The Treasury has released draft legislation to require the big four banks to participate fully in the credit reporting system by 1 July 2018. They say this measure will give lenders access to a deeper, richer set of data enabling them to better assess a borrower’s true credit position and their ability to pay a loan.
We note that there is no explicit consumer protection in this bill, relating to potential inaccuracies of data going into a credit record. This is, in our view a significant gap, especially as the proposed bulk uploading will require large volumes of data to be transferred.
It does however smaller lenders to access information which up to now they could not, so creating a more level playing field. Consumers may benefit, but they should also beware of the implications of the proposals.
The Government is seeking views on the exposure draft legislation and accompanying explanatory materials, which implements this measure. Closing date for submissions: 23 February 2018
The Bill amends the Credit Act to mandate a comprehensive credit reporting regime such that from 1 July 2018 large ADIs and their subsidiaries must provide comprehensive credit information on open and active consumer credit accounts to certain credit reporting bodies. It also expands ASIC’s powers so it can monitor compliance with the mandatory regime. The Bill also imposes requirements on the location where a credit reporting body must store data.
Since March 2014, the Privacy Act has allowed credit providers and credit reporting bodies to use and disclose ‘positive credit information’ or ‘comprehensive credit information’ about a consumer.
This includes information about the number of credit accounts a person holds, the maximum amount of credit available to a person and repayment history information.
Prior to March 2014, the information that could be shared was limited to ‘negative information’. This includes details of a person’s overdue payments, defaults, bankruptcy or court judgments against that person.
However, the Privacy Act does not mandate the disclosure of comprehensive credit information by credit providers to credit reporting bodies.
The 2014 Murray Inquiry and the Productivity Commission Inquiry into Data Availability and Use recommended that the Government mandate comprehensive credit reporting in the absence of voluntary participation. Comprehensive credit reporting is expected to enable credit providers to better establish a consumer’s credit worthiness and lead to a more competitive and efficient credit market.
In the 2017-18 Budget, the Government committed to mandating a comprehensive credit reporting regime if credit providers did not meet a threshold of 40 per cent of data reporting by the end of 2017.
On 2 November 2017 the Treasurer announced that he would introduce legislation for a mandatory regime as it was clear the 40 per cent target would not be met.
The Bill amends the Credit Act to establish a mandatory comprehensive credit reporting regime which will apply from 1 July 2018. The amendments do not require or allow disclosure, use or collection of credit information beyond what is already permitted under the Privacy Act and Privacy Code.
Currently, Australia’s credit reporting system is characterised by an information asymmetry. A consumer has more information about his or her credit risk than the credit provider. This can result in mis-pricing and mis-allocation of credit.
The Bill seeks to correct this information asymmetry. It lets credit providers obtain a comprehensive view of a consumer’s financial situation, enabling a provider to better meet its responsible lending obligations and price credit according to a consumer’s credit history.
The Government expects that the mandatory regime will also benefit consumers. Consumers will have better access to consumer credit, with reliable individuals able to seek more competitive rates when purchasing credit. Consumers that are looking to enter the housing market will be better able to demonstrate their credit worthiness. Consumers that possess a poor credit rating will also be able demonstrate their credit worthiness through future consistency and reliability.
The mandatory regime applies to ‘eligible licensees’ which initially will be large ADIs and their subsidiaries that hold an Australian credit licence. An ADI is considered large where its total resident assets are greater than $100 billion. Other credit providers will be subject to the regime if they are prescribed in regulations.
Eligible licensees are required to supply credit information on 50 per cent of their active and open credit accounts by 28 September 2018. The information on the remaining open and active credit accounts, including those that open after 1 July 2018, will need to be supplied by 28 September 2019.
The bulk supply of information must be given to all credit reporting bodies the eligible licensee had a contract with on 2 November 2017. In this way the credit provider has an established relationship with the credit reporting body and will have an agreement in place on the handling of data to ensure it remains confidential and secure.
Following the bulk supply of information, large ADIs and their affected subsidiaries must, on a monthly basis, keep the information supplied accurate and up-to-date, including by supplying information on accounts that have subsequently opened. This information must be supplied to credit reporting bodies the credit provider continues to have a contract with.
Credit providers that are not subject to the mandatory regime will be able to access credit information supplied under the regime by voluntarily supplying comprehensive credit information to a credit reporting body or becoming a signatory to the PRDE.
The security and privacy of a consumer’s credit information will be preserved and protected. The Bill relies on the existing protections established by the Privacy Act and Privacy Code and the oversight of the Australian Information Commissioner. The Bill also places a new obligation on credit reporting bodies on where data is stored. In addition, the Bill places an obligation on credit providers to be satisfied with the security arrangements of the CRBs prior to supplying information.
ASIC will be responsible for monitoring compliance with the mandatory regime. It has new powers to collect information and require audits to confirm the supply requirements are being met. ASIC will also have the ability to expand the content to be supplied under the mandatory regime and prescribe the technical standards for the format of the information.
The Treasurer will also receive statements from large ADIs, their affected subsidiaries and credit reporting bodies to demonstrate that the initial bulk supply requirements, as well as the ongoing supply requirements, have been met.
The mandatory comprehensive credit regime, implemented by this Bill, recognises that industry stakeholders have already taken a number of steps to support sharing comprehensive credit information. This includes the PRDE and supporting ARCA Technical Standards.
The mandatory regime includes the ‘principles of reciprocity’ and the ‘consistency principle’ that have been developed by industry. To the extent possible, the mandatory comprehensive credit reporting regime operates within the established industry framework but also provides scope for future technological developments.
An independent review of the mandatory regime must be completed by 1 January 2022. The review will table its report in Parliament.
