Financial Rights Legal Centre Inc. & Others and Veda ... · Veda Advantage Information Services and Solutions Ltd (Veda) interfered with the privacy of the class of individuals identified

Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd [2016] AICmr 88 (9 December 2016) Decision and reasons for decision of Australian Privacy Commissioner, Timothy Pilgrim

Complainants: Financial Rights Legal Centre Inc

Consumer Action Law Centre

Financial Counselling Australia

Australian Privacy Foundation

Respondent: Veda Advantage Information Services and Solutions Ltd

Decision date: 9 December 2016

Application number: CP14/03515, CP14/04469, CP14/04470

Catchwords: Privacy — Privacy Act 1988 — Part IIIA — Privacy (Credit Reporting)

Code 2014 (Version 1.2) — APP 7

https://www.oaic.gov.au/

Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 2

Contents

Determination ................................................................................................................ 4

Background .................................................................................................................... 4

The Veda Group .............................................................................................................. 5

The Law .......................................................................................................................... 5

Terminology ................................................................................................................... 8

The complaints ............................................................................................................... 9

Representative complaints ............................................................................................10

First representative complaint .......................................................................................11

Second representative complaint ...................................................................................11

Third representative complaint ......................................................................................13

Investigation process .....................................................................................................14

The first complaint .........................................................................................................14

Veda’s websites .............................................................................................................14

The prominence issue ....................................................................................................17

Findings in relation to prominence issue ........................................................................18

The online access issue ..................................................................................................23

Findings in relation to online access issue ......................................................................25

The phone access issue ..................................................................................................39

Findings in relation to the phone access issue ................................................................41

The onerous identification issue ....................................................................................43

Findings in relation to the onerous identification claim ..................................................45

The second complaint ....................................................................................................46

The timing issue .............................................................................................................46

Findings in relation to timing issue .................................................................................47

The direct marketing issue .............................................................................................47

Findings in relation to the tick box 1 ...............................................................................51


Findings in relation to tick box 2.....................................................................................55

The third complaint .......................................................................................................56

The 12-month issue .......................................................................................................56

Findings in relation to 12-month issue ............................................................................58

Expedited delivery .........................................................................................................60

The excessive charge issue .............................................................................................61

Findings in relation to excessive charges issue ................................................................62

The VedaScore issue ......................................................................................................64

Findings in relation to the VedaScore claim ....................................................................67

Declarations ..................................................................................................................70


Determination 1. Veda Advantage Information Services and Solutions Ltd (Veda) interfered with the privacy of the class of

individuals identified as ‘members of the public seeking to access a free copy of their credit report from

Veda Advantage’ in breach of the Privacy Act 1988 (Cth) (Privacy Act) by:

I. failing to prominently state that individuals have a right to obtain their credit reporting information

free of charge in certain circumstances, in contravention of paragraph 19.3(a) of the Privacy (Credit

Reporting) Code 2014 (version 1.2) (CR code)

II. failing to take reasonable steps to ensure that free access to credit reports was as available and as

easy to identify and access as paid access to credit reports, in contravention of paragraph 19.3(b) of

the CR code

III. using and disclosing personal information it held about individuals seeking free access to credit

reports for the purpose of direct marketing in breach of Australian Privacy Principle (APP) 7

IV. charging for the ‘expedited delivery’ of a credit report in breach of s 20R(5), in circumstances where

the individual (or access seeker) had not sought access to credit reporting information within the

preceding 12-month period.

Background

2. This determination relates to three representative complaints (the complaints) made under Part V of the

Privacy Act. The complaints are made jointly by consumer advocacy groups, Financial Rights Legal Centre

Incorporated, the Consumer Action Law Centre, Financial Counselling Australia and the Australian Privacy

Foundation (complainants) on behalf of a class of individuals identified as ‘members of the public seeking

to access a free copy of their credit report from Veda Advantage’ (class members, hereafter also referred

to as access seekers). The respondent to the complaint is Veda Advantage Information Services and

Solutions Limited (Veda).

3. It is complained that a number of Veda’s acts and practices relating to the provision of credit reporting

information (CRI), are in breach of the Privacy Act and the CR code.

4. Specifically, the complaints relate to alleged breaches of:

(a) section 20R of the Privacy Act (access to credit reporting information)

(b) APP 7 (direct marketing) under the Privacy Act; and

(c) paragraphs 19.3 and 19.4 of the CR code (access).


The Veda Group

5. The Veda Group Limited is an information services and aggregation business. It comprises a number of

separate companies, including the respondent in this matter, Veda Advantage Information Services and

Solutions Limited, which operates a credit reporting business. The respondent is a ‘credit reporting body’

under the Privacy Act1, and is the major credit reporting body in Australia. According to its website, Veda

is a ‘data analytics company and the leading provider of credit information and analysis in Australia and

New Zealand’.2

6. Veda collects, holds, uses and discloses information about individuals and corporations for the purpose of

providing information about the creditworthiness of an individual or corporation. It holds data on more

than 16.4 million individuals and 3.6 million companies and businesses.3 In February 2016, the Veda

Group Limited was acquired by Equifax Incorporated, a leading consumer credit reporting agency in the

United States and ‘a global leader in consumer, commercial and workforce information solutions’.4

The Law

7. The credit reporting provisions in Part IIIA of the Privacy Act govern the handling of information held by

credit reporting bodies (CRBs) and credit providers (CPs) relating to credit reporting.

8. Section 20R of the Privacy Act deals with access to credit reporting information. It relevantly states:

Access

(1) If a credit reporting body holds credit reporting information about an individual, the body must, on request by an access seeker in relation to the information, give the access seeker access to the information.

and

Dealing with requests for access

(3) The credit reporting body must respond to the request within a reasonable period, but not longer than 10 days, after the request is made.

(4) If the credit reporting body gives access to the credit reporting information, the access must be given in the manner set out in the registered CR code.

1 Under s 6(1) of the Privacy Act 1988 (Cth), credit reporting body is defined to mean: (a) an organisation, or (b) an agency

prescribed by the regulations; that carries on a credit reporting business.

2 https://www.veda.com.au/about-us. Accessed 10 August 2016.

3 https://www.veda.com.au/business. Accessed 10 August 2016.

4 https://www.veda.com.au/insights/equifax-completes-acquisition-australias-leading-credit-information-company-veda-group. Accessed 10 August 2016.

https://www.veda.com.au/about-us

https://www.veda.com.au/business

https://www.veda.com.au/insights/equifax-completes-acquisition-australias-leading-credit-information-company-veda-group


Access charges

(5) If a request under subsection (1) in relation to the individual has not been made to the credit reporting body in the previous 12 months, the body must not charge the access seeker for the making of the request or for giving access to the information.

(6) If subsection (5) does not apply, any charge by the credit reporting body for giving access to the information must not be excessive and must not apply to the making of the request.

9. APP 7 deals with direct marketing. It states:

7.1 If an organisation holds personal information about an individual, the organisation must not use or disclose the information for the purpose of direct marketing.

The relevant exceptions to this is set out in APP 7.3:

7.3 Despite subclause 7.1, an organisation may use or disclose personal information (other than sensitive information) about an individual for the purpose of direct marketing if:

(a) the organisation collected the information from:

(i) the individual and the individual would not reasonably expect the organisation to use or disclose the information for that purpose; or

(ii) someone other than the individual; and

(b) either:

(i) the individual has consented to the use or disclosure of the information for that purpose; or

(ii) it is impracticable to obtain that consent; and

(c) the organisation provides a simple means by which the individual may easily request not to receive direct marketing communications from the organisation; and

(d) in each direct marketing communication with the individual:

(i) the organisation includes a prominent statement that the individual may make such a request; or

(ii) the organisation otherwise draws the individual’s attention to the fact that the individual may make such a request; and

(e) the individual has not made such a request to the organisation.

10. The CR code is a written code of practice about credit reporting under s 26N(1) of the Privacy Act. Under

s 26L of the Privacy Act, if an entity is bound by the registered CR code it must not do an act or engage in

a practice that breaches the code.


11. The CR code adds to aspects of the credit reporting obligations imposed by Part IIIA, relevantly here,

obligations relating to access:

19. Access

19.3 If a CRB has a service whereby an individual (whether personally or through another access seeker) may

for a fee obtain their credit reporting information (fee-based service):

a. the information made available by the CRB about the fee-based service must prominently state that individuals have a right under Part IIIA to obtain their credit reporting information free of charge in the following circumstances:

i. if the access request relates to a CP's decision to refuse the individual's consumer credit application;

ii. if the access request relates to a decision by a CRB or CP to correct credit reporting information or credit eligibility information about the individual; and

iii. once every 12 months (this is in addition to any access given in accordance with

paragraphs 19.3(i) or (ii))

b. the CRB must take reasonable steps to ensure that its service, whereby individuals may obtain their credit reporting information free of charge, is as available and easy to identify and access as its fee-based service.

Source Notes: Sec 20R, 21T

19.4 Where credit reporting information is provided to an access seeker free of charge by a CRB as required

by Part IIIA, the Regulations or this CR code:

a. the CRB must provide the access seeker with access to:

i. all credit information in relation to the individual currently held in the databases that the CRB utilises for the purposes of making disclosures permitted under Part IIIA; and

ii. all current CRB derived information about the individual that is available;

b. the CRB must present the information clearly and accessibly and provide reasonable explanation and summaries of the information to assist the access seeker to understand the impact of the information on the individual's credit worthiness; and

c. if the CRB does not provide the information to the access seeker in the manner requested by the access seeker, the CRB must take reasonable steps to provide access in a way that meets the needs of the CRB and the individual.

Source Notes: Sec 20R, Explanatory Memorandum p.178

12. Section 13 of the Privacy Act provides that an act or practice of an entity is an interference with the

privacy of an individual if:

(a) the act or practice breaches a provision of Part IIIA in relation to personal information about the individual; or

(b) the act or practice breaches the registered CR code in relation to the personal information about the individual and the code that binds the entity.


Terminology

13. The term ‘credit report’ which I refer to on various occasions in this determination and which appears

numerous times in correspondence from the complainants and Veda, is not a term used in the Privacy

Act or the CR code.

14. The appropriate term for an individual’s credit report is ‘credit reporting information’, which is defined

in s 6 of the Act to be: ‘... credit information, or CRB derived information, about the individual’.5

15. Credit information is defined in the Privacy Act at s 6N. There is no need to replicate the full definition

here, suffice to say that it is personal information about an individual (other than sensitive information)

that is, relevantly:

……..

(b) consumer credit liability information about the individual; or

(c) repayment history information about the individual; or

…….

(e) the type of consumer credit or commercial credit, and the amount of credit sought in an application;

i. that has been made by the individual to a credit provider; and

ii. in connection with which the provider has made an information request in relation to the individual; or

(f) default information about the individual; or

(g) payment information about the individual; or

……

16. Under subsection 6(1) of the Privacy Act, CRB derived information means any personal information

(other than sensitive information):

a. that is derived by a credit reporting body from credit information about the individual that is held by the

body; and

b. that has any bearing on the individual’s credit worthiness; and

c. that is used, has been used or could be used in establishing the individual’s eligibility for consumer

credit.

17. Personal information is defined in section 6(1) of the Privacy Act to mean information or an opinion

about an identified individual, or an individual who is reasonably identifiable:

a. whether the information or opinion is true or not; and

b. whether the information or opinion is recorded in a material form or not.

