Changes to the Credit Reporting Privacy Code have been issued by the Privacy Commissioner John Edwards. Amendment No 14 to the Code will provide enhanced consumer rights, keep the system fair for consumers and improve enforcement and compliance.
The changes mean that credit reporting companies will be prohibited from bundling requests for consents to additional unrelated uses or disclosures of credit information into their processes enabling individuals to exercise their statutory rights. For example, when someone makes a request to a credit reporter for their credit information, the credit reporter will not be allowed to use that process to obtain consent to disclose information to a third party such as an insurer, debt collector or credit broker. ‘Bundled consents’ can be an unfair means of collection of consents, as the individual might be misled as to whether consent is voluntary and as to what is being authorised. Changes clarify that a formal request by an individual to a credit reporter to exercise Code rights of access, correction or suppression is not an opportunity to cross-sell products or seek consent to marketing, debt collection or other unrelated purposes. This concept of unbundling consents and requiring real and specific consent is in line with the GDPR compliance principles, and so reflective of international trends. To learn more about what the GDPR means in practice for NZ businesses click here, and for a GDPR compliance toolkit click here.
Loopholes will be closed by this Amendment, so that credit reporters will also be prohibited from using arrangements with related companies to circumvent the Code or to make uses or disclosures of credit information that would breach the Code – such as for the purposes of direct marketing or cross-selling products.
The changes strengthen and broaden the existing prohibitions on the use of credit information by credit reporters for marketing or the facilitation of marketing by others. Various safeguards are included to ensure best privacy practice and to support responsible lending.
Other changes include:
Most of the changes come into force on 1 April 2019.
If you want to know more about data privacy, consumer law and marketing contact Hayley Miller and Gretchen Fraser.
05.02.19 Government seeking feedback on proposed supplier code of conduct
23.01.19 Strong recognition in the 2019 Asia Pacific legal directories
20.11.18 GDPR you compliant? A note on the first extra-territorial action taken under the GDPR
06.11.18 Have you got a plan?
10.07.18 Privacy Law Submission to Parliament on the Privacy Bill
07.06.18 Privacy – Hear the latest legal changes and what they mean for you
06.06.18 If GDPR applies to your business – what should you do?