Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1697633996489.pdf (Australia)
veda ADVANTAGE Senate Finance and Public Administration Committee Exposure draft of the Australian Privacy Amendment (credit reporting) For further information please contact: Matthew Strassberg, Senior Adviser, External Relations Veda Advantage ) VEDA ADVANTAGE LIMITED ABN 29 080 662 568 Level 15, 100 Arthur St, North Sydney NSW 2060 Australia PHONE+612 9278 7838 F+612 9278 7304 www.vedaadvantage.com Executive Summary Recommendations Part 1- Positive credit reporting 1.1 1.2 1.3 1.4 1.5 1.6 1.7 Why is positive credit reporting before the Committee?
What is positive credit reporting?

What is repayment history (the fifth data element)?

Why is positive credit reporting important?

Where else does positive credit reporting occur?

How is positive credit reporting related to responsible lending?

How will positive credit reporting help credit providers meet responsible lending obligations?

7 7 8 8 9 10 10 1.8 What are the key consumer and economic benefits of positive credit reporting?
11 Part 2 - The Proposed Legislation 2.1 2.2 Why is this legislation needed?

How will consumers be protected?


• Further strengthening of consumer protections 2.3 Structural changes to strengthen governance • Simpler definitions, consistent disclosure & use • Reinstate the dominant purpose test • Penalties • Data quality obligations to rest with CRA 2.4 2.5 Specific clauses of concern Consumer education Part 3 - How the system currently works - information for the Committee 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 What information is allowed on a credit report?
Accuracy and credit reports Security and credit reports Consumer access to their credit reports How does Part lilA ofthe Privacy Act work now?

Investigating consumer complaints about a credit report Identity fraud and credit reports Defaults The amount of data on credit reports in a negative & positive system 3.10 Credit reporting agencies in Australia and internationally 15 15 16 18 19 21 22 24 25 26 27 29 31 32 33 Page 11 Appendices a.

Legal perspective on an improved regulatory framework b.
Proposal for simpler definitions c. Positive credit reporting - timeline of events d. About Veda Advantage 35 43 46 47 Page I 2 EXECUTIVE SUMMARY Veda Advantage welcomes the exposure draft bill (EDB) on credit reporting regulation.

The EDB reflects many ofthe policy recommendations made in the Australian Law Reform Commission (ALRC) review ofthe Privacy Act, particularly the addition of positive data to consumer credit reports.
Better information on credit reports will significantly assist credit providers to meet responsible lending provisions of the National Consumer Credit Protection (NCCP) Act 2009.

In addition} Veda supports the provisions for increased obligations on credit reporting agencies (CRAs) when dealing with access, corrections and complaints.

They reflect much of what is currently practiced by Veda and their inclusion in the bill is appropriate in view of the increased information available to CRAs.
Existing credit reporting legislation is now 21 years old and Veda is conscious that the opportunity to get new legislation right is a once in a generation event.

The exposure draft bill, while fulfilling the policy outcomes recommended by the ALRC, is an extremely complex and very prescriptive document - triple the size of the existing Act.

Veda submits that more intense regulation does not necessarily require more prescriptive regulation.
We believe it is possible to have stronger governance and a simpler scheme.

Areas of specific need for review: • A simpler drafting style: simpler definitions and consistent disclosure and use provisions are urgently needed, with an outcomes focus.
The proposed Act replaces the seven key definitions with 60 new ones, many overlapping, others unnecessary; • Reinstate the dominant purpose test to ensure certainty about the Act's applicability; • • • • • Fairer penalty provisions: penalty quantum needs to reflect the harm done; Simpler compliance: with simpler drafting, many provisions will be easier to comply with, such as the 'ban period' on credit files.

Stronger data quality: data quality obligations should rest with eRA.
While the EDB goes part of the way to achieve this, Veda recommends further strengthening.

Improve consumer protection by prohibiting third parties from charging for consumer credit reports or correcting information on a credit report.

Public information: this is a small but complex change - consumers will need an industry funded campaign to educate them about their rights.
We look forward to further engagement with the Committee in its deliberations Page 13 RECOMMENDATIONS Veda Advantage supports the exposure draft bill (EDB), particularly provisions that allow for additional information on credit reports - these are key to ensuring responsible lending obligations are met.

We welcome tougher obligations on credit reporting agencies regarding access, correction and complaints.

Simpler drafting style 1.


The proposal for 60 statutory definitions to replace the current Act's seven core definitions needs urgent review.

Some of the new definitions are overlapping, others unnecessary and the end result is confusing.

The critical issue is to ensure there are consistent use and disclosure protections for information - the creation of multiple definitions does not achieve that.

1.1.
1.1.

Replace multiple definitions of regulated information with a common definition of credit information applying to credit providers and credit reporting agencies.

1.2.

The EDB needs to align credit reporting information's use or disclosure by a credit reporting agency (CRA) and its subsequent permitted use or disclosures by credit providers.

This should be redrafted into a single clear table.

1.3.

The dominant purpose test should be reinstated.


The approach taken in the draft uses a very wide reaching definition of a credit reporting business, with exemptions through regulation.

Organisations could be captured by the Act while conducting credit reporting business on an incidental or temporary basis, creating uncertainty for compliance and confusion for consumers seeking remedy.

1.4.
1.4.

Section 113 (consumer rights to institute a Iban period' on their credit file) should be expressed as a legislated outcome with operational detail in the Industry Code of Conduct.

Flexibility of approach is critical to preventing fraud.

2.

Fairer penalty provisions Penalty provisions need to link the quantum of penalties to a notion of proportion or impact.

A defence of "reasonable mistake of fact" needs also to be expressly provided for; without it a test of strict liability could apply to CRAs.
Simpler compliance 3.

Section 120 (Notice of correction to be given to previous recipients of information) Where credit reporting information is corrected, the CRA should notify any previous recipients as requested by a consumer.

As drafted, corrections would have to be sent to recipients up to five years previous.

Page 14 4.

Section 126 (destruction of credit reporting information in cases of fraud) should simply require the removal of information from a credit report.
Vital insights into fraud behaviours will be lost if information is destroyed.

5.

Section 127 (retaining information otherwise due for deletion ifthere is a pending correction request) appears pointless - consumers would be better off having the information deleted than retained in isolation and then deleted after correction.

Stronger data quality 6.

Section 116 (3) should have an additional provision requiring CRAs to comply with the data standard developed under the Credit Reporting Code of Conduct.
7.

Improve consumer protection Regulation is needed to prevent third parties charging consumers for access to their credit report, or for investigation and correction of negative information.

Rights are clearly provided in the Act for access and correction and should not be eroded.

Public Information 8.

A consumer education campaign, funded by industry and overseen by Government will be required to ensure consumer awareness ofthe changes and their impact.
Page I 5 PART 1- Positive (comprehensive) credit reporting 1.1 Why is positive credit reporting before the Committee?

1.2 What is positive credit reporting?

1.3 What is repayment history (the fifth data element)?

1.4 Why is positive credit reporting important?

1.5 Where else does positive credit reporting occur?

1.6 How is positive credit reporting related to responsible lending?

1.7 How will positive reporting help credit providers meet responsible lending obligations?
1.8 What are the key consumer and economic benefits of positive credit reporting?

Page I 6 PART 1- POSITIVE CREDIT REPORTING 1.1 WHY IS POSITIVE CREDIT REPORTING BEFORE THE COMMITTEE?

