Office of the Australian Information Commissioner - Home

Australian Government - Office of the Australian Information Commissioner
Australian Government - Office of the Australian Information Commissioner

Main menu

Privacy fact sheet 29: Who can access your credit report

pdfPrintable version273.94 KB

May 2014

Credit reporting ‘know your rights’ series no. 4

This fact sheet is the fourth in a series that outlines what you need to know about how your personal information can be handled in the Australian consumer credit reporting system. It contains information about who can gain access to your consumer credit report. There are lots of technical terms used in the credit reporting system and we refer to some of those terms in this series. You can find more information about these terms in no. 2 (Privacy fact sheet 27) of this series.

Are there restrictions on who can access your credit report?

Yes, the credit reporting laws place restrictions on who can access your consumer credit report.

Your consumer credit report is created and managed by a credit reporting body (CRB). A CRB is only able to give your consumer credit report to credit providers that choose to participate in the consumer credit reporting system, and a limited number of other people and organisations.

The credit reporting laws also restrict a credit provider (or other person or organisation) that has received a copy of your consumer credit report from passing on that information.

Who can access your credit report?

The following organisations are able to request a copy of your consumer credit report from a CRB:

  • other Australian CRBs
  • credit providers
  • mortgage insurers, and
  • trade insurers

However, a CRB will only be permitted to give a copy of your consumer credit report to those organisations for certain purposes (see below for more information).

Credit providers that can access your credit report

The types of credit providers that can access your consumer credit report include:

  • banks
  • building societies
  • credit unions
  • retail companies that issue credit cards
  • small amounts lenders (including payday lenders) that provide contracts for credit of up to $2000 for a term of between 16 days and one year.

Importantly, the types of businesses that are credit providers under the Privacy Act 1988 (Privacy Act) and are, therefore, able to request a copy of your consumer credit report also include businesses that provide goods or services on credit. Such businesses include:

  • energy and water utility companies
  • telecommunications carriers
  • toll road and public transport operators,and
  • retail businesses that supply goods or services and who allow you to defer payment for 7 days or more.

Who cannot access your credit report?

Importantly,the following businesses are not credit providers and are,therefore, not permitted to access your consumer credit report:

  • real-estate agents
  • landlords
  • employers, and
  • insurance companies other than mortgage insurers and trade insurers.

In addition, your consumer credit report cannot be accessed by foreign credit providers or foreign CRBs.

For what purposes can a credit provider or other organisation access your credit report?

Credit providers

A CRB can only give a credit provider a copy of your consumer credit report in certain circumstances, including where the credit provider requests a copy of your consumer credit report to:

  • assess an application for consumer credit made by you to that provider (this includes a request to defer payment for goods or services)
  • enable it to collect any overdue payments that relate to consumer credit provided by the credit provider (this includes overdue payments for goods or service provided to you on credit).
  • assess an application for commercial credit made by you to the credit provider, but only where you have expressly consented to the disclosure of your consumer credit report to that provider
  • enable it to collect any overdue payments that relate to commercial credit provided by the credit provider, but only where you have expressly consented to the disclosure of your consumer credit report to that provider
  • assess whether to accept you as a guarantor in relation to an application for credit made by someone else to the credit provider, but only where you have expressly consented to the disclosure of your consumer credit report

In addition, a CRB can give a credit provider a copy of your consumer credit report where:

  • the CRB holds personal information about consumer credit that you have been provided with by the credit provider, and
  • that credit has not been terminated, and
  • the credit provider has given the CRB information that suggests there is a significant risk that you will default on your obligations under that credit.

Mortgage and trade insurers

A CRB can only give a mortgage or trade insurer a copy of your consumer credit report where the insurer requests your report to:

  • help it assess the risks associated with providing insurance to a credit provider, and
  • that insurance relates to credit that has been provided to you (or that you have applied for).

Are there additional restrictions on access to information in your credit report?

Yes, there are additional restrictions that apply to information about your repayment history.