5 Privacy Act 1988 (Cth), s 6(1).


18. Over the years the provision of credit information to individuals by CRBs has generally been coined as

access to your ‘credit file’ or ‘credit report’. For convenience and comprehensiveness, I have used the

term ’credit report’ interchangeably with ‘credit reporting information’. Accordingly, where I have used

the term ‘credit report’ in the context of access to credit reporting information, I am referring to a

report provided to an individual by a CRB that includes all credit information about the individual and all

CRB derived information about the individual held by the CRB at the time of the request.

The complaints

19. The first complaint lodged on 15 August 2014 alleges that in contravention of section 19.3 of the CR

code:

(a) Veda has failed to prominently state that individuals have a right to obtain their credit reporting

information free of charge in certain circumstances (the prominence issue); and

(b) Veda has not taken reasonable steps to ensure that free access to credit reports online is as

available and as easy to identify and access as paid access to credit reports (the online access

issue); and

(c) individuals are not able to obtain a free credit report from Veda over the phone, but credit

reports issued via a fee-based service are available over the phone (the phone access issue); and

(d) Veda’s identification requirements to obtain a free credit report are more onerous than those for

credit reports issued via a fee-based service (the onerous identification issue).

20. The second complaint was lodged 20 October 2014 subsequent to Veda making free credit reports

available online on the Veda website by completing a form. The complainants allege that:

free credit reports are not being provided by Veda within the 10 day requirement under s 20R(3)

of the Act (the timing issue); and

tick boxes on Veda’s online application form for a free credit report lead to the marketing of

Veda’s fee-based services, in breach of APP 7 (the direct marketing issue). 6

21. The third complaint lodged on 20 October 2014 alleges that:

6 In their complaint dated 20 October 2014, the complainants identified as an issue the inconsistencies between free credit report

information on Veda’s ‘my credit file’ website, and the actual process of applying online for free credit report. In its submission dated 20 April 2005, Veda declared that the information on the ‘my credit file’ website had been corrected. The complainants confirmed this in their response to Veda’s submission. I understand that the claim regarding the discrepancy is no longer in issue, having been adequately dealt with.


Veda is charging for access even when an individual has not requested a credit report within the

previous 12 months in contravention of s 20R(5) of the Privacy Act (the 12-month issue)

Veda is charging for the ‘expedited delivery’ of a credit report, in breach of s 20R(5), in

circumstances where the access seeker had not sought access to credit reporting information

within the preceding 12-month period (expedited delivery issue); and

the cost of a Veda credit report issued through its fee-based service is excessive, in contravention

of s 20R(6) of the Privacy Act (the charge issue) ; and

Veda does not include the individual’s VedaScore information in a free credit report, in

contravention of s 19.3(b) and 19.4(a) of the CR code (the VedaScore issue).

Representative complaints

22. The complaints have been made under s 36 of the Privacy Act, which provides for the making of

representative complaints. Additionally a representative complaint must meet the requirements of s 38

of the Privacy Act.7

23. Section 38(1) states that a representative complaint may be lodged under s 36 of the Privacy Act only if:

(a) the class members have complaints against the same person; and

(b) all the complaints are in respect of, or arise out of, the same, similar or related circumstances; and

(c) all the complaints give rise to a substantial common issue of law or fact.

24. Section 38(2) sets out further conditions for a representative complaint to be made. Specifically, it states that the representative complaint must:

(a) describe or otherwise identify the class members; and

(b) specify the nature of the complaints made on behalf of the class members

(c) specify the nature of the relief sought; and

(d) specify the questions of law or fact that are common to the complaints of the class members.

7 Section 36(2A) of the Privacy Act states that in the case of a representative complaint, s 36 has effect subject to s 38.

8 Veda’s submission to the OAIC, 20 April 2015.

http://www.austlii.edu.au/au/legis/cth/consol_act/pa1988108/s38.html

http://www.austlii.edu.au/au/legis/cth/consol_act/pa1988108/s36.html


25. Veda has raised objections to the complaints being treated as representative complaints because, Veda

argues, the complaints have been made by the aforementioned consumer advocacy groups on behalf of

individuals who have complained to them about acts or practices that may be an interference with their

privacy.8

26. A person on behalf of an individual or individuals, as well as individuals themselves, can make a

complaint under s 36 of the Privacy Act. I am satisfied that the complaints received were validly made

under s 36. In respect of whether or not the complaints meet the requirements under s 38 of the Privacy

Act for representative complaints, I will consider each complaint in turn.

First representative complaint

27. I am satisfied that in respect to the first complaint, the requirements for making a representative

complaint under s 38 have been met. Though this complaint deals with a wide range of issues, I am

satisfied that the claims made are connected by circumstances sufficiently related to warrant their

grouping as a representative complaint. All class members are affected in common by Veda’s practices

surrounding its services to provide access to credit reporting information free-of-charge. The

complainants allege inequities between accessing credit reporting information free-of-charge and

accessing this information through Veda’s fee-based service. This raises questions as to whether these

practices are in contravention of s 19.3 of the CR code.

28. The complainants on behalf of all class members seek a declaration that Veda must take action to ensure

that its provision of free-of-charge access to credit reporting information is as available, and as easy to

identify and access as its fee-based services.

Second representative complaint

29. The second complaint made on 20 October 2014 similarly includes a varying range of issues, this time

relating to the use of Veda’s online application form to lodge a request for a free credit report.

30. One of the issues raised with this second complaint is the claim that class members were not receiving

free-of-charge access to their credit reporting information within the 10-day period mandated by s 20(3)

of the Privacy Act (the timing issue).

31. Veda objects to the timing issue being included within the scope of the second complaint because the

complainants have based its inclusion on a single instance of a credit report not being received within 10

days.8 Veda submits that the timing issue should be treated as a separate complaint by the concerned

individual under s 36(1) of the Privacy Act.9

8 Veda’s submission to the OAIC, 20 April 2015, 8-9, [6.1]-[6.2].

9 Veda’s submission to the OAIC, 20 April 2015,9, [6.6].


32. The complainants have confirmed the inclusion of this issue within the second complaint was based on a

single instance of a credit report being provided outside the 10-day requirement. The complainants

argue that it is reasonable to assume there may have been other instances where the statutory

timeframe has not been met.10

33. Under s 38, I must be satisfied that all the complaints are in respect of, or arise out of, the same, similar

or related circumstances, and all the complaints give rise to a substantial common issue of law or fact.

34. Veda points out there is nothing in the complaint that establishes:

that there are any class members with complaints against Veda in respect of, or arising out of, the

same or similar or related circumstances as the timing issue; or

that there are any complaints by class members that give rise to a substantial common issue of

law or fact as the timing issue.11

35. I disagree. Firstly, I note that the Privacy Act has a remedial purpose, and the purpose of representative

procedures is to reduce the need for multiple complaints. I further note that all the complaints by class

members under this representative complaint arise out of attempts to lodge an online application form

on Veda’s website to access credit reporting information free-of-charge. Class members are therefore

affected by a common circumstance. Veda is alleged in this complaint of having an online process in

place that disadvantages class members who are applying online for a free credit report over those

customers who apply online for their credit reporting information through one of Veda’s paid services.

There is a substantial common issue of fact: do impediments in fact exist for class members applying

online for a free credit report that don’t exist for those customers who pay a fee to access the online

service?

36. The fact that both the class member who is complaining of receiving their free credit report out-of-time

after lodging an application for one online, and the class member who is complaining of having to tick

boxes during the online application process that allegedly results in direct marketing activity, are having

difficulties with Veda’s free credit report online access service is, in my view, enough to constitute a

common issue of fact. The differences in the circumstances do not in my opinion prevent them from

being included in a representative complaint.

37. I am therefore satisfied that in respect of the second complaint, the requirements for the making of a

representative complaint under s 38 have been met.

10 Complainants’ submission in reply to the OAIC, 15 June 2015, 13, [46].

11 Veda’s submission to the OAIC, 20 April 2015, 9, [6.4].


38. In relation to representative complaint two, the complainants on behalf of all class members seek a

declaration that Veda must take action to ensure that:

I. Veda has systems in place that prevent delays in providing requested free credit reports

II. Veda collects and maintains records for the monitoring of its compliance with s 20R of the

Privacy Act; and

III. a request for a free credit report is not used as a direct marketing opportunity in

contravention of APP 7.

Third representative complaint

39. In the third representative complaint, class members are allegedly affected by the practices of Veda in

relation to credit report charges:

paying for access to credit reporting information that should otherwise be free-of-charge

paying an excessive charge for credit reporting information

receiving less credit reporting information in Veda’s free credit report compared to the

information provided with a paid report.

40. The remedy sought by the complainants is a declaration by the Commissioner that:

I. Veda’s charge in relation to credit reporting information is excessive

II. that Veda provide its actual costs relating to the issuing of credit reporting information, and the

$79.95 amount charged by Veda be reduced to that amount; and

III. VedaScore information be provided in the free credit report.

41. In this third representative complaint, the circumstances of class members are tied by a common

integer; that is, the entitlement to credit reporting information free of charge and what comprises that

entitlement. I am satisfied that the issues outlined in this third complaint are sufficiently related to

warrant dealing with this as a representative complaint for the determination of the common issue so

defined. In respect of this third complaint, the requirements for the making of a representative

complaint have been met.


Investigation process

42. The investigation of these representative complaints involved the following steps:

11 November 2014 — correspondence to Veda regarding the opening of an investigation

under s 40(1) of the Act

11 March 2015 — correspondence to Veda initiating the s 52 determination process

20 April 2015 — Veda’s initial submissions received

21 April 2015 — Veda’s initial submissions provided to the complainants

15 June 2015 — the complainant’s submissions received

30 March 2016 — OAIC representatives make an onsite visit to Veda’s premises to observe

firsthand how certain processes occur.

The first complaint

Veda’s websites

43. Veda maintains two websites, available at the domain names <www.veda.com.au> (the Veda website)

and <www.mycreditfile.com.au> (my credit file website).

44. Customers looking to obtain copies of their Veda credit reports can do so through the Veda website by

clicking on the ‘Get Your Credit Report’ button. This button re-directs users to the my credit file website.

45. At the relevant time12 the my credit file website detailed a caption beneath its ‘My Veda Alert’ heading,

which read as follows (figure 1):

‘My Veda Alert - Get your credit report to help ensure your credit history is accurate and up to date. Your credit file

will be despatched in one working day. You also receive email alerts whenever specific changes occur on your credit

file for 12 months. Buy Now $79.95’13

12 For the purposes of this determination, I shall accept as the time of the alleged breach, the date of the initial complaint on 15

August 2014 or thereabouts.

13 Initial representative complaint about Veda Advantage to the OAIC, 15 August 2014, 3.

http://www.veda.com.au/

http://www.mycreditfile.com.au/


Figure 1 — Veda’s my credit file homepage

46. The complainants allege that a class member must scroll down the web page through a list of fee-for-

service options before being alerted by a button with the words ‘Free file, Find out more’ that they may

be able to access a free copy of their credit report (figure 2).


Figure 2 — first appearance of the option to get a free credit report


The prominence issue

47. Under paragraph 19.3(a) of the CR code, information made available by the CRB about the fee-based

service must prominently state that access seekers have a right to obtain, on request, their credit

reporting information free of charge in certain circumstances including once every 12 months.

48. The complainants argue that information made available on Veda’s websites about its paid services do

not prominently outline access seekers’ right of free access to credit reporting information in certain

circumstances. The complainants contend that on the my credit file website, although the ‘paid report’

option is very prominent, the ‘free report’ button is below the fold-line (see figure 2), and the statement

about the rights of access seekers to free reports is not prominent.

