Submission - Credit Reporting Regulatory Framework: Submission to ALRC Privacy Inquiry (December 2007)

2.9. Complaints and External Dispute Resolution

Complaints handling in credit reporting is a significant issue with a long history of concern. Virtually all parties in the credit reporting environment are unhappy with the way complaints have been managed in recent years.

The ALRC proposals in DP72 appear to have wide support and may help to address these concerns.

However, the main issue is that consumer caseworkers have lost confidence in the Office of the Privacy Commissioner (OPC) as both the industry regulator and the key complaints handling body for credit reporting. Some advocates argue that the OPC should not have both roles. However, solutions to this issue are complex and may cause more problems than they solve.

This is an issue where the solution may require an acknowledgment that caseworker concerns are real as a first step. This acknowledgment is missing from both the DP72 and the OPC Submission to IP32. This Report notes it is a significant issue that neither the OPC nor the ALRC appear to acknowledge that there has been a problem in complaints handling.

Following such an acknowledgment, all parties may be able to commit to ongoing improvements to complaints handling processes, built on the ALRC recommendations as a foundation.

Consumer caseworkers have raised issues with complaints handling in credit reporting in submissions to multiple inquiries over a long period.[27] It is important to recognise that a typical consumer casework agency deals with dozens of different regulators and EDR schemes. They have consistently and unanimously rated the OPC complaints handling process for credit reporting as unsatisfactory. A breakdown of confidence in a regulator is rare in the Australian consumer sector. These issues should not be dismissed lightly, and the lack of confidence in the OPC is likely to have an ongoing impact on the regulation of credit reporting in Australia.

The current views of consumer caseworkers are well summarised in the following extracts:

With limited resources, there is always a tension between undertaking individual complaints handling and working to address broader, systemic issues. Neither function, however, should be ignored. The difficulty for the consumer is that unlike other privacy breaches, credit reporting involves the individual and at least two organisations with the individual’s personal information. Hence, the ‘respondent to the complaint’ is not easy to identify. The practice of the OPC upon receipt of these complaints is to take a vary narrow, and possibly incorrect, view of the provisions of the Act and Code, and refer the consumer to the relevant credit provider before it will take the complaint, even though the consumer has already complained to the CRA... There is a clear need for major change to the culture and practices of the OPC. The OPC should also review its approach to the acceptance of credit reporting complaints, particularly where the complainant has already complained to the relevant CRA.[28]
Consideration of the credit reporting provisions must take account of views both on the adequacy of the complaints and enforcement provisions and on the fifteen years experience of how those provisions have been used in practice. Further, failure of successive Privacy Commissioners to adequately address systemic non-compliance, and their willingness to make Determinations and issue advices that favour wider business use of credit information, seriously undermine confidence that any further discretion should be given to the Commissioner.[29]

On the positive side, the proposed UPPs and the proposed Privacy (Credit Reporting Information) Regulations will be simpler and easier to implement than existing rules, so complaints should be reduced and those complaints that do reach the EDR schemes and the OPC should be simpler.

The ALRC proposals also include significant enhancements for complaints and EDR, and credit reporting agencies will take on a greater share of responsibility for the management of complaints. Some of the key enhancements include:

  • Shifting the burden of proof to credit providers and imposing time limits
    Proposal 55-7: The proposed Privacy (Credit Reporting Information) Regulations should provide that credit providers have an obligation to provide evidence to individuals and dispute resolution bodies to substantiate disputed credit reporting information, such as default listings, and that if the information is not provided within 30 days the credit reporting agency must delete the information on the request of the individual concerned.
  • Mandating membership of an EDR scheme
    Proposal 55-6: The proposed Privacy (Credit Reporting Information) Regulations should provide that credit providers may only list overdue payment information where the credit provider is a member of an external dispute resolution scheme approved by the Office of the Privacy Commissioner.
  • Ability to require the OPC to make a determination
    Proposal 45-5 (b): Where, in the opinion of the Commissioner, all reasonable attempts to settle the complaint by conciliation have been made and the Commissioner is satisfied that there is no reasonable likelihood that the complaint will be resolved by conciliation, the Commissioner must notify the complainant and respondent that conciliation has failed and the complainant or respondent may require that the complaint be resolved by determination.
  • Clear right of appeal from OPC determinations
    The ALRC concludes that the current rights to merits review of determinations are not sufficient. They propose (Proposal 45-7) that the Privacy Act 1988 should be amended to provide that a complainant or respondent can apply to the Administrative Appeals Tribunal for merits review of a determination made by the Privacy Commissioner under Section 52. Obviously the strength of this proposal relies heavily on the ability of consumers to receive a determination in the first place.

