Consultation on proposed variation to the Credit Reporting Code

Summary

• The Privacy (Credit Reporting) Code 2024 (CR Code) requires an independent review of the code be conducted every four years. The next review is due to be initiated in March 2025
• Various consultation and review processes have recently been completed or are underway in connection with the CR Code, including the review of Australia’s credit reporting framework and the recent completion of the 2021 independent review of the CR Code.
• The OAIC proposes to defer the next independent review for 2 years to allow these processes to complete and for any changes arising from them to be put in place before the next review occurs.
• This requires an amendment to the CR Code, which the OAIC is consulting with stakeholders about until 21 February 2025

Background

In accordance with section 26T(1)(a) of the Privacy Act 1988 the Australian Information Commissioner is proposing to initiate a variation to the Privacy (Credit Reporting) Code 2024 (CR Code).

The proposed variation will seek to amend the provisions concerning the Information Commissioner’s role and the independent review requirements outlined at section 24 of the CR Code.

The OAIC is seeking views from stakeholders about this proposal, which is outlined below.

Details of the proposed variation

Under section 24(4) of the Privacy (Credit Reporting) Code 2024 (CR Code), the Commissioner is required to initiate an independent review of the operation of the CR Code every 4 years. This is an important mechanism to ensure that the CR Code is fit for purpose and operating as intended. The OAIC is due to initiate its next independent review in March 2025.

There is a lot happening in the credit reporting space. The Government is currently considering the final report for the review of Australia’s credit reporting framework. The OAIC understands that the Government will be conducting further consultation on the report’s recommendations. Some of the recommendations from the report, if adopted by Government, will have implications for the CR Code.

Further, the OAIC recently gave effect to the remaining proposals made in our 2021 independent review of the CR Code. In October 2024, the CR Code was varied to implement 15 proposals made in that review.

The review of Australia’s credit reporting framework was the first review of the credit reporting provisions of the Privacy Act since their inception in 2014. Stakeholder engagement on the report’s findings will play an important role for any proposed credit reporting reforms. The OAIC also intends to work closely with Government in considering the recommendations from the report.

The OAIC is conscious that the independent review of the CR Code due to commence in March 2025 may conflict with the further consultation planned for the review of Australia’s credit reporting framework. The OAIC is also alive to the fact that the CR Code was only recently varied and that not enough time has lapsed to be able to see how the new CR Code is operating in practice.

Given this, the OAIC considers that it would be desirable to delay the next scheduled review of the CR Code, which is currently due to commence in early 2025. Delaying this review will give more time for recent and expected imminent changes to the CR Code to operate before the next review commences and will reduce the risk of consultation overload for interested stakeholders. To achieve this, the OAIC proposes to vary the CR Code to introduce a mechanism to allow the Commissioner to extend the independent review under section 24(4) of the CR Code by up to 2 years.

Consultation questions on the proposed variation to the CR Code

The following questions are provided to help guide your feedback to the proposed variation:

1. Are you supportive of the OAIC using the proposed discretionary deferral provision to extend the independent review due to commence in 2025? If not, why not?
2. Referring to the two-year period proposed in the discretionary deferral provision, do you support this timeframe? If not, why not?
3. Do you have any feedback about the proposed provision to give effect to the deferral, being a new provision within the CR Code to allow the Commissioner to defer an independent review by up to two years?

Summary of the proposed variation to the CR Code

The proposed CR Code will amend section 24 of the CR Code by:

• Inserting a new provision at section 24(5) of the CR Code to add a new provision to create a discretionary deferral, allowing the Commissioner to extend the independent review by up to two years.
• The new section 24(5) will include a requirement that the OAIC consult with interested stakeholders when making a decision to defer the timing of an independent review.
• We also propose to amend section 24(4) of the CR Code to trigger a review 4 years from then the previous review was completed rather than commenced. Independent review processes can be lengthy. The current framing has in practice meant that review recommendations may only have been recently implemented before the next review is due to commence.

Purpose of the consultation

The OAIC is now conducting consultation on the proposed variation, during which the public may provide comments.

Information about the CR Code can be accessed through our privacy codes register.

How to provide comments

Submissions can be made by:

Email: consultation@oaic.gov.au

Post: GPO Box 5218, Sydney NSW 2001

The closing date for submissions is COB Friday, 21st February 2025.

Although you may send your comments by email or post, email is preferred.

We intend to make all submissions publicly available. Please indicate when making your submission if it contains confidential information, you don’t want made public and why it should not be published.

Requests for access to confidential comments will be determined in accordance with the Freedom of Information Act 1982.

Privacy collection statement

The OAIC will only use the personal information it collects during this consultation for the purpose of considering the application.