The exposure draft bill (EDB) is the result of an extensive consultation process, started in 2006 when then Attorney General, Phillip Ruddock commissioned the Australian Law Reform Commission (ALRC) to review Australia's twenty year old Privacy Act.
The Privacy Act includes a specific section on credit reporting - Part IliA.

This is a different regulatory approach to most other countries, where credit reporting is regulated under the financial services or corporations legislation.

The ALRC process was extensive, including an Issues Paper, then a Discussion Paper and finally a Position Paper in August 2008.

The Position Paper included support for positive credit reporting (contingent on the introduction of responsible lending laws).
In October 2009, the Rudd Government announced its support for positive reporting1 in October 2010, Minister for Privacy, Brendan O'Connor, outlined a legislative timetable ; and with passage of legislation intended by mid 2012.

Responsible lending laws under the National Consumer Credit Protection Act 2009 (NCCP) passed parliament in December 2009 and are now in force.

1.2 WHAT IS POSITIVE CREDIT REPORTING?


Credit reporting in Australia currently relies on assessing credit risk based on the presence of negative information.
Under Part IliA of the Privacy Act, credit reports can list: • • Personal information - name, address, date of birth, employer, drivers licence Applications for credit2 made over the past five years (but not whether it was granted, or the type of credit, or the current credit limit); • Defaults and court judgements over the past five years and bankruptcies (seven years).
Following an extensive review process, in 2008 the ALRC recommended five additional datasets be added in a move to a system of positive (or comprehensive) credit reporting.
1 "Collection and use of repayment history information will be subject to the proposed commencement of the responsible lending obligations in the National Consumer Credit Protection Bill (2009)" pg 106Enhancing National Privacy Protection Senator the Hon Joe Ludwig, October 2009 2 Known in the industry and in the Act as 'credit inquiries' Page 17 This balances out the credit reporting process by providing a fuller picture of an applicant's credit capabilities.
The new datasets are: • What type of credit was offered; • What the credit limit currently is; • When the account was opened; • When the account was closed; • Repayment history over the previous two years (see below) 1.3 WHAT IS REPAYMENT HISTORY (the fifth data element)?

Repayment history shows if a person paid, on-time, the minimum payment required on an account.

It does not show the outstanding balance, or the actual amount paid.
Repayment history offers substantial insight into how well a person is managing their credit commitments, showing: • • • if they have been late making the minimum payment required; how many times late; and how many credit accounts have been late.

Predictive power from repayment history is equal to the other four new datasets combined 3 .

Repayment history typically relates to credit cards, mortgages and personal loans -the most common form of credit issued by a licensed provider.
Only licensed credit providers can give or have access to repayment history.

Utilities and telcos are not eligible to provide or have access to repayment history.

1.4 WHY IS POSITIVE CREDIT REPORTING IMPORTANT?

Positive reporting will help credit providers meet new obligations under responsible lending laws.

As a condition of licence, credit providers must make inquiries - and take reasonable steps to verify - a consumer's financial situation.
Credit reports - and their role in verification feature throughout ASIC's Regulatory Guide 209: Credit Licensing: Responsible Lending Conduct.

3 In a notional 100% predictive scorecard, current negative information contributes 11%, the first four data sets 23% and repayment history 22% - AReA study 2006 Page 18 Positive reporting will enable a much better assessment ofthe appropriate level of credit (if any) that may be extended to someone struggling with current commitments.
In addition, for people who have been through financial difficulties, positive reporting gives an opportunity to demonstrate they are financially stable.

Together with responsible lending, positive credit reporting should: • Reduce new lending to applicants who cannot meet new commitments; and • Reduce rejection of credit to applicants who are able to meet additional commitments.

1.S WHERE ELSE DOES POSITIVE CREDIT REPORTING OCCUR?
Most GECD nations now have both negative and positive credit reporting information.

This includes Austria, Belgium, Canada, Czech Republic, Estonia, Germany, Greece, Hungary, Ireland, Italy, Japan, Korea, Netherlands, Portugal, Poland, Slovakia, Slovenia, Spain, Sweden, United Kingdom and the United States.

Australia, New Zealand, Chile, France, Finland, Denmark have negative-only data.

Australia's move to positive reporting is in the context of new responsible lending obligations.
New Zealand has introduced four new data elements (account opening, closing, type of credit and current limit); their move to include repayment history will depend on Australia doing the same.

Worldwide, there has been a long term trend towards allowing positive information on credit reports and in the past seven years Hong Kong, Belgium and India moved to positive reporting.
Research across the globe shows consistent outcomes from sharing of consumer credit information: • • The sharing of positive data significantly increases credit access while reducing the share of non-performing loans in a portfolio; The addition of positive data significantly increases access to credit by underprivileged social segments such as lower income householet Recent evidence for this can be seen in Hong Kong's 2003-2005 move to positive reporting.
4 "The economic consequences of consumer credit information sharing: efficiency, inclusion and privacy" Turner & Varghese DECD Conference Decernber 2010 pg 32 Page I 9 In 2006 the Hong Kong Money Authority reviewed the new reporting arrangements and noted there had been a "conspicuous improvement in the problem of over-indebtedness" and further noted: A few major players said they were proactively offering lower interest rates products to selected credit card holders - presumably as a response to the challenge coming from non-bank players.
New players continue to emerge and the consumer credit market has become more competitiveS Additionally, where people had gone bankrupt, the average indebtedness declined from over 35 times their monthly income to 25 times.

1.6 HOW IS POSITIVE CREDIT REPORTING RELATED TO RESPONSIBLE LENDING?

Unlike most other DECO nations, consumer credit reporting in Australia is regulated as a privacy issue, not part of consumer credit laws.
However, the ALRC explicitly recognised the link to credit reform, recommending that repayment history only be introduced if responsible lending laws were in place.

Responsible lending, part of the NCCP Act, was introduced in January 2011, under the jurisdiction of the Australian Securities and Investments Commission (ASIC).
These laws strengthen consumer protection and impose lending conduct obligations on credit providers; but while the law can require financial institutions to lend responsibly, it is difficult to do so without the best tools.
1.7 HOW POSITIVE CREDIT REPORTING WILL HELP CREDIT PROVIDERS MEET RESPONSIBLE LENDING OBLIGATIONS Fulfilling responsible lending obligations is a condition of licence under the National Consumer Credit Protection Act 2009. Credit providers must make inquiries - and take reasonable steps to verify - a consumer's financial situation.

This applies not only to new credit contracts, but also to increased limits on existing credit.
Responsible lending laws oblige credit providers to assess that a credit contract is "not unsuitable" for a consumer.

This is based on taking: (a) "reasonable inquiries about both the consumer's requirements and objectives and financial situation; and 5 Hong Kong money Authority Quarterly Bulletin March 2006 pg 10 Page 110 (b) "reasonable steps to verify the consumer's financial situation,l6.
However, credit providers have limited ways to verify the financial circumstances of new consumers applying for credit.

The information on credit reports provides only a partial picture ofthe extent of a person's credit obligations and how well they are managing them: • Credit reporting agencies only hold records of credit enquiries over the past five years, giving an incomplete and distorted view of a consumer's real credit exposure.
• ASIC's guide to NCCP regulations cautions against the over-reliance on a credit provider's internal data (such as information in savings accounts) to verify application-form financial details.