Not all credit providers that choose to participate in the consumer credit reporting system will be permitted to access information about your repayment history. Only credit providers that hold an Australian Credit Licence issued by the Australian Securities and Investments Commission (ASIC) will be able to access that information. This includes most:

  • banks
  • building societies
  • credit unions
  • credit card issuers, and
  • some licenced small amounts lenders

Importantly, the following credit providers will not be able to access information about your repayment history:

  • energy and water utilities
  • telecommunications carriers
  • toll road and public transport operators, and
  • retail companies that provide goods or services on credit.

For more information see no. 9 (Privacy fact sheet 34) in this series.

Who can a credit provider give your credit report to?

Other credit providers

A credit provider is permitted to give a copy of your consumer credit report (or personal information contained in that report) to another credit provider in specific circumstances, including:

  • if you give consent in writing (unless the disclosure is for the purpose of assessing a verbal application for credit made by you to the recipient credit provider, in which case consent does not need to be in writing), or
  • if the recipient credit provider is acting as an agent for the credit provider who is sharing your consumer credit report.

Debt collectors

A credit provider is permitted to disclose certain types of personal information contained in your consumer credit report to a debt collector. However, the information may only be disclosed to enable the debt collector to collect overdue payments that relate to:

  • consumer credit that the credit provider has provided to you, or
  • commercial credit provided by the credit provider to any person.

A credit provider may only disclose the following types of personal information to a debt collector:

  • your full name
  • your date of birth
  • your sex
  • your current (or last known) address and previous 2 addresses
  • the name of your current (or last known) employer
  • your driver’s licence number
  • any court judgements made against you in relation to credit
  • certain information about you that is recorded on the National Personal Insolvency Index, including information that relates to bankruptcy and debt agreements, and
  • that you have defaulted on a consumer credit payment of $150 or more (but only if you have not since paid the amount that was recorded as being overdue).

Persons acting, or offering to act, as a guarantor

A credit provider is permitted to provide information contained in your consumer credit report to a person who is considering whether to:

  • act as guarantor, or
  • provide property as security

in relation to credit that you have been provided with by the credit provider (or that you have applied for).

However, you must have consented in writing to the disclosure of that information (unless the application for credit made by you was not in writing; in which case, you must still expressly consent, but that consent does not need to be in writing).

A credit provider is also permitted to provide personal information contained in your consumer credit report to a person who is already acting as guarantor, or who has provided property as security, in relation to credit that you have been provided with by that credit provider. Generally, you must have consented in writing to that disclosure, unless the disclosure relates to the enforcement of the guarantee.

Credit managers

A credit provider is permitted to provide personal information contained in your consumer credit report to a person who manages credit provided to you by that credit provider, or a person that processes an application for credit made by you to the provider.

Purchasers and their advisors

A credit provider is permitted to provide personal information contained in your consumer credit report to a person or organisation that is considering whether to purchase, or has purchased:

  • a debt that is owed to that credit provider, or
  • an ownership share in that credit provider.

A credit provider is also permitted to provide that information to a professional legal or financial adviser that is providing advice to the purchaser in relation to that purchase.

What happens if a credit provider discloses information in your credit report overseas?

Where:

  • a credit provider discloses your consumer credit report overseas, and
  • the overseas recipient subsequently handles your consumer credit report (or the information contained in that report) in a way that would breach the credit reporting laws,

the credit provider will generally be responsible for that breach.

Can a recipient of information contained in your credit report further disclose that information?

Persons or organisations that receive information contained in your consumer credit report from a credit provider are generally not permitted to disclose that information.

Are there any other circumstances in which a CRB or a credit provider can disclose your credit report?

A CRB or credit provider might be permitted to disclose your consumer credit report to certain other bodies in very limited circumstances. Such circumstances include where the disclosure of your consumer credit report is:

  • authorised by an Australian law or court/tribunal order
  • required by a recognised external dispute resolution (EDR) scheme, of which a CRB or a credit provider is a member, to resolve a complaint.

For further information

telephone: 1300 363 992
email: enquiries@oaic.gov.au
write: GPO Box 5218, Sydney NSW 2001
Or visit our website at www.oaic.gov.au