I I }1 • 1.0 1.1 1.2 1.3 Review of the Invasion ofPrivacy Act /971 and the Invasion ofPrivacy Regulation 1998 CONTENTS Executive Summary Review Parameters Title of Legislation Reasons for Review Review Methodology 1.3.1 Public Notification PAGE NUMBER 3-6 7 7 7 7-8 8 I I I I I I 2.0 Overview of the Restrictive Provisions of the Current Legislative Regime 2.1 2.2 9 9 10 10-11 11 11 Invasion ofPrivacy Act 197iand the Invasion a/Privacy Regulation 1998- Legislative Background RestrictiveProvisions 2.2.1 2.2.2 Listening Devices Credit Reporting Agents I I I I I I I I I I I 2.2.3 Invasion a/Privacy Regulation 1998 3.0 Background Information 3.1 3.2 3.3 Background to Privacy Laws Compliance Background Industry Background 11-12 12-13 13-14 14-16 4.0 Legislative Regulations in other Jurisdictions 4.1 4.2 16-17 Commonwealth -Current Industry Coverage of Credit Reporting Agents 17 17-18 4.1.1 Recent Commonwealth Amendments 4.1.2. Legislative Scheme 18 Interstate jurisdictions 19 19 4.2.1 South Australia 19-20 4.2.2 Northern Territory 4.2.3 Victoria 20 20-21 4.2.4 New South Wales 4.2.5 Austrulian Capital Territory, Western Australia and Tasmania zt 5.0 Issues - Assessment of Restrictions on Competition Contained within the Invasion ofPrivacy Act 1971 5.1 Credit Reporting Agents 5.1.1 Licensing (including Geographical) Restrictions 5.1.1 Exemptions from Licensing 5.1.3 Conduct Restrictions 5.1.3.1 Reports 21 21 22 22 23 23 National Competition Policy Public Benefit Test Report ---"--- ------------------------------------- I I • 6.0 6.1 6.2 6.3 6.4 Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 J1 i AM I I I I I I I I I I I (CONTINUED) 5.1.3.2 Record Keeping 5.1.3.3 Disclosure 23 23-24 Identifleation and Assessment of Alternatives to the Restrictive Elements of the Current Legislative Regime Option 1 - Alternative Regulation - Voluntary Code of Conduct Option 2 - Alternative Regulation - Negative Licensing Option 3 - Alternative Regulation - Mandatory Code of Conduct with Negative Licensing Option 4 - Deregulation 6.4.1 Licensing (including Geographical) Requirements 6.4.2 Business Conduct Requirements (including Reports, Record Keeping, Security and Disclosure) 24 24-25 25 26 27 27 27-28 28 29-30 30 31 7.0 8.0 9.0 Consultation Conclusions Transitional Issues 10.0 Recommendation Appendix A I I I Appendix B Consideration of Costs and Benefits of moving from the existing Legislative Regime to the Preferred Option Identified in this Review of Repealing the Credit" Reporting Agents Provisions of the Invasion ofPrivacy Act 1971 Comparison of the Commonwealth Credit Reporting Requirements to Queensland requirements I I 2 National Competition Policy Public Benefit Test Report I I. "--~---------------------------------------! I I I I I I I I I I I I I I I I I I I I • Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 MM ,..... EXECUTIVE SUlVIMARY A review has been conducted on the Invasion of Privacy Act 1971 (lOP Act) and the Invasion of Privacy Regulation 1998 (IOP Regulation) in line with National Competition Policy Guidelines. This document reports the findings of the review. The IOP Act was introduced with the objective of attempting to protect consumers against unwarranted invasions of privacy in specific circumstances. The lOP Act provides for regulation of entry into dwelling houses, the use and supply of listening devices and the licensing and business conduct of credit reporting agents. The lOP Regulation prescribes some licensing exemptions for financial institutions, some administrative guidance and the licence application fee for credit reporting agent licenses. The restrictive provisions identified and assessed in this review are the licensing and business conduct requirements for credit reporting agents in Queensland. The right to privacy is recognised at the International levelland is widely viewed as essential to human dignity and a key value that underpins other key values such as freedom of association and freedom of speech". It is viewed as an integral part of democracy that respects individual liberty. These are the principles that underpin the policy objectives of Government. There are four licensed credit reporting agents under the Queensland lOP Act, three of which report for commercial purposes and one which is the major credit reporting agent in Australia. The Queensland Office of Fair Trading, administering the lOP Act, has received minimal complaints in relation to the business activities of credit reporting agents. The major credit reporting agent in Australia holds a database on credit information for individuals (containing data relating to consumer credit) which is sourced from court and bankruptcy proceedings and from information supplied by financial institutions in relation to previous credit applications, history and infringements. This company holds a major share of the market due to the large amount of" information it has gathered over many years, making it extremely difficult for new entrants to establish themselves in the market. Financial institutions subscribe to the major credit reporting agent for access to their database for the purpose of producing credit reports on individuals applying for consumer credit. These financial institutions are exempt from the licensing requirements, on the assumption that the major credit reporter maintains that database of information, and the financial institute simply has access to it. I Article 12 of the 1948 Universal Declaration of Human Rights and Article 17 of the 1966 International Covenant on Civil and Political Rights 2 Anstralian Privacy Charter issned by the Australian Privacy Charter Council, December 1994 3 National Competition Policy Public Benefit Test Report I I I I I I I I I I I I I I I I I I I I • z Review of the Invasion a/Privacy Act 1971 and the Invasion a/Privacy Regulation 1998 MiM The Privacy Act 1988 (Cth) (privacy Act) contains a Credit Reporting Agents Code of Conduct including eleven Information Privacy Principles. The Privacy Code of Conduct and legislation limits the scope of activities of credit reporting agents and regulates the way personal information can be used, stored and secured, but does not create a licensing scheme, as the Queensland rop Act does. The Commonwealth Privacy Act attempts to ensure information is used only for assessing credit applications and other legitimate activities involved with providing consumer credit. The Privacy Act provides strict limits on what information can be held on a person's credit information file by an agent, limits access to those files and limits the purpose the information obtained from an agent can be used. It also provides that only corporations can carry out the function of a credit reporting agent or provide information to an agent. Other jurisdictions do not provide for licensing of credit reporting agents and only some have provisions in consumer protection laws, which generally regulate the activities of reporting agents. However, since the introduction of the Commonwealth legislation, it has effectively been the Commonwealth who has regulated the activities of credit reporting agents nationally. Queensland is the only jurisdiction who has a positive licensing regulatory regime. All jurisdictions including Queensland forward complaints in relation to privacy issues to the Commonwealth Privacy Commissioner for consideration under the Privacy Act. The restrictive provisions of the Queensland rop Act include licensing requirements (including the geographical requirement that a licensee hold a registered office in Queensland) and business conduct requirements. A potential licensee has to be a fit and proper person and pay the $430 licence fee to be considered for a credit reporting agents licence. No application has been refused in Queensland.. The business conduct restrictions contained in the rop Act include: • • • instructions as to the limited release of reports containing credit information about individuals; deletion of stale records; limits on disclosure of information; and if credit is refused as a result of the contents of a credit report, the agent must provide notice to the person of the refusal and of his or her right to access that information and dispute the accuracy ofthe contents ofthe credit report. The provisions of the Privacy Act cover a much wider range of privacy issues, including most of the business conduct provisions contained in the rop Act. The Privacy Act differs in that the agent is not required to notify a person of refusal, but the person can access his or her file at any time, upon request. The Privacy Act is much more detailed as to the ways credit reporting agents conduct their business. 4 National Competition Policy Public Benefit Test Report I I I I I I I I I I I I I I I I I I I I • Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 iiililli This review considered alternatives to the restrictive elements of the current regulatory regime. It considered whether the alternatives would meet the objectives of the lOP Act, and whether the current regulatory regime continues to meet those objectives. The first option considered was a voluntary code of conduct, where a code of conduct would be developed with contribution from consumer groups, industry and Government. However, the Commonwealth Privacy Act provides for a mandatory Code of Conduct and in reality there is only one major credit reporting agent who could assist in development of a Queensland based Code of Conduct. This option was rejected as a non-viable option. The second option considered was a negative licensing scheme, which would allow anyone to enter the industry; provided they meet predetermined standards. If an agent did not meet the predetermined standards, they could be excluded from operating in the industry. The cost to Government of developing a negative licensing scheme would be medium to high and, as the Commonwealth Privacy Act provides for a mandatory Credit Reporting Agents Code of Conduct, the introduction of a negative licensing scheme would serve no additional useful purpose. Negative licensing will not adequately meet the objectives of the legislation, as it is a reactive approach, which may not prevent invasions to individual's privacy. This option was rejected as a non-viable option. The third option assessed was a mandatory Code of Conduct with negative licensing imposed under the Queensland Fair Trading Act 1989. While it would meet the policy objectives of the legislation, a Queensland Code of Conduct would unnecessarily duplicate the Commonwealth's requirements under the Privacy Act. There would be additional cost associated with developing a Code of Conduct with little benefit to stakeholders. This option was rejected as a non-viable option. The fourth option assessed was deregulation of the Queensland lOP Act. Under this model the only legislative requirements credit reporting agents would be required to meet would be under the Commonwealth Privacy Act. The removal of the licensing requirements, including the geographical restriction, contained in the lOP Act are not likely to impact on competition nor . reduce consumer protection and the business conduct requirements are similar to those contained in the Commonwealth Privacy Act. However, the Privacy Act, while relatively consistent with the lOP Act, is much more specific in most areas, covering a broader range of issues with stricter penalties associated with non-compliance than that contained in the lOP Act. Queensland deregulation would result in a consistent industry-wide reliance on the Commonwealth Privacy Act. The objectives of the Queensland lOP Act are now being fulfilled by the Commonwealth Privacy Act and retention of the lOP Act creates unnecessary duplication and potential confusion to stakeholders and consumers. 