• The manual verification of documents is not only costly and time consuming (and as such not sustainable in the high-volume unsecured lending market), but also open to fraud and misuse.
Positive reporting will help lenders comply with responsible lending obligations - preventing provision of credit to struggling consumers who may be incapable of meeting further credit commitments.

For banks and other lenders who are licensees, the new reporting and disclosure regime will deliver valuable external indebtedness and serviceability measures.
The insight into consumer's total credit exposure, and their past 24 months of credit repayment data, can be used (along with applicant supplied data) to ensure better compliance with responsible lending obligations.

1.8 WHAT ARE THE KEY CONSUMER AND ECONOMIC BENEFITS OF POSITIVE CREDIT REPORTING?

• For people who have been through financial difficulties, a positive reporting system will allow them to demonstrate they have recovered and are once again financially stable.
• Under a negative credit reporting system, a person may have fully recovered from financial difficulties, but will have a mark on their credit file for five years.

Currently, there is no way to demonstrate they now pay bills on time and are a good credit risk.

• A positive credit reporting system will provide consumers with more opportunity to switch banks.
• Consumers will also be able to negotiate for better terms, including lower interest rates, through demonstrating they have a good repayment history.

• Better quality information, provided under appropriate protections, should put downward pressure on the cost of credit via more informed and responsible lending.
"ASIC Regulatory Guide 209:Credit licensing: Responsible lending Conduct pg S Page 111 Access Economics7 research into positive credit reporting found benefits to borrowers, lenders and a $1.7 billion boost to household buying power.

This follows from improved risk assessment leading to a reduction in lenders losses, a more competitive credit market with lower interest rates and consequent increase in household buying power.
Their key findings are: Greater access to mainstream better priced credit Positive reporting will enable institutions to lend more equitably.

People who were denied credit outright, or were previously forced to seek fringe lenders because of a lack of information on their file, will be able to access mainstream credit.

Positive reporting also allows consumers to demonstrate they are a good credit risk, paving the way for banks to offer lower interest rates to attract them.
Increased competition - consumers more able to switch credit providers Negative reporting hinders the capacity of people to move between financial institutions.

This is particularly applicable for consumers with a limited or unknown credit history, typically younger Australians and families with inadequate information on their credit file.
Positive credit reports enable more accurate identification of high risk/low risk borrowers, creating a more level information playing field for all financial institutions.

Consumers will find it easier to get credit from a new lender, encouraging competition.

Access Economics8 found acceptance rates for new-to-bank applicants is often nearly half that of existing customers - and attributes 50 per cent of that result to the quality and quantity of information available.
Access Economics also found positive reporting is most likely to benefit low-risk individuals who are currently viewed as high-risk.
These consumers typically are: 7 "The benefits of broadening access to credit via comprehensive credit reporting" Access Economics May 2008 commissioned by Veda Advantage pg 3 8 1bid Page [ 12 "low to middle income earners with limited track records with financial institutions...[and] new-to-bank customers, where declined applications are often as much the result of poor information as the financial status of the applicant.
9" Lower default rates Access Economics cited a study by Barron and Staten, which took the results of credit applications under a positive reporting and assessed them against Australia's negative-only regime They concluded the percentage rate of defaults would fall under positive reporting as lenders were better able to identify risk.
Moreover, Australia's new responsible lending laws provides a strong framework for ensuring that increases in the level of credit acceptances occur through more accurately identifying low risk applicants.

9Access Economics pg 21 Ibid Page 113 PART 2- The proposed legislation 2.1 WHY IS THIS LEGISLATION NEEDED?

2.2 HOW WILL CONSUMERS BE PROTECTED?


• Further strengthening of consumer protections 2.3 STRUCTURAL CHANGES TO STRENGTHEN GOVERNANCE • Simpler definitions, consistent disclosure & use • Reinstate the dominant purpose test • Simpler compliance • Fairer penalties • Data quality obligations to rest with CRA 2.4 SPECIFIC CLAUSES OF CONCERN 2.5 CONSUMER EDUCATION Page 114 2.1 WHY IS THIS LEGISLATION NEEDED?
In 2008, following a two year review ofthe Privacy Act, the Australian Law Reform Commission (ALRC) recommended changes to Australia's twenty-year old credit reporting provisions.

The changes were under six headings: I. II.

III.

IV.

V. VI.

Approach to reform; More comprehensive credit reporting; Collection and permitted content of credit reporting information; Use and disclosure of credit reporting information; Data quality and security; Access and correction, complaint handling and penalties.
The ALRC noted that facilitating more responsible lending would be aided by the availability of better quality consumer information across the system.

The recommendation for providing access, under appropriate protections, to the five additional datasets, complements an expectation of more responsible lending.
The legislation before the committee provides a legislative basis for limited access to a restricted additional amount of consumer credit information and therefore assists the Parliament's desire for more responsible lending.

2.2 HOW WILL CONSUMERS BE PROTECTED?
The exposure draft bill proposes extensive new protections for consumers, including: • • • Provision offree credit reports upon request (one per annum); Tougher data quality standards, with provisions that credit reporting agencies (CRAs) ensure audits of credit provider's data quality and use of credit reporting data; Simplifying consumer complaint handling and extending obligations from the industry Code of Conduct into the act; • Mandatory membership of an external dispute resolution process by credit providers and CRAs.
Veda Advantage supports - and in many instances already practices - these protections.

Further regulation to better protect consumers In accord with the current industry Code of Conduct, Veda provides consumers with the option to obtain their credit report without charge.

Further, investigation into disputed information is done without cost to the consumer, regardless of the outcome.
However we understand there are "credit repair" organisations who may charge clients a substantial fee for obtaining a copy of their credit report.

Page 115 These organisations may then impose a "success fee" - up to $1/000 - for each piece of derogatory information that a eRA investigates and removes from a credit report.

Veda and consumer organisations are concerned vulnerable consumers will pay substantial sums for normat regulated, credit reporting activities that would otherwise be free.
Typically, the consumer would be exercising their legal rights of access and correction as provided for under the Act.

It is unfair to charge consumer for the mere exercise of their rights and detracts from the quality of legal protections that the Act specifically provides for.
To avoid this, we support a provision to the effect that only CRAs be permitted to impose a fee on provision of credit reports (in addition to obligation to providing free reports); and that no entity may charge for investigation or amendment of a credit report.

If fees are to be permitted for such adjunct services by third party organisations, there should be prescriptive rules governing fee disclosure to consumers by those organisations.
Such rules should expressly provide for a disclosure to the effect that access to and correction of credit information, when conducted by a credit reporting agency, is conducted for no fee to the consumer.

2.3 STRUCTURAL CHANGES TO STRENGTHEN GOVERNANCE Veda Advantage accepts that credit reporting, as a specific issue, needs specific regulation.

We understand that access to additional information begets greater responsibility in handling that information.
However, Veda believes this outcome can be achieved without unnecessarily prescriptive drafting and an overly-complex regulatory structure.

As drafted, there are instances where the proposed legislation sets out a policy objective and then prescribes very detailed steps CRAs must take to achieve the outcome.
Structurally, the legislation will benefit if underlying issues are reviewed, specifically: Definitions (see appendix /JA/J for further details) The EDB replaces seven key definitions with 60 new definitions.

There are multiple overlapping and confusing statutory definitions, such as Credit provider (ep) permitted disclosure; and Permitted CP uses, de-identified information and credit reporting and CRA derived information.
These are in addition to the definitions in the main structure of the revised Privacy Act.

