Consumer Council Submission to The Office of the Privacy Commissioner for Personal Data on "The Sharing of Mortgage Data for Credit Assessment"

1. The Consumer Council (the Council) is pleased to submit its views concerning the consultation document issued by the Office of the Privacy Commissioner for Personal Data (PCPD) on sharing of mortgage data for credit assessment in Hong Kong.
2. This submission sets out the concerns that consumers may have in relation to the financial services industry's proposal (the proposal) of greater sharing of mortgage data for general credit assessment and the Council's responses to the issues raised in the consultation document, for the consideration of the PCPD.

General views

3. The objective of the proposal as stated in the consultation document is to promote responsible lending by credit providers and responsible borrowing by consumers, thereby reducing the risk of over-leveraging on residential or non-residential property mortgages as security for the consumers' indebtedness.
4. The Council appreciates the public interest to be served in preserving the stability of Hong Kong's financial markets and the economy as a whole. However, it is equally important to strike an appropriate balance between the public interest and an individual's interests in data privacy and protection.
5. The Council is of the view that the proposed expansion of consumer credit data sharing has wider implications for consumers as far as their valuable financial assets and personal assets are concerned and go beyond simply enhancing the assessment of credit risk.
6. The Council feels that in considering the proposal, there are important areas that the industry and the regulators need to address in order to have a complete and fair evaluation of the proposal.

Issue 1 - Types of mortgage loans to be covered

7. From a consumer protection perspective, the Council is of the view that the proposal to extend the scope of sharing of consumer credit data to cover additional mortgage data, namely, positive mortgage data in respect of residential properties, and both positive and negative mortgage data in respect of non-residential properties, will inevitably increase the range of information in the consumer credit reporting system.

Concerns over data concentration

8. Given the problems that arose in the past of leakage of personal information that used for marketing purposes, consumers will be concerned as greater disclosure and use of consumer credit data will put their information at risk of abusive use, to the detriment of their interests.
9. The Council is concerned that too much consumer mortgage data than necessary is to be disclosed by credit providers to the credit reference agency (CRA) to the disadvantage of consumers, particularly since the credit reference database will be a lucrative source of marketing information.

Justifications for inclusion of additional mortgage data

10. Notwithstanding the above concerns, the consultation document does not clearly demonstrate the extent of problems, for instance, whether there is a substantial number of consumers causing the purported problems of holding multiple properties or identify the root cause of the problems which call for the inclusion of all mortgage loan types in the CRA database.
11. The Council is concerned that requiring the sharing of credit information to the extent proposed by the industry may expose a majority of consumers to unnecessary detailed scrutiny. The industry should explain more on the need of including all mortgage loan types, in light of the statement in Part IV of the industry's proposal that "a predominant element of mortgage loans is residential loans which typically represent the largest borrowing of a private individual". The industry should also go into the anticipated impact of greater sharing of mortgage data to the property market.

Issue 2 - Types of data to be contributed by credit providers to the CRA and to be accessed by credit providers: Positive and Negative

12. The Council acknowledges that the industry has taken into consideration public concern by limiting the types of data items to be contributed and accessed under the proposal.
13. The Council considers that a solution may be needed to help develop a healthy mortgage lending environment conducive to the stability of Hong Kong's financial markets and the economy as a whole. To strike an appropriate balance between the public interest and data privacy interest of consumers, the collection of mortgage data should be kept to the minimum necessary, with safeguards (such as upon the credit applicants' written consent) in place to prevent information from being misused.

Public assurance on the extent of data sharing

14. Whilst noting that the proposed data sought represents a minimum amount of data necessary for the purpose of assessing the credit risk of consumer credit applicants, the Council is concerned that the sharing would open up the floodgate and that the coverage of the data sharing will progressively extend to collection of more mortgage loan data. One would recall the industry's promise back in 2002 of not including positive residential mortgage data when lobbying for extending the range of positive consumer credit information.
15. In light of such background, the Council strongly requests that a public assurance be given by the industry that use of the proposed data will be restricted to provision of the proposed items of contributed data by credit providers to the CRA and the access of only the Mortgage Count by credit providers from the CRA, which represents the purpose(s) for which the data are collected and used.

Effect of Mortgage Count on credit score

16. As regards the use of Mortgage Count by credit providers and the CRA, the Council urges that the industry and the CRA to clarify the implication of the additional mortgage data would have on consumer credit scoring. For instance, whether a high count of outstanding mortgages would simply in itself be construed as a high risk factor in the compilation of credit scores.
17. The Council is concerned that the use of Mortgage Count may result in a "mislabeling" of an individual's credit-worthiness, since a high or low Mortgage Count has no direct bearing to the extent of his indebtedness, and simply looking at a high Mortgage Count may adversely affect his credit standing. Putting into the credit database information that will have any labeling effect on consumers should be critically examined. In any case, greater transparency of the consumer credit scoring system is required to ensure a fair credit assessment will be conducted.

