Submission - Credit Reporting Regulatory Framework: Submission to ALRC Privacy Inquiry (December 2007)

2.10. Sanctions, compensation and redress

This section discusses concerns regarding the effectiveness of sanctions to change industry practice and the availability of redress and compensation for consumers.

There appears to be a general consensus in submissions and in DP72, that criminal offences should be removed from the credit reporting regulation. A more effective sanctions and remedy regime can be delivered by civil penalties, supplemented by the ability to restrict access to credit reporting information for those organisations who engage in systemic breaches.

The location of the civil penalties regime should be in the proposed Privacy (Credit Reporting Information) Regulations. The OPC should also have the ability to make specific orders in determinations to limit access to credit reporting information where organisations are found to have engaged in a systemic breach. This is possibly already covered by the DP72 proposal on systemic issues:

Proposal 45-6: Section 52 of the Privacy Act should be amended to empower the Privacy Commissioner to make an order in a determination that an agency or respondent must take specified action within a specified period for the purpose of ensuring compliance with the Act.

However, it may be useful for the industry to have a self-policing role in addition to the sanctions available in the Regulations. For example, the ability to limit access to credit reporting information where organisations are found to have engaged in a systemic breach might also apply to systemic breaches of the potential industry Code. Sanctions could be applied by a Code compliance body, and might include suspension or restricted access to credit reporting information, or requirements for specific performance such as corrective advertising, training, changes to procedures etc.

The inclusion of such sanctions in an industry Code will raise potential competition issues and may risk breaching the Trade Practices Act 1974.[31] The Code may require authorisation by the Australian Competition and Consumer Commission (ACCC) in order to overcome this concern. This issue is discussed in more detail in this Report at Section 3.2.3 (page 47). 

[31] Trade Practices Act 1974 (Cth), <>.