49. Veda on the other hand argues that it meets the requirements of paragraph 19.3(a) of the CR code:

‘both free and paid services are prominently identified, and available and accessible from the home page of the

website. The ‘free report’ button is prominent and physically close to the information regarding the paid service.’14

50. Veda contends that the correct interpretation of paragraph 19.3(a) in the context of a website-based

service, having regard to the purpose of the provision ’to give visibility to the rights to credit reporting

information free of charge’, is that the phrase ‘the information made available by the CRB about the fee-

based service’ means information made available on the website as a whole:

‘The paragraph does not require the placement of the specified statement regarding free reports, or a “free

report” button at every single instance where information regarding a fee-based service appears on a website.

This would be an absurd and unreasonable interpretation, which goes beyond the object or purpose of the

paragraph. Once a user is alerted to the possibility of a free report, the user does not then need to be reminded at

every step that a free report is available….

‘By analogy, in the circumstances of a hard copy brochure regarding a fee-based service, paragraph 19.3(a) could

not reasonably be interpreted to require multiple prominent statements regarding free reports, appearing in each

paragraph of the brochure where information regarding a fee-based service appeared.’

51. In this respect Veda notes that the first two relevant links to credit reports on the Veda website

homepage, entitled ’get your credit report’, link to the my credit file website, which contains a

prominent ’free report’ button, and contains the information regarding free reports required by

paragraph 19.3(a) of the CR code. The your credit and identity

(www.veda.com.au/yourcreditandidentity) web page is a subpage of the Veda website, with links on the

Veda homepage that are subordinate to those for the my credit file website.21

52. The complainants contend that websites are not comparable to brochures.

14 Veda’s submission to the OAIC, 20 April 2015, 2-3, [1.4].

21 Veda’s submission to the OAIC, 20 April 2015, 5-6, [3.4]-[3.5].


http://www.veda.com.au/yourcreditandidentity


‘Websites are amorphous, are navigated via hyperlinks and can consist of many dozens of separate pages.’15

Findings in relation to prominence issue

The Veda website

53. Veda claims that the primary site for information about its paid services is its my credit file website,

which is the website that also contains the free credit report information. The your credit and identity

web page is a subpage of the Veda website. As I understand it, the Veda website at the relevant time re-

directed customers to the my credit file website if the appropriate link ‘Get Your Credit Report’ was

clicked on, but the Veda website did not otherwise contain or provide links to free credit reporting

information.

54. I have reviewed various links from the Veda website homepage around the time the complaint was

made. The following web pages were linked to the Veda website homepage and made reference to paid

services that include accessing ‘your credit report’ but did not provide any information about accessing

credit reports free of charge:

I. https://web.archive.org/web/20140707102041/http://www.veda.com.au/yourcreditandidentity/pr

oduct-comparison (link from Veda homepage by clicking onto buttons ‘Get your credit score’ and

‘Get identity watch’ as at 7 July 2014) (figure 3)


https://web.archive.org/web/20140707102041/http:/www.veda.com.au/yourcreditandidentity/product-comparison

https://web.archive.org/web/20140707102041/http:/www.veda.com.au/yourcreditandidentity/product-comparison


Figure 3 — link from Veda homepage by clicking onto buttons ‘Get your credit score’ and ‘Get identity watch’

II. https://web.archive.org/web/20140712112900/http://www.veda.com.au/yourcreditandidentity/ch

eck (link from Veda homepage by clicking onto buttons ‘Check your credit file and Veda score’ /

‘Understand your credit file and Veda score’, as at 12 July 2014) (figure 4)

Figure 4 — link from Veda homepage by clicking onto buttons ‘Check your credit file and Veda score’ /

‘Understand your credit file and Veda score’

https://web.archive.org/web/20140712112900/http:/www.veda.com.au/yourcreditandidentity/check

https://web.archive.org/web/20140712112900/http:/www.veda.com.au/yourcreditandidentity/check


III. https://web.archive.org/web/20140712151905/http://www.veda.com.au/yourcreditandidentity/im

prove/improving-your-veda-score (link from Veda homepage by clicking onto button ‘Tips to

improve your credit file and Veda score’, as at 12 July 2014) (figure 5).

Figure 5 — link from Veda homepage by clicking onto button ‘Tips to improve your credit file and Veda score’

55. From these web pages, I could not discern any information about accessing credit reporting information

free of charge, despite my attempts to investigate through a series of optional click-throughs to other

pages on the Veda website.

56. The word ‘prominent’ is not defined in the Privacy Act and in the absence of any legislative intention to

the contrary, it may be ascribed its ordinary natural meaning. According to the Macquarie Dictionary the

word ‘prominent’ means in the relevant context ‘standing out so as to be easily seen; conspicuous; very

noticeable’.16

57. I agree with the complainants — brochures are not websites. Websites are not generally read in the

same front-to-back and left-to-right way as brochures. Users may enter the site from a subpage rather

than the home page, and may never go to the home page of a website.17 Veda’s contention that

providing free credit reporting information on only one web page is sufficient does not appear to take

this into account.

16 Macquarie Dictionary, Macquarie Dictionary Online, 6th ed (October 2013) < https://www.macquariedictionary.com.au/>.

https://www.macquariedictionary.com.au/features/word/search/?word=transfer&search_word_type=Dictionary>.

17 See for example, Sarah Morton. (November 2012). Writing Brochure Copy versus Website Copy, Sarah Morton Copywriter. (Accessed 15 August 2016). <https:sarahmortoncopwriter.com.au/writing-brochure-copy-versus-webiste-copy>.

https://web.archive.org/web/20140712151905/http:/www.veda.com.au/yourcreditandidentity/improve/improving-your-veda-score

https://web.archive.org/web/20140712151905/http:/www.veda.com.au/yourcreditandidentity/improve/improving-your-veda-score

https://www.macquariedictionary.com.au/features/word/search/?word=transfer&search_word_type=Dictionary


58. Keeping in mind the ordinary meaning of the word ‘prominent’, I am of the view that Veda has not met

the requirements of paragraph 19.3(a) of the CR code in relation to the information Veda has made

available about its fee-based services on its Veda website.

The ‘my credit file’ website

59. A review of the home page on the my credit file website shows if a class member scrolls down the web

page through a list of fee-for-service options, they will be alerted by a button with the words ‘Free file,

find out more’ that they may be able to access a free copy of their credit report (figure 2).

60. The words ‘Free File’ are in white text against a light red background and the button is readily viewable

and identifiable. I also note that a statement setting out the circumstances in which a free credit report

can be obtained is displayed on the same page, to the left of the ‘Free File’ button. The information is

directly below information about Veda’s fee-based service.

61. It is therefore apparent that information made available on the my credit file website about Veda’s fee-

based services also provides information about individuals’ right under the Privacy Act to access their

credit reports free of charge.18 The complainants argue that this information was at the relevant time not

‘prominently stated’ for the purposes of paragraph 19.3(a) of the CR code.

62. Examining the layout of the my credit file website home page as it was at the time the complaint was

made (figures 2 and 6), I note the following:

the statement about free access to credit reports (the relevant statement) is located below the

‘fold’ (that is, below that part of the web page that is visible without scrolling)

the text of the relevant statement is in Arial font, size 10

to the right side of the relevant statement appear the words ‘Free File, Find out more’ within a

large light red luminescent rectangle

the text directly above the relevant statement, stating that “for less than $1.55 a week, you can

better manage one of your most important assets” is in bold Helvetica font, size 13.5, and in

colour

to the right side of this text is a smaller rectangle (button) of a dark red colour featuring the words

‘Buy Now’.

18 <www.mycreditfile.com.au>; <www.mycreditfile.com.au/products-and-pricing>; <www.mycreditfile.com.au/personal/veda-

alert.dot>,

http://www.mycreditfile.com.au/

http://www.mycreditfile.com.au/products-and-pricing

http://www.mycreditfile.com.au/personal/veda-alert.dot

http://www.mycreditfile.com.au/personal/veda-alert.dot


Figure 6


63. The home page of the ‘my credit file’ website, displays a series of colour photographs and two ‘buy now’

buttons (figure 6). The ‘Free File’ button, although large and colourful, is below the ‘fold’ and does not

come into view until the page is scrolled. It is not able to be seen on the web page at first instance (prior

to scrolling). In other words, it is not noticeable on the face of it, and in my view does not have the

necessary degree of prominence needed to meet the requirement of ‘prominently stated’ under

paragraph 19.3(a) of the CR code.

64. I therefore find that Veda has not met the requirements of paragraph 19.3(a) of the CR code in relation

to the information Veda has made available about its fee-based services on its ‘my credit file’ website. I

am of the view that Veda has engaged in conduct constituting an interference with the privacy of

individuals who are members of the class identified in the complaint.

The online access issue

65. The complainants also allege that access to a free credit report on the Veda and ‘my credit file’ websites

is not as available and as easy to identify and access as credit reports accessed through its paid services,

in breach of paragraph 19.3(b) of the CR code.19

66. Paragraph 19.3(b) of the CR code states that if a CRB has a service whereby an individual may obtain

their credit reporting information for a fee, the CRB must take reasonable steps to ensure that its

service, whereby individuals may obtain their credit reporting information free of charge, is as available

and easy to identify and access as its fee-based service.

67. In reference to the ‘my credit file’ website shown in figures 1 and 2, the complainants contend that a

free file is not as easy to access and identify as Veda’s fee-based service because:

o the reference to the free service is much further down the page

o unlike Veda’s fee-for-service options which provide for direct access via an online application

form, access to a free credit report requires access seekers to fill in an enquiries form at first

instance. The ordering form and instructions are subsequently emailed to the access seeker to

complete.20

68. The complainants also refer to the ‘’your credit and identity’ web page on the Veda website which

compares a number of Veda paid products including Starter, Access, ID and Plan. According to the

complainants the web page does not mention the option of free access to a credit report. They state

that it would be reasonable for a person looking at this web page to assume that these four products

were the only choices (figures 7 and 8).21

19 Initial representative complaint about Veda Advantage to the OAIC, 15 August 2014, 1.

20 First representative complaint about Veda Advantage to the OAIC, 15 August 2014, 3.

21 First representative complaint about Veda Advantage to the OAIC, 15 August 2014, 3.


Figure 7.

Figure 8: the ‘your credit and identity’ web page after scrolling down.


69. The complainants state that there are several links to the ‘your credit and identity’ web page and none of

the linked pages refer to the option of free access to a credit report.22

70. Veda does not accept that it did not comply with paragraph 19.3(b) of the CR Code. It argues that

paragraph 19.3(b) requires an assessment of what a reasonable person would be expected to implement

in the circumstances, and does not require Veda to treat its paid services and its service providing access

to free reports identically. Veda contends that rather, what is required is ‘reasonable substantial parity’ in

the availability of, identification of, and access to, free reports, having regard to all the circumstances.23

Current position

71. I acknowledge that since the first representative complaint was lodged, Veda has amended how it makes

information about its service providing access to credit reports free of charge available on its ‘my credit

file’ website. It has moved information about free credit reports to a horizontal level equivalent to the

Veda website’s first reference to a paid service, so that a viewer no longer has to scroll right down the

web page to view information about how to access a credit report free of charge. It has also amended its

‘your credit and identity’ web page on the Veda website so an initial comparison of Veda products

(‘Compare Our Products’) at the top of the web page includes a ‘free file’ option.24

72. Nonetheless, the current presentation mode of Veda’s websites is not relevant to the issues that I have to

decide here. My findings must be based on the steps Veda had in place at the time the complaint was

lodged. It must also be said that all the current website presentations show what could have been done

earlier. They do not, by any necessary implication, demonstrate that what was done earlier was in

contravention of the Act or the CR code.

