Office of the Australian Information Commissioner - Home

Australian Government - Office of the Australian Information Commissioner
Australian Government - Office of the Australian Information Commissioner

Main menu

Privacy fact sheet 33: Making a credit reporting complaint

pdfPrintable version432.63 KB

Updated October 2016

Credit reporting ‘know your rights’ no. 8

This fact sheet is the eighth in a series that outlines what you need to know about how your personal information can be handled in the Australian consumer credit reporting system. It contains information about how you can make a complaint if you believe that your consumer credit report (or the information contained in that report) has been mishandled. There are lots of technical terms used in the credit reporting system and we refer to some of those terms in this series. You can find more information about these terms in no. 2 (Privacy fact sheet 27) of this series.

When can you make a complaint?

You can make a complaint if you believe that a credit reporting body (CRB), credit provider or other recipient of your consumer credit report has handled that report (or the personal information contained in that report) in a way that is inconsistent with the credit reporting laws.

If a CRB, credit provider or other recipient of your credit report, handles your report in a way that breaches the credit reporting laws that is an interference with your privacy under the Privacy Act.

If you are not sure whether you have grounds to make a complaint, you should start by reading through the relevant fact sheets in this series.

Who should you complain to?

Your complaint will generally follow a three stage process.

Step 1: You should first complain to the relevant CRB, credit provider or other recipient. A CRB or credit provider is not permitted to charge you for making a complaint and the body or provider must make a decision about your complaint within 30 days of receiving your complaint.

Step 2: If you are not satisfied with the outcome of Step 1, you can complain to an external dispute resolution (EDR) scheme of which the CRB, credit provider or other recipient is a member.

Step 3: If you are not satisfied with the outcome of the EDR process, or if you would prefer to complain directly to the regulator, you can complain to the Office of the Australian Information Commissioner (OAIC).

What do you need to know about making a complaint to a CRB or credit provider?

Where possible, if you believe that a CRB or a credit provider has mishandled your consumer credit report (or the information contained in that report) you should first complain directly to that CRB or credit provider.

Importantly, your complaint must be about an action of the CRB or credit provider that you complain to.

Can a CRB or credit provider charge you for making or dealing with a complaint?

A CRB or credit provider is not permitted to charge you a fee for making, or dealing with, a complaint.

How do you know that the CRB or credit provider has received (and is dealing with) your complaint?

You should receive a written notice confirming that the CRB or credit provider has received your complaint within 7 days of making your complaint. That notice will also set out how the CRB or credit provider will deal with the complaint.

When can you expect a response to your complaint?

The CRB or credit provider must make a decision about your complaint within 30 days of receiving your complaint.

In certain circumstances, a CRB or credit provider may request that you agree to an extension of that timeframe. If the CRB or credit provider makes an extension request, it must:

  • explain to you the reasons for the delay, and
  • inform you of the new expected timeframe for resolving your complaint. That new timeframe must be reasonable in the circumstances.

If you agree to allow the extension, this must be done in writing. The CRB or credit provider must then make a decision about your complaint within the extended period that you have agreed to.

However, you do not have to agree to an extension of time. If you believe that the request is unreasonable you can refuse the request. You may then make a complaint to a recognised EDR scheme or the OAIC.

What information will be provided by the CRB or credit provider when responding to your complaint?

Once the CRB or credit provider has made a decision about your complaint, you will receive a written notice of that decision. That notice will:

  • outline the decision, and
  • explain who you can complain to if you are not satisfied with that decision.

What if your complaint is that a CRB or credit provider knew that information in your credit report was not correct?

If you discover that personal information in your consumer credit report is incorrect and you believe that a CRB or credit provider knew that the information was incorrect, you can make a complaint.

Importantly, the CRB or credit provider that receives your complaint will automatically notify any other credit providers or CRBs that it has given a copy of your consumer credit report to within the past 3 months. You can also request that the CRB or credit provider notify other credit providers that you specify.

What if your complaint is about the outcome of an earlier correction request?

If you have made a correction request to CRB or a credit provider and the CRB or credit provider has decided not to correct your personal information and you are not satisfied with that decision, you can complain directly to an EDR scheme or the OAIC.

How can you make a complaint to an EDR scheme?

CRBs and credit providers that hold an Australian Credit Licence issued by the Australian Securities and Investments Commission (ASIC) will generally be a member of either the:

Other credit providers, including telecommunications companies, energy and water utilities and toll road or public transport providers generally are members of industry based EDR schemes. For example, the:

For a full list of EDR schemes that have been recognised by the OAIC, please see the OAIC’s recognised EDR schemes register.

How do you know which EDR scheme to complain to?

Credit providers accessing the credit reporting system are required to be a member of an EDR scheme recognised by the OAIC.

If you are not satisfied with the response that you have received from a CRB or a credit provider about your complaint (or if you want to complain about a decision by a body or provider not to correct your consumer credit report), you can make a complaint to an EDR scheme that the body or provider is a member of.

If you are not sure which EDR scheme the CRB or credit provider is a member of, you should contact the CRB or credit provider directly. When a CRB or a credit provider makes a decision about your complaint, that body or provider must also provide you with information about how you can make a complaint to an EDR scheme that they are a member of.

How can you make a complaint to the OAIC?

The OAIC has the power to investigate possible interferences with privacy, either following a complaint or on its own initiative.

The Privacy Act does not prevent you from lodging a complaint directly with the OAIC, if you have not first complained to the relevant credit provider, credit reporting body, or EDR scheme. However, the Information Commissioner can decline to investigate a complaint on a number of grounds, including that: the complainant has not complained to the relevant credit reporting body or credit provider directly; or the complaint is already being dealt with by an EDR scheme; or your complaint would be more effectively or appropriately dealt with by an EDR scheme.

The OAIC has a range of enforcement powers and other remedies available. For more information about how to complain to the OAIC, please refer to the OAIC website page How do I make a privacy complaint?

What if your complaint is about a breach of the Australian Privacy Principles (APPs)?

In some circumstances the APPs will also apply to the handling of personal information contained in your consumer credit report. When particular APPs apply to a credit provider in addition to the credit reporting laws is set out in no. 15 (Privacy fact sheet 40) in this series.

If you believe that a credit provider or a third party has handled your consumer credit report (or the personal information contained in that report) in a way that breaches an APP that applies, you should refer to the OAIC website page How do I make a privacy complaint?

For further information

GPO Box 5218 Sydney NSW 2001 | P 1300 363 992 | enquiries@oaic.gov.au
Or visit our website www.oaic.gov.au
The information provided in this resource is of a general nature. It is not a substitute for legal advice.