5 National Competition Policy Public Benefit Test Report I I I I • Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 !Wi! I I I I I I I I I I I I I I I I The benefit to Queensland licensees, and to new entrants into the market, will include a slight cost saving on licensing fees and the removal of geographical requirements that it hold a registered office in Queensland. It will be a benefit in that repeal of the rop Act and a move to the preferred option will ensure there is one consistent approach to credit reporting. There will be no real cost or benefit to credit providers as they are currently exempt from licensing requirements, but will continue to meet conduct requirements under the Commonwealth legislation. There will be a benefit to consumers in that there is more protection afforded under the Commonwealth legislation and it covers a much broader range of credit reporting issues. A consumer can access his or her information file at any time under the Commonwealth legislation and the information stored on a file will be subject to review at much more regular intervals and stale information will be subject to more rigid review. There will be a cost saving to the Queensland Goverrnnent in that it will not incur administration costs, but may lose some revenue due to the lack of renewal fees being extracted from licensees. Given the consistency between the deregulation model, the policy objectives of the Queensland legislation and Goverrnnent's commitment to efficient and effective regulatory models, the deregulation model is considered the most viable option in providing an overall net benefit to stakeholders. No other Australian jurisdiction positively licenses credit reporting agents and there is no evidence that credit reporting agents behaviour is different in Queensland as a result of licensing. It is unlikely the deregulation model will have any impact on employment and there are negligible incremental costs for the market to achieve the changed state. The deregulation model will involve a small cost to Queensland Goverrnnent in educating licensees about the removal of the credit reporting provisions of the rop Act. Deregulation should not have any impacts on the regional areas of the State, as in reality, credit reporting agents are complying with the Commonwealth requirements. Of the options considered, the deregulation model provides the greatest net public benefit for all stakeholders. The Terms of Reference and this PBT report will be made available to the general public at the· Office of Fair Trading website 'www.fairtrading.qld.gov.au'. A covering letter including the Terms of Reference and the Executive Summary will be forwarded to affected stakeholders. It is recommended that the credit reporting agent provisions of the Invasion ofPrivacy Act 1971 be repealed as its objectives are now being met by the Commonwealth Privacy Act 1988. 6 National Competition Policy Public Benefit Test Report Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 REVIEW PARAMETERS 1.1 TITLE OF LEGISLATION This review considered the following legislation: Invasion ofPrivacy Act 1971; and Invasion ofPrivacy Regulation 1998 I I I I I I I I 1.2 REASONS FOR REVIEW In April 1995, the Commonwealth, State and Territory Governments signed a set of agreements to implement a National Competition Policy (NCP). Under the policy, each participating jurisdiction cornmitted to implementation of a series of competition reforms. Pursuant to these agreements, each participating jurisdiction was obliged to reform, where necessary, all legislation that contained measures restricting competition. The Queensland Legislation Review Timetable3 identified potential restrictions on competition in both the Invasion of Privacy Act 1971 (lOP Act) and Invasion of Privacy Regulation 1998 (lOP Regulation). This review has considered those restrictions in accordance with Queensland Treasury's Public Benefit Test Guidelines4 (Queensland Treasury Guidelines). 1.3 REVIEW METHODOLOGY The guiding principle for the review of legislation, as contained in Clause 5 of the Competition Principles Agreement, is that legislation should not restrict competition unless it can. be demonstrated that: (a) the benefits of the restriction to the community as a whole outweigh the costs; and (b) the objectives of the legislation can only be achieved by restricting competition. In consideringrestrictions contained within the lOP Act and lOP Regulation, the Department I I I I I I I of Tourism, Racing and Fair Trading considered a wide range of issues including fair trading, social justice issues and a balance of the commercial interest of providers and consumers respectively. 3 4 Queensland Government, 1996. Queensland Treasury, 1999. 9i 7 National Competition Policy Public Benefit Test Report I I I I I I I I I I I I I I I I I I I I • • • • Review oftlleInvasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 In accordance with Queensland Treasury Guidelines, a minor review of the lOP Act and the lOP Regulation was conducted within the Legislative Review Unit of the Office of Fair Trading (OFT) of the Department of Tourism, Racing and Fair Trading. A minor review was conducted because: The relevant markets are not large; Restrictions contained in the lOP Act and the lOP Regulation are relatively minor; and The subject matter is not particularly complex or controversial. Clause 9 of the Competition Principles Agreement states that reviews should (a) (b) (c) (d) (e) Clarify the objectives of the legislation; Identify the nature of the restriction on competition; Analyse the likely effect of the restriction on competition and on the economy generally; Assess and balance the costs and benefits of the restriction; and Consider alternative means for achieving the same result including non-legislative approaches. An integral part of the review process was consideration of employment issues, social and economic concerns in the community, and retaining quality of life through promotion of rights of privacy. 1.3.1 PUBLJC NOTIFICATION The Terms of Reference and this Report will be made available to the general public at the Office of Fair Trading website 'www.fairtrading.qld.gov.au' or on request by telephone to the Project Officer on (07) 3239 6260. The Terms of Reference and an Executive Summary with covering letter will be forwarded to affected stakeholders. 8 National Competition Policy Public Benefit Test Report Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 OF RESTRICTIVE PROVISIONS OF THE LEGISLATIVE REGIME In recognition of the increased importance of the notion of privacy to all sectors of the community, the lOP Act was introduced in 1971. Provisions contained in other legislation have now superseded some sections of the lOP Act, which are outlined below. 2.1 I.NVASIONOF PRlVACYACT1971 ANDINVASlONOFPRlVACY REGULATION1998- LEGISLATIVE BACKGROUND The objective of introducing the lOP Act was essentially to provide persons with protection against unwarranted invasions of privacy in specific circumstances. In line with its objective, the lOP Act provided for: 1. 2. 3. 4. 5. regulation of entry into dwelling houses; regulation ofthe use and supply oflistening devices; licensing and business conduct requirements of credit reporting agents; licensing of private inquiry agents (commonly referred to as private investigators); and lOP Regulation. I I I I I I I I I I I I I The subsequent introduction of the Security Providers Act 1993 removed the specific provisions relating to private inquiry agents from the lOP Act. The Police Powers and Responsibilities Act 2000 (formerly 1997) (PPR Act) effectively removed any reference to police involvement contained in the lOP Act. It states that in the case of any inconsistency between it and any other Act that confers a power or imposes a responsibility on a police officer, that the PPR Act shall prevail. Effectively the PPR Act. removes the requirement contained in the lOP Act that a police officer must seek consent from a Judge of the Supreme Court, before authorised to use a listening device when performing duties as a police officer. The lOP Act in its current form provides for the licensing and conduct of credit reporting agents, entry to dwelling houses and the use and supply of listening devices. The lOP Regulation provides for some exemptions to licensing requirements for financial institutions and prescribes fees for licensing. 9 National Competition Policy Public Benefit Test Report I I I I I I I I I I I I I I I I I I I I • 2.2 Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 RESTRICTIVE PROVISIONS The following restrictive provisions have been nominated in the Queensland Legislative Review Timetable 5 : J2.2.1 LISTENING DEVICES The lOP Act regulates the use and advertising of listening devices in certain circumstances for the purpose of protecting privacy. Listening devices are defined as 'any instrument, apparatus, equipment or device capable of being used to overhear, record, monitor or listen to a private conversation simultaneous with its taking place' (s4). A private conversation is also defined in s4. The use of listening devices is regulated by Part 4 of the rop Act, which creates a prohibition on the use of prescribed listening devices unless used for a lawful purpose [s43(2)]. The rop Act also prohibits (absolutely) advertising for the sale of any prescribed class of listening device. However, to date, there has been no class of listening device prescribed for the purpose of that prohibition and that regulation making power has never been exercised. While the regulation making power relating to the prohibition of a prescribed class of listening device has not been exercised, there is a need to keep these powers in place to protect consumers i£'when an issue arises in the marketplace warranting Government intervention. The Government Priorities are to provide safer and more supportive communities which is achieved through providing effective consumer protection and ensuring traders operate responsibly by identifying, exposing, prohibiting and publicising unfair trading practices. The retention of this regulation making power is in accordance with Government Priorities. This regulation making power does not impact on competition as there are no prohibited class of listening device, however if/when consideration is given to prescribing a class of device for the purpose of prohibiting advertising of that device, all impacts on competition will be analysed at that time. The restriction on the use of recording materials and some behaviour is not particular to any market or industry and the PPR Act has effectively removed the requirement that police officers receive consent to use a listening device (prior to use) thereby further reducing the s Queensland Government, 1996 10 National Competition Policy Public Benefit Test Report I I I I I I I I I I I I I I I I I I I I Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 restrictive provisions in the lOP Act. The listening device sections of the lOP Act are not considered to restrict competition and will not be included in the review parameters. 2.2.2 CREDIT REl'ORTING AGENTS Part 3 of the lOP Act creates a licensing regime and business conduct requirements to control the activities of credit reporting agents. The lOP Act requires that any person who is regularly engaged in providing credit reports to another person (s4) must hold a credit reporting agent licence (s8). A 'credit report' is defined as a commuuication, which is used (or expected to be used) for the purpose of establishing a consumer's eligibility to obtain credit for personal, family or household purpose (s4). A person applies to the Chief Executive for a licence, pays the prescribed fee and is submitted to a criminal history check to assess the applicant's character. If the application is granted the applicant is required to adhere to the business conduct standards for information collection, secure storage of information and information disclosure. The potential for the existing regulatory regime to restrict competition will be the only restriction examined in the review of the lOP Act. 2.2.3 INVASION OF PRlf--:4CyREGULATlO!Y 1998 The lOP Regulation came into force on 26 May 1998 and repealed all previous subordinate legislation enacted under the lOP Act. It provides administrative guidance in the process of licence applications. This review will not consider provisions of the lOP Regulation, as they contain no direct impact on competition. 