The last year has seen fundamental changes to credit reporting law. A new regime is embodied in a complete re-write of Part IIIA of the Privacy Act 1998 supplemented by a number of regulations and a new Credit Reporting Code (CR Code). This body of new law establishes a framework for comprehensive credit reporting in Australia.

However if the recent recommendations of the Financial System Inquiry Report (FSI Report) published on 6 December 2014 are any indication, the journey reforming the Australian credit reporting system may only be partially complete.

Comprehensive credit reporting was the subject of significant consideration prior to the introduction of the new regime on 12 March 2014. Prior to that date credit reporting information within the system was limited to "negative" information. Credit reports typically gave an indication of the default history of loan applicants and borrowers but little more.

The current regime expands the available data sets so that more information about borrowers is available within the system. There are new categories of "positive" information about borrowers' consumer credit arrangements including:

  • the type of consumer credit that a borrower has obtained.
  • the day on which the relevant credit arrangements were entered and the day on which they are terminated or cease to be in place.
  • certain information about repayment obligations.
  • the maximum amount of credit available under consumer credit arrangements.
  • repayment history information.

In conjunction with the new data sets come additional protection for individuals about the use and disclosure of credit information. These include rules about protecting minors, mechanisms to assist customers when they are the victim of fraud (including identity theft), and maximum retention periods for different categories of data. The regime also includes more comprehensive rules and obligations on credit industry participants about the rights of individuals to access or correct credit information that is held about them and to deal with complaints (including through external dispute resolution (EDR) schemes and complaints to the Privacy Commissioner).   

Mandatory participation in EDR schemes has seen some debate and there have been some teething difficulties in the new regime for commercial trade creditors and some utility providers in particular. This has resulted in transitional exemptions for some of these entities under the regulations. Assuming that the existing regulations are not amended, the exemptions granted from the requirement to be part of an EDR scheme are due to expire in March 2015.   

The provisions in the legislation are supported by the new CR Code which has been approved by the Privacy Commissioner but which was developed following an industry consultation process overseen by the Australian Retail Credit Association (ARCA). This CR Code is mandatory for participants in the credit reporting system.   

The move to comprehensive credit reporting has been heralded as a means to improve credit decisions for lenders. The availability of additional information was seen as being capable of driving better consumer outcomes by reducing the likelihood of unsuitable credit being provided to credit applicants and also reducing the cost of and improving access to credit. Strong impetus for the introduction of comprehensive credit reporting came with the introduction of "responsible lending" obligations for credit licensees under the National Consumer Credit Protection Act 2009 (NCCP Act). The ability to participate in comprehensive credit reporting arrangements in the new regime is tied to an appropriate credit licensing status under the NCCP Act.

With the first anniversary of the new regime fast approaching, there are still elements missing in the new credit reporting system. An industry data sharing agreement to allow for the exchange of information between industry participants was contemplated by ARCA during its consultation process. This has not yet been finalised. According to submissions made by ARCA to the Financial System Inquiry the finalisation of this arrangement is not expected until at least March 2015.   

The FSI Report also correctly observes that participation in comprehensive credit reporting under the new regime is "voluntary". This means that the "pace and extent of eventual participation in the regime is not yet clear". The FSI Report observes that the exchange of some categories of data within the credit reporting system may not occur until late 2016 or early 2017.   

Given the fundamental change in the nature the credit reporting system under the new law, the late development of the data sharing industry agreement and also the relatively late finalisation of the CR Code in early 2014 it is understandable that the impacts of the new credit reporting regime cannot yet be assessed. However during the course of the Financial Service Inquiry it appears that some concerns were raised about whether there is sufficient motivation for credit industry participants to participate in the new comprehensive credit reporting system. The approach by ARCA in relation to data sharing is that a principle of reciprocity should apply so that only those credit providers who contribute comprehensive credit information should be entitled to obtain it. A credit provider's assessment on whether or not to participate comes down to a cost benefit analysis (i.e. whether the benefit of having access to additional information outweighs the cost of compliance and the risk of making additional information available to competitors).   

The FSI report fell short of making participation in comprehensive credit reporting mandatory. However the report suggests that industry participation should be monitored by the Commonwealth and that if over time participation is "inadequate" government should consider formally mandating participation in consumer credit reporting for consumer lenders. The report suggests that an assessment about the level of participation in comprehensive credit reporting should be made during the course of 2017. One uncertain element from this discussion is what level of industry participation in comprehensive credit reporting might be regarded as adequate.   

The consideration of privacy issues in the FSI Report suggests that credit reporting and indeed other practices in respect of the use and disclosure of data more generally in the financial sector will remain under the microscope. In another of its recommendations, the FSI Report recommends that the Privacy Commissioner should undertake a review about the costs and benefits of increasing access and use of data (including both public and private sector data).   

The FSI Reports suggest that one of the areas of enquiry for such a review would be the possible expansion of data sets within the newly introduced comprehensive credit reporting regime. The FSI Report suggests that submissions made to it generally supported the further expansion of data sets. The earlier interim report and submissions made to the Financial Services Inquiry suggest that new data fields for example might include account balances and repayment history in respect of non-bank credit providers (like telecommunications and utility providers). In fact in response to the interim report ARCA indicated that it would support other debt information in an expansion of the data sets, including information about tax debts.   

Interestingly the Financial Service Inquiry also considered the extension of mandatory credit reporting to SMEs. The interim report had called for submission on whether such a measure would allow lenders to address a perceived "information asymmetry" faced by lenders when lending into the SME sector. The final report issued in December did not recommend the adoption of mandatory credit reporting for the SME sector, observing that the majority of submissions suggested that the cost of such a measure would outweigh the benefits.   

The outcomes of the FSI report suggest that even while the credit industry continues to implement the new regime, credit reporting issues remain the subject of significant scrutiny. If adopted by government the recommendations may ultimately see mandatory participation for consumer credit providers in the comprehensive credit reporting system and a possible further expansion of the types of information circulating within the credit reporting system.   

Therefore while the emphasis for most credit industry participants will remain the implementation of the existing regime, the journey may continue beyond that into new reforms in the medium to long term.