73. My findings in relation to the online access issue are as follows.

Findings in relation to online access issue

74. Veda contends that it met the ‘reasonable steps’ standard mandated at paragraph 19.3 of the CR Code, by

making both free and paid services prominently identifiable, available and accessible from the homepage

of its ‘my credit file’ website.

75. The complainants argue that the requirement under paragraph 19.3 that Veda’s free service be ‘as

available’, ‘as easy to identify’ and ‘as easy to access’ as its fee-based service, “demands equivalence

22 Initial representative complaint about Veda Advantage, 15 August 2014, 3.

23 Veda’s submission to the OAIC, 20 April 2015, 2, [1.2]-[1.4].

24 https://www.veda.com.au/yourcreditandidentity/product-comparison.


between the free service and the fee service of the three mandated outcomes: availability, ease of

identification, and ease of access”.25

76. In determining whether Veda has fulfilled its paragraph 19.3 obligations I must also consider the overall

objects of the Privacy Act including the facilitation of an efficient credit reporting system while ensuring

that the privacy of individuals is respected; and that the protection of the privacy of individuals must be

balanced with the interests of entities in carrying out their functions or activities.26

Reasonable steps

77. Paragraph 19.3 of the CR code names s 20R of the Privacy Act as its source. The explanatory

memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012 (‘explanatory

memorandum’) states:

This provision [s 20R] is based on the obligations set out in, and the structure of, APP 12, modified to apply specifically to credit reporting bodies. It is generally intended that access to credit reporting information should occur on the same terms as access to personal information held by an APP entity27.

78. Though the APPs do not apply to a credit reporting body in relation to personal information that is credit

reporting information28, the APP guidelines may provide some guidance in relation to what may be

considered ‘reasonable steps’.

79. ‘Reasonable steps’ is not defined in the Privacy Act, but I accept that the steps required to be taken do not

have to be exhaustive; rather reasonable where ‘reasonable’ means appropriate in the circumstances.29 It

is, however, the responsibility of the APP entity to be able to justify that its conduct was reasonable, and

that reasonable steps were taken. 30

Google search results

80. Veda contends that the results returned from internet search engines are highly relevant in assessing

what constitutes ‘reasonable steps’ under paragraph 19.3(b) of the CR code given that the standard

practices of internet users seeking information is to search via internet search engines rather than by

reviewing web pages.31

25 Complainants’ reply to Veda’s submission, 15 June 2015, 5, [14].

26 Privacy Act 1988 (Cth), s 2A.

27 Explanatory memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012

28 Privacy Act 1988 (Cth), s 20A(2).

29 Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines, B.99.

30 Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines, B.105, B.108.

31 Veda’s submission to the OAIC, 20 April 2015, [1.5].


81. Search engines such as Google allow internet users to search for information of interest by entering

search terms into the search box on the search engine’s website or on users’ toolbars. A search will

produce both advertisements (‘sponsored links’)32 and ‘organic search results’ (i.e. the main search results

not influenced by advertising). Organic search results are ranked in order of relevance to the search terms

entered by the user.

82. In its 20 April 2015 submission Veda uses the example of a Google search conducted on 14 April 2015 on

the search phrase ‘credit report’ which returned a link to the ‘my credit file’ website under the heading

‘Order a Free Credit Report’. This link took the user directly to a web page titled ‘How to get your credit

report free of charge’ (figure 9).

Figure 9.

32 On a web page, advertisements are labelled ‘Ad’ or ‘Ads’ and are listed separately to the organic search results. They are triggered by

keywords supplied by the advertiser to the search provider, using an AdWords program. When a user enters search terms into the search engine that match the keywords of an advertiser, the search results will display the triggered sponsored links. Organisations like Veda using sponsored links pay the search provider every time a user clicks on the sponsored link.


83. Veda contends that search results like this ‘clearly demonstrate that Veda has taken reasonable steps to

ensure that its service whereby individuals may obtain their credit reporting information free of charge

is as available and easy to identify and access as its fee-based service’.33

84. The complainants argue that it is not a ‘reasonable step’ to “trust in a Google search as providing parity

of availability, ease of identification and ease of access” between paid services and those services

provided free of charge.34

85. I agree that there are some difficulties with Veda’s contention. Firstly, search results will vary between

different devices and different users on different days. Searches of the same keywords - ‘credit report’ –

on 16 December 2014 (figure 10) and 5 May 2015 (figure 11), produced different search results, for

example.

33 Veda submission to the OAIC, 20 April 2015, 5-6, [3.4]-[3.6].

34 Complainants’ reply to Veda’s submission, 15 June 2015, 8, [22].


Figure 10

86. For example, in contrast to the search results provided on 14 April 2015, the first Veda result returned

on the 5 May 2015 search by the complainants was http://www.veda.com.au/yourcredit and

identity/tips-mythbusters/fags/how-can-I-check-my-credit-history (figure 10). This web page did not

refer to free credit reports, providing only options for paid services.35

35 Complainant representatives’ response to Veda submission of 20 April 2015, 8, [22]-[25].


Figure 11.

87. This is not surprising. Different search results may be obtained even when the same key words are

searched. This may be due to variances in a user’s physical location or in the search history of different

devices, or the keyword search being performed by different Google data centres.36

88. Secondly, I note the searches conducted by Veda to illustrate the relevance of Google search results to it

meeting its obligations under paragraph 19.3(b) of the CR code were undertaken sometime after the

date of the complaint. Their relevance as to what results might have been produced around the time of

the complaint is accordingly limited.

89. Thirdly, and perhaps most importantly, there is no information before me which indicates that Veda has

actually taken any steps to produce the search results it highlights in its submission.

36 McEvoy, M. (2015). 7 Reasons Google Search Results Vary Dramatically. Web Presence Solutions. Accessed 22 August 2016.

www.webpresencesolutions.net/7-reasons-google-search-results-vary-dramatically/>; Snipes, Susan. (2012). SEO Under Scrutiny: Reasons your Google search results are different than mine. Q Digital Studio. Accessed 19 August 2016. < <http://www.qdigitalstudio.com/library/reasons-your-google-search-results-are-different-than-mine>; Sullivan, Rob.(n.d.) SEO Questions – Why Do I See Different Google Results Than My Clients? Internet Seer. Accessed 19 August 2016. < http://www.internetseer.com/services/article.xtp?id=37037>.

http://www.webpresencesolutions.net/7-reasons-google-search-results-vary-dramatically/

http://www.qdigitalstudio.com/library/reasons-your-google-search-results-are-different-than-mine

http://www.internetseer.com/services/article.xtp?id=37037


90. A business may maximise its exposure via organic search results through a process known as ‘search

engine optimisation’ to ensure that it appears first in the organic search results.37 This is a form of search

engine marketing and involves optimising each page of a website to include keyword phrases in headers,

sub headers, web page text, hyperlinks and, where appropriate, in image file names and alt tags, which

provide a text alternative to an image.

91. Veda engages from time to time in search engine optimisation strategies to market to individuals and/or

business customers.38 However, there is no evidence that Veda engaged in any search engine optimisation

strategies to try to bring its service of free access to credit reports to the attention of access seekers.

There is no information which suggests that Veda did anything by way of website optimisation to promote

its service whereby individuals may obtain their credit reports free of charge.

92. For this reason, I give little weight to the results returned from internet search engines in determining this

matter.

‘my credit file’ website

93. In its letter to the complainants dated 14 May 2014, Veda outlines the online process an access seeker

may take to access a free credit report:

(a) On Veda’s main website and landing page <www.veda.com.au>, a consumer can see information

about access to credit reports as well as other Veda services (figure 12).

37Search engine optimisation discussed by Katzmann J in Veda Advantage Limited v Malouf Group Enterprises Pty Limited [2016] FCA

255 (21 March 2016).

38 Noted in Veda Advantage Limited v Malouf Group Enterprises Pty Limited [2016] FCA 255 (21 March 2016), [12].


Figure 12.

(b) When a consumer clicks on GET YOUR CREDIT REPORT, they are taken to Veda’s ‘My Credit File’

website which includes information about credit reports as well as a large ‘free file’ button (figure 13)

Figure 13.

(c) Clicking on the large red button brings consumers to the free credit file page. Very clear instructions

on how to order your free credit file are provided (figure 14).

(d) A consumer enters in details and the ordering form and instructions are emailed to the consumer to

complete (figure 15).39

39Veda letter to the complainants, 14 May 2014, 3-6.


Figure 14.

Figure 15.


94. Veda, in support of its contention that its free and paid services in relation to access to credit reports are

of “reasonable substantial parity”, points out that the ‘Free File’ button is prominent and physically close

to the information regarding Veda’s paid services (figures 6 and 7).40 I have discussed the issue of

prominence at [56]-[63].

95. The complainants note that the position of the ‘Free File’ button is, however, much further down the

web page (i.e. below the ‘fold line’). By this I take it to mean that the complainants are contending that

information about free credit reports is less easily identified or accessible than information about Veda’s

paid services because access seekers have to scroll further down the web page.

96. Veda argues that:

The ‘fold line’ is irrelevant, as reasonable, substantial parity is achieved by having both types of reports

prominently identified, available and accessible via the internet at the same place, being the ‘My Credit File’

home page. Nothing further is required.41

97. Secondary sources in the form of research findings suggest that although the concept of a fold was

important in early web history, nowadays people do scroll and it is not as integral to web advertising

today.42 Research findings on whether scrolling is an impediment to users are mixed.43 There is research

that indicates users’ attention is generally caught above the fold44, while other studies have found that

users spend more time on actual web content as they move down the page45. What does seem to be an

accepted finding amongst researchers is that users’ behaviour has changed over the years since the

inception of the personal computer and they are more likely to scroll than previously. Research has also

indicated that web designers are now being encouraged to design a page that encourages users to scroll

rather than to navigate away from the page.46



42 Motive, The Motive Web Design Glossary, (updated August 2009) <www.motive.co.nz/glossary/fold.php.

43 Mixed research findings noted by Matt Keogh (February 2015, updated June 2016) Does It Matter if Users Need to Scroll? Liquid Light. https://www.liquidlight.co.uk/blog/article/does-it-matter-if-users-need-to-scroll>. See also Haile, Tony. (March 2014). What You Think You know About the Web is Wrong? Time. http://time.com/12933/what-you-think-you-know-about-the-web-is-wrong/.

44 Schade, Amy. (February 2015). The Fold Manifesto: Why the Page Fold Still Matters. Nielsen Norman Group. <https://www.nngroup.com/articles/page-fold-manifesto>. Highlighted by Matt Keogh (February 2015, updated June 2016) Does It Matter if Users Need to Scroll? Liquid Light. https://www.liquidlight.co.uk/blog/article/does-it-matter-if-users-need-to-scroll>.

45 Josh. (August 2013). Scroll behaviour across the web. Chartbeat Blog. <blog.chartbeat.com/2013/08/12scroll-behavour-across-the-web>. Highlighted by Matt Keogh (February 2015, updated June 2016) Does It Matter if Users Need to Scroll? Liquid Light. https://www.liquidlight.co.uk/blog/article/does-it-matter-if-users-need-to-scroll>.

