1. The Consumer Council is pleased to respond to the public consultation paper on the revision of the Code of Practice on Consumer Credit Data (the Code) by the Office of the Privacy Commissioner for Personal Data (PCO).
2. In this submission, the Council directs its response to the three categories of amendments proposed by the PCO:
- amendments to provide a broader basis for credit assessment;
- amendments relating to data of discharged bankrupts; and
- miscellaneous amendments.
Amendments to provide a broader basis for credit assessment
3. The PCO, states that in light of demand from financial regulators and the consumer credit industry for relaxation of the restrictions under the Code it is proposed to
- extend the period of retention of credit application data and file activity data by a credit reference agency, respectively from 90 days and 12 months to 5 years;
- allow the release of file activity data by a credit reference agency to credit providers; and
- prevent credit providers from accessing an individual's data held by a credit reference agency except where there is a relevant need to do so.
4. It is stated that the rationale behind the above proposals is to make available to lenders a greater range of data to enable better credit assessment. The consultation paper cites the growing undesirable trends in consumer lending as support for the need for more vigorous credit assessment.
5. Notwithstanding the stated justifications, the Council is of the view that there are many reasons that can contribute to an increase in delinquencies. For example, the recent economic downturn and aggressive marketing strategies, such as pre-approved applications.
6. There may be some merit in extending the retention and disclosure of certain consumer credit information. However, the Council reiterates its view that problems of increased delinquency by borrowers should not be viewed solely as a consumer problem that requires them to sacrifice their rights in the interests of promoting commercial benefits. The industry also bears some collective responsibility to the problems that arise. Clearly, a balance needs to be struck between the privacy rights of individuals and the interests of credit providers and the wider economy.
7. The Council accepts that some relaxation can be made to the code requirements. However, they should be on the condition that there are adequate safeguards in place to protect the information from being misused.
Appropriate Retention Period
8. The Council has concerns over extending the retention period from 90 days to 5 years.
9. Extending the retention period of credit application data and file activity data to 5 years would increase the store of centralized personal information on consumers in the hands of one credit reference agency. However, there are no statistics provided to support a correlation between the availability of a greater range of data, and a reduction in the delinquency rate.
10. Furthermore, Mr. Tony Lam, the Deputy Privacy Commissioner for Personal Data, was recently quoted in the press [1], when referring to Australian practices, that while the collection, retention and disclosure of 5 years of credit data to credit providers in that country helped better credit assessment, the practice did not demonstrate any reduction in bad debts.
11. The Council therefore queries the notion that simply relaxing the restrictions will improve delinquency rates. It considers that credit providers also have an important part to play in lowering delinquency rates, such as adopting a more prudent approach in the granting of loans.
12. In the absence of data that clearly correlates a lowering of delinquency rates with data retention, the Council considers that moving from 90 days to 5 years is excessive, and that an intermediate approach may be more appropriate. The Council suggests the period of retention of credit application data should be extended from 90 days to 1 year instead of 5 years. In these circumstances the industry will be able to gauge what incremental advances have been made in delinquency rates, that indicates a correlation between the two, and on which further time periods can be considered.
Releasing file activity data
13. The consultation paper also proposes allowing the release of file activity by a credit reference agency to credit providers, and preventing credit providers from accessing an individual's data held by a credit reference agency except where there is a relevant need to do so.
14. The consultation paper does not provide any reason for increasing the categories of data to be made available to credit providers other than noting:
"it has been suggested that credit providers should have available to them a greater range of data to enable the assessment of credit risk in relation to a particular credit applicant subject to appropriate safeguards. In particular, it has been suggested that aside from default data, both credit application data and file activity data will have substantial reference value to a credit provider considering a credit application". (paragraph 2.5 of the consultation paper refers).
15. The Council is concerned that the justification for this expansion of data collection is based simply on "suggestions" made to the PCO without, it appears, any evidence being put forward that the release of file activity and application data will assist in alleviating any problems with delinquency rates.
16. The Council has made detailed submissions in the past, arguing against proposals to allow for the collection of positive credit data, as distinct from negative credit data. It is concerned that the proposal relating to file activity and application data is an attempt to introduce positive data collection incrementally, by beginning with seemingly innocuous data such as file activity and application data.
17. The Council does not consider that the proposal to release file activity and application data in order to enable the better assessment of a credit application has been justified in the reasons put forward in the consultation paper. Given the absence of evidence in the paper to satisfy the basic 'need to know' principle that should govern privacy concerns, the Council cannot support the proposal.