Page ]16 We believe it is possible to reduce the number of definitions of protected personal credit information, but attach consistent requirements for use/disclosure protections.

The main recommendation is for a single definition for regulated information - "credit information".

This will allow simplification or deletion various use and disclosure provisions throughout the EDB.
Additionally, a single aligned use and disclosure table covering credit providers and eRAs should be inserted.

This will allow for further simplification, including merging of 108 (use or disclosure of credit reporting information; 109 (permitted CRA disclosures in relation to individuals); 135 (use or disclosure of credit eligibility information); and 136 (permitted CP uses in relation to individuals.

A table of simpler definitions can be found at appendix "B".
Dominant purpose test (see appendix "A" for further detaNs) The proposed definition of a credit reporting business (section 194) does not include the use of a dominant purpose test.

Instead, the draft has a very wide reaching definition, and then proposes exemptions through regulation.

This creates uncertainty as it becomes possible for organisations to be regarded as conducting a credit reporting business on an incidental, temporary or transient basis.
The dominant purpose test in the current Act has proven to be effective in application.

Veda supports its retention.

Penalties (see appendix '~" for further details) There does not appear to be a scheme of applying penalty units consistent with the nature ofthe offence and harm caused.

For instance, a CRA that collected information falling outside section 106 attracts a $1.1 million penalty.
Similarly, a CRA that adopted a Government number as a consumer identifier - a much more harmful offence - would also attract a penalty of $1.1 million.

Further, without the defence of "reasonable mistake oHact" under section 117, the EDB will effectively create strict liability offences.
Data standards (see appendix "A" for further details) Page 117 Credit reporting agencies are at the centre of information exchange - a fact recognised in Section 116 of the EDB which requires that: • • • CRAs must enter into agreements with credit providers that require information the credit provider discloses be accurate, up to date and complete; Independent audits must be conducted to ensure the agreements are being complied with; The CRA must identify and deal with breaches.
It would be desirable to expressly state, as part of section 116, that a CRA is responsible for compliance with the applicable data standards and must have systems or arrangements in place to facilitate such compliance.

2.4 SPECIFIC CLAUSES OF CONCERN The EDB has clauses where detailed prescription erodes the objective of increased consumer protection.
As an example, draft Section 113 requires that an individual have the right to institute a 'ban period' on their credit file, typically requested when a person believes they have been, or are about to be the victim of identity fraud.

Having set out the outcome required, the legislation then goes into lengthy detail on how the ban period should operate.
Locking detail into legislation fails to recognise the need for continually innovating when Instead, the legislation should mandate the outcome - "the eRA shall dealing with fraud.

take all reasonable steps to enable a consumer to ban use or disclosure of credit reporting information" - and leave operational details to an industry Code of Conduct and, where appropriate, regulation.
Other examples include: Section 120 Notice of correction to be given to previous recipients of information Where credit reporting information is corrected, the CRA must then notify any previous recipients in writing ofthe correction.

No subsequent obligations exist for the recipients.

Corrections, of varying significance, can occur for credit information up to five years old.

The provision as drafted would create a substantial compliance regime for CRAs with no clear benefit for consumers.
A better alternative would be to require CRAs to notify, as requested by the consumer, credit providers whom have been recipients of the information.

Page 118 Section 126 Destruction of credit reporting information in cases of fraud.

By requiring the destruction ofthis information, the ability for CRAs to gain insight into patterns of fraud behaviours is lost.

A better outcome would be the removal of the information from a credit report.
Section 127 Dealing with information if there is a pending correction request Information, having reached its legislated retention limit, must be deleted from a credit report.

>- However, according to Section 123, if a correction or dispute is pending, the CRA must continue to hold onto the information until the matter is resolved.

~ During the time the information must be retained, it cannot be used or disclosed for day-to-day credit reporting purposes.
>- Once the dispute/correction is resolved, the information, having reached the end of its retention period, is required to be destroyed.

It is not clear how this is of any benefit to a consumer, who presumably would rather see disputed/incorrect information drop off the credit file sooner as scheduled.

CONSUMER EDUCATION 2.5 Australians have paid little attention to their credit reports; Galaxy surveys10 consistently show that 80 per cent of people have never requested a copy of their credit report.
For those that do request a copy, there is limited data (personal identifying information, inquiries for credit and defaults).

If a consumer has not applied for credit or defaulted over the past five years, the report will be blank apart from personal identifying information.

This will change under positive reporting.

Credit reports will become much more dynamic, updated monthly to reflect repayment history.
Consumers will have the ability to demonstrate their credit worthiness and negotiate a better deal from lenders.

Conversely, people who habitually fail to make the minimum payment on time can find credit applications more heavily scrutinised as lenders query their ability to manage further credit.

In the lead up to the introduction of positive reporting, consumer education is paramount.
Veda supports an industry-funded education campaign, co-ordinated by Government, before the start of positive credit reporting.

10 Galaxy Australian Debt Survey - March 2011 and September 2007- telephone survey of 1000+ people commissioned by Veda Advantage.

Page 119 PART 3 - Background briefs on how consumer credit reporting works 3.1 What information is allowed on a credit report?
3.2 Accuracy and credit reports 3.3 Security and credit reports 3.4 Consumer access to their credit reports 3.5 How does Part iliA of the Privacy Act work now?

3.6 Complaints about consumer credit reports 3.7 3.8 Identity fraud and credit reports Defaults 3.9 The amount of data on credit reports in a negative and positive system 3.10 Credit reporting agencies in Australia and internationally Page I 20 3.1 What information is allowed on a credit report?
Key Points Part lilA ofthe Privacy Act sets out what information can be collected on a credit report and for how long they can be retained: • • Personal information - name, address, date of birth, employer, drivers licence; Applications for credit made over the past five years (but not whether it was granted, or the type of credit, or the current credit limit); • Defaults - where a payment is more than 60 days past overdue on credit provided for more than $100 (five years); • Dishonoured cheques (five years); • Court judgements (five years); • Bankruptcies and serious credit infringements (seven years).
Background The current permitted contents are known as negative-only credit reporting information.

Impact of Legislation The EDB prohibits the collection of any information on a credit report - and then sets out a list of exemptions.

These will include five new datasets: • What type of credit was offered; • What the credit limit currently is; • When the account was opened; • When the account was closed; • Repayment history over the previous two years (see below).
Repayment history shows if they have been late making the minimum payment required; how many times late; and how many lines of credit have been late.

It does not show the outstanding balance, or the actually amount paid.

The predictive power from repayment history dataset is equal to the other four new datasets combined.

Only licensed credit providers can give or have access to repayment history - utilities and telco's are not eligible to provide or have access to repayment history.
Page 121 Accuracy and credit reports 3.2 Key Points • Credit reporting agencies under Section 18 G (a) are currently obliged to "take reasonable steps to ensure personal information in the file or report is accurate, up to-date, complete and not misleading" • Data quality and accuracy is important not only to consumers but to credit reporting agencies and credit providers.

Background CRAs receive information from a wide range of Australian credit providers and then matches it to the correct file.
This brings with it a significant data quality challenge - not only accurately matching the data to the correct person, but also that the information provided is done so in accord with legislative and regulatory requirements.

Veda has worked hard to improve processes and procedures to better meet accuracy obligations.