46 Schade, Amy. (February 2015) The Fold Manifesto: Why the Page Fold Still Matters, Nielsen Norman Group <https://www.nngroup.com/articles/page-fold-manifesto>. See also Cao, Jerry. (October 2015). The New Rules for Scrolling in Web Design. DesignMode. <designmode.com/scrolling-web-design.>

http://www.motive.co.nz/glossary/fold.php

https://www.liquidlight.co.uk/blog/article/does-it-matter-if-users-need-to-scroll

http://time.com/12933/what-you-think-you-know-about-the-web-is-wrong/

http://time.com/12933/what-you-think-you-know-about-the-web-is-wrong/

https://www.nngroup.com/articles/page-fold-manifesto




https://www.nngroup.com/articles/page-fold-manifesto


98. There is no doubt that scrolling is an extra action, but the issue here is, does having to scroll down to

information about how to access a free credit report lessen its availability or the ease with which this

information may be identified or accessed?

99. I accept that the images on a web page are not, unlike television for example, transitory; a viewer can

generally take as long as they wish to review the contents of the page.47 It is therefore difficult to see

how scrolling down half a page on the same web page could be seen to lessen the availability of the free

credit reporting information or lessen the ease with which it is accessed, within the ordinary meaning of

the word (i.e. access meaning ‘the opportunity to approach or enter a place’48). Nonetheless, as I noted

at paragraphs [56]-[63], information that is not viewable at first instance on a screen is not as prominent

as information that is instantly viewable on screen. For information to be as identifiable as other

information, it must be as easily recognisable. In my view, the information made available on the ‘my

credit file’ website does not enable access seekers to identify Veda’s free-based service as easily as its

fee-based services, and in this regard I find that Veda has not complied with paragraph 19.3(b) of the CR

code.

Veda’s www.veda.com.au website

100. The complainants also claim that the web page www.veda.com.au/yourcreditandidentity linked to

Veda’s main website, at the relevant time, compared a number of Veda’s paid products (Starter, Access,

ID and Plan) which included a service to provide customers with their credit report (figure 16). The

complainants contend that the web page did not include any information which identified a service for

customers to access their credit report free of charge. The complainants contend that:

It would be reasonable for a person looking at this web page to assume that these four products were the only

options.49

47 See Australian Competition and Consumer Commission v Hillside (Australia New Media) Pty Ltd trading as Bet365 [2015] FCA 1007

for support of this view.

48 Macquarie Dictionary, Macquarie Dictionary Online, 6th ed (October 2013) < https://www.macquariedictionary.com.au/>. https://www.macquariedictionary.com.au/features/word/search/?word=transfer&search_word_type=Dictionary>.

49 Complainants’ representative complaint to the OAIC, 15 August 2014, 3.

https://www.macquariedictionary.com.au/features/word/search/?word=transfer&search_word_type=Dictionary


Figure 16.

101. Veda contends that this web page, as well as its Veda home page and ‘my credit file’ website, had links

to Veda’s credit policy “which clearly sets out how individuals can obtain free access to their credit

reporting information”50.

102. I accept that nowadays a majority of class members have a reasonable understanding of how to

navigate the web. Clicking-through to other pages does not necessarily mean that something is less

accessible. Nonetheless, at the relevant time the digital pathway from Veda’s ‘my credit and identity’

web page to information embedded in Veda’s credit policy about accessing credit reports free of charge

was lengthy and not user-friendly. In order to navigate successfully, an access seeker would need to

already be aware that information about access to Veda’s free service could be found within Veda’s

credit policy.

103. Having to discern how to access a credit report free of charge by firstly being aware that the

information was embedded in a ‘credit policy’ page, and then clicking through to that page, is not as

easy as being presented with that information on the home or landing page. I therefore consider that

the Veda website does not enable access seekers to identify Veda’s free-based service as easily as its

fee-based service, and I find that Veda has not complied with paragraph 19.3(b) of the CR code in this

regard.

50 Veda response to the complainants, 14 May 2014, (Appendix C to Representative complaint about Veda Advantage dated 15

August 2014).


104. The complainants further contend that Veda’s free service is not as easy to access and is not as

available as the paid service. To access the free service, access seekers needed to submit an ‘enquiries

form’ through Veda’s portal. I note from a review of the web pages at the relevant time51 that clicking

on the ‘’Free File, find out more’ button on the ‘my credit file’ home page took access seekers to a page

titled ‘How to get your credit report free of charge’. To obtain a free copy of their credit report, access

seekers had to complete the Veda Free Credit File Form. Certain identification details (name, phone

number, email address, state, and ‘yes/no’ to marketing) needed to be submitted on an online ‘order

form’. Once this form was submitted, access seekers would ‘immediately receive’ by email another form

to request a free copy of their credit report (figure 15).

105. Veda confirms this process in its 14 May 2014 response to the complainants, which is outlined at

paragraph [93].

106. In contrast, individuals accessing Veda’s paid services at the relevant time, could apply directly online

for their credit report. There was no additional requirement to complete an enquiries form and receive

further email instructions from Veda on how to apply for their credit report.

107. In its 14 May 2014 response to the complainants, Veda advises that it is investing in “a new portal

aligning processes and requirements for free reports with those available for paid services”. Veda states:

Customers seeking a free report will have the same straight through process as applies for paid reports, that is,

they will be able to type-in their information onto an online application form.

108. It is evident that at the relevant time a further step had to be undertaken to obtain a credit report free

of charge. Customers accessing a credit report through Veda’s paid services, on the other hand, could

readily apply online. The online process for paid access was evidently more accessible than that for free

access. Veda accepts that the ‘same straight through process’ as applied to paid reports did not apply to

reports accessed free of charge.52

109. I accept that Veda was at the relevant time “making efforts to streamline the process for requesting a

free credit report”, but I have no substantive information available to me which explains why the online

process for access to free credit reports was implemented differently from the outset, or why there was

such a lag in addressing the variance between the access processes of the paid and unpaid services. I

note that there were “some teething problems with some of the new IT infrastructure” and “an

unprecedented demand for free credit reports”.53

110. In ‘S’ and Veda Advantage Information Services and Solutions Limited54, which the complainants

helpfully referred to, I considered whether or not Veda had taken reasonable steps to ensure that

51 https://web.archive.org/web/20140731202413/http://www.veda.com.au/mcfpage.

52 Veda’s response to the complainant’s complaint, 14 May 2014.

53 Veda’s response to the complainant’s complaint, 14 May 2014.

54 [2012] AICmr 33 at [61].


personal information contained in the complainant’s credit file or report was ‘accurate, up-to-date,

complete and not misleading’ as required under s 18G, a former provision of the Privacy Act which

existed prior to the 12 March 2014 reforms. In making an assessment of the ‘reasonable steps’ I

relevantly considered:

• the size and nature of an organisation such as Veda and how Veda's practices may impact on a large

number of individuals and credit providers, and

• the ease with which any particular step can be implemented.

111. In their response to Veda’s 20 April 2015 submission, the complainants point out that:

Veda has not shown that it would be arduous or costly to implement practices that provide equivalent

availability, ease of identification of, and ease of access to free credit reporting information to the

availability, ease of identification of, and ease of access to fee-based credit reporting information.

We submit that given Veda’s size and nature, the large number of individuals affected, the object of the

Act and Code to make credit reports freely available to enable errors and omissions to be rectified, the

ease of access to and prominence of Veda’s fee-based services the Commissioner should find that Veda has

not complied with paragraph 19.3(b) of the CR code.55

112. I note that Veda is by its own admission ‘the leading provider of credit information in Australia’. As a

credit reporting body, it claims a market share of 96% with a database of 16.5 million credit-active

Australians.56 It was put on notice about the ‘sizeable changes’57 arising from the 2014 legislative

reforms well before the passing of the Privacy Amendment (Enhancing Privacy Protection) Act 2012, and

was, or should have been aware, of the impact of the changes on its customers58. The onus was on Veda

to justify that it took reasonable steps (as were appropriate in the circumstances) to ensure its free

service was as available and as easy to access as its fee-based services. I am not satisfied that it did so. In

my view, Veda did not meet its obligations under paragraph 19.3(b) of the CR code in this regard.

55 Complainant’s reply to Veda’s submission, 9, [28]-[29].

56 Explanatory Memorandum, Privacy Amendment (enhancing Privacy Protection) Bill 2012, citing Veda Advantage ‘About Us’, accessed 23 July 2009 from <http://www.vedaadvantage.com/about-veda/au_our-data.dot>.

57 Veda response to the complainants, 14 May 2014, (Appendix C to representative complaint about Veda Advantage dated 15 August 2014).

58 See for example, Explanatory Memorandum, Privacy Amendment (enhancing Privacy Protection) Bill 2012, citing Veda Advantage responds to ALRC Privacy Review proposal in Wot News, accessed 23 July 2009 from <http://wotnews.com.au/like/veda_advantage_responds_to_the_alrc_privacy_review_proprosal/1666111>.

http://www.vedaadvantage.com/about-veda/au_our-data.dot


The phone access issue

113. The complainants allege that access seekers are not able to obtain a credit report free of charge from

Veda over the phone, while credit reports can be obtained over the phone via Veda’s paid services.59

114. The complainants contend that this is a breach of paragraph 19.3(b) of the CR code which relevantly

states that the CRB must take reasonable steps to ensure that its service whereby individuals may obtain

their credit report free of charge is as available and easy to identify and access as its fee-based service.60

115. The complainants state:

The phone number for Veda … leads to a message that states a free copy of your credit report can be

obtained by visiting the Veda website. There is an option to get a paid copy of a credit report over the

phone, but there is no option to get a free credit report over the phone.61

116. The complainants detail the experiences of an access seeker’s attempts to order a free credit report

over the phone:

In their automated section it asks you whether you are seeking your credit report. On following the prompts,

it takes you to a pre-recorded message that explains that you are entitled to receive a free credit report

every 12 months, and within 90 days of a credit application. It then continues to explain that you can order

the free credit report online or by sending specific information to a postal address.

You are then prompted to go through to a customer service operator. When requesting the free credit

report, I was told by the operator that it could not be done through her and that I could only order the

‘express’ report for $67.62

117. The access seeker’s second attempt to order a free credit report went as follows:

This time the customer service operator that picked up said that I could only receive the free report if I had

internet (which I had told both that I did not have). She said that if I did not have internet the only other

option open to me was to purchase an express report for $67, as it is "easier and better" than the free report

anyway. When I pressed her why I couldn't get a free one on the phone she said that it was a Veda process,

they could only sell the 'express' credit reports on the phone, nothing else.

She also noted that if I purchased the express report I would get all the updates for free. I questioned back to

her, "Are you saying that if I don't have the internet I cannot get a free credit report like I was told I could".

59 Initial representative complaint to the OAIC, 15 August 2014, 1-3.

60 Initial representative complaint to the OAIC, 15 August 2014, 1-3.

61 Initial representative complaint to the OAIC, 15 August 2014, 1-3..

62 Complainant’s reply to Veda’s submission, Attachment 2, ‘Veda Shadow Shopping’, 5 May 2015.


She said "That is up to you, if you don't have the internet you don't have any other option but to buy the

express credit report".63

118. The complainants contend these experiences highlight that in contrast to accessing a credit report by

phone through a paid service, requesting a credit report free of charge by phone is not an option, i.e. an

access seeker is limited to ordering online or making a request by post. In other words, the complainants

are contending the Veda’s free service is not as available and as easy to access as its paid services.