However, it should be made clear that the ALRC proposals in DP72 will not fix complaint handling problems overnight. For example, there have been very long lead times before the involvement of EDR schemes had a significant impact on systemic issues in other sectors (e.g. telecommunications). Regular reviews, EDR summits, and reports on systemic issues will be required in order to achieve effective reform.

In addition, some further enhancements will be required to enhance consumer confidence in the complaints handling process and the key regulator – the OPC. These might include:

  • Improved links between systemic complaints and access to credit reporting information
    Where a credit provider or another party (e.g. an assignee) is the subject of consistent complaints that indicate systemic issues, their access to credit reporting information should be suspended so that the damage they can do to consumers or to the accuracy of data can be limited. This will also act as a disincentive for poor conduct.
  • Allowing and encouraging the OPC to accept a complaint that is yet to be referred to the respondent
    The requirement for complainants to first submit their claim to respondents is a highly bureaucratic requirement that unfortunately has been liberally applied by the OPC in the past.[30] It has a significant impact on consumers and has probably resulted in many consumers walking away from the complaints process entirely. The approach is very difficult to justify and is inconsistent with modern approaches to complaints handling. The OPC is just as well placed as the complainant to send the complaint to the respondent and this requirement makes no allowance for the needs of disadvantaged and confused consumers. This issue will not be solved by further information on complaints handling (as suggested by the ALRC in DP72 and by the OPC in the OPC Submission to IP32). Concerns about complaints volumes can be allayed by the effective management and referral of complaints to appropriate EDR providers – but consumers should not be turned away if their first port of call in this complex environment just happens to be the OPC.
  • Limiting OPC discretion not to investigate a complaint
    In DP72, the ALRC proposes that the OPC should be given ‘more discretion not to investigate complaints, including where an EDR mechanism could handle the complaint’. It is to be hoped that this statement refers only to situations where the OPC may use their discretion to refer a complaint to a more appropriate EDR provider, rather than expanding their general discretion not to investigate complaints at all. It is a discretion that is already widely used by the OPC with significant negative effects for consumers. The ALRC also hopes to ‘free up the Privacy Commissioner from dealing with individual complaints to enable more of a focus on systemic issues’. However, the experience of consumer caseworkers is that the OPC uses its discretion to not investigate complaints specifically as a tool to not investigate systemic complaints.
  • Bringing forward the review to 3 years
    The ALRC has proposed that the credit reporting regulatory arrangements should be reviewed after 5 years. In an environment where there are significant concerns about complaints handling processes and culture this review will need to be brought forward. This Report proposes bringing the review forward from 5 years to 3 years.

Overall, we believe there is a real risk that in three to five years time consumers will still be unhappy with the complaints process unless there is a significant change in the approach of the OPC. The other ALRC proposals and enhancements are all worthwhile, but the OPC remains at the centre of credit reporting complaints management and simply must take a more flexible, proactive role and assist in removing technical and bureaucratic obstacles to effective dispute resolution. 

[27] Refer, for example, to Consumer Action Law Centre, Submission to the Productivity Commission Inquiry into Australia’s Consumer Policy Framework, June 2007, <>.

[28] Consumer Action Law Centre, Review of Privacy – Credit Reporting Provisions Submission in response to Issues Paper 32, 30 March 2007, <>.

[29] Australian Privacy Foundation, Review of Privacy – Credit Reporting Provisions Issues Paper 32 – Submission to the Australian Law Reform Commission, March 2007, page 3, <>.

[30] Corker J and Bond C, The merry-go-round: credit report complaint handling under the Privacy Act, Privacy Law and Policy Reporter vol 43, 2001, <>.