3.0 BACKGROUND INFORMATION The credit reporting industry is subject to continuous change in the way it carries on business through advances in information technology. . Information is now easily distributed electronically. This carries the risk that information may be distributed to a wrong person, in a very short period of time, which may cause damage to consumers. Submissions to the Legal, Constitutional and Administrative Review Committee Inquiry during 1997 revealed that many individuals and organisations have concerns relating to II National Competition Policy Public Benefit Test Report I I I I I I I I I I I I I I I I I I I I .' 3.1 Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 privacy protection which they felt were not adequately canvassed in Queensland", The inquiry indicated that many people do not believe there are adequate measures regulating the collection, storage, use, access and disclosure of their personal information by private and public sector organisations and have an expectation that Government will protect them from any misuse of this information, which may encroach on their privacy rights. BACKGROUND TO PRIVACY LAWS There is no universally accepted definition of privacy, however, the following definition is widely supported: 'Privacy is the claim of individuals, groups or institutions to determine for themselves when, how, and to what extent information about them is communicated to others.' 7 The right to privacy has been recognised at the international level through Article 12 of the 1948 Universal Declaration of Human Rights and Article 17 of the 1966 International Covenant on Civil and Political Rights. They state that no one shall be subjected to arbitrary and unlawful interference with hislher privacy, family, home or correspondence, nor to unlawful attacks on his/her honour and reputation. In defining privacy there are four recognised categories of privacy in Australia: I. 2. Privacy of person, where people should have freedom in relation to their own body; Privacy of space or territory, where people should have a right to conduct their personal affairs in certain private spaces and have some controls on people entering that private space or territory; Privacy of communication, where people have the right to conduct communication, either written or oral, without being subject to surveillance; and Privacy of information, which is the notion that people, at least to some extent, should be able to regulate the use of information about them 8 . 3. 4. Certain relationships give rise to a duty of confidentiality such as that of doctor and patient, lawyer and client and banker and customer. In addition, contracts may include terms that relate to the protection of confidential information. 6 Legislative Assembly of Queensland referred to the Legal, Constitutional and Administrative Review Committee, the responsibility of conducting an inquiry into the adequacy of existing privacy measures in Queensland and considered whether introduction of further measures was warranted. The findings were tabled Privacy in Queensland, Report No.9, 1998 'Professor A F Westin, Privacy and Freedom, Antheneum, New York, 1967, p7 8Australian Law Reforru Commission, Privacy, Report No. 22, Australian Government Printing Service, Canberra, 1983,p21 12 National Competition Policy Public Benefit Test Report I I I I I I I I I I I I I I I I I I I I • Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 There are a number of arguments advaucedas to why privacy in general should be protected. Firstly, privacy may be viewed as essential to humau dignity aud a key value that underpins other key values such as freedom of association aud freedom of speech", Secondly, privacy protection cau be viewed as an integral part of a democracy that respects individual liberty. Finally, implementing measures that protect privacy will give effect to international obligations to maintain the principles embodied in covenauts of which Australia is a signatory. However, privacy is not au absolute right. Determining the level of protection that privacy should be afforded is fundamentally a question of determining au appropriate balauce between competing interests. These issues are the basis for policy objectives underpinning continued Government intervention, which seeks to balauce broader public needs. Another factor taken into account in this review is the privacy protection currently afforded in Queenslaud, in legislation in addition to the lOP Act, which includes: • • • • Parliamentary Commissioner Act 1971 which creates the position of Parliamentary Commissioner, with powers to investigate administrative decisions by public sector agencies aud to make recommendations to the principal officer of Public Sector Agencies, the Premier aud Parliament. Privacy Committee Act 1984 is a modified version of New South Wales legislation, which establishes a Privacy Committee whose functions include the research, aualysis, investigation aud dispute resolution of matters relating to privacy. Freedom of Information Act 1992 allows persons access to information held by Government agencies and enables persons to have the information corrected if it is inaccurate, incomplete, out-of-date or misleading. Privacy Act 1988 (Cth) provides for Information Privacy Principles which effectively establishes a maudatory Credit Reporting Code of Conduct and National Privacy Principles, which apply to other orgauisations both of which apply throughout Australia. 3.2 COMPLIANCE BACKGROUND To obtain a credit reporting agents licence, au applicant must apply to the Chief Executive of the OFT for a licence aud pay a licence application fee of $430. The applicant must show it holds a registered office in Queenslaud (s35) and must demonstrate it is a fit and proper person to carry on business as a credit reporting agent. There are no professional qualifications required. 9Australian Privacy Charter issued by the Australian Privacy Charter Council, December 1994 13 National Competition Policy Public Benefit Test Report Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 Records maintained by the Licensing Branch of the OFT show that as at 30 June 2000, four credit reporting agent licences were in force. In 200 I there has been one additional licence granted and one licensee has chosen not to renew. The figures for recent years demonstrate a consistent number oflicenses (including renewal of existing licences). 7 3 3 3 3 4 I I I I I I I I I I I I I I I 4 Since 1992 the OFT has received 10 complaints relating to the licensing and conduct of credit reporting agencies. Complaints it does receive are referred to the Office of the Federal Privacy Commissioner. The OFT has not undertaken any investigations in relation to credit reporting agents for a number of years. The Office of the Federal Privacy Commissioner reports that it received, during the 1998/1999 financial year 1,407 enquires regarding credit reporting activities" and formally investigated 131 complaints11. During the 1998/1999 financial year 65 complaints into credit reporting activities were investigated12. During the 1998/1999 year the Office of the Federal Privacy Commissioner also finalised five audits of credit providers to ensure compliance with the Commonwealth credit reporting legislation and commenced a further eight audits. 13 3.3 INDUSTRY BACKGROUND The rop Act defmes a credit reporting agent as a person regularly engaged in providing . reports in relation to the credit worthiness, credit standing or credit capacity of a consumer (s4). The rop Act requires a person who acts as, carries on the functions, advertises, notifies or states they operate in Queensland to hold a credit reporting agents licence and to have a registered address in Queensland (s8). The licensee's address is then recorded in the licence register so notices can be served on them. 10 Office II of the Federal Privacy Commissioner, 'Eleventh Annual Report on the Operation of the Privacy Act', at p. 50. See note 3, atp. 53. 12 See note 3, at p. 53. 13 Eleventh Annual Report on the Operation of the Privacy Act for the period I July 1998-30 June 1999. 14 National Competition Policy Public Benefit Test Report I I I I I I I I I I I I I I I I I I I I • Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 There are currently four credit reporting agents' licences issued under the lOP Act in Queensland, all of which are corporations. In 1990 there were 11 licensed credit reporting agents in Queensland. Between 1991 and 1995 eight credit reporting agent's licence were allowed to expire or were surrendered, as the licences were no longer required by their holders. This contraction in the market is consistent with movements in the credit reporting market in the United States of America where an annual report on the Operation of the US Privacy Act made the comment that: 'During the 1980s, the credit reporting industry took advantage of improved computer technologies and consolidated its databases from thousands of local credit bureaus into five, then three national credit bureaus.' 14 Advances in information technology during the last 20 years have revolutionised the way information is stored and retrieved. This has allowed one major credit reporting agent in Australia to gather large amounts of information relating to consumer credit over a number of years, which effectively acts as a barrier to entry for any potential credit reporting agents. To begin competing with the major credit reporting agent, a new agent would need to develop or purchase a suitable database and obtain and input relevant consumer credit information. It would be very difficult for a new entrant to the market to gather and hold the same information as this major credit reporting agent, so it can begin securing some of the market demand for the product. The competitive advantage that this credit reporting agent has over other potential credit reporting agents, is unrelated to the legislative regime governing this industry. Three of the four current licensed credit reporting agents deal in the business of providing reports in relation to credit for commercial purposes such as persons with trade debts or persons wanting to hire videos. One licensed credit reporting agent in Australia supplies all banks, credit unions, finance companies, retail stores, credit card issuers, and mobile telephone companies with credit reports. That company operates Australia-wide and is the major consumer specific credit reporting agent in Australia and supplies approximately 1.6 million consumer credit checks annually in Australia, of which approximately 16-18% relate to Queensland. Their database is maintained in Sydney but is accessible by staff in the Brisbane office. The company has offices in Brisbane, Sydney, Melbourne, Adelaide, Perth and overseas. The database from which that company generates reports has a book value of $139,370,000.15 14 http://www.pirg.org/consumer/creditimistakes/page2 .htm, 15 Data downloaded 717198 Advantage Limited Annual Report 1999 15 National Competition Policy Public Benefit Test Report Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 refers to the information contained in the files only and does not include the computer or software that drives the system. The database contains information in relation for commercial purposes as well as credit for personal purposes. A lot of credit reports in relation to Queenslanders are issued and supplied in New South Wales. This occurs because a number of lending institutions have central offices located in New South Wales and deal directly with the credit reporting agent's head office in Sydney. The cost of a credit report to the credit provider varies between $2.81 and $4.02 depending on the bulkbuy discount offered. The demand for credit checks has been increasing by about 5% per annum for the last five to ten years, mainly as a result of new industries such as mobile phones. Ninety-nine percent of credit reports are supplied electronically. I I I I I I I I I I I I I Information sought by credit reporting agents comes from two sources. Firstly there is the publicly available information from court and bankruptcy proceedings and secondly there is information supplied by lending institutions in relation to previous credit applications and serious credit infringements. The major market barrier for potential new competitors would be the availability of previous credit applications and serious credit infringements held by other credit reporting agents. The current major credit reporting agent was originally established by the finance and retail sectors and holds a major share of the market due to accumulation of information over time. However for a fee the company makes its database available to subscribers such as lending institutions, private investigators and other similar organisations. 