18. The consultation paper notes that a new clause 3.1 will be added to prevent credit providers from accessing an individual's data held by a credit agency "except where there is a relevant need to do so". The stated aim of this provision is to prevent the generation of unnecessary file activity data, which if generated could lead to an adverse inference in a credit assessment on an individual by another credit provider
19. It is not clear from the consultation paper how the term 'relevant need' is defined, nor what safeguards will be in place to ensure that a query on an individual's data is relevant. Given the:
- possible detrimental consequences to an individual's credit assessment from excessive file activity data (which is acknowledged in the consultation paper); and
- lack of clarity on the definition of 'relevant need' and safeguards to prevent unnecessary requests for data,
the Council is reaffirmed in its view that file activity and application data should not be collected and made available to credit providers.
Amendments relating to data of discharged bankrupts
20. The Consultation Paper notes that the Bankruptcy Ordinance was amended to introduce a new section, under which a bankrupt will in most cases be automatically discharged upon the expiry of a normal period of 4 or 5 years.
21. To cope with such changes in the law, the PCO proposes making amendments in the Code to address problems regarding data held by a credit reference agency in respect of an individual who has been automatically discharged from bankruptcy under the new section. The proposed amendments are as follows:
- obliging a credit reference agency to delete from its records default data relating to a discharged bankrupt within 5 years from the date of the discharge;
- stipulating that a discharged bankrupt furnish a certificate of discharge as proof to a credit reference agency; and
- providing automatic deletion of public record about an individual's bankruptcy by a credit reference agency within 7 years, irrespective of whether there has been actual discharge.
22. The Council supports the PCO taking steps to address data accuracy problems by stipulating in the Code a requirement for the deletion of the fact of bankruptcy, and default data by a bankrupt within a certain period of time.
23. The Council notes that the onus of notification of bankruptcy discharge to a credit reference agency will rest on an individual. For the purpose of convenience, there may be merit in requiring the individual to notify a credit reference agency. However for the sake of clarity, the Council believes that as a matter of principle, there should be an onus on a credit reference agency to, wherever practicable, verify the accuracy of data for the use of its client credit providers.
24. The Council recognises, however, that it is to an individual's own advantage that any outdated credit reports should be amended, as they may jeopardise credit worthiness. The Council agrees that public education of bankrupt persons is necessary in this respect.
Miscellaneous amendments
25. The PCO proposes that to bring better protection to the interests of individuals and to alleviate certain operational difficulties encountered by the consumer credit industry, the following amendments be introduced:
- requiring credit providers to provide notification of "any payment etc" to a credit reference agency "as soon as reasonably practicable";
- providing for access or correction by a credit applicant of current data held on him by a credit reference agency; and
- providing for the review of a credit decision by a credit provider based on such corrected data.
Notification of payment
26. It is stated in the Consultation Paper that replacing the requirement of "prompt" notification to credit reference agency by "as soon as reasonably practicable", removes a requirement on credit providers that is too onerous an obligation, and the compliance of which is impractical.
27. While this amendment seems acceptable on its face, the definition as to what is 'reasonable' is a subjective term with different meanings for borrowers and lenders, and far less clear than 'prompt'. Because delays in notifying payments could cause consumers hardship and aggravation, the Council suggests that the term should be amplified in a way that gives some guidance as to what is 'reasonable'.
28. For example, the term could be recast to read:
"as soon as is reasonably practicable, having regard to accepted standards of information transfers undertaken by the credit provider with regard to information that is of benefit to the credit provider."
29. The Council welcomes the proposal of providing access or correction by a credit applicant to data held on him by a credit reference agency, so that an updated credit report can be made available to a credit provider for reviewing its credit decision. However, the Council would be concerned if this new right by credit applicants is viewed as somehow reversing any onus on credit providers from ensuring that its obligations to ensure data is correctly maintained.
30. In addition, the Council has received complaints from consumers that when they have approached the credit reference agency for access to their data, they were asked to pay a handling fee of HK$150. The Council is concerned that on the one hand, individuals will be given increased access rights but on the other hand, individuals as data owners will have to pay for that right. The concern is heightened if the review of procedures under the Code leads to a position where more responsibility is placed on borrowers to notify the credit reference agency of information, and to ensure the accuracy of reports.
Remarks:
1. Hong Kong Economic Times, 7 March 2001.
