioner would support a reasonable business judgement as to the nature of the transaction. Cases where a credit provider has failed to take reasonable steps to distinguish between consumer and commercial credit, leading to breaches of the Act, could give rise to the credit provider being subject to the liabilities under the Act Commission arrangements It is considered that an insurance company's commission arrangements with its agents would not be regarded as involving the provision of credit, even where the agent is required to refund a commission which had been paid and as a result owe money to the insurance company. A commission of this sort which is paid to an agent is not given on the basis that it is a loan which the recipient must repay. While a payment of a commission may subsequently be withdrawn resulting in a debt, it is clear that the initial payment of the commission does not represent the extension of credit. An insurance company would not, therefore, be regarded as a credit provider for the purposes of the Privacy Act in relation to its commission arrangements with its agents Fidelity bonds The issuing of a fidelity bond is not considered to constitute the provision of credit for the purpose of the Privacy Act. Such a bond is understood to be an undertaking on the part of the issuer to ensure initial payment of a debt which the party on whose behalf the bond is issued may or may not incur in the future. Apart from the payment of a premium, there is no transfer of funds and no debt incurred when the bond is lodged. Based on this understanding, a fidelity bond issuer would not be considered to be providing loans within the meaning of s.6 of the Privacy Act, and would not be permitted to obtain a consumer credit report from a credit reporting agency to assist in deciding whether to issue such a bond Overdrawn cheque accounts 17

18 Where the terms and conditions of personal cheque accounts state that the accounts must operate with a credit balance, or, where there is a specific exclusion on the account holder from obtaining loans in the operation of the account, the overdrawing of an account could not be considered to involve the provision of credit within the meaning of the Privacy Act. It is unlikely, in such an instance, that any contract, arrangement or understanding for the provision of a loan, as defined in s.6 exists. It would therefore not be lawful for a financial institution to obtain a credit report from a credit reporting agency, or credit information from another credit provider about an individual in connection with an overdrawn cheque account. This should be distinguished from situations where overdraft facilities are available to cheque account holders. A person who obtains an overdraft may be considered to have obtained credit within the meaning of the Act, and the credit provider which provides the overdraft would be entitled to obtain a credit report or other credit information about the individual in accordance with the Act Commercial credit providers Although the focus of the Privacy Act is upon consumer credit reporting and consumer credit information, its provisions impact upon commercial credit granting to the extent that it involves access to consumer credit information about individuals. Commercial credit providers seeking access to the consumer credit information about individuals will therefore need to consider whether they fall within the meaning of 'credit provider' under the Act for the purposes of being entitled to receive lawfully consumer credit information about individuals. A commercial credit provider would be considered to fall within the meaning of 'credit provider' for the purposes of the Privacy Act if a substantial part of its business or undertaking involves the provision of loans (see s.11b(1)(b)(iii) and s.6 for the definition of 'loan'). Alternatively, if such a description does not fit the commercial credit provider's business, it may be a credit provider by virtue of the determination issued by the Privacy Commissioner under s.11b(1)(b)(v)(b) of the Act. Under that determination any corporation which provides goods or services and then allows deferral of payment for them for 7 days or more is a credit provider in relation to that transaction. Thus, if a business permits deferred payment of at least 7 days, or if a substantial part of its business or undertaking is the provision of loans within the meaning of the Act, the business will fall within the Privacy Act definition of 'credit provider' and the business may obtain access to the trade customer's consumer credit report in connection with an application for commercial credit. It is important to note that the individual's specific written agreement is required before the credit provider may obtain access to a consumer credit report about the individual issued by a credit reporting agency in connection with an application for commercial credit (see s.18k(1)(b)). (See also paragraph 8.2 for notice and agreement requirements, paragraph 8.9 concerning disclosures of trade references between credit providers, and paragraph 10.2 for the disclosure of commercial information by a credit provider.) 1.14 Credit providers by assignment, subrogation or other means Where a credit provider takes assignment of an existing loan, it is considered that it should thereafter be regarded as the credit provider for the purposes of the Privacy Act in respect of the loan. If a business is a credit provider in its own right (prior to assignment of the loans), and it takes assignment of a loan, it 18