4.0 Legislative Requirements in Other Jurisdictions Commonwealth legislation contains Information Privacy Principles and a mandatory Credit Reporting Code of Conduct, which applies to the industry throughout Australia effectively regulating the activities of all Australian based credit reporting agents. Privacy legislation . operating in the Commonwealth and other jurisdictions is discussed below. Some jurisdictions provide for a positive licensing scheme where persons who want to operate as credit reporting agents, are required to fulfil certain requirements or hold certain qualifications before they will be allowed to operate. Some jurisdictions operate a negative licensing scheme where all persons can operate. within the industry, but which excludes those who demonstrate they cannot operate satisfactorily within the industry or who have a serious criminal history. The Commonwealth Privacy Act administers a Code of Conduct, a breach of which attracts severe penalties. 16 National Competition Policy Public Benefit Test Report Invasion otPrivacv Act 1971 and the Invasion mrprivnJ°" Regulation 4.1 COlV1MONvVEALTH - CURRENT INDUSTRY COVERAGE OF CREDIT REPORTlNG AGENTS The Privacy Act 1988 (Cth) (Privacy Act) introduced eleven InformatiollPrivacy Principles (IPPs) which bind Commonwealth Agencies. I I I I I I I I I I I I I I I I In May 1989, following increased public concern, the CommonwealthrGovernment announced an intention to regulate credit reporting practices by amending the Privacy Act. These amendments (which received Royal Assent on 24 December 1990) are principally contained in Part lIIA of the Privacy Act. The amendments resulted in the creation of the Credit Reporting Code of Conduct (Code), fully operational in February 1992, which in conjunction with Part lIIA of the Privacy Act, applies the IPPs to the specialised area of credit reporting. Thus, the IPPs, which generally only applied to Commonwealth agencies, were extended to this specific segment of the private sector. The Code essentially supplements Part IIIA of the Privacy Act on matters of detail. The Code has the status of law, with section 18B of the Privacy Act requiring compliance by credit reporting agencies and credit providers with the Code's requirements. A breach of the Code is considered to be a breach of the Privacy Act. The Commonwealth legislation including the Code attempts to limit individuals from carrying on the business of a credit reporting agent by prescribing conduct requirements in relation to the supply of credit reports. It prescribes what information a credit reporting agent may maintain in a credit information file and what information may be included in a credit report. It restricts inclusion of information in a credit reference report, about a person's political, social or religious beliefs or affiliations, criminal record, medical history or physical handicaps, race, ethnic origins or national origins, sexual preferences or practices or lifestyle, character or reputation. 4.1.1 RECENT COMMONWEALTH AMENDMENTS The Privacy Amendment (Private Sector) Act 2000 (Cth) was assented to on 21 December 2000, (to commence on 1 July 2001) and amends the Privacy Act. The amendments widen the scope of the Privacy Act to create National Privacy Principles (NPPs) which will similarly apply to the activities and practices of organisations within the private sector. These organisations include an individual, bodies corporate, a partnership, or any other unincorporated association, or a trust, but not a small business operator, in some situations (s6C). 17 National Competition Policy Public Benefit Test Report Invasian ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 From 1 July 2001 all organisations will be required to comply with NPPs or a privacy code submitted to and approved by the Privacy Commissioner. The NPPs set out standards for· the collection of data (NPPl), use and disclosure of information (NPP2), data quality (NPP3), data security (NPP4) and openness (NPP5) of personal information by all private sector organisations (Schedule 3 - National Privacy Principles). The NPPs and any privacy codes approved by the Privacy Commissioner have effect, in addition to sections 18 and 18A and Part IIIA, and do not derogate from them (sI6A). 4.1.2 LEGISLATIVE SCHEME I I I I I I I I I I I I I I \ The Code and Part IIIA of the Privacy Act combine to create a regulatory scheme, which, in summary, limits the scope of activities of credit reporting agents and regulates the way personal information can be utilised. However it should be noted, that unlike the Queensland lOP Act, the Commonwealth Privacy Act does not create a licensing scheme for credit reporting agents. A comparison between the Commonwealth Privacy Act and the Queensland IOP Act is contained at Appendix B. Part IIIA provides privacy safeguards for individuals in relation to consumer credit reporting. In particular, it governs the handling of credit reports and other credit worthiness information about individuals by credit reporting agents and credit providers. The Privacy Act ensures that the use of this information is restricted to assessing applications for credit lodged with a credit provider and other legitimate activities involved with giving credit. The key requirements of Part IIIA include: • • • Strict limitations on information which can be held on a person's credit information file by a credit reporting agency; Limits on access of credit files held by a credit reporting agency; and Limits on the purposes for which a credit provider can use a credit report obtained from a credit reporting agency. Section 18C limits certain credit reporting activities to corporations. Section Ill.A of the Privacy Act defines that 'a person is a credit reporting agency if the person is a corporation that carries on a credit reporting business'. In effect this definition means only corporations can operate as credit reporting agents, therefore falling within the ambit of the Code. From 1 July 2001, the gap between corporations captured by the Code, and other organisations holding personal information, will be closed. All organisations (including an individual, bodies corporate, a partnership or any other unincorporated association or trust, with the exception of some small business operators in limited situations - s6), will have to comply with the NPPs requirements. 18 National Competition Policy Public Benefit Test Report Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 4.2 INTERSTATE JURISDICTIONS The issue of interstate jurisdiction is compounded by the Commonwealth Privacy Act and its Australia-wide industry coverage. 4.2.1 SOUTH AUSTRALIA Credit reporting agents in South Australia (SA) are subject to the general provisions of the Fair Trading Act 1987 (SA). These provisions apply conduct restrictions to all persons carrying on the business of providing reports containing personal information to any person not known to the person who is the subject of the report. Credit reporting agents are not subject to licensing requirements in SA. SA legislation places no restriction on who can obtain information concerning a person's credit history nor is there any restriction on the age of that history. The Commonwealth legislation provides for both these issues and also places restrictions on who can provide information to reporting agents. The SA provisions allow persons to access information held by reporting agencies and establishes remedies to correct errors in that information. It also prohibits the inclusion of information about race, colour or religious or political belief or affiliation of any person who is the subject 0 f any report. The SA legislation is less restrictive than the Commonwealth legislation in a number of areas. The Commonwealth Privacy Act prescribes: only corporations can operate as credit reporting agents; specific content permitted on information files; and that agents must keep accurate and secure records. • • The provisions of the SA legislation provides only for the correction of errors if disputed by the individual. The maximum penalty for any offence against the SA reporting agent provisions is $5,000 whereas the Commonwealth penalties are much higher. In reality, since 1990 it has been the Commonwealth legislation that actually regulates the activities of credit reporting agents in SA. 4~2.2 NORTHERN TERIUT{)R~~/ Specific provisions of the Northern Territory (NT) legislation governing credit reporting agents are contained in the Consumer Affairs and Fair Trading Act 1990 (NT). These provisions substantially mirror the SA legislation. Additionally, the NT legislation has 19 National Competition Policy Public Benefit Test Report Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 provision for the Minister to prepare a code of practice for fair dealing between a particular class of suppliers and (or in relation to) consumers. However, to date no code of practice has been drafted in relation the conduct of the credit reporting industry. The NT Consumer Affairs Bureau has not received any complaints in relation to a credit report agent, nor has it exercised its exclusion powers. The Commonwealth legislation is more restrictive than the NT legislation for similar reasons as SA. Consequently, it is the Commonwealth legislation that regulates the activities of credit reporting agents in the NT. 4.2.3 ViCTORIA The Credit Reporting Act 1978 (VIC) contains provisions in relation to the business conduct of credit reporting agencies in Victoria. The legislation does not require the licensing of credit reporting agents in Victoria. Victorian legislation places no restriction on who can obtain a credit report in relation to a consumer, nor is there any restriction on the age of that information. However, the legislation requires that traders who refuse credit to a consumer, as a result of a credit report, supply the name and address of the credit reporting agent to the consumer. Like the NT and SA legislation, the Victorian legislation allows persons access to information concerning themselves held by credit reporting agencies and establishes remedies to correct errors in that information. In Victoria, a Magistrate may order a correction or deletion to any information held on a person's file that is found to be inaccurate, misleading or irrelevant. The Victoria legislation prohibits the inclusion of information concerning consumer's race, colour, religious or political belief or affiliation. Other than the provisions for a Magistrate's Court order, the Commonwealth legislation is . more restrictive than the Victorian legislation and consequently it is the Commonwealth legislation that regulates the activities of credit reporting agents in Victoria. The Victorian Office of Fair Trading and Business Affairs has received 17 complaints in relation to credit reporting agents between 1 March 1995 and 20 July 2000. All complaints were resolved by conciliation. There is no legislation in New South Wales (NSW) regulating the activities of credit reporting agents. Privacy NSW, a statutory body established under the Privacy and 20 National Competition Policy Public Benefit Test Report Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 Personal Information Protection Act 1998 (NSW), regulates the collection and use of information by public sector organisations in NSW. Privacy NSW also attempts to conciliate any information received from privacy complaints in relation to the private sector in NSW. However, any complaints received that specifically relate to the actions of credit reporting agencies are referred to the Commonwealth Privacy Commissioner. It is the Commonwealth legislation that regulates the activities of credit reporting agents in New South Wales. ArSTRc\LfAN CAPITAL TERRITORY, VVRSTERN AU:iTRAU.