119. Veda submits, as already noted at [75], that paragraph 19.3(b) of the CR code does not require identical

treatment of paid services and free reports in every respect:

Rather, what is required is reasonable, substantial parity in the availability of, identification of and access to

free reports, having regard to all the circumstances.64

120. Veda also makes the following contentions:

the Explanatory Note for paragraph 19.3(b) of the CR code (the Explanatory Note) refers only to a

CRB making available means to address all information requirements for free reports online, if this

option is available for the purposes of a fee-based service65

the prevalence of smartphones and internet access services, as well as the wide availability of

internet access including through cafes and internet cafes, means that phone access to credit

reporting information is a superfluous access channel.66 In other words, telephone-based access is

not reasonably required for the purpose of obtaining free reports, where online access is available

individuals may also access free reports by submitting a request in writing. Further, in the case of

persons with a relevant disability, Veda has provided and continues to provide access to free

reports by telephone on request67

in determining what is reasonably required under paragraph 19.3(b), a relevant factor is the

substantial additional cost and resources required to provide free access to credit reports over

the phone.68

121. By way of response, the complainants state:69

63 Complainant’s response to Veda’s submission, Attachment 2, ‘Veda Shadow Shopping’, 5 May 2015.



66 Veda’s submission to the OAIC, 20 April 2015, 7, [4.4]..





…when considering what are reasonable steps, it should be noted that it is likely to be the most

disadvantaged individuals who do not have access to the internet. The following information from the

Australian Bureau of Statistics is sobering:

In 2012–13, 98% of households with household income of $120,000 or more had internet access, compared

to 57% of households with household income of less than $40,000.70

…. there are 2.32 million people that are either completely illiterate or mostly illiterate between 15 and 74

years of age in Australia. Telephone access is an important avenue for the poorest households and those

with the lowest literacy levels. People in these categories are more likely than most to have experienced

troubled credit history.71

Findings in relation to the phone access issue

Explanatory note

122. Veda argues that the proper interpretation of the Explanatory Note is that s 19.3(b) of the Code refers

only to online access for credit reports.72

123. The Explanatory Note provides:

This gives visibility to rights to credit reporting information free of charge and minimises access barriers. As

a result of the requirement that the free service must be as easy to access as the fee-based service, a CRB

would have to permit an individual to address all information requirements online in order to obtain credit

reporting information free of charge, if this option were available for the purposes of the fee-based

service.

124. Firstly, I note that the explanatory notes are not part of the registered CR code. They were included in

the draft Code, and as noted in that draft, aimed to assist readers to understand the purpose and intent

of the CR code provisions. The explanatory notes constitute guidance and do not have mandatory status.

In particular, they are not binding on the Information Commissioner.73

70 Complainants’ submission in reply to the OAIC, 15 June 2015, 11, [36] citing Australian Bureau of Statistics

< http://www.abs.gov.au/ausstats/[email protected]/Lookup/8146.0Chapter12012-13 >.

71 Complainants’ submission in reply to the OAIC, 15 June 2015, 11 [36], citing Australian Bureau of Statistics

< http://www.abs.gov.au/ausstats/[email protected]/Lookup/4228.0Main+Features20211-12>.

72 Veda submission to the OAIC, 20 April 2015, paragraph [4.5].

73 The OAIC’s Guidelines for developing codes provide:

[2.29] Although the Information Commissioner is not required to consider the explanatory material the Information Commissioner may use the explanatory material to inform his or her understanding of the intended operation of the code.

http://www.abs.gov.au/ausstats/[email protected]/Lookup/8146.0Chapter12012-13


125. In any case, the Note is not, in my view, meant to limit the application of the CR code to online access

to free credit reports. It is merely intended to illustrate that if there is an option available to subscribers

to a fee-based service which addresses all information requirements online, a CRB would also have to

provide that same option in relation to its free service.

The phone as an unnecessary access channel

126. I do not agree with Veda’s contention that the telephone is a superfluous access channel where an

internet-based service for credit reporting information is available74 or that the requirements of

paragraph 19.3(b) are satisfied in this context by giving individuals the option to access free reports by

submitting a request in writing.75 Paragraph 19.3(b) of the CR code mandates that Veda take reasonable

steps to ensure that its free service is as available and easy to identify and access as its fee-based

service. I accept the complainants’ contention that telephone access is an important way for many

people, which may include the poorest households and those with the lowest literacy levels, to access

services.76 As the information provided by the complainants demonstrates, a significant number of

Australians are likely to have difficulty navigating and completing a form online to obtain their credit

report.77

127. Veda submits, and I agree, that in assessing what constitutes ‘reasonable steps’ for the purposes of

paragraph 19.3(b), consideration must be given to the cost and resources required of Veda to provide

phone access to credit reports free of charge.78 Keeping this in mind, I note that Veda is the leading

provider of credit information and analysis in Australia.79 According to its 2015 annual report Veda made

a profit after income tax of more than $78 million, and revenue from continuing operations of more

than $338 million.80 Veda has indicated that the additional cost and resources required to provide free

access to credit reports over the phone would be ‘substantial’, but it has not quantified the costs

involved in any way, or demonstrated how such costs would, or could be, onerous to the operations,

functions, and/or activities of its organisation. Accordingly, I give this contention little weight in

assessing what are ‘reasonable steps’ in the circumstances.

[2.30] The Information Commissioner will not approve the explanatory material nor will the Information Commissioner be bound by the explanatory material, <https://www.oaic.gov.au/agencies-and-organisations/advisory-guidelines/guidelines-for-developing-codes#part-2-developing-codes>.



76 Complainants’ submission to the OAIC, 15 June 2015, 11-12, [36]-[37].



79 https://www.veda.com.au/about-us

80 Veda Group Limited. (25 September 2015). Annual Report 2015 < http://investors.veda.com.au/Investor-Relations/?page=Annual-Reports >

https://www.veda.com.au/about-us

http://investors.veda.com.au/Investor-Relations/?page=Annual-Reports

http://investors.veda.com.au/Investor-Relations/?page=Annual-Reports


128. The credit reporting provisions in Part IIIA of the Privacy Act and the CR code are intended to provide

additional consumer protections by enhancing obligations and processes dealing with amongst other

things, access.81 The complainants provided a first-hand account of someone who didn’t have internet,

and was advised that they had no option but to ‘buy the express credit report’.82 The complainants have

also provided information supporting the notion that low income and/or otherwise disadvantaged

individuals may not have access to the internet. It is evident that phone ‘may be their only workable

access point to get their credit report’.83

129. Keeping this in mind, and the notion of access as ‘opportunity of approach’84, it is difficult to see how

the s 19.3(b) provision could be interpreted in any other way than an obligation to provide similar

opportunities over the phone (and through all other access channels) for Veda’s free service as with its

fee-based services.

130. Accordingly, I cannot accept that in this regard Veda took steps that were appropriate in the

circumstances to ensure its free service was ‘as available’ and as ‘easy to access’ as its paid services. In

my view, Veda did not meet its obligations under paragraph 19.3(b) of the CR Code.

The onerous identification issue

131. The complainants contend that between 12 March 2014 and 3 September 201485 Veda’s identification

verification requirements for a free credit report were more onerous than for a paid credit report, and

that this is a breach of paragraph 19.3(b) of the CR Code which relevantly states that the CRB must take

reasonable steps to ensure that its free service is as available and easy to identify and access as its fee-

based service.86

132. Paragraph 19.1 of the CR code provides that a CRB must not provide access [to a credit report] without

first obtaining such evidence as is reasonable in the circumstances to satisfy itself as to the identity of

the person making the request and of the person's entitlement to access under Part IIIA of the Privacy

Act, the Regulations and the CR code.

81 Privacy Amendment (Enhancing Privacy Protection) Bill 2012, Explanatory Memorandum.

82 Complainant’s submission in reply to the OAIC, 15 June 2015, Attachment 2, Veda telephone access memo 05052015.

83 Complainants’ complaint to Veda, 14 April 2014, 5.

84 As defined in the Macquarie Dictionary, Macquarie Dictionary Online, 6th edition (October 2013) <https://www.macquariedictionary.com.au >.

85 The identification verification requirements for obtaining access to free credit reports online were amended by Veda on

September 201485 in an effort to streamline the process for requesting a free credit report online. The complainants have not

indicated there is a continuing issue in relation to the amended identification verification requirements. Veda has confirmed that

it no longer requires any identity verification from individuals seeking free access to their credit report, additional to the

requirements for those subscribing to a fee-based service: Veda submission to the OAIC, 20 April 2015, 8. 86 Initial representative complaint about Veda Advantage, 15 August 2014, 1-2.

https://www.macquariedictionary.com.au/


133. At the relevant time identification verification requirements to obtain access to a credit report via one

of Veda’s fee-based services were as follows87:

• Name and date of birth

• Driver’s licence number (if available)

• Employment

• Previous creditor (if known)

• Contact details

• Current address

• Previous addresses (optional)

• Pay by credit card

134. In contrast the identification verification requirements for obtaining a free credit report were (the

differences from above being in bold)88:

• Full name and date of birth

• Driver’s licence number (and there is no option if a driver’s licence is not held)

• Two forms of identification: 1) copy of driver’s licence, passport, birth certificate or proof of age

card, as well as 2) a document issued by an official body which includes your name and address

(i.e. rates notice, utility bill or bank statement)

• Your current employer (although no option to not have an employer)

• Name of organisation to which you last applied for credit (although not optional)

• Your current residential addresses

• Your previous addresses (although unlike the paid product, there is no option to not have a previous

address)

• A daytime phone number

• How you’d like the file sent

135. The complainants say there is no reason why the identification requirements for access to a credit

report (whether it is paid or free) should differ.89

136. Veda acknowledges that there were, prior to 3 September 2014, differences in the identification

verification process between its free and paid services. It contends however that its process at the

relevant time satisfied the requirements of paragraph 19.3(b) because the provision of credit card

details for access through paid services made verification requirements ‘inherently more

straightforward’.90

87 Representative complaint about Veda Advantage, 15 August 2014, 4-5.

88 Initial representative complaint about Veda Advantage, 15 August 2014, 4-5.

89 Initial representative complaint about Veda Advantage, 15 August 2014, 4-5.



Findings in relation to the onerous identification claim

137. The points of difference between the identification verification requirements for free and paid services

are three-fold:

I. Providing details about driver’s licence number, previous addresses, previous creditors and

current employer is optional when an access seeker accesses their credit report through a

paid service. Providing these details is not optional through Veda’s free service.

II. When accessing a credit report free of charge, access seekers are required to provide two

additional forms of identification:

(c) licence, passport, birth certificate or proof of age card, and

(d) a document issued by an official body including name and address (e.g. bank statement, rates

notice)

III. When accessing a credit report through a paid service, individuals are required to pay by

credit card.

138. The complainants argue that Veda has not provided any evidence that identification is made easier by

the provision of credit card details.91 I note that Veda has not made any information available about the

steps it may undertake to verify the identities of cardholders subscribing to its paid services.

139. Paragraph 19.3(a) obliges CRBs like Veda to undertake some form of identity verification before

providing access to credit reports to ensure that the requestor is who they are claiming to be. The use of

an individual’s credit card to obtain a credit report for a fee provided Veda with an additional ‘identity

document’ not required by access seekers seeking free access. It follows that some other form of

identity document or documents must be obtained from those who seek a free credit report.

140. I accept that the information Veda needs to gather from its customers to satisfy paragraph 19.3(a) is an

assessment for Veda to make. The Privacy Act mandates that the interests of the individual must be

balanced with the interests of entities with respect to their functions and/or activities.92The provision of

different documents to inform a requestor’s identity does not mean that free access is not as available

and easy to access as paid access. Nonetheless it is unclear why Veda insisted on so many additional

pieces of documentation (i.e. information regarding previous creditors, previous addresses,

licence/passport/birth certificate, and bank statements/rate notices) as a substitute for credit card

information.