Our published matching rate is accurate to within 0.0001 per cent.
This reflects continued efforts to improve data quality, including: • Subscribers must sign up to Veda's Terms of Supply, including obligations for accuracy; o Subscribers are also provided with training and materials on use of Veda's service; • • o They are then subject to regular and random audits.
Technology that ensures credit file disclosures are only made to credit providers entitled to receive the information; Internally, Veda has a team dedicated to data quality and has on-going training and testing of all staff on requirements of the privacy act; • Where there is a complaint, Veda has a team dedicated to investigate accuracy • • complaints and make amendments, as necessary; If requested, Veda will re-investigate complaints; Further investigation is also conducted if a complaint is received via the Office ofthe Australian Information Commissioner.
Page I 22 Impact of Legislation The EDB makes a number of important changes to strengthen data quality: • The draft legislation will require o eRAs to "take such steps as are reasonable in the circumstances to ensure that credit information the agency collects is accurate, up-to-date and complete; and o eRAs to take such steps as are reasonable in the circumstances to ensure that credit reporting information the agency uses or discloses is accurate, up-to date complete and relevant.
• Whereas Veda has voluntarily entered into agreements with credit providers regarding respect to accuracy, the draft legislation will make this mandatory, giving the agreements statutory backing.

• Whereas Veda voluntarily conducts audits of subscribers} the draft legislation will make audits mandatory and require they be conducted by an independent auditor.

Page I 23 3.3 Security and credit reports Key Points • Veda Advantage has strict security standards for protecting personal information.
• However, security obligations needs to be flexible enough to allow consumer's qUick and relatively easy access (via the phone or internet) to information held about them.

• Legislation or regulations also need to be flexible enough to allow the adaptation of technological advances in today's digital environment.
Background Part lilA ofthe Privacy Act requires safeguards as are reasonable in the circumstances} against loss} and against unauthorised access, use, modification or disclosure; it also sets out the grounds for which CRAs can disclose information on a credit file or report.
In addition to external obligations, Veda has a series of internal security procedures} including: • • • Internal access is by a unique security code} updated regularly; Audits of internal operator use; Firewalls of a level similar to that of banks; • Unique security codes for subscribers; • Audit of use by subscribers; In addition, Veda conducts random audits on credit providers to help address security needs.

This is not a current regulatory obligation but is a recommendation ofthe DAle.
Impact of Legislation The EDB extends data security protection obligations to credit providers, via the agreements they enter into with CRAs.

CRA must now require credit providers to protect credit reporting information disclosed to them in a similar way as CRA are obliged to.

These obligations must also be subject to regular audits independently conducted, and to identify and deal with any breaches.

Veda supports the proposals as it provides additional consumer protection.
Page I 24 3.4 Consumer access to their credit reports Key Points • • • The industry Code of Conduct currently provides consumers with a right to a free credit report; The exposure draft bill (EDB) proposes to move the right to a free credit into legislation; Positive information - and its ability to demonstrate a pattern of good financial behaviour - will likely lead to increased consumer interest in their credit report.
Background Part lilA ofthe Privacy Act requires that a consumer denied credit must be told by the lender; • • if the reason for declined credit related to their credit report (but not what the actual negative content ofthe report was); and The name and contact details of the CRA that provided the information.

This leads to Australians only asking for a copy of their credit report after being denied credit.
Impact oj Legislation The EDB moves the provision for free consumer access to their credit reporting information from an industry code to legislation.

Veda supports this provision.

We believe there will be increased interest in accessing credit reports and anticipates providing 750,000 reports annually in the first three or four years of positive reporting and more than a million within ten years.

At the moment, Veda estimates only 0.23% of Australians monitor information on their credit report.
In the UK that figure is 2.4%, and in the USA, 5%.

Page I 25 3.5 How does Part iliA of the Privacy Act work now?

Key POints • Part lilA ofthe Privacy Act, sets out detailed and prescriptive rules that apply to Credit Reporting Agencies (CRAs) and financial lenders when dealing with credit reporting information.

The focus is on reporting what is known as 'negative information' or information about an event or a default by a consumer.
• • This is achieved through a number of key definitions, including credit information file, credit report, credit reporting business and credit reporting agency.

There are express limits on what information a eRA can hold on a credit information file, what can be disclosed and who credit information can be disclosed to.

• Generally, internal uses of credit reporting information by CRAs have been unregulated.
Background Most private sector organisations are regulated under the principles-based National Privacy Principles (NPPs).

However, credit reporting agencies are regulated by specific legislation under Part III A ofthe Privacy Act.

Part III A predates the NPPs and is drafted in a very prescriptive manner.

Over time, many different interpretations ofthe relationship between the NPPs and Part lilA ofthe Act.
Impact of Legislation The exposure draft legislation for Part IliA expands the types of information CRAs and credit providers can collect and exchange for credit reporting purposes.

This helps to provide a positive picture (as opposed to negative only) about a consumer's ability and capacity to repay a debt.

The draft legislation aligns credit reporting with responsible lending obligations.
The draft: • Broadens the depth and scope of regulation in this area, in that it goes beyond the typical matters dealing with personal information; • Creates an even more prescriptive and legalistic approach to regulating credit reporting; use, as well as disclosure, of credit reporting information, will now be expressly regulated; • Increases the types of options that a consumer can exercise in resolving credit reporting related disputes or complaints.
Page I 26 3.6 Investigating consumer complaints about a credit report Key Points • Part IliA ofthe Privacy Act 1988 and the accompanying Credit Reporting Code of Conduct specifically address the dispute resolution process for credit reporting information; • Over the past decade Veda Advantage has initiated significant improvements in its complaints handling, beyond obligations under the Privacy Act or industry Code; • Complaints fall into one oftwo categories: o Complaints that do not require an investigation (e.g.
correct a misspelling or incorrect driver's licence number or similar).

These are completed within five working days.

o Complaints that reqUire investigation.

These are completed within 30 days of receipt.
Background Veda Advantage has made considerable improvements to handling consumer complaints: • • A 100 person call centre in Sydney handles 1100+ consumer inquiries every day; As the first point of contact for most people with a complaint, Veda will take responsibility to help resolve a complaint through a dedicated investigative team, rather than re-direct them to the credit provider who listed the complaint; • In 2005 Veda set up a quarterly forum with consumer organisations to address systemic issues; • Veda has the Financial Ombudsman Service as our external dispute resolution service and the Telecommunications Industry Ombudsman in relation to telco disputes.
How investigations are conducted: 1.

As the first point of contact, Veda will assume responsibility for the investigation.

2.

Veda will contact the credit provider (generally in writing) to seek specific details and evidence with respect to the accuracy of the information they have listed; 3.

Veda writes to the individual, setting out the outcome of the investigation; 4.

Ifthe investigation reveals the information needs to be amended or removed, Veda will make the necessary amendment or deletion; 5.
Veda offers to re-investigate complaints.

This is in addition to its obligations under the Act and the Code of Conduct.

6.

When the matter is something that Veda is not in the position to investigate, such as claims of identity theft or fraud, Veda provides the individual with details of wh om they should contact to seek an investigation (that is, report the matter to the police and contact the relevant credit providers).
Page I 27 Impact of Legislation The EDB proposes to elevate some ofthe rights currently under the Credit Reporting Code Into legislation: • • • • • • • to dispute the accuracy of information on their credit information files; to have amendments made with five working days; to be informed within 30 days of outcome of investigations and reasons why an amendment is not made; to complain to the Office ofthe Australian Information Commissioner; in certain circumstances, to have a statement added to their credit file; in certain circumstances, to obtain a copy oftheir amended credit file within 14 days ofthe amendment; in certain circumstances, to have persons advised of an amendment made to their credit record.
The draft legislation also requires CRAs and credit providers using CRAs to be members of an external dispute resolution service.

The EDB makes a number of other changes to complaints handling, summarised below: • Extends the rights of an individual who requests a correction, to also include correction of Credit Reporting Agency (CRA) derived information and credit provider derived information.

These are types of data that do not exist under Part IliA of the current legislation.
• Places in the Act itself rights and obligations that currently form part ofthe Code and, in Veda's view, is more appropriate for a Code where it can be more easily amended to address lessons learned after the implementation ofthe new Act.

• Potentially shortens the period of time given to the investigation, by stipulating the 30 days commences on the day on which the request is made by the consumer (as opposed to received by the CRA).
• The draft legislation required credit reporting agencies "to take such steps (if any) as are reasonable in the circumstance to correct information within the period of 30 days.... [or] such longer period as the individual has agreed to...// Page I 28 3.7 Identity fraud and credit reports Key Points • • Identity fraud impacts consumers, lenders and Credit Reporting Agencies (CRAs).

Identity protection strategies are currently in place to help restrict fraudulent access to, or use of, credit reports.
• Legislative framework affecting CRAs must be able to adapt and change as fraud techniques evolve.

• Veda supports legislation that state the outcome required, while leaving the steps needed for that outcome to an Industry Code of Conduct.

Background Identity fraud on an international and domestic level is increasing in frequency as identity information becomes easier to obtain, especially via details published on social media sites.
The estimated cost of identity fraud in Australia is more than $1.1 billion per yearl l .

True identity fraud, where a fraudster impersonates an individual in order to obtain additional credit or take control of existing credit facilities, remains rare, but the impact on the individual can be difficult to remedy.

Veda has two strategies relating to identity fraud and credit reports: L Use of dynamic questioning to ensure the person requesting access to a credit report is entitled to do so.
iL Consumers may subscribe to a service - MyVedaAlert - whereby Veda immediately notifies the consumer of any activity on their credit file.

Impact of Legislation The exposure draft bill recommends that a consumer have the ability to institute a 'ban period' on their credit file.

While Veda Advantage understands the intended purpose, bans are not without challenges.
• If a consumer genuinely applies for credit during the ban period, automated systems commonly used by lenders are likely to decline the application.

Lender will be reluctant to approve loans on a manual basis without access to the credit file.

11 Australian Government, Department of Immigration and Citizenship, Fact Sheet 84, Biometric Initiatives http://www.immi.gov.au/media/faet-sheets/84biometric.htm 2009 Page 129 • People may deliberately keep shut their file to avoid negative information appearing.
An alternative solution could include a fraud flag, allowing the victim of identity theft to apply for credit, but alerting the credit provider ofthe necessity for higher vigilance on identity.

Neither flags nor bans are without practical issues.

Veda Advantage is concerned the legislation is too prescriptive about what steps a eRA must take, preventing the flexibility required to adapt as fraudster's techniques change.
Page I 30 3.8 Defaults Key Points • • • A default is defined as a failure to pay money at least 60 days overdue; Such a debt must be equal to or greater than $100; Before listing a default with a Credit reporting Agency (CRAL the credit provider must notify the individual they are liable for listing and usually make several attempts in writing to retrieve the money, • Defaults can only be listed with Veda Advantage by our subscribers, who are bound by Veda's Terms of Supply agreement.
Background Part IliA of the Privacy Act 1988 lists three types of defaults: • • A debt that is 60 days or more overdue.

Such a debt must be equal to or greater than $100.

A serious credit infringement which relates to obtaining credit fraudulently and evading the obligation to pay, or where the person's behaviour indicates they no longer intend to comply with their credit obligations (e.g.

they leave their address and provide no forwarding details).
• A cheque for an amount greater than $100 that has been dishonoured twice.

Under the Act only credit providers can list defaults.

In the case of listing defaults with Veda the credit provider must be a subscriber to Veda's services and are, therefore, bound by Veda's Terms of Supply (requiring data to be accurate, complete and up to date).
The Act and the Credit Reporting Code of Conduct place obligations on credit providers before they can list an overdue payment including: • • They must first have notified the individual that they may report the debt to a CRA; and They must take steps to recover the whole, or part of, the amount outstanding.

Credit provider must, as soon a practicable, notify a CRA when an individual is no longer overdue, or contends they are no longer overdue.
Impact of Legislation The exposure draft bill's detail on reporting, updating and retention of default information is largely consistent with current legislation.

Page I 31 3.9 The amount of data on credit reports in a negative and positive system Key Points • Credit reporting agencies (CRAs) fulfil a crucial, specialist role in collecting, interpreting and presenting an assessment of a consumer's credit worthiness to a lender.
• • • In a negative-only environment, credit reports infrequently receive new information - on average once a year.

Positive reporting will see regular updates on consumer credit reports - most likely on a monthly basis.

Access to CRA data is only available to subscribers who are required to agree to strict terms and conditions in accord with Part IliA ofthe Privacy Act and the credit reporting industry Code of Conduct.
Background A CRA fulfils a key role in collecting credit information from credit providers and public record data.

Given that Australia has no nationallD system, Veda Advantage relies on identity data, and a sophisticated matching algorithm refined over 40 years, to associate each piece of data to a unique identity.
The negative-only reporting regime allows information such as payment defaults, serious credit infringements and applications for credit to be collected from credit providers, and returned to credit providers, for the purpose of assessing credit worthiness.

This data is provided relatively infrequently - on average one new piece of data on each credit file is added every year and retained for between five and seven years.
Page I 32 Credit reporting agencies in Australia and internationally In Australia, consumer credit reporting was first regulated in 1990; at that time, the only CRA in Australia was a mutual, the Credit Reference Association of Australia (now Veda Advantage).

Two other CRAs currently operate in Australia.

In the context of credit reporting reforms, there have been media reports that a large European CRA has expressed an interest in setting up in Australia.
Internationally, CRA ownership models vary amongst the OECD: • Public Credit Registers are operated by Central Banks with compulsory contribution of information from financial institutions.

They generally do not provide additional data analysis associated with credit scoring or portfolio monitoring.

• Credit Bureaus are usually owned by specialist firms delivering more wide ranging data insights, including fraud prevention.
While public credit registers exist in 14 countries in Europe, privately operated credit bureaus exist in all European states.12 12European Credit Research Institute:ln!ormation-sharlng and cross border entry In European banking Feb 2010 pg 7 Page I 33 APPENDICES a) Legal perspective on an improved regulatory framework b) Proposal for simpler definitions (table) c) Positive credit reporting - timeline of events d) About Veda Advantage Page I 34 a.
Legal perspective on an improved regulatory framework DEFINITIONS Privacy protections are critical to the robust working of a credit reporting network.

These protections are best achieved when there is clear regulation of use and disclosure based on outcomes.