-'S V\D T\Sl'd.\"T' There is no specific legislation in the Australian Capital Territory, Tasmania or Western Australia governing the activities of credit reporting agents. The Commonwealth legislation regulates the activities of credit reporting agents in these jurisdictions. The Australian Capital Territory Consumer Affairs Bureau relies on the Commonwealth legislation and does not consider further regulation is necessary. The Western Australian Ministry of Fair Trading advises that complaints received in relation to credit reporting agents are negligible. No complaints were received in 1999/2000. The Tasmanian Office of Consumer Affairs and Fair Trading report that they have not received any complaints in relation to credit reporting agents during the last twelve months. 5,0 ISSUES - ASSESSMENT OF RESTRICTIONS ON ' i"f'l'A .l'!/ l'V.t. _:1 :.., J C "\.) 1'1 1 ' I",rVD ';\lTTYTJ"'i TI E- I'Vf/A<;,Tn'\f rs t: PI'?T]/ i ' j / ~_ Lt nl~ 3 2.1 ,. ./J.".. i v J 'f 'l.7" -L .'Li f "'-.-_. {'710'/'! .>..--.'f _oL./.'_'-. An assessment of the lOP Act has highlighted market entry restrictions in the form of specific credit reporting agent licensing and business conduct requirements. It is in the public interest for the Government, insurance companies or credit providers to collect certain information about people in order to operate and plan more effectively. See Impact Matrix at Appendix A for an analysis of the costs and benefits to stakeholders associated with a move from current regulatory regime to the preferred option. 5.1 CREDIT REPORTING AGENTS A credit reporting agent is defined as a person who regularly engages, in whoIe or part, in providing credit reports to any other person, whether for remuneration or otherwise (s4). -------------------------National Competition Policy Public Benefit Test Report 21 Review of the Invasion ofPrivacy Act I97I and the Invasion ofPrivacy Regulation 1998 5.1.1 LICENSING (INCLUDING GEOGRAPHICAL) RESTRICTIONS In order to regularly engage in the business of providing credit reports to any other person, the person acting or carrying on the business or functions of a credit reporting agent, must hold a licence under the lOP Act (s8). To obtain a licence, the applicant must have a registered office in Queensland (s36) and demonstrate to the Chief Executive that the individual or corporation (directorls and secretary) is a fit and proper person to carry on business as a credit reporting agent. Consideration by the Chief Executive is given to the interests of the public, the fame, character, suitability and any qualifications demonstrated by the applicant before granting or renewing a licence. It should be noted that the lOP Act does not prescribe any specific qualifications required to obtain a licence. The licensee is then required to renew the licence annually. The license application fee and subsequent renewal fee is currently $430. For the past decade, no application for a credit reporting agent's licence has been refused on the grounds that the applicant was found unsuitable to hold a licence in Queensland. Most credit reports are produced by agents or credit providers and are generated by electronic means, where the physical location is not relevant. The geographical requirement in the lOP Act does assist consumers to locate an agent, should they wish to litigate against an agent. However, as there is effectively only one major credit reporting agent in Australia which is a corporation, the location of the agent can be accessed through the Australian Securities and Investment Commission records. Therefore the geographical restrictions do not appear to have a significant impact on competition in the market and therefore does not significantly restrict consumers in their choice of agents. 5.1~2 EXE:\lPTIONS }i'ROlVILICENSING Financial institutions are exempted from holding a licence under s8 of the lOP Act. They. are not exempt from conduct requirements. Financial institutions subscribe to a current licensed credit reporting agent for access to consumer credit information, contained on a database. The purpose of licensing is to ensure credit reporting agents are identifiable and that they comply with certain requirements. As financial institutions actually obtain information from a licensed credit reporting agent, they are not in competition with each other, the financial institutions rely on the licensed credit reporting agent to provide accurate information. 22 National Competition Policy Public Benefit Test Report Review of the Invasion a/Privacy Act 1971 and the Invasion a/Privacy Regulation 1998 5.J.3 CONDl;CTRESTRICTIONS The IOP Act restricts the business conduct of credit reporting agents in the way credit reporting agents keep records, how they provide reports, the consumer's right to access his/her information file, who should receive disclosure of information kept and measures to protect the security of information stored. 5 •.r.s.: REPORTS A credit report is defined as any written, oral or other communication in relation to the credit worthiness, credit standing or credit capacity of a consumer, which is used, or expected to be used, or collected in whole or in part, for the purpose of serving as a factor in establishing the consumer's eligibility for credit (s4). The IOP Act states a credit reporting agent is not allowed to furnish a report to any person other than in accordance with written instructions of the consumer to whom it relates, or to a person whom the credit reporting agent has reason to believe intends to use the information contained in the credit report in connection with a credit transaction (s16). Financial institutions will not receive any information from an agent unless the consumer has authorised its release. 5.1.3.2 RECORD KEEPING The lOP Act states the agent must go through records once a year and delete any reference to anything that happened more than 5 years ago, excluding fraud or dishonesty convictions (s24). It creates an offence if any person knowingly falsifies a credit report or any records used or intended for use (s22), and if any person who obtains information on a consumer from an agent by any false pretence (s19). 5.1.3.3 DISCLOSURE A credit reporting agent must comply with prescriptive disclosure requirements on information contained in the credit reports or on the credit reporting agent's operations, as follows: • • No person can knowingly provide information concerning a persons credit information to any person unauthorised to receive that information (s20); and Any person who supplies false or misleading information to a credit reporting agent for the purpose of having that information recorded, commits an offence against the lOP Act (s2l ). 23 National Competition Policy Public Beuefit Test Report Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 When credit has been refused, the credit provider must notify the consumer that based on credit information, credit was refused and that a right exists for himlher to obtain access to the credit information files relied on (s17). Where a consumer elects to access this information, the agent must disclose all information, which was given to the credit provider who refused the credit. Additionally, the consumer has some ability to dispute the accuracy of information contained within the report (s18). There are additional safeguards for agents, users and suppliers of credit reports in s23. The safeguard is that no liability is incurred for defamation, in respect of a publication made in good faith, of any matter in the course of preparation, supply and use of a credit report in compliance with the lOP Act. See Impact Matrix at Appendix A for an overview of the analysis of the costs and benefits to stakeholders associated with moving from the current regulatory regime to the preferred option. IDENTIFICATION AND ... THE RESTRICTIVE .E'·I lCNIlTNTS LEGISLATIVE REGIME L ....a ~, LL~ L~ OF '"[HE This review considers alternatives to the restnctrve elements of the current legislative framework. It considered the policy objectives of the lOP Act and whether the alternatives identified will continue to meet these objectives. The review measures the costs and benefits of the alternative, which has been identified as the most viable option. 6~ 1 OVTI()N 1 - ,ALTERNATl\FEREGULATl(}N - CONDUCT An alternative to the current regime may be the development of a voluntary code of conduct. . An industry body could regulate membership through an industry driven voluntary code of conduct. However, as there is only one substantial consumer credit reporting agent within the credit reporting industry in Queensland and this is likely to remain the case in the long term and there are no credit reporting associations as such, a voluntary code would effectively be developed and regulated by the same organisation. This would not contribute toward meeting the policy objectives of the legislation, as consumer protection could be lessened through one organisation only developing the code of conduct. The Commonwealth Privacy Act provides for the mandatory Code and a Queensland voluntary code of conduct would serve no additional useful purpose, which cannot already be drawn by the Commonwealth Privacy Act. 24 National Competition Policy Public Benefit Test Report Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 A voluntary code of conduct would not adequately meet the policy objectives in protecting the dignity of individuals in respect to their right to privacy by regulating against unwarranted invasions of privacy and, as such this option is not a viable option. A.2 OPTION 2 - ALTERNATIVE REGULATION - NEGATIVE UCENSIl\TG A negative licensing scheme where potential market participants are not required to seek Government approval prior to entering the market, but are required under legislation to conduct themselves in accordance with predetermined standards may be a suitable alternative to the current regulatory regime. This type of regulation could be used to exclude organisations found to be unfit to operate in the industry. Currently the industry is regulated by a positive licensing regime where persons are required to provide certain information to Government and show they are fit and proper persons to hold a licence, before they are able, by law, to enter the market. A negative licensing regime would allow anyone to enter the market, but would monitor market behaviour in accordance with legislative provisions. If market participant's behaviour is inappropriate, a Government authority could exclude that participant from the market place. The cost to Government of creating a negative licensing scheme would be medium to high and would involve industry representation to develop and negotiate the scheme. The Commonwealth Privacy Act provides for the mandatory Code, and a Queensland based negative licensing scheme would serve no additional useful purpose, which cannot already be drawn by the Privacy Act. Negative licensing is a reactive approach to regulation that does not prevent the inappropriate behaviour initially occurring in the marketplace. The increased speed with which electronic information can be widely distributed, has increased the chance of public detriment being caused through information being widely spread before a person has an opportunity to complain of an indiscretion, thereby invading the person's privacy. It is noted that this issue may not be specific to negative licensing schemes. A negative licensing system would not adequately.meet the policy objectives in protecting the dignity of individuals in respect to their right to privacy by regulating against unwarranted invasions of privacy and, as such this option is not a viable option. 