Submission - Credit Reporting Regulatory Framework: Submission to ALRC Privacy Inquiry (December 2007)

2.7. Direct marketing concerns

Potential consumer harm may arise in the context of the use of credit reporting information for direct marketing purposes. The harm may be in the form of a privacy concern (direct marketing can be a highly unpopular activity with consumers and is considered a significant privacy breach by the majority of the population) or the harm may be more closely associated with consumer detriment resulting from the unsolicited marketing of consumer credit.

For both types of harm there appears to be some industry support for prohibiting the use of credit reporting information for direct marketing. The Australian Retail Credit Association (ARCA), for example, has stated that:

ARCA is absolutely consistent in its view that credit reporting information must not be used or disclosed as a source for acquiring prospects for direct marketing purposes and that a serious breach of this obligation should not only result in a civil penalty but should also include suspension from the future use of credit reporting information.[24]

With this broad consensus in place, the ALRC has proposed a complete prohibition on the use of credit reporting information for direct marketing:

Proposal 53-3: The proposed Privacy (Credit Reporting Information) Regulations should prohibit the use or disclosure of credit reporting information for the purposes of direct marketing.

However, one outstanding concern regards the use of credit reporting data in pre-screened direct marketing campaigns. ARCA has a very different view on pre-screening and states:

The regulation must clarify that pre-screening is an allowable process as it reduces the volume of direct marketing transactions per campaign and helps protect those vulnerable individuals from receiving further offers of credit.[25]

Pre-screening raises both privacy and consumer harm issues and there is a close overlap with concerns regarding unsolicited credit offers.

Pre-screening is based on a technical loophole in existing privacy law. The disclosure of personal information is avoided by providing the screened list to the mailing house (rather than returning it to the credit provider). This arrangement avoids any general breach of the current NPPs.

There are more specific restrictions on the use of credit reporting information by credit providers contained in Section 18L of Part IIIA of the Privacy Act 1988. Indeed, under Section 18L a credit provider would be committing a criminal offence if it used credit reporting information for a purpose not listed in the section (and direct marketing or pre-screening are not listed). However, the industry avoids these offence provisions because the use of the credit reporting information is conducted by the credit reporting agency, not the credit provider. Section 18L does not extend to credit reporting agencies.

Despite this technical loophole, it would seem to set a risky precedent to allow the practice to continue. It is possible to think of examples where pre-screening could be used in other sectors, and if the credit reporting database can be used to ‘filter’ direct marketing campaigns then virtually any database could be used for a similar purpose.

An additional concern is that all of this activity occurs without the general knowledge of the community that it is occurring, and pre-screening would be well outside the expectations of the specific consumers whose data is being used in this way. Again, this sets a risky precedent for other sectors.

Some potential regulatory options include:

  • Apply UPP 5
    It is possible that pre-screening is a breach of UPP 5, as it is a use of the personal information (whether or not it is a disclosure) that is outside the expectation of consumers and there has been no notice or consent. This appears to be a sound argument – hence the industry request that pre-screening should be specifically allowed.
  • Prohibit pre-screening in the Regulations
    The practice could be specifically named and prohibited in the Privacy (Credit Reporting Information) Regulations.
  • Allow pre-screening in the Regulations with additional safeguards
    The practice could be specifically named and allowed in the Privacy (Credit Reporting Information) Regulations. However, this may be difficult to justify on public benefit grounds. A compromise would be to allow pre-screening subject to certain additional safeguards. These might include a requirement to offer both a comprehensive and specific opt-out service, complemented by a requirement for specific notice.

The third option is clearly a compromise solution and may be attractive. The comprehensive opt-out service would assist those people who want to opt-out of pre-screening as a ‘use’ of their personal information at the credit reporting agency level. The specific opt-out service would assist those people who do not wish to receive any further pre-screened offers from a specific credit provider. However, it is very difficult to see how either service could work in practice. How will a consumer know that they are receiving a pre-screened offer? How will they know about their opt-out rights? How will the opt-out service work in an environment where there is more than one credit reporting agency?

It is also very important that consumers do not receive a mixed message from the ALRC reforms. If on one hand the use of credit reporting in direct marketing is to be completely and totally prohibited, why then would consumers have to specifically opt-out of pre-screening direct marketing campaigns by contacting a credit reporting agency? Consumers are likely to be confused by the obvious inconsistency between regulations that prohibit the use of credit reporting information for direct marketing, and notices in credit applications that advise them their credit reporting information will be used for pre-screened direct marketing campaigns.

The industry argument is that pre-screening helps facilitate responsible lending. However, the evidence for this is weak. The pre-screened marketing campaigns themselves are often poor examples of responsible conduct. Many of the invitations imply that credit has been pre-approved (some campaigns even include a sample plastic credit card with the target consumer’s name embossed on the front of the card). The marketing material contains little information about the risks of credit. Application forms are typically very brief and provide insufficient space for a person to list details of all of their liabilities – they are certainly shorter than the application forms available in branches for the same products.

It is possible that if the material was not pre-screened the credit providers would have to be more cautious in the language and forms used in such campaigns to avoid risking the embarrassment and reputation damage of rejecting applications from a large number of consumers who had initially believed the ‘pre-approved’ marketing. A more cautious approach to the marketing of credit may have a greater impact on responsible lending than the questionable impact of pre-screening.

It is important to remember that pre-screening does not remove or replace the requirement for responsible lenders to check credit reporting information at the time of application. It would appear that the most significant impact of pre-screening is to save marketing costs, reduce applications that are likely to be rejected, and to reduce environmental waste. Without a clear link to responsible lending, there is no justification for making a special case for credit providers to avoid the full coverage of UPP 5 in their marketing campaigns.

This Report concludes that pre-screening is contrary to both the requirements and spirit of privacy law (in particular UPP 5) and contrary to the proposed ALRC prohibition on the use of credit reporting information for direct marketing purposes. In order to avoid sending mixed messages to consumers on the use of credit reporting information in direct marketing, pre-screening should be specifically included in the direct marketing prohibition in the proposed Privacy (Credit Reporting Information) Regulations.

However, it may be necessary to consider pre-screening hand in hand with the regulation of responsible credit marketing. For example, if there was an Australian regulatory initiative on the responsible marketing of credit that helped to address this long list of concerns, support for pre-screening might improve. Unfortunately, there is no regulation of responsible credit marketing in Australia at this time. Further details are in this Report at Section 2.15 (page 32).

[24] Australasian Retail Credit Association, The ARCA response to the Review of Australian Privacy Law Discussion Paper 72 undertaken by the Australian Law Reform Commission (ALRC), 3 December 2007.

[25] Australasian Retail Credit Association, The ARCA response to the Review of Australian Privacy Law Discussion Paper 72 undertaken by the Australian Law Reform Commission (ALRC), 3 December 2007.