The notice that comes before the check

C.1 · The list

What the notice must cover

Section 21C of the Privacy Act sets the first item, and paragraph 4(3) of the Privacy (Credit Reporting) Code 2025 adds the rest. In our words, a lender must tell you, or otherwise make sure you are aware of:

• the name and contact details of the credit reporting body it is likely to disclose to s 21C(1)
• for an information request, that your consent to it isn’t required 4(3)(a)(i)
• that a record of the request may be used to assess your creditworthiness, including in working out a credit score or rating 4(3)(a)(ii)
• in general terms, how the request may affect a score or rating the body calculates 4(3)(a)(iii)
• that the body may include the information in reports it gives credit providers to help them assess you 4(3)(b)
• that if you don’t meet your payment obligations, or commit a serious credit infringement, the lender may be entitled to tell the body 4(3)(c)
• how to get the lender’s policy on credit-related personal information, and the body’s 4(3)(d)
• your rights to get the information from the lender, ask it to correct the information, and complain to it 4(3)(e)
• your rights to ask the body not to use your information to pre-screen direct marketing, and not to use or disclose it if you believe on reasonable grounds that you are, or are likely to be, a victim of fraud 4(3)(f)

The last item names two requests you can make of a credit reporting body. File G covers pre-screening and File E covers bans.

C.2 · How

How it usually reaches you

The code lets a lender meet the duty in a set way, in four parts. In order:

1. On its website

   A statement of notifiable matters

   The lender publishes a clearly expressed statement of the matters above on its website.

2. When it collects your information

   A pointer and a summary

   At or before collection, it tells you that its website has information about credit reporting, including the bodies it is likely to disclose to, and gives a brief description of the key issues in the statement.

3. On the page itself

   Prominent, and easy to find

   It gives you the website’s details, and the matters must be prominently displayed there.

4. If you ask

   Another form

   It makes clear that you can ask for the statement in another form, such as a hard copy.

The OAIC describes the same practice from the outside: to meet the notification rules, credit providers generally publish a statement of notifiable matters and a privacy policy on their websites.

C.3 · The policy

The credit reporting policy behind it

If the lender is an APP entity, bound by the Australian Privacy Principles, this notice comes on top of the collection notice Australian Privacy Principle 5 already requires, and section 21C(3) adds credit matters to that one: that the lender’s credit reporting policy explains how you can get access to the credit eligibility information it holds, how you can ask for a correction, how you can complain if it breaks the credit reporting rules, and how it will deal with that complaint.

The notice must also say whether the lender is likely to disclose credit information or credit eligibility information to entities without an Australian link and, where it is practicable to say so in the policy, the countries they are likely to be in.

C.4 · Consent

Where notice isn’t enough

Notice covers the ordinary case: a credit provider checking your report to assess your own application for consumer credit. Some checks need more than that.

Consumer credit, in the OAIC’s terms, includes credit you mean to use wholly or mainly for personal, family or household purposes, and credit to buy, maintain, renovate or improve residential property for investment.