Veda Advantage calls for Privacy Law to keep pace with digital data explosion
Australia’s Privacy Regulation has not been updated for more than a decade, and is currently being reviewed by the Australian Law Reform Commission (ALRC).
Veda Advantage has a depth of experience managing sensitive data, and has worked within the boundaries of the Australian Privacy Act longer than any other company. We believe the current Federal Privacy legislation needs to be updated to keep pace with the rapid changes in technology, and to better address the needs of Australian consumers and business.
Veda Advantage recently made two submissions to the Australian Law Reform Commission (ALRC) calling for reform of Federal Privacy law to create stronger data governance standards and bring our Australian system into line with international best practice by allowing consumers to be assessed on their full financial merits when it comes to credit checking.
Both our submissions are based on the need to achieve simultaneous improvements in the free flow of information and consumer data protection – which is a fundamental challenge of the new information economy.
You can view our submissions at: Veda Advantage ALRC IP32 Submission March 2007.pdf. We welcome your feedback.
ALRC Submission One: Data and the Information Economy
There has been an explosion in the amount of personal information that is captured and shared across organisations and geographical borders in our new digital economy, driving innovation and value creation, but raising new privacy challenges. Our first submission covers the need to create stronger data governance standards to respond to these challenges whilst allowing business and consumers to reap value from the information economy.
Key recommendations raised in our submission include:
Introduce voluntary data governance standards for organisations which handle sensitive personal data in ‘information networks.’ Create a voluntarily entered, but then binding, transparent and enforceable standard in the handling of data specific to an organisation. Place greater obligations on organisations which aggregate data – these organisations should publicly outline their approach to the collection, use and disclosure of personal data. The Privacy Act should recognise the indirect collection of data from individuals in information networks – and introduce a means of notifying consumers about indirect, or third party, collection of personal details. The Act should explicitly recognise a principle of proportionality and prevention of harm, directing business and regulators’ energy towards areas of higher risk (for example: genetic information provided to a health insurer versus a name and address provided to a raffle operator), with “higher obligations” for some data controllers - depending on the amount and range of data sharing and the degree of risk Harness emerging technologies such as portable digital signatures and other forms of digital identity to allow consumers to manage their own ‘portfolio’ of data collection consents (this is particularly important in the case of bundled consents). Strengthen guidelines for assisting and monitoring trans-border data flows - including the monitoring of compliance by the Privacy regulator, special contractual provisions, and appropriate consumer notification procedures. Recognise the value of historical data to the economy and to personal and national security – in particular as a means of combating identity fraud, money laundering, terrorism funding and general fraud risk. Create a transparent enabling mechanism for appropriate access and “novel” use of historical data beyond the current 5 – 7 year access expiry period.
ALRC Submission two: Comprehensive Credit Reporting
Veda Advantage’s second submission to the ALRC review supports an approach that allows Australia to adopt best practice credit reporting, and also recognises the role of a comprehensive reporting system in promoting responsible lending.
The submission highlights overseas experience which demonstrates that comprehensive credit reporting can provide an effective foundation for more responsible lending and can also lead to more efficient credit markets and to cost savings which can be passed onto consumers. Most OECD countries have a positive or comprehensive credit reporting model in place, with Australia, New Zealand and France amongst the only countries who continue to maintain a negative reporting system.
Summary points and recommendations raised in our submission include:
A re-written Privacy Code should contain more detail regarding preventing harmful uses of credit reporting data – and strengthen obligations on credit reporting agencies to ensure data quality, data security and effective compliance with privacy requirements. The future system should record and allow lenders to acknowledge a positive credit history – in particular outstanding balances and re-payment history should be considered when making lending decisions. The current system restricts accurate assessment of an individual’s credit approval history and total credit obligations. It also penalises those who may “shop around” for credit. Australian credit files should include details such as: the type of credit, the credit provider, the date a credit account was opened, the credit limit, the outstanding balance and the re-payment history. This would allow business to more effectively assess the level of risk of each customer. Currently credit files cannot be effectively accessed to aid in identity verification and/or the prevention of identity fraud – which costs Australians and the Australian economy more than $ 1 billion annually. Access to a wider range of public databases such as driver’s licence registries and Births, Deaths and Marriages information to verify elements of an individual’s identity would facilitate a faster, more secure service – proactively reducing the incidence of identity theft.
Veda Advantage acknowledges the positive reporting debate, like most privacy-related issues, has a propensity to be sensationalised. Any amendments would need to allow for the free flow of information, with inbuilt consumer data protection standards and systems. It is our recommendation that information kept on credit reports would only be accessible to authorised institutions – and that an organization-specific, binding, transparent and enforceable standard should be introduced to business.
The credit reporting debate is often oversimplified to a choice between “partial” and “full” comprehensive reporting. However, almost all credit providers agree that the more complete and current the credit risk information, the greater the quality of our lending decisions.
Veda Advantage believes a partial reporting model disadvantages Australian consumers by limiting their ability to build an appropriate history of good credit management. A partial model would also encourage inconsistent record keeping across the industry, which can impact on accuracy and efficiency – and ultimately create poor economic outcomes.
Veda Advantage believes Australia must aim for an international best practice model which allows decision makers access to the amount of credit data required to adequately inform markets, and to protect consumers from incorrect decisions. We support the completion of a detailed, independent, data study to identify the most appropriate best practice model within the Australian environment. .
For further information, please contact: Matthew Walker on 02 9951 7646
|