91 Complainants’ submission to the OAIC, 15 June 2015, [43].



141. Veda has contended that credit cards details make identification ‘inherently more straightforward’,

but has unfortunately not explained this statement in any way. In considering the notion of access as

‘opportunity of approach’ it is difficult to see how the paragraph 19.3(b) provision could be interpreted

in any other way than an obligation to require similar identification processes for both fee paying and

non-fee paying customers.

142. In my view on the information I have available to me, the identity documents requested from access

seekers applying for a free credit report were sufficiently more voluminous to impede the ‘opportunity

to approach’ or the ‘readiness for use’ of credit report access.

143. Accordingly, I cannot accept that in relation to its identity verification processes at the relevant time,

Veda took steps that were appropriate in the circumstances to ensure its free service was ‘as available’

and as ‘easy to access’ as its paid services. In my view, Veda did not meet its obligations under

paragraph 19.3(b) of the CR code in this regard.

144. I therefore find that the first complaint has been substantiated, and Veda has engaged in conduct that

constitutes an interference with the privacy of class members.

The second complaint

The timing issue

145. Section 20R of the Privacy Act provides that a CRB must respond to a request for access to credit

reporting information within a reasonable period, but not more than 10 days after the request was

made.

146. The complainants allege that an access seeker has complained that their report was not received within

the 10-day period.93 The complainants acknowledge that they are unaware of other complaints by

access seekers in relation to this issue, but argue that:

While it is possible that it was an isolated instance, there is no reason to think that it was one.94

147. In relation to the reason why the credit report in this instance was delivered outside the statutory

timeframe, Veda says:

Veda’s investigations have revealed that the report delivery issue complained of arose as the result of an

emergency software deployment occurring at the precise time at which that particular online request was

lodged. The emergency software release resulted in the request being inadvertently deleted. This was an

93 Complainants’ complaint to Veda, 20 October 2014, 13.

94 Complainants’ submission in reply, 15 June 2015, 13, [46].


isolated incident, of short duration. Veda has taken steps designed to prevent the incident from

reoccurring.95

148. The complainants argue that it is reasonable to suggest that other access seekers may have been

similarly affected:

Veda’s response … shows that failure to provide the particular report within time was caused by a problem

at its end: the effect of an emergency software deployment at the precise time when the online request was

lodged. The 180,000 free credit reports provided by Veda between March 2014 and April 2015 average out

to approximately 450 - 500 reports per day. It seems most likely that more than one request for a free report

was affected by the same software deployment issue.96

Findings in relation to timing issue

149. Veda has admitted that in one instance a credit report was not delivered to the access seeker within

the 10-day timeframe. This constitutes a breach of s 20R(3) of the Privacy Act.

150. Notwithstanding this, and as pointed out by Veda, the incident was isolated and not ongoing. Veda has

advised that “it has taken steps to prevent the incident from recurring”97 though has provided no further

information on remedial actions to date.

151. The complainants suggest there may be other instances of a s 20R(3) breach, but I have not been

provided with any evidence of this. This matter must be decided on what information I have available to

me, not on speculation of what might have been.

152. Although I accept there was one instance of a class member receiving their credit report after the

requisite 10-day period, there is no information to suggest that there is or was any systemic problem

with Veda’s compliance with s 20R caused by software deployment or anything else. Accordingly,

though I find there was a singular breach of s 20R(3), there is no evidence of ongoing non-compliance,

and I determine that it is inappropriate for any further action to be taken in relation to this issue.

The direct marketing issue

153. The complainants assert that at the relevant time, when a class member completed Veda’s online

application form for a free credit report the member was presented with two tick boxes. Box 1 states:

Veda can contact me on the details supplied above regarding my application for a copy of my credit report.98


96Complainants’ submission in reply to the OIAC, 15 June 2015, 13, [46].

97 Veda’s submission to the OAIC, 20 April 2015, [7.3].

98 Second representative complaint, 20 October 2014, 2.


Box 2 provides:

I would like to be contacted by telephone/email with finance, insurance and other offers relating to finance. I

consent to Veda providing my personal information including my contact details to relevant corporate partners

for this purpose.99

154. The complainants contend that the wording of the statements associated with the tick boxes is

misleading and in breach of APP 7.

155. APP 7 deals with direct marketing. APP 7.1 provides that:

If an organisation holds personal information about an individual, the organisation must not use or disclose

the information for the purpose of direct marketing.

156. APP [7.2]-[7.5] provide a number of exceptions to the prohibition of use and disclosure for the purpose

of direct marketing. Of relevance to this matter is APP7.2 and APP 7.3.

157. APP 7.2 provides that an organisation may use and disclose personal information (other than sensitive

information) about an individual for the purpose of direct marking if the organisation collected the

information from the individual and the individual would reasonably expect the organisation to use or

disclose the information for that purpose. The organisation must also provide a simple means by which

the individual may easily request not to receive direct marketing; and the individual must have not

already made such a request to the organisation.

158. APP 7.3 relies on consent (where it is not impracticable to do so) in situations where the information is

collected from an individual and that individual would not have reasonably expected the organisation to

use or disclose the information for that purpose, or where the information is collected from someone

other than the individual. Additionally, the organisation must do the following:

(b) the organisation provides a simple means by which the individual may easily request not to receive direct

marketing communications from the organisation; and

(c) in each direct marketing communication with the individual:

(i) the organisation includes a prominent statement that the individual may make such a request;

or

(ii) the organisation otherwise draws the individual’s attention to the fact that the individual may

make such a request: and

(d) the individual has not made such a request to the organisation.

159. Section 20A(2) of the Privacy Act states:



(2) The Australian Privacy Principles do not apply to a credit reporting body in relation to personal information

that is:

(a) credit reporting information; or

(b) CP derived information; or

(c) a pre-screening assessment.

Note: The Australian Privacy Principles apply to the credit reporting body in relation to other kinds of personal

information.

160. The complainants contend that:

… the APPs do apply in these circumstances because the information provided in connection with an

individual’s application for a credit report is not itself credit reporting information.100

161. I agree. I also note that Veda has not disputed that the APPs apply in these circumstances. Given this, I

will not consider this point further.

Current presentation

162. Since the time of the complaint the application form for a free credit report has undergone two

transformations in relation to its tick box statements. Veda advised at the time it lodged its 20 April

2015 submission that it had changed tick box 1 to state:

Veda can contact me on the details supplied above regarding my application for a copy of my credit report and

the options available to me.

163. A further amendment resulted in an application form with one rather than two tick boxes. The tick box

currently states:

You agree to Veda Group and its corporate partners using and disclosing your personal information to contact

you about other goods and services and using your information for direct marketing purposes including

contact by phone, mail, SMS or electronic means (figure 17).

164. As similarly noted at paragraph [73], the relevance of the post–complaint presentation of Veda’s

websites to the issue I have to decide here is limited. It simply demonstrates what could have been done

earlier, and does not necessarily imply that what was done earlier was in contravention of the Privacy

Act and/or the CR code.

100 Complainants’ submission to the OAIC, 15 June 2015, [56].


Tick box 1

165. The complainants contend that tick box 1 is misleading:

…Based on our experiences to date Veda does not contact the individual for further information but

instead uses this as an opportunity to sell a paid credit report to individuals applying for their free credit

report.101

166. Veda denies that it does not comply with AAP 7. It claims that the wording in tick box 1 constitutes a

request for consent which, if ticked, entitles Veda to contact the individual to sell its paid services in

respect of credit reports.

167. Veda argues that the wording ‘regarding my application for a copy of my credit report’ is sufficient to

constitute consent for this purpose in so far as the access seeker is alerted to the differences between

the credit report applied for and the premium or ancillary services which are also available to the access

seeker.

168. Veda goes on to claim that express consent to Veda contacting the access seeker for direct marketing

purposes had been given by virtue of clauses 11, 12 and 13 of the user agreement which the class

member must have read and agreed to in order to request a free report:102

11. Veda and its related companies may, at any time, use your personal information to send you information

about Veda and its related companies products and services. This will include promotional material including but

not limited to communications of the following kind:



Figure 17.


........

12. Veda may do so by using a variety of means including:

electronic means such as emails, SMS, MMS or similar devices

hardcopy to your nominated address; and

subject to Do Not Call Register, call you.

13. In doing so, Veda will be expressly relying on the consent that you have provided on the website when you

ordered the My Credit File or My Veda Alert report. At all times you are free to choose not to receive some

or all of the marketing communications sent by Veda or on Veda's behalf. In order to exercise that choice,

you need to communicate that to:

Veda

PO BOX [address]

Or call us on xxxx xxx xxx

In doing so, Veda may disclose any of this information to its related bodies corporate or service providers of

Veda or its related bodies corporate where such disclosure is required to conduct the marketing activities set

out above.103

169. Veda accepts that contacting an access seeker to clarify information that an individual has included in

their request for a credit report is a permitted use under APP 6 and does not require consent. Veda’s

view is the request for consent at tick box 1 was a request for direct marketing.

170. The complainants contend that the consent is not effective because the access seeker is not adequately

informed before giving consent, and the consent is involuntary.104 They claim that the statement at tick

box 1 is misleading and the user agreement terms and conditions are lengthy and not able to be readily

accessed (access is not granted until the class member reaches the ‘submit’ page).105

Findings in relation to the tick box 1

Consent

171. The APP guidelines, relevant at the time the complaints were lodged, at B.29 and B.30 gave

consideration to the meaning of 'consent':

Consent means ‘express consent or implied consent’ (s 6(1)). The four key elements of consent are:

the individual is adequately informed before giving consent

103 Veda’s submission to the OAIC, 20 April 2015, Annexure C.

104 Complainant’s reply to Veda’s submission, 15 June 2015, 17-18, [65]-[69].

105 Complainants’ reply to Veda’s submissions, 15 June 2015, 17-18, [65]-[69].


the individual gives consent voluntarily

the consent is current and specific, and

the individual has the capacity to understand and communicate their consent.

B.30 Express consent is given explicitly, either orally or in writing. This could include a handwritten signature,

an oral statement, or use of an electronic medium or voice signature to signify agreement.106

172. Informed consent means an individual must be aware of the implications of providing or withholding

consent. The guidelines provided that an APP entity should ensure that an individual is properly and

clearly informed about how their personal information will be handled, so they can decide whether to

give consent.107

173. According the APP guidelines, consent is voluntary ‘if an individual has a genuine opportunity to

provide or withhold consent’:

B. 37 Consent is not voluntary where there is duress, coercion or pressure that could overpower the person’s

will.

B.38 Factors relevant to deciding whether consent is voluntary include:

the alternatives open to the individual, if they choose not to consent

the seriousness of any consequences if an individual refuses to consent

any adverse consequences for family members or associates of the individual if the individual refuses

to consent. 108

174. It is apparent that access seekers have the option of not ticking tick box 1, and there is nothing to

suggest that not ticking the box has serious or adverse consequences for the access seeker attempting

to obtain their credit report free of charge. I have for example no information before me to suggest that

failure to tick box 1 rendered access seekers ineligible for a free credit report.

175. Given this, I cannot accept that consent is involuntarily given. I do accept that although it might be clear

to Veda that ticking box 1 constitutes consent sufficient to cover Veda contacting access seekers for

direct marking purposes, this might not be so clear to access seekers themselves.

176. Veda claims that access seekers are informed that they are providing consent when they tick the boxes,

because they are so advised by clauses 11-13 of the user agreement. Though I agree the user agreement

106APP guidelines (v 1.1, 1 March 2014), B.29-B.30. These provisions now at B.43-B.44 have not been amended in the updated

version of the guidelines (v 1.2, 1 April 2015).