25 National Competition Policy Public Benefit Test Report ----------'-.. _--------------------------~ Review of the Invasion a/Privacy Act 1971 and the Invasion a/Privacy Regulation 1998 6.3 OPTION 3 - ALTERNATIVE REGULATION - MANDATORY COl" CONDUCT "VITH NEGATIVE LICENSING A mandatory code of conduct is made similarly to a voluntary code of conduct, where Government and industry are represented and provide input into its creation. However, a mandatory code of conduct would be made under a regulation, which would ensure industry compliance, attracting penalties for persons who do not comply with the code. A mandatory code of conduct could be imposed upon Queensland credit reporting agents under the provisions of the Fair Trading Act 1989 (Qld). However, a Queensland code of conduct would duplicate requirements under the Privacy Act and its Code. A negative licensing regime is not likely to have any irnmediate effect on the current market structure, as the current licensing requirements are minimal. Theoretically, if the dual enforcement of identical State and Commonwealth codes of conduct increased the administrative burden on a credit reporting agent the agent could choose to relocate interstate and service its Queensland clients electronically. Practically, there is only one major credit reporting agent and it is likely that it would keep an office in Queensland in the future regardless of whether licensing and geographical requirements exist or not. The introduction of a negative licensing scheme and a code to regulate conduct under this option is considered a model that could meet the policy objective of the legislation of allowing persons protection against unwarranted invasions of privacy in specific purposes. This model would still provide ability for service providers to be removed from the market if the need arises. However, the development and implementation of a mandatory code of conduct, combined with a negative licensing regime is likely to place additional financial and administrative burden on the Queensland Government with little benefit that can not already be obtained through the provisions of the Commonwealth Privacy Act. Although fulfilling the policy. objectives of the legislation, this option would substantially duplicate the Commonwealth legislation and cause an unjustified cost to Government and to Queensland stakeholders, which is not justified. The Commonwealth Privacy Act provides a mandatory Code and a Queensland based mandatory code of conduct would serve no additional useful purpose, which cannot already be drawn by the Privacy Act. This option is not a viable option. 26 National Competition Policy Public Benefit Test Report Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 6.4 OPTION 4 - DEREGULATJON Consideration has been given to repealing the licensing and conduct requirements for credit reporting agents contained in the IOP Act as well as the exemptions in the rop Regulation. Under this model the only legislation that would continue to impact on the credit reporting industry would be the Commonwealth Privacy Act and its Code. A comparison between relevant provisions contained in the Queensland Commonwealth Privacy Act is contained at Appendix B. rop Act and the In summary, it shows that removal of Queensland licensing and conduct requirements will not significantly alter industry conduct requirements, as the industry remains compelled to meet the requirements ofthe Commonwealth Privacy Act and its Code. No other jurisdiction in Australia positively licences credit reporting agents. The evidence in Queensland and from all other jurisdictions does not support the need for licensing, as there have been minimal complaintslinvestigations into the conduct of members within the industry. All jurisdictions are effectively covered by conduct requirements contained in the Commonwealth Privacy Act. 6.4.1 LICENSING (INCLUDING GEOGRA-PI-flCA'L) REQUIREMENTS The removal of the licensing provisions in the IOP Act is not likely to impact upon competition, nor reduce consumer protection against unwarranted invasion of privacy as licensee conduct requirements are preserved under the Commonwealth Privacy Act. The requirement for licensed credit reporting agents to maintain premises in Queensland was designed to enable notices pursuant to rop Act to be served on credit reporting agents. If the licensing provisions are repealed there will be no need to serve notices pursuant to the rop Act and therefore no reason to maintain the geographic restriction of maintaining a registered office in Queensland. 6.4.2 BUSINESS REQUIRElVIENTS KEEPING, SECURITY AND DISCLOSIRE) CONDUCT (lNCLlJDlNC REPORT". - URB Removal of the conduct restrictions contained in the Queensland rop Act in relation to record keeping, the acceptable supply of personal information, content of records kept by credit reporting agents, the accuracy of information stored and information security will not adversely affect consumers. 27 National Competition Policy Public Benefit Test Report I I I • Review of the Invasion ofPrivacy Act 197/ and the Invasion ofPrivacy Regulation 1998 II I I I I I I I I I I I I Credit reporting agents would still be subject to Commonwealth conduct requirements. They seek the same policy objectives in ensuring consumer's privacy is adequately protected, attempting.to guarantee the information held in individual records is accurate and the use of the information is for credit purposes only. Removal of the Queensland credit reporting agent requirements will reduce costs to Queensland based credit reporting agents who meet the requirements of both pieces oflegislation, without detriment to consumers. Consumers will still have access to a process to have inaccurate or misleading information corrected by virtue of the provisions of the Commonwealth Privacy Act. In fact, as mentioned, Queensland consumers are already accessing that service. The Privacy Commissioner, created under the Commonwealth Privacy Act, has jurisdiction wherever the credit reporting agent conducts business in Australia. If a Queensland credit reporting agent should, after deregulation, decide to close its premises in Queensland, consumers will still be able to contact the credit reporting agent electronically and by post and can lodge complaints with the Privacy Commissioner. Queensland deregulation would result in a consistent industry-wide reliance on the Commonwealth Privacy Act. While protecting people against unwarranted invasions of privacy and striking a balance between the interest of this particular industry and consumers, are still important, these objectives are now being fulfilled by the Commonwealth Privacy Act, and retention of the Queensland lOP Act creates unnecessary duplication and potential confusion to stakeholders. Given the consistency between the deregulation model, the policy objectives of the Queensland legislation and Goverrunent's commitment to efficient and effective regulatory models, this model is considered the most viable option in providing an overall net benefit to stakeholders. For an overall view of the costs and benefits to stakeholders of moving from the current state to the preferred option, see Impact Matrix at Appendix A. 7.0 CONSULTA.nON The Terms of Reference and this Report will be made available to the general public at 'www.fairtrading.qld.gov.au' or on request by telephone to the Project Officer on (07) 3239 6260. The Terms of Reference and an Executive Summary with covering letter will be forwarded to affected stakeholders and relevant consumer groups. I I I I AU 28 National Competition Policy Public Benefit Test Report --"------------------------- I I I I I I I I I I I I I I I I I I I I • 8.0 Review of the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 CONCLUSIONS Queensland deregulation would result in a consistent industry-wide reliance on the Commonwealth Privacy Act. While protecting people against unwarranted invasions of privacy and striking a balance between the interest of this particular industry and consumers, are still important, these objectives are now being fulfilled by the Commonwealth Privacy Act, and retention of the Queensland rop Act creates unnecessary duplication and potential confusion to stakeholders. The Commonwealth Privacy Act commenced in 1988 with amendments being made in 1990 and in 2000, which incorporate a Code of Conduct for Credit Reporting Agents. The objectives of the Privacy Act to protect the privacy of individuals, are identical to the objectives of the Queensland rop Act. To retain the credit reporting provisions of the rop Act would result in a duplication of the requirements contained in the Privacy Act. This would mean small ongoing costs to Queensland credit reporting agents and the Queensland Government, which are unnecessary expenses. Licensing restriction No other Australian jurisdiction positively licenses credit reporting agents, There is no evidence that credit reporting agents' behaviour is different in Queensland as a result of licensing. The licensing of credit reporting agents in Queensland under the provisions of the rop Act does not further contribute to the objectives of the Queensland or Commonwealth legislation. The contribution of this reform alone will be negligible in economic terms. However, the accumulative effect of this and other reviews may be more significant. Geographical Restriction The requirement for credit reporting agents to operate from a registered office in Queensland arises as a result of the necessity to send notices pertaining to their Queensland licence. If the licensing requirements are removed in Queensland there is no need to send notices pursuant to the rop Act to credit reporting agents. Removal of this restriction will allow credit reporting agents to locate their business wherever it is most efficient to do so. 29 National Competition Policy Public Benefit Test Report Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1998 l:on<1uct Restrictions will not be any social impact from the removal of these restnctions as the Commonwealth Privacy Act provides the same protection offered by the current provisions of the lOP Act as consumers currently are using the Commonwealth provisions in relation to pnvacy. Overall Recommendation As observed from the Impact Matrix in Appendix A, the deregulation model provides an overall net low benefit, which has the most benefit to all stakeholders. It also best serves the interests of the objectives ofthe legislation. It is unlikely the deregulation option will have any impact on employment. I I I I I I I I I I I I The most viable option of deregulation contains virtually no incremental costs for the market to achieve the changed state. The alternative deregulation model will involve small costs to the Queensland Government in educating licensees about the removal of the credit reporting provisions ofthe Queensland lOP Act. Of the current state and alternative models, the deregulation model will produce the best net public benefit across stakeholder groups. It is recommended that the credit reporting agent provisions of the Invasion of Privacy Act 1971 be repealed as its objectives are now being met by the Privacy Act 1988 (Cth). 9,0 TRANSITIONAL ISSUES The OFT is considering the best way to inform current licensees of the proposed chances .. An issue that will need to be addressed prior to implementing the recommendation will be the process for discontinuing licensing. 