19 would thereafter be entitled to obtain access to credit information in relation to the loan as if it had provided the loan in the first instance. In relation to a business taking assignment of a loan where it is not a credit provider in its own right, the Privacy Commissioner issued a determination under s.11b(1)(b)(v)(b) of the Act, to enable a corporation which acquires the rights of a credit provider with respect to the repayment of a loan to be regarded as a credit provider for the purposes of the Act. The full text of this determination, together with an explanation of reasons for the determination, appear in this section in the Handbook Participants in securitisation schemes A number of amendments relating to securitisation schemes were made to the Privacy Act by the Law and Justice Legislation Amendment Act (No. 4) 1992, proclaimed on 7 December The broad focus of the amendments is to allow participants in securitisation schemes to be regarded as credit providers while performing tasks reasonably necessary to the provision and management of securitised loans and to be permitted to obtain and use credit reports in the performance of those tasks. Persons involved in securitisation schemes should examine carefully the detail of the amendments to ensure familiarity and compliance with the law Insurance One of the main intentions of Part IIIA of the Privacy Act was to limit access to consumer credit information to those businesses with a legitimate involvement in credit granting. Generally speaking, only those businesses which fall within the Privacy Act definition of a credit provider are permitted access to consumer credit information in the possession of credit reporting agencies and credit providers. The clear intention of Parliament, as indicated in the published Parliamentary debates on Part IIIA, was that insurers were generally not to be included in those categories of businesses covered by the definition of credit provider. It should be noted that an obligation to repay an overpaid benefit, or an arrangement to defer payment of an insurance premium, is not regarded as consumer credit for the purposes of the Privacy Act Insurance companies with credit provision functions While not generally capable of meeting the definition of credit provider under the Act, an insurance company may be a credit provider if it has, as a separate business arm, a credit provision function. If the provision of loans by the insurance company constitutes a substantial part of the overall business of the company, the insurance company may meet the definition of 'credit provider' under the Privacy Act in relation to its credit provision function by virtue of s.11b(1)(b)(iii) of the Act. It should be noted that, as a credit provider, the insurance company is only entitled to obtain or use consumer credit information regulated by the Act for specified credit-related purposes as described in the Act. Other divisions of the insurance company which are not involved in the provision of credit will not be entitled to obtain access to consumer credit information from credit reporting agencies and credit providers, including from the credit provision arm of the insurance company. For information as to the 19

20 position affecting corporations which are related to the credit provider, see s.18n(1)(d) and s.l8q(1) of the Privacy Act Insurance company loans to agents While not generally 'credit providers' within the meaning of the Privacy Act, insurance companies often provide housing, vehicle and other loans to their agents. With the exception of housing loans, these loans are provided to agents to assist them in carrying out their agency activities. Some of the loans have concessionary components. Housing loans made to insurance agents would be considered to be consumer loans for the purposes of the Privacy Act. Motor vehicle and other loans made to agents for business uses would be commercial loans for the purposes of the Act. This means that an insurance company would be entitled to obtain consumer credit information from credit reporting agencies and credit providers for certain purposes related to the provision of these loans in accordance with the rules of the Act, provided it fell within the definition of a 'credit provider' for the purposes of the Act. Whether an insurance company is a credit provider for the purposes of the Act depends on whether, in accordance with s.11b(1)(b)(iii) of the Act, a 'substantial part' of its business or undertaking is the provision of loans. It would need to be considered whether an insurance company's activities as a provider of loans in this and other contexts form a substantial part of its business, in order to determine whether it is entitled as a credit provider to obtain access to credit information in relation to the provision of loans to its insurance agents Legal Aid Commissions If a body such as a Legal Aid Commission provides services and allows deferral of payment for those services for 7 days or more, it could be a credit provider in relation to those transactions by virtue of the determination issued by the Privacy Commissioner under s.11b(1)(b)(v)(b) of the Act. This would only apply in situations where the individual who received legal services owed debt directly to the Commission as a result. The Commission would be entitled to obtain and use consumer credit reports about individuals to whom it was providing credit in this manner subject to the provisions of the Act and of the Credit Reporting Code of Conduct which strictly limit the circumstances in which credit providers can obtain and use such reports Universities and student loan schemes Universities may be considered to be credit providers in relation to loan schemes which they operate. However, if universities are not in the practice of obtaining credit reports or information on loan applicants from credit reporting agencies or credit providers, or of disclosing information about loan recipients to consumer credit reporting agencies or credit providers, the Privacy Act should not affect the operation of these schemes. If a university does wish to participate in the credit referencing system, either by obtaining consumer credit reports about loan applicants from a credit reporting agency or other credit related information from credit providers, it will need to establish whether it is a credit provider for the purposes of the 20