107 Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines (v 1.1, 1 March 2014), B.41. This provision now at B.47 has not been amended in the updated version of the guidelines (v1.2, 1 April 2015).

108 APP Guidelines, (v 1.1, 1 March 2014), B.37 – B.38. The updated version of the guidelines (v 1.2, 1 April 2015) does not amend these provisions.


is lengthy, I accept that an ordinary and reasonable member of the class could have been expected to

read the terms and conditions in the user agreement, and be aware that, in accordance with clause 13, if

they provided ‘express’ consent when they ordered their ‘My Credit File’ report, Veda and its related

companies could use their personal information to send them information about Veda and its related

companies’ products and services.

177. Notwithstanding this, in my view, an ordinary and reasonable access seeker would not necessarily think

that they were providing express consent for such uses and disclosures where they ticked tick box 1. Tick

box 1 provides for Veda contacting the access seeker regarding their application for a copy of their

credit report and their available options. While tick box 2 is much clearer about using an access seeker’s

personal information to send them information about the products and services of Veda and its related

companies, there is no clear suggestion of this at all with respect to tick box 1.

178. I am mindful that the Privacy Act is beneficial legislation which makes provision to protect the privacy

of individuals.109 It doing so, it promotes the human rights principle of freedom from interference with

privacy, contained in article 17 of the International Covenant on Civil and Political Rights to which

Australia is a party. To give credence to that principle, any express consent obtained must therefore be

sufficiently precise with regard to the kind of information to which the consent relates. 110

179. The statement “Veda can contact me … regarding my application for a copy of my credit report” limits

the purpose of contact to ‘my application’. It makes no reference to the access seeker being contacted

for any other purpose. It is difficult to see, even if one accepts a very broad and liberal interpretation of

what ‘my application’ might encompass, how such consent extends to consent for Veda and its related

companies to contact the access seeker about their services and products. In my view it cannot be

stretched in the way submitted by Veda.

180. In my view it is reasonable for an ordinary and reasonable access seeker, who did not sign tick box 2,

but signed tick box 1, to assume that they were providing consent only in relation to Veda’s

communications with them about their application. In my view, despite reading the terms and

conditions of the user agreement, an ordinary and reasonable access seeker would not have reasonably

expected that a tick of box 1 was express consent for direct marketing purposes.

181. If Veda wished to ensure that access seekers consented to being contacted by Veda for direct

marketing purposes, then it should have expressed this plainly. In my view, the wording of the

statement associated with tick box 1 was such that access seekers were not adequately informed about

the consent they were providing when they ticked that box. Accordingly, I find that access seekers who

ticked tick box 1 were not consenting to the use or disclosure of their information for the purpose of

direct marketing, nor was it within their reasonable expectations that their information would be used

or disclosed for that purpose. I find that Veda was in breach of APP 7 in this respect.


110 Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWA, TAP 43, [97].


Tick box 2

182. The complainants have also raised issues with the second tick box (tick box 2). They advise that the

statement associated with the tick box 2, that is:

I would like to be contacted by telephone/email with finance, insurance and other offers relating to

finance. I consent to Veda providing my personal information including my contact details to relevant

corporate partners for this purpose.111

is not sufficiently specific because “the conditions of the consent are hidden in the detail of the lengthy

User Agreement and because the purpose for which consent is being obtained is not made clear”.112

183. The complainants contend that:

it needs to be expressly stated that the ‘offers relating to finance’ are marketing contacts

information about who are the relevant corporate partners needs to be disclosed

it should be made clear that eligibility for a credit report is not contingent on consent to

disclosure to third parties for direct marketing purposes.113

184. The complainants have referred to a number of Privacy Commissioner case notes which they argue

support their requested changes to tick box 2. 114 The case notes are not persuasive, with only one of

relevance to the present set of circumstances.115 Moreover given the case notes have no legal status,

and are not binding, I afford them little weight in my consideration of this issue.

185. Veda denies that it has contravened APP 7 with respect to the statement offered at tick box 2. Veda

argues that by ticking tick box 2, access seekers have consented to the use or disclosure of their personal

information collected by Veda for the purpose of direct marketing.

186. Veda contends that the wording of tick box 2 clearly describes (i) that the consent is for disclosure of

personal information to specified types of entities; and (ii) the specific purpose of the disclosure of the

information by Veda. Veda notes that although “relevant corporate partners” are not individually

identified, this is not a requisite element of consent under APP 7.116

111 The second representative complaint, 20 October 2014, 2.

112 Complainants’ submission in reply to the OAIC, 15 June 2015, 18-19, [71-[72]].

113 Complainants’ submission in reply to the OIAC, 15 June 2015, 18-19, [71]-[72].

114 OPC v Employment Services Company [2005] PrivCmr 13; N V Private Insurer [2004] PrivCmrA 1 (1 January 2004); A and Insurer [2002] PrivCmrA1 (1 December 2002)

115 N v Private Insurer [2004] PrivCmrA 1 (1 January 2004).



Findings in relation to tick box 2

187. As I similarly noted at paragraph [174] in relation to tick box 1, access seekers are not compelled to tick

tick box 2, and there is nothing to suggest that not ticking the box has serious or adverse consequences

for the access seeker attempting to obtain their credit report free of charge. There is no information

before me to suggest that failure to tick tick box 2 rendered access seekers ineligible for a free credit

report. The option to tick, or not tick, tick box 2 makes it apparent that eligibility for a credit report is not

contingent on consenting to the disclosure of personal information to third parties for direct marketing

purposes.

188. ‘Direct marketing’ is a term not defined in the Privacy Act. It is however described in the explanatory

memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012, as:

… the use and/or disclosure of personal information to communicate directly with an individual to promote

goods and services. A direct marketer may communicate with an individual through a variety of channels,

including telephone, SMS, mail, email and online advertising. 117

189. The statement found at tick box 2 falls within that definition. Veda’s user agreement at clauses 11-13

confirms that consent provided on its website when the credit reporting information is ordered is

consent for Veda and its related bodies corporate and service providers to use the personal information

of access seekers to send them information about Veda and its related companies products and

services. It clearly states at clause 13 that these activities are ‘marketing activities’. An ordinary and

reasonable member of the class could have been expected to read the terms and conditions provided to

make sure they were adequately informed.

190. In my view Veda has, to a sufficient degree, outlined the purpose of the use or disclosure of personal

information for the purpose of securing informed consent.

191. Likewise, within the statement at tick box 2, Veda has, in my opinion, sufficiently outlined the third

parties to whom disclosure may be made for the purposes of direct marketing. An individual must also

be sufficiently informed about each of the proposed collections, uses and/or disclosures, and how their

personal information will be handled so that they can make an informed decision about whether or not

to give consent. There is no specific requirement to specify to whom the information is proposed to be

disclosed. There is a question as to whether or not Veda’s related entities could rely on consent

obtained by Veda without being identified; however, this is a separate issue and does not need to be

determined here.

117 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, 81.


192. Veda informs the access seeker at the statement associated with tick box 2 that if consent is given,

their information will be disclosed to its ‘corporate partners’. The user agreement indicates that direct

marketing activities may be deployed by Veda and its ‘related bodies corporate’ and ‘service providers’.

The information is provided in plain English and I believe adequately identifies the type of entity to

which information may be disclosed, sufficient for Veda to meet its obligation of ensuring individuals are

properly and clearly informed about how their personal information will be handled so they can decide

whether to give consent.

193. In my view the statement at tick box 2 is sufficiently clear to signal that a ticked box means the access

seeker has provided informed consent to the use or disclosure of their information for the purpose of

direct marketing. On this basis, in relation to the statement associated with tick box 2, in my view Veda

has not breached APP 7.

194. Nonetheless as a result of my finding in relation to tick box 1, I determine that the second complaint

has been substantiated, and at the relevant time Veda engaged in conduct that constitutes an

interference with the privacy of class members.

The third complaint

The 12-month issue

195. Section 20R(5) of the Privacy Act provides that a CRB is not permitted to charge for access if the access

seeker has not made a request for access within the preceding 12 months. The complainants contend

that Veda is charging for access to a credit report even when the access seeker has not requested a

credit report in the previous 12 months and that this is a breach of s 20R(5).118 They contend that an

audit of individual applications for credit reporting information within the preceding 12 months is

required and any individual who has paid for a credit report when they have not accessed a credit report

in the previous 12 months must be refunded the fee.119

196. Veda denies its practice of providing access to credit reports is in breach of s 20R(5). Veda claims that

since the commencement of the Privacy Amendment (Enhancing Privacy Protection) Act 2012 on 12

March 2014, it has not charged access seekers for making requests in relation to credit reporting

information held by Veda or for giving access to that information. It declares that this free credit

reporting information is available to an access seeker regardless of whether or not the access seeker has

made an access request in the previous 12 months.120

118 Third representative complaint, 20 October 2014, 2.

119 Third representative complaint, 20 October 2014, 2..



197. Veda says that although it does not charge for giving access to credit reports it does charge for the

premium and ancillary services provided in addition to the credit report (Additional Services).121 In other

words, individuals purchasing products from Veda are said to be purchasing “value-added services”, not

the credit report.

198. Veda acknowledges that it does not check whether individuals who are paying for Additional Services

have had access to their credit reporting information in the preceding twelve months. Veda appears to

be claiming that such a process is unnecessary because all requests for access to credit reports are met

free-of-charge .122

199. The complainants argue that Veda’s claim it never imposes charges for requests for access to credit

reporting information is incorrect. They argue that through the marketing of its products, Veda imposes

charges for credit reports because individuals are forced to purchase some other product in order to

obtain the “free” credit report.123

200. The complainants refer to the products comparison table at paragraph 11.1 of Veda’s 20 April 2015

submission reproduced here at Figure 18 (the table), which outlines the various packages of Additional

Services individuals can access. They point out that the table shows that the ‘My Veda Alert’ and ‘Veda

Starter’ packages restrict the number of credit reports to 1 per year and that other paid products are

restricted to 2 or 4 credit reports per year. They say that this does not fit with the claim made by Veda

that access to credit reports is free to all individuals who request them regardless of whether they have

been provided with a free credit report in the previous 12 months.

121 Veda’s submission to the OAIC, 20 April 2015, 13-14, [11.1]


123 Complainants’ submission in reply to the OAIC, 19-21, [74]-[83].


Figure 18.

201. The complainants also point out that access seekers are led to believe that any access to credit reports

outside of the circumstances listed on the ‘my credit file’ website (i.e. where a credit application has

been declined, where a correction request has been lodged and corrected, and where a free copy has

been requested once every 12 months), is only available through paid services.124 At the relevant time,

the ‘my credit file website’ stated: “there are certain circumstances under which you can get a copy of

your credit report for free”. The complainants argue that this implies in all other circumstances an

individual will have to pay to receive a credit report.125 I agree with the complainants’ submission on this

point.

202. The complainants argue that for all practical purposes Veda charges for credit reports, and without a

system in place to monitor whether or not an access seeker has applied for a free credit report in the

preceding 12 months, it falls in breach of s 20R(5).

Findings in relation to 12-month issue

203. I accept for the reasons outlined by the complainants in [201] that Veda’s ‘my credit file’ website

contains information that is inconsistent with its claim that it does not charge for access to credit

reports.

124 Complainants’ submission in reply to the OAIC, 19-21, [74]-[87].

125 Complainant’s submission in reply to the OAIC, 15 June 2015, 19-20, [76]-[77].


204. I also note that at the relevant time, Veda’s credit reporting policy on the Veda website stated:

Excerