Commonwealth law

The Privacy Act 1988 [Part IIIA] prescribes a mandatory regime for the storage, use, disclosure, access to and accuracy of consumer credit information. It applies to credit reporting agencies and credit providers (including banks, building societies, credit unions, finance companies and retailers that issue credit cards to customers) [ss 6, 11A, 11B].

The Act controls the type of personal information which may be contained in credit information files [s 18E] and the uses which may be made of that information.

Some of the important rights and obligations created by Part IIIA of the Act are:

credit reporting agencies must ensure that credit information files are accurate, up-to-date, complete and not misleading, and they must use adequate safeguards to protect the files against loss, and against unauthorised access, use, modification or disclosure [s 18G]
credit reporting agencies must ensure that people have access to their credit information files [s 18H]
if people think that the information in their file is not accurate, up-to-date and complete, they may ask the credit reporting agency to alter the file. If the agency refuses, the person can have a statement included in the file to the effect that he or she requested the alteration [s 18J]
generally, credit reporting agencies cannot disclose personal information about a person except to credit providers so they can decide whether to give credit to that person [s 18K]
a credit provider must only use personal information (a credit report) on a person to assess a credit application of that person [s 18L]
very strict limits apply to credit providers disclosing personal information in credit reports [s 18N]
when assessing a consumer credit application, a credit provider generally must not use information about a person's commercial creditworthiness unless that person specifically consent [s 18L(4)]
a credit information file must include a note of each disclosure of information [s 18K(5)]
where credit is refused because of information in a credit report, the credit provider must tell the applicant of this fact in writing and give the name and address of the credit reporting agency who provided the credit report [s 18M]
credit providers must inform credit reporting agencies when loans or other forms of credit are repaid [s 18F(5)]
there are time limits on the keeping of credit information [s 18F(2)]. Some of the common time limits are set out in the following table.