Minimum amount of Contributed Data

18. To be in line with the principle that data should be kept to the absolute minimum necessary to fulfill the purpose(s) for which they were collected, the Council considers that the proposed Contributed Data in respect of items (c) and (g) should be adjusted to limit the amount of mortgage loan data provided to the CRA. For instance, it may not be necessary to supply the full HKID Card number or the mortgage account number to the CRA.

Issue 3 - Contribution of pre-existing mortgage data by credit providers to the CRA

19. With regard to the industry's view that there is no need to obtain the explicit consent of the customers as the additional mortgage data are to be used for a lawful purpose directly related to the core activity of credit providers and the original purpose for which they were collected, even in the absence of prior notification. The Council is unable to concur with the said industry view.

Prior explicit notification must be given

20. The industry's interpretation of "directly related purpose" is in a much broader context than what the public may have perceived. The Council shares the PCPD's view that it may not be within the reasonable contemplation of consumers that data in relation to their pre-existing mortgages and mortgage loan applications would be disclosed to the CRA for consumer credit data sharing.
21. An analogy can be drawn from the lesson learnt in the Octopus Rewards incident with the consuming public astonished to find that their data had been transferred and sold for purposes beyond what they could have reasonably contemplated. It also came as a surprise to the public that some banks had transferred and sold their clients' credit data to third parties other than for banking purposes.
22. In view of rising public demand for adequate privacy protection for consumers, the Council therefore sees it necessary to give prior explicit notification to consumers for the additional mortgage data in respect of pre-existing mortgages to be contributed to the CRA when the proposal is implemented. The notification should clearly spell out the purpose(s) for which consumers' personal data are to be used, and be presented in a font size easily readable to consumers.

Enabling consumers to retain control of personal data

23. Apart from consumers being informed of the use of the data, the Council considers that adoption of a consent-based approach is appropriate to uphold the individual's rights to control his personal data. A consumer, being the subject of the additional mortgage data concerned, should have the right to choose whether to allow his data to be shared. The Council is of the view that choice should be made available to applicants applying for a consumer credit facility before their mortgage data are contributed for sharing.

Issue 4 - Use of Mortgage Count for general credit assessment on or after implementation of the industry proposal

24. While understanding that expanding the scope of mortgage loan data will give a full picture of a borrower's overall indebtedness for prospective lenders to accurately assess his credit-worthiness, the Council queries whether such sharing of additional mortgage information is necessary for evaluation of loan applications other than mortgages, e.g. new consumer credit applications, or for review and renewal of the consumers' existing credit facilities.

Level of disclosure should be in line with degree of credit risk

25. As stated in the consultation document, the total value of outstanding residential mortgage loans as of 30 June 2010 exceeded HK$679,545 million which is much larger than credit card lending with the total amount of receivables exceeding HK$74,463 million for the same period. The size of non-mortgage credit facilities to be considered by credit providers is relatively small compared to the size of mortgage loans.
26. For that reason, the Council doubts if the availability of mortgage data is absolutely necessary for the purpose of processing, for example, an application for credit card involving a relatively small amount of credit facilities compared to mortgage loans.

Issue 5 - Transitional period

27. The industry has proposed a transitional period of 24 months before allowing access to the additional mortgage data for the purpose of general portfolio reviews. The Council is of the view that if the industry's proposal to extend the range of data is adopted, a transitional period of 24 months at the minimum would be required. Consumers should be given the chance to manage and re-arrange if necessary their credit portfolio during the transitional period when any mortgage data collected by the CRA could not be accessed and used.

Prevention of calling up loans

28. The Council believes that imposing a transitional period helps forestall the occurrence of sudden calling up of loans which may have a significant impact on the economy. It therefore urges that credit providers should give sufficient time for their borrowers, in particular those who have heavily over-borrowed and would need to work out a realistic repayment schedule with their lending institutions. This will serve the stated objective of the proposal of maintaining the stability of Hong Kong's financial markets.

Clarification of access conditions

29. The consultation document proposes restricting credit providers from accessing and using the data concerned for the purposes of review of existing credit facilities of borrowers except where there is a relevant need to do so. It is however not clear as to the circumstances (e.g. when a direct request is made by an individual or when the credit provider becomes aware of an individual's financial difficulties) in which the credit providers can have immediate access and use of mortgage data during the transitional period.
30. To avoid uncertainty, the Council suggests that the circumstances should be made specific rather than left to the judgment of credit providers, to allow access during the transitional period only where a customer is applying for new credit or seeking a debt restructuring.

Issue 6 - Implementation safeguards

31. As regards the proposed compliance audit, the Council supports the PCPD's proposals to require the CRA to carry out an independent privacy compliance audit within 6 months after implementation of the proposal and also periodic IT security audits. It also supports that those audits should not be limited to the credit database system but should also apply to the relevant stakeholders involved in the system including the staff of the CRA and the credit providers that interface with the system to prevent abusive access.
32. Apart from the above, the Council considers that adequate data protection safeguards and restriction should be put in place to ensure the protection of the consumers' privacy interests, if the industry's proposal is adopted. The Council sets out in the subsequent paragraphs a number of proposed additional privacy safeguards for the consideration of the PCPD.