10,0 RECOMMENDATION It is recommended that in accordance with the cost benefit analysis attached at Appendix A, the options demonstrating most public benefit be adopted by: • • Repealing the credit reporting provisions of the lOP Act; and Developing a strategy for managing transitional issues. National Competition Policy Pnblic Benefit Test Report APPENDIX A IMPACT MATRIX NCP Review of the Invasion ofPrivacy Act 1971 Consideration of Costs and Benefits of moving from the existing Legislative Regime To the Preferred Option Identified in this Review of Repealing the Credit Reporting Agents Provisions of the Invasion ofPrivacy Act 1971 Ratings: H+ = High Positive (benefit); M+ = Medium Positive (benefit); L+ = Low Positive (benefit) Negligible = negligible costs or benefits; H- = High Negative (cost); M- = Medium Negative (cost); L- = Low Negative (cost) Stakeholder Costs Benefits Current Credit Reporting There may be increased competition for the Queensland There currently exists an administrative and financial burden on agents for the initial market if other entrants were to establish themselves in licence application and ongoing renewal fees of $430 per annum. Set up costs are Agents the industry where the current credit reporting agent may approximately $192M 1, so the licence fee is minimal compared with other costs Impact: L+ loose profits as a result. However, given the cost associated with operation of the business. Under the preferred option, the licensing involved in commencing a business and that there is one and geographical restrictions will be removed. major credit reporting agent now, it is unlikely that there would be a change in the marketplace. The current regime attracts costs for current Ck.A's associated with holding a registered office in Queensland. Under the new regime, current CRA's wonld no The quality assurance of licensing requirements would longer be required to hold an office in Queensland thereby creating a cost saving. be removed, but quality assurance currently exists under Commonwealth legislation. The current regime requires compliance with particular business conduct Cost rating: negligible requirements, which are substantial duplications of Commonwealth legislation. The move to the preferred option will be a cost saving to current CRA's as they will no longer need to meet Queensland requirements, in addition to the Commonwealth. One particular area of the Queensland legislation, which is slightly different to the Commonwealth legislation is the requirement that CRA's take certain action when consumer credit is refused. Under the preferred option, CRA's will not be required to take this action as consumers can obtain access to their information files at any time, producing a cost saving to current Ck.A's, Quality assurance from the conduct requirements of the Commonwealth legislation. In reality current agents should already be complying with the Commonwealth requirements. Benefit ratinz: L+ 1 Data Advantage Limited Annual Report 1999 - the price paid by Data Advantage to acquire Credit Reference Limited, the only Australia wide credit reporting agent. Stakeholder New Entrants Market Impact: L+ to Costs removed, but the conduct requirements under the Commonwealth legislation are sufficient to ensure quality assurance for those providing a credit reporting Benefits and renewal fees of $430 per annum; and set up costs of a registered office in Queensland. Under the preferred option, the licensing and geographical restrictions will be removed. the Quality assurance of licensing requirements would be Currently there is a slight financial burden on new entrants to the market for licence service. Cost rating: negligible The costs of licensing are unnecessary and the conduct requirements of credit reporting agents are better dealt with by the Privacy Act /988 (Cth), which prescribes clear conduct requirements for credit reporting agents through the Act and the Credit Reporting Code of Conduct. There is a small benefit to new Queensland entrants to the market, as they will only need to comply with the Commonwealth requirements. Credit Providers Impact: Negligible Consumers Impact: Negligible to L+ There would be no real chauge for credit providers under the preferred option. They are exempted from Qld licensing requirements, but not from conduct requirements, and will continue to be captured where applicable, by the Commonwealth legislation. Cost ratina: ne!!li!!ible Moving to the preferred option of removmg the Queensland licensing and business conduct requirements will not result in additional costs to consumers, as all credit reporting agents, from Queensland and elsewhere, are currently complying with the requirements under the Commonwealth legislation. Cost rating: negligible Quality assurance of the conduct requirements prescribed under Commonwealth legislation. In reality, regardless of any Queensland conduct requirements, any new entrants to the market would be required to comply with the Commonwealth legislation. Benefit rating: L+ Quality assurance of the conduct requirements prescribed under Commonwealth legislation. In reality, credit providers should be currently complying with the appropriate provisions of the Commonwealth legislation. Benefit rating: negligible There may be a slight cost saving to Queensland consumers through the reduction in licensing costs, but this would be a negligible amount. The Commonwealth legislation fulfils the same objectives as State legislation and some duplication is occurring. In reality all Queensland credit reporting agents are currently required to meet the Commonwealth requirements and moving to the preferred option will produce a slight benefit to consumers, as there will be a national consistency in the requirements and less confusion as to what consumer rights exist. One particular benefit to consumers will be that they no longer need to wait for credit to be refused before obtaining a copy of their information. Under Queensland legislation, there are procedures for consumers and Ck.A's when credit is refused which are effectively removed under the Commonwealth legislation. The Commonwealth allows consumers access to their credit information at any time. Currently, Queensland only requires that information which is over 5 years old to be deleted from a consumer's file. Under the preferred option, the information contained on consumer files will be regularly amended, depending on the information - there should not be irrelevant or stale information on the file. Benefit ratins: nealiaible to L+ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _---J Stakeholder Government Impact: L+ Costs The Queensland Government received $430 per annum for each licensed credit reporting agent. Under the preferred option, the Queensland Government would lose this revenue. There may be some cost to Queensland Governinent as consumers could view the repeal of the credit reporting provisions as reducing their protection in this State. However, in reality, consumers are more fully protected under the Connnonwealth legislation. Benefits The Queensland Government incurs slight administrative burden in administering the rop Act in respect to licensing requirements. Under the preferred option there will be an administrative cost saving to the Queensland Government, as the Commonwealth Government would regulate the activities of credit reporting agents. The detailed comparison outlined at Appendix B shows that since the introduction of the Commonwealth Government the Queensland legislation is, for the most part, a duplication of the Commonwealth's legislation. A benefit to consumers of moving to the preferred option will be the assurance of a nationwide consistent approach to credit reporting activities. Cost rating: LBenefit ratlnai L+ Net overall benefit to all stakeholders of moving to the preferred option: L+ APPENDIXB Comparison of the Commonwealth Credit Reporting Requirements to Queensland Requirements Requirement Credit reporting agent must be licensed CTH QLD ./ Licensee must reside within jurisdiction ./ Corporation only to operate ./ Personal information can only be given to ./ credit reporting corporation Permitted contents of credit information files. ./ COMMENTS S8 (Qld) - No person shall act as, carry on business or functions, or advertise, notify or state the person acts as, carries on or is willing to carry on the business of a credit reporting agent it holds a licence. A credit reporting agent is a person regularly engaged (in whole or part) in providing credit reports to any other person (max penalty: $450 or 3 months imprisonment) Note: Qld does not require an agent to be a corporation. However, the Cth creates an offence if both the· agent and information providers are not corporations. Qld does not require licensees to possess particular qualifications, but does require the person to be fit and proper S36 (Qld) Applicants for a licence must have a registered address where it intends to carry on business in Queensland where notices can be sent, and must notify the chief executive of any changes, additions or cessation of that business address (s36) SIIA, 18C (Cth) Only corporations can operate a credit reporting business defined in S6 as a business involving preparation or maintenance of records containing personal information relating to individuals for the purpose of providing to other persons information on an individuals eligibility, history or capacity to repay credit (max penalty $30,000) S18D (Cth) seeks to ensure no person other than a corporation gives personal information to a credit reporting agent, when information is intended to be used in the course of carrying on a credit reporting business (max penalty $12,000) S18E(I) (Cth) - Only certain relevant information, necessary to identify an individual is to be included in an individual's credit information file such as details of requests for credit reports and overdue payments. S18E(2) (Cth) - No individual's credit information file is to contain political, social, religious beliefs, criminal or medical records, race, ethnic or national origins, sexual preferences or practices, or lifestyle, character or reputation The Qld Act does not specify information permitted (or not) on individual files. Page 1 of7 Deletion of information information files from credit ~ ~ Accuracy and security of credit information files and credit reports ~ Agent must ensure individual can obtain access to hislher file and credit reports ~ Alterations of credit information files and credit reports ~ Limits on disclosure of personal information by credit reporting agents Permissible purposes of reports ~ ~ Both Acts provide for deletion of stale information. 824 (Qld) only requires the agent to go through records once a year, to delete any reference to anything that happened more than 5 years ago, not including convictions a of fraud or dishonest (no prescribed penalty) 818F (Cth) is specific and provides maximum permissible periods for keeping different information ie. 14 days after credit provider is no longer a current credit provider to the individual; 5 years for information that a credit provider or mortgage insurer have sought a credit report or for an overdue payment; and 7 years for bankruptcy information (no prescribed penalty) 824 (Qld) only specifies deletion of stale information (above) 8 18G (Cth) states a credit reporting agency must take reasonable steps to ensure personal information in its possession or control of the agent is accurate, up-todate, complete and not misleading; information must be secured against unauthorised use, modification or disclosure (no prescribed penalty) Qld does not specify that an individual can obtain access to hislher file (unless credit is refused as a result of information in a credit report - s17). 