The exposure draft bill creates 60 definitions of information and then provides varying use and disclosure requirements for them, creating a web of complexities.
Some definitions appear confusing (largely due to an overlap in the definitions and incorporation into other definitionsL for example: • Credit eligibility information • De-identified information • Consumer credit liability information • Credit information (section 181) • Default information (section 182) • CRA derived information • Credit provider derived information • Repayment history information (section 187) • • Payment information (section 185) Information request (section 183) • New arrangement information (section 184) • Credit (sections193(1) and 193 (3)) • Amount of credit (section 193 (2)) • Credit provider (sections 188 to 191) Some definitions appear to be unnecessary, (largely because these terms have a well understood meaning or stem from a different regulatory structure), for example: • Hold • Identification information • • • Identifier Information request Interested party • Order of a court or tribunal • Consent • Access seeker Page I 35 • Credit card 13 • Solicit These are in addition to some of the key operative provisions and definitions relating to the operation ofthe EDB, such as the definition of organisation and personal information.
Under the current Act there are seven core definitions for data flows, and hence obligations, in the credit reporting environment.

They are: i. ii.

iii.

iv.

v. vi.

; Personal information 14 Credit reporting agency and credit reporting business 15 Credit provider16 ; Credit report17 ; Credit information file 18 ;and Serious Credit Infringemene9 • ; Each definition has a particular purpose.

Personal information sets the scope of the regulatory structure for the Act and its enforcement.
Credit reporting agency and credit reporting business describes the type of organisation that has the core role of processing and administering the sharing of information in the credit reporting data sharing environment or network.

A credit provider is the user of the systems, with entitlements to use and disclose a protected type of personal information.

In this case, the information is the credit report as an output provided by the credit reporting agency.
13 It is primarily used in the section 188(1)(c)(ii) definition of one kind of "credit provider" (being a supplier of goods or services with a revolving facility used to pay for them).

For that purpose, it is submitted, it is not necessary to track the definition of "credit card" that was originally included in the then Trade Practices Act for the purposes of controlling unsolicited bankcard offers in 1977 as amended in 1986 (to deal with debit cards) and again in 2001.
As proposed to be used in the Privacy Act, this seems excessive (particularly because only paragraph (c) of the definition is apt to the circumstances where it is used).

14 See section 6 of th e Act 1S See section 6 an d llA ofthe Act 16 See section 6 of th e Act 17 See section 6 ofth e Act 18 Ibid "Ibid Page I 36 The definition of credit information file covers the larger body of personal information held and used by a credit reporting agency to produce a credit report.
Credit information files are the credit reporting agency's raw data or tools oftrade.
A serious credit infringement is a type of default that was a permitted content of the credit information file and could be retained for a longer period than a standard default (seven years instead of five) The introduction of additional information as part of positive reporting required changes to just two key provisions of the Act: • Section 18 E, to be expanded to expressly permit CRAs to hold additional types of data - the five datasets as set out in ALRC recommendations 55-1 and 55-2; and • Section 18 K, to be expanded to expressly permit a CRA to disclose the additional types of data.
Consequential amendments to other parts of Part lilA would then also be desirable (such as 18N and alignment of use and disclosure provisions) but not, strictly speaking, necessary.

Additionally, to the extent that the definition of credit providers needs to distinguish between licensed and un-licensed credit providers this could be achieved by a Determination to that effect by the Privacy Commissioner under the Act.
To assist with considerations of this issue we have summarised our suggested revisions to the definitions in the attached table.

RE-INSTATEMENT OF THE DOMINANT PURPOSE TEST A dominant purpose test should be reinstated, ensuring a clear compliance framework.
The exposure draft bill proposes a very broad, wide-ranging definition of "credit reporting business" capturing a business that: "involves collecting, holding using or disclosing personal information about individuals for the purpose of, or for purposes including the purpose of providing an entity with information about the credit worthiness of an individual."

Section 194 (l) (b) The EDB then provides at 191 (4) to allow for exemption by regulation.
Such an arrangement, requiring specific regulation to achieve certainty, is not desirable.

Page I 37 The absence of the dominant purpose makes it possible for types of organisations or their service providers to be regarded as conducting a credit reporting business on an incidental, temporary or transient basis.

This would make it very difficult (if not impossible) to have a stable, permanent and transparent compliance environment required to support credit reporting activity or activities.
It would also impact on the rights of consumers when it comes to enforcing their rights and the ability of regulators to audit and otherwise undertake enforcement activities as these relate to credit reporting.
The current Act at sections six ofthe Privacy Act 1988 (Cth) (the Act) states: "credit reporting business" means a business or undertaking (other than a business or undertaking of a kind in respect of which regulations made for the purposes of subsection (SC) are in force) that involves the preparation or maintenance of records containing personal information relating to individuals (other than records in which the only personal information relating to individuals is publicly available information), for the purpose of, or for purposes that include as the dominant purpose the purpose of, providing to other persons (whether for profit or reward or otherwise) information on an individual's: (a) eligibility to be provided with credit; or (b) history in relation to credit; or (c) capacity to repay credit; whether or not the information is provided or intended to be provided for the purposes of assessing applications for credit.
The reference to a dominant purpose of a business allows all the parties to be clear as to what is credit reporting and how it is different to many other types of data processing and analytical activities common place in credit environments.

Any scope for ambiguity as to what is a credit reporting business at a given point in time must be removed and that is best achieved by the insertion of a dominant purpose test.
PERMITTED USES Similarly Veda considers that ifthe issues in respect of definitions are addressed, it is possible to combine the permitted uses tables (currently in sections 136 and 109) into one key table that sets out the permitted uses and disclosure of credit information by reference to purposes and outcomes of such use.

Page I 38 For example, the revised table could be structured as follows: • Credit providers can use credit reporting information for the following purposes .
• Credit providers can disclose credit reporting information for the following purposes .

• Credit reporting agencies can use reporting information for the following purposes... • Credit reporting agencies can disclose reporting information for the following purposes...... PENALTIES Almost all substantive penalty provisions in the EDB are civil penalty provisions with the majority of them being amounts of 2,000 penalty units (in the case of a corporation, $1,100,000).
While some civil penalties are for the lesser value of 500 ($275,000) or 1,000 ($550,000) there does not seem to be a consistent scheme of applying one level of penalty units to contraventions of equivalent seriousness.

In particular, the higher penalty applies to some provisions about the policy settings of the business as a whole (e.g.
adoption of government identifiers), but also to a large number of individual-transaction provisions (such as collecting information or using information that in a given case happens to be misleading).

For example, any collection of any information by a credit reporting agency which falls outside one of the section 106 exemptions will attract the maximum $1.1 million penalty, even though collections are routine transactions which ordinarily occur many thousands of times a day.
This penalty (as with many ofthe others) might be thought in most cases to be completely disproportionate to the nature of the offence, and to the harm (if any) that a relatively minor contravention may bring.

In cases where there are systemic problems that lead to two or more improper instances of collections from the same source, section 167 suggests that multiple the $1.1 million penalties can be imposed.

Some of the significant civil penalties relate to provisions where there is great complexity.
A $550,000 penalty applies under section 113(4), a provision which requires two separate assessments by the credit reporting agency on reasonable grounds.

Page I 39 Section 164(5) does not give a court any concrete assistance in how to determine what is an appropriate penalty.
For example} assume that a piece of information has been improperly collected - is it intended that the worst possible kind of single collection would lead to a $1.1 million penalty or, is the severity to be considered on a scale or by reference to impact in a given system or, in matters involving an individual harm to the given individuals.

Some provisions, such as section 117, make no provision for compliance measures and any reference to steps taken to comply by the given organisation.
This fails to reflect the fact that in data sharing arrangements one does not always have control over the conduct of others and their processes.

These matters are, by their nature, internal to each organisation.

It is feasible for data supplied to be incorrect even though the systems and processes that one has in place are word class.