Disclosure of compliance results

33. Due to the wide range of consumer credit data held in the hands of a single CRA, there is high expectation of rule compliance. The Council is of the view that it is necessary to take a positive approach to ensure the integrity and security of the data that there is no misuse of the data. The Council therefore invites the PCPD to consider making the compliance results available for the public's information.
34. As far as the Council is aware, the HKMA discloses the state of compliance of the banking industry with respect to the Code of Banking Practice for the public's information. The Council believes the PCPD making similar disclosure will help to enhance public confidence in the operation of the credit reference agency and the credit reporting system.

Transparency is needed both ways

35. In relation to the argument advanced by the industry that credit providers are handicapped by the lack of mortgage data in their assessment of consumer credit applications, the Council is of the view that consumers likewise are disadvantaged because they understand very little about the consumer credit reporting system, and are not given to know how their information is being portrayed to credit providers.
36. As a matter of fact, consumers rarely know about or check what goes into their own credit reports until after they have been turned down or otherwise encountered a problem. The Council believes that enhancing transparency of the consumer credit reporting system is of paramount importance to ensure a fair credit assessment.

Provision of free consumer credit report

37. The Council believes that there is the need to impose additional privacy safeguard obligations upon the CRA and the credit providers (particularly since the regulatory requirements applicable to different financial institutions are not homogenous) upon implementation of an enlarged credit database and greater sharing and use of the mortgage data. The Council re-iterates its proposal in previous submissions that consumers be provided with free access to their credit report on a regular basis.
38. Whilst citing the comprehensive consumer credit data sharing arrangements in other economies to support their case for greater sharing of mortgage data in Hong Kong, the industry has not disclosed the safeguards available in these economies to protect consumers' privacy interests.
39. Upon a quick search, the Council found that consumers in Australia are entitled to free copies of their credit reports. In the US and Canada, consumers can get free annual copies of their credit reports. To the knowledge of the Council, the provision of free credit reports is stipulated in these countries' privacy laws. In contrast, Hong Kong's access fee ($99-$200 for a credit report) would discourage consumers from checking their reports to ensure accuracy of the information contained. The Council trusts that the industry and the CRA should be able to give thorough information to the public about means to access consumer credit reports in other jurisdictions.
40. The Council considers that consumer rights will be greatly enhanced if measures are introduced for consumers to have free copy of their credit report on an annual basis. With the provision of credit reports with data requestor list included, consumers will be in a better position to know whether or not information in their report is complete and accurate, and whether there has been any abusive access.

Posting of dispute statement

41. Furthermore, consumers should be allowed to add a brief statement about any information in their report if there has been a dispute over their credit status and the dispute is not resolved. The brief qualifying statement will afford consumers the chance to explain the circumstances giving rise to negative information in their consumer credit report.

Other comments

42. The Council appreciates that the PCPD has taken the initiative to also highlight in the consultation document not data privacy-related matters to convey a bigger picture for the relevant privacy matters to be considered by the general public. In advocating for consumer interests, the Council would like to provide the following views for the consideration of the PCPD.

Respective roles of lenders and borrowers

43. Whilst recognizing that borrowers have the responsibility and obligation to provide relevant information to facilitate prudent lending in a healthy lending and borrowing relationship, the Council believes it is crucial for the lenders to take on an equal share of responsibility in ensuring prudent lending. However, the Council notes it is quite common in the industry for lenders to encourage over-borrowing by consumers, as evidenced in the offer of tax loans (e.g. X times the tax amount payable).
44. The Council is of the view that prudent lending is a prerequisite for preserving a healthy lending environment in Hong Kong.

Effectiveness of the proposal in bringing benefits to consumers

45. With regard to the effectiveness of the proposal in bringing about more favourable loan terms and pricing to consumers, the Council's surveys on tax loans were quoted in the consultation document to illustrate that reduced interest rates were offered after the introduction of the positive credit data sharing on unsecured lending. It is quoted that the tax loans were as low as 1.62%-2.66% in 2009 which compared favourably with the rates of 3.20%-8.16% in 2004. The Council would like to point out that it had not come to any conclusion in its survey reports what would have brought about lower interest rates, let alone any relationship between interest rates and the sharing of consumer credit data.
46. Further, to put record right, the interest rates for a $100,000 tax loan reported by the Council should be in the range of 2.58%-7.48% in 2009 (instead of 1.62%-2.66% as stated in the consultation document) as compared to 3.20%-8.16% in 2004. If the range quoted was meant to compare the respective lowest interest rates, the ranges should be as low as 1.62%-2.66% in 2009 and 2.12%-3.65% in 2004 (instead of 3.20%-8.16% in 2004 as quoted in the consultation document).
47. The industry has made repeated representations that the sharing of credit data will provide benefits to consumers (such as bring about lower interest rates). The Council urges upon the PCPD to seek from the industry explanation of consumer benefits in more explicit terms to demonstrate how the benefits to lenders of sharing mortgage data will be passed on to consumers.