8 18H (Cth) requires agent to take reasonable steps to make sure individuals can access their file (no prescribed penalty) Qld only refers to deletion of stale information (s24) 818J (Cth) states the agent must take reasonable steps to make corrections, deletions or additions, to ensure accurate up-to-date, complete information which is not misleading is contained on an individual's file (no prescribed penalty) 816 (Qld) provides reports are only permissible if written instructions have been given from the individual concerned; or to a person the agent believes will use the information in connection with a credit transaction involving the individual concerned (no prescribed penalty) 8 18K (Cth) is specific as to when an agency can disclose personal information, such as when the individual has applied for credit, insurance or to be a guarantor, and the information is required assess the person's credit worthiness (max penalty $150,000) Page 2 of? Limits on use by credit providers of personal information contained in credit reports v' Information to be given if an individual's v' application for credit is refused Information to be disclosed by the credit reporting agent (when requested by consumer pursuant to s17) Qld does not prescribe any limitation on the use of reports, but s20 prevents unauthorised disclosure (max penalty $7500 or 5 years imprisonment) S18L states that a credit providers who has obtain a credit report can only use the report to assess an application for credit and in limited other circumstances (max penalty $150,000) S18M (Cth) and S17 (Qld) - when credit has been refused based on a credit report, the credit provider must notify the individuals of the refusal, that it was based on information contained in a credit report. The credit provider must to notify the consumer of his or her right to request the name and address of the credit agent within 14 days and states that upon request the credit provider must provide this information, and notify the agency of such. The Cth also requires the name and address of the agent be given, and the individual to be advised ofthe right to obtain access to his/her credit information maintained by the agency (no prescribed penalty) S18 (Qld) - where a consumer exercises rights under s17, the agent must disclose all information contained in the report given to the credit provider who refused credit. Where the accuracy of information is in dispute the agent must make investigations and pending the outcome, the agent must note the dispute on records; the agent must promptly delete information found inaccurate and must inform the individual of the outcome of investigation; agent may disclose the source of information so an individual can adequately refute information, but only if the agent has reasonable grounds to believe disclosure is unnecessary; specific ways to disclosure information are provided, to ensure security of information (no prescribed penalty) No similar provision exists in the Cth Act, but it allows a consumer to obtain access to his/her file under any circumstance (sI8H); and IPP7 requires a recordkeeper having possession or control of personal information to take steps to correct, delete and/or add information to ensure the record is accurate. The function carried out under s18 (Qld) would be fulfilled by the Cth requirement that all information kept is accurate and the responsibility is on the record keeper to keep it that way. Effectively, the consumer would not have to dispute information in order and have it investigated before information would be verified and eventually corrected. Page 3 of7 -------------------• Obtaining Information falsely v' v' Limits on Disclosure Unauthorised disclosure v' v' Supply offalse information v' v' Falsifying records or credit report v' Liability of credit reporting agent v' S19 (Qld) - any person who obtains information on a consumer from a credit reporting agent by any false pretence is guilty of an offence (max penalty $7,500 or 5 years imprisonment) S18T - a person must not, by false pretence, obtain access to an.individual's credit information files or reports in possession or control of a credit reporting agent or credit provider (max penalty: $30,000) S20 (Qld) is broader, stating any person who knowingly provides information concerning a consumer from the records of a credit reporting agent to a person not authorised to receive that information is guilty of an offence ($7,500 or 5 years imprisonment) Sl8N (Cth) states credit providers must not disclose contents of report unless under certain specified conditions (max penalty $150,000) S2l (Qld) - any person who knowingly supplies false or misleading information to an agent for the purpose of having that information recorded commits an offence ($7,500 penalty or 5 years imprisonment) S18D (Cth) states that only another corporation can provide personal information to the agent; and S18R (Cth) places the onus on the agent to not provide false or misleading information in a credit report (max penalty $75,000) Sl8R (Cth) - states an agent must not give false or misleading information (max penalty $75,000) The removal of the Qld provision will not lessen protection to Qld consumers, in fact, it is a greater safeguard as the agent commits an offence if it holds incorrect or misleading information, which attracts a severe penalty, and any information that is provided must come from a corporation and the record keeper in responsible for ensuring information kept is accurate (lPP7) S22 (Qld) - any person who knowingly falsifies a credit report or any records used or intended for use in relation thereto is guilty of an offence (max penalty $7,500 or 5 years imprisonment) Sl8R (Cth) -an agent must not give any person a credit report containing false or misleading information (max penalty $75,000) S23 (Qld) - an agent, user and supplier of information does not incur liability for defamation in respect of publication in good faith of any defamatory matter in the court of preparation, supply and use of a credit report and specifies instances when a publication is taken to be made in good faith Page 4 of? -------------------• Demanding payment by threats ./ Limits on use or disclosure by mortgage ./ insurers or trade msurers of personal information contained in credit reports Unauthorised disclosure Limits on use by certain persons of personal ./ information obtained from credit providers ./ False or misleading credit reports ./ ./ Unauthorised access to credit information files or credit reports ./ ./ Functions of Commissioner III relation to interferences with privacy Commonwealth Information Privacy Principles apply to all agencies having possession but not control of a record of personal information in the Commonwealth's jurisdiction -r ./ S25 (Qld) - any person who writes to any person, demanding payment of money, which contains a threat of injury or detriment in relation to the individual's credit worthiness if payment is not made commits an offence - this does not include a threat regarding the person's future availability of credit if payment is not made (max penalty $1,500 or 1 year imprisomnent) S20 (Qld) - is broader, stating any person who knowingly provides information concerning a consumer from the records of a credit reporting agent to a person not authorised to receive that information is guilty of an offence (max penalty $7,500 or 5 years imprisomnent), but it does not particularly limit the use thereof S18P (Cth) - Mortgage insurers or trade insurers obtaining personal information contained in credit reports must not use the report for any purpose other than assessing the credit risk of the individual (max penalty $150,000) S19 (Qld) - any person who obtains information on a consumer from an agent by any false pretence is guilty of an offence ($7,500 or 5 years imprisomnent). The Cth is much more specific on the limitations on use of information contained in an individual's file. S18Q (Cth) - Corporations obtaining personal information contained in credit reports must not use the report for any purpose other than for considering the credit risk of the individual (max penalty $30,000) S22 (Qld) prohibits any falsifying of reports or records (max penalty $7,500 or 5 years) S18R (Cth) - Agents must not give false or misleading credit reports (max penalty $75,000) S19 (Qld) - no person can obtain information from an agent under false pretence (max penalty $7,500 or 5 years imprisomnent) S18S (Cth) - no person can access individual's credit information files or credit reports unless access is authorised by the Act (max penalty $30,000) S27 (Cth) - Privacy Commissioner has power to fulfil certain functions in relation to Interferences with privacy Generic application ofIPPs over all Commonwealth jurisdiction Page 5 of7 -----Manner and purpose of collection of personal information Govemment legislation and policies relating to ecologically sustainable development; . > Social welfare and equity considerations, including community service obligations; > Govemment legislation and policies relating to matters such as occupational health and safety, industrial relations and access and equity; > Economic and regional development, including employment and investment growth; . > The interests of consumers generally or of a class of consumers; > The competitiveness of Australian businesses; and > The effective allocation of resources. I I I• I I I I I I I I I I I I I I I I I I 4. During the course ofthe review, the Office of Fair Trading will consider: ~ ~ ~ whether existing levels of regulation are appropriate and alternative options for the regulation of credit reporting agents and suppliers oflistening devices (including the impact of deregulated markets on stakeholders); the impact ofthe developing regulatory environment for the protection of privacy; and having regard to and making use ofthe Queensland Govemment Legislative Review Guidelines. 5. Advice will be sought from the Office of the Privacy Commissioner (C'wlth) on the capacity of existing Commonwealth regulation to meet the regulatory objectives of the lOP Act. AIl other consultation will be conducted through meetings with affected stakeholders considering issues papers outlining: • • • •. current states of regulation; continuing relevance of regulatory objectives; alternative methods of achieving objectives; potential impacts of alternative regulatory methods. 6. On completion ofthe review, a report on the outcomes will be provided to Queensland Treasury, and advice provided to the Minister for consideration. Outcomes will then be submitted to Cabinet if appropriate. Legislation to be reviewed 7. It is proposed to review the Invasion ofPrivacy Act 1971 and the Invasion ofPrivacy Regulation 1986. The Invasion ofPrivacy Act 1971 was enacted for the purpose of providing protection against unwarranted invasions of privacy by: • the licensing of credit reporting agents; • the licensing ofprivate inquiry agents; • the regulation of entry to dwelling houses; and • the regulation of the use and supply of listening devices. The introduction of the Security Providers Act 1993 subsequently removed provisions relating to the regulation of private inquiry agents from the lOP Act. Restrictive provisions contained within the Act are as follows: • • • • Licensing I licence renewal requirements for credit reporting agents; Limitations on the business conduct of credit reporting agents including purposes of reports, storage of information and obligations to individual consumers; Limitations on where a credit reporting agent business may be located; and Prohibition on advertisingfor the sale of listening devices or exhibiting listening devices with 2 the intention of promoting its sale or use. 8. Review Arrangements It is proposed that a minor desk top review be conducted within the Legislative Review Unit of the Office of Fair Trading. A social impact assessment and an employment impact statement will be prepared and the . Government's priority outcomes for Queensland will be considered as an integral part of the review process. 9. Timing of the Review It is anticipated that the review process will be completed and a final report and recommendations fmalised by June 2000. 3