Veda is concerned that the unintended consequences of the drafting are to create what are in effect strict liability offences.
• It would assist with compliance to link the quantum of penalties to a notion of proportion or impact.
Similarly, courts and regulators to be given guidance as to whether systems designed to prevent the breach should mean there will be no penalty, or that only a small penalty should be imposed; • For the section lOG prohibitions on collection to work (civil penalty of $1,100/000)/ some of the very complicated conditions in 10G(4), (5) and (G) would need to be removed; and • For section 117 (criminal penalty of $110,000 and a civil penalty of $1,100,000), dealing with use or disclosure of credit reporting information to work, the defence of "reasonable mistake of fact" needs to be expressly provided for.
This is important because despite taking appropriate care, it will always be possible that a record happens to be false in a material particular, in circumstances where the credit reporting agency has no way of knowing this.

COMPLIANCE WITH APPLICABLE DATA STANDARDS - align sections 143, 144 and 116 Veda recognises that credit reporting businesses are at the centre of the information exchange that is core to credit reporting.
Accordingly, it makes commercial and regulatory sense to expressly bind credit reporting businesses (as opposed to credit providers) to comply with data standards applicable to information provided to the credit reporting business by the credit providers.

Page 140 This is in line with the proposed provisions as set out in section 116 (3) dealing with enforcement of contractual obligations between credit reporting businesses and credit providers.
It would be desirable, for compliance purposes, to expressly state (as part of section 116) that a credit reporting business is responsible for compliance with the applicable data standards and must have systems or arrangements in place to facilitate such compliance.
We note that there are express obligations on credit providers in respect of accuracy of credit eligibility information (see sections 143 and 144 of the Proposed Act) and no corresponding provisions in respect of credit provider obligation in respect of credit information.

It would be desirable to mirror these obligations that would potentially apply to similar types of personal information.
This helps avoid confusion and assists with compliance and aligns with the responSibilities as proposed in section 116.

Veda submits that: • The scope of section 116 be expanded to include the additional responsibilities or powers; and • Responsibility for accuracy of credit information and credit eligibility information is aligned.

Page I 41 b.
Page I 41 b.

Proposal for simpler definitions Page I 42 Proposal for simpler definitions Credit eligibility information Merge or combine this definition with the conceptually similar definition of consumer credit liability information.

The policy intention of regulating credit reporting information - when and how it is handled by credit providers - can be addressed by use and disclosure provisions dealing with credit reporting information.
De-identified information Delete this definition and instead expressly address use of credit reporting information or credit information by CRAs.

The definition is an example of overreach.

De-identified information is not personal information as defined by the Privacy Act.

Credit information This is a cornerstone definition and should guide the structure of what follows.
(section 181) The relevant use and disclosure requirements for CRAs and credit providers would then build on this definition (in line with recommendation 54-3 by the ALRC.

Amend the definition to remove internal references within this definition.
Currently this definition incorporates information that is otherwise well known, publicly available information; for example court proceeding 181 (i), information and personal insolvency information about an individual 181 (j), and publicly available information 181 (k)).

Consumer credit liability information This has the effect of bringing information into scope for specific additional regulation when it is already well defined and regulated elsewhere.
Merge or combine this definition with the conceptually similar definition of credit eligibility information.

The policy intention of regulating credit reporting information - of when and how it is handled by credit providers - can be addressed by use and disclosure provisions dealing with credit reporting information.

It is unnecessary to have two definitions that describe the same types of information.
Prescribed use and disclosure of that Page 143 information needs to be addressed as part of use and disclosure obligations under the Act.

Default information (section 182) Align this with the definition of payment information and repayment history given the connection made between this types of information.

The fact that one can default directly (as per section 182(1) or as a guarantor (as per section 182(2)) can be dealt with in one definition.

These should be merged.


CRA derived information Delete this definition.

If the intention is to regulate use of credit information, that should be addressed as part of use provisions.

The definition is an example of overreach.

Many types of information are by necessity 'derived' from others.

This is potentially confusing in a large data sharing environment.

Any definition that links to a concept of origin or source is ambiguous.
CP derived information As above Repayment history information (section 187) Amend this definition to be more generic as the term can be well understood from other sources (eg guidelines or codes) As drafted, the definition is very product specific and is therefore unhelpful.

The definition is conceptually similar to default information and as such the link between these concepts needs to be made clear.
A definition does not need to reflect the fact that licensed credit providers can have access to more information.

framework that makes clear who can or cannot contribute to or access types of data.

[t is the licensing Under the Privacy Act it is a question of disclosure and should be regulated as such.

Payment information (section 18S) Amend this definition to be more generic as the term can be well understood from other sources (eg guidelines or codes).
It is conceptually similar to default information and as such the link needs to be made clear.

New arrangement information (section 184) As above.

Credit (sections193(1) and 193 (3)} Amend this definition to be more generic as the term "credit" is well understood.
It can be simplified to deal with the fact that the regulatory structure applies to consumer credit (as opposed to other types of credit) Page 144 Amount of credit (section 193 I Delete - this definition is very product specific and therefore unhelpful; it is unnecessary and does not add clarity.

(2)) Credit provider (sections 188 to 191) I Amend this definition to reflect the recommendations of the ALRC Information request (section 1 I Delete.
It is unnecessary and does not add clarity Permitted CRA disclosure (section 109) Permitted CP use (section 136) Permitted CP disclosure (section 137 to 141) I Delete.

Regulate as part of the disclosure provisions (It would also assist with clarity if the definition was not separated from other definitions) I Delete Regulate as part of the use provisions (It would also assist with clarity if the definition was not separated from other definitions) I Delete.

Regulate as part of the disclosure provisions.
(It would also assist with clarity if the definition was not separated from other definitions) Page I 45 c. POSITIVE CREDIT REPORTING - TIMEUNE OF EVENTS 2006 January Attorney General Philip Ruddock requests the Australian Law Reform Commission review the Privacy Act 1988 to report by March 2008 October The ALRC releases an Issues Paper on aspects of the Privacy Act December The ALRC releases an Issues Paper specific to credit reporting provisions of the Privacy Act 2007 September 2008 February The ALRC releases a Discussion Paper Extension granted by Attorney General Robert McClelland to 30 May 2008 May The Review is completed August For Your Information is released.
Special Minister of State John Faulkner commits to considering the report's 285 recommendations in two stages, with stage one (new privacy principles, health and credit reporting regulations) the subject of legislation within 12-18 months October Government announces it willlegisJate for responsible lending laws 2009 October Special Minister of State Joe Ludwig announces the Government's response to 197 ofthe ALRC's 296 recommendations, including credit reporting reforms December National Consumer Credit Protection Act (NCCP) passes with various start dates for compliance 2010 October 2011 January Minister for Privacy Brendan O'Connor announces the Government aims to have legislation through the parliament by mid 2012.
Responsible lending Jaws start Exposure draft bill on credit reporting released Page I 46 d. ABOUT VEDA ADVANTAGE Veda Advantage is an information economy company, best known as Australia's leading credit reporting agency, assisting 15 million credit-active Australians.

Starting in 1967 as a mutual, the Credit Reference Association was demutualised in 1998, becoming Data Advantage until 2001 when merged and listed on the stock exchange as Baycorp Advantage.
In 2007 Pacific Equity Partners and Merrill Lynch bought and delisted the company, relaunching it as Veda Advantage.

Based in North Sydney with offices in Brisbane and Melbourne, Veda employs more than 400 staff.

Page I 47