21 Privacy Act. Whether it is a credit provider in relation to student loan schemes will depend in part on whether the university is the original source of funds for loans made under the schemes. Unless the university is a credit provider under the Privacy Act, it will not be entitled to obtain consumer credit information about loan applicants from credit reporting agencies or credit providers. If the university wishes to disclose to other credit providers information concerning loan applicants, it will need to ensure that such disclosures do not breach the s.18n disclosure rules of the Privacy Act. This obligation stands regardless of whether the university is itself in the practice of obtaining consumer credit information from credit reporting agencies or other credit providers Doctors and hospitals Doctors who extend patient account facilities, which allow for the deferral of payment in full or in part for at least seven days, could be considered to fall within the meaning of a credit provider for the purposes of the Privacy Act in accordance with the Privacy Commissioner's determination under s.11b(1)(b)(v)(b) of the Act. As a credit provider, a doctor would be subject to a range of requirements under the Act and the Credit Reporting Code of Conduct relating to access to, and use and disclosure of, consumer credit reports. Where a hospital presents patients with an account on discharge, for which the hospital requires immediate payment, the hospital would not be considered to be a credit provider within the meaning of the Act, since the hospital has not entered into any agreement with those individuals on terms which permit deferral of payment. This position applies even if certain patients do not pay the account at the required time and themselves defer payment for periods which can exceed 7 days Pawnbrokers Pawnbrokers are not considered to satisfy the definition of 'credit provider' under s.11b(1) of the Privacy Act. Section 11B(1) includes as part of the definition a person "whose business or undertaking is the provision of loans" (see s.11b(1)(b)(iii)). 'Loan' as defined under s.6 of the Privacy Act presupposes an enforceable obligation on the part of the borrower to repay a debt. It is understood that a pawn transaction does not impose on the customer a legal obligation to repay the funds given in exchange for the goods, nor does it confer on the pawnbroker a right to enforce repayment. The sale of the goods to another person by the pawnbroker at the expiration of an agreed period is quite distinct from the situation where a security holder exercises the right to sell the secured property in the event of borrower default. In the latter case there is a clear obligation on the part of the borrower to repay the debt, and the lender may only enforce the security after seeking repayment in accordance with certain legally prescribed procedures. Given that a pawnbroker is not considered to fall within the Privacy Act definition of a credit provider, it would follow that a pawnbroker would not be permitted to avail itself of provisions in the Act enabling access to consumer credit reports issued by a credit reporting agency. These comments on the meaning of a credit provider of course only apply to that term as it is defined in the Privacy Act and not in any other legislation. 21

22 1.23 Hotels and motels While in most cases it would be unlikely that a hotel or a motel would satisfy the Privacy Act definition of credit provider, a hotel or a motel might be considered to be a credit provider under the Privacy Act if goods or services were provided to consumers on terms which allowed the deferral of payment of a debt in full or in part for at least seven days (see the Privacy Commissioner's determination under s.11b(1)(b)(v)(b)). If a hotel or a motel were a credit provider under the Act, it would be permitted to obtain access to consumer credit reports about individuals from a credit reporting agency or from a credit provider if the requirements of the Act and the Credit Reporting Code of Conduct were observed in so doing. A hotel or a motel which was a credit provider would be required, also, to observe the Privacy Act requirements in its use, retention and disclosure of consumer credit information concerning individuals Commonwealth agencies The definition of 'credit provider' in s.11b(1) of the Act states clearly that a body which is an agency for the purposes of the Act is not a credit provider for the purposes of the Act. Therefore, a Commonwealth agency may not obtain access to consumer credit information concerning individuals from either a credit reporting agency or a credit provider, unless such access is required or authorised by or under law, or where a provision of Part IIIA otherwise allows disclosure Public utilities (not edited subject to review) The Privacy Commissioner's office has considered the question of the status of public utilities as credit providers in the provision of gas, electricity and water services and has concluded that it is not possible to be definitive about their status but that the question needs to be resolved on a case by case basis. This is because of the variation that exists between public utilities in terms of the nature of the service being provided and the manner in which payment for the service is made. Central to the issue is whether the financial relationship between the individual consumer and the supplier of the service is one which falls within the meaning of the term 'loan' as defined by s.6 of the Privacy Act, thereby making the public utility a credit provider under either s.11b(1)(b)(iii) or s.11b(1)(b)(v)(b) of the Act. Section 6 defines 'loan' to mean:... a contract, arrangement or understanding under which a person is permitted to defer payment of a debt A number of factors may have a bearing on this question, including the following. First, the nature of the services provided by public utilities means that for all practical purposes the amount to be paid by individuals for the service (whether electricity, water, or gas) normally cannot be calculated until the service has been rendered. Upon receipt of an account, the consumer is expected to pay the amount charged. There is usually no arrangement under which the payment of the debt may be deferred, although this may vary according to the particular billing arrangements of the organisation. In other words, there is no contract, arrangement or understanding under which an individual is permitted to defer payment of the debt. The fact that most utilities allow individuals a number of days to pay an electricity bill, for example, is not in itself the provision of a loan. If, however, a public utility entered into an arrangement with the individual whereby it was agreed that upon receiving the account the individual had a further 14 days (for example) o pay the amount then it might follow that the utility would be considered to have provided a loan within the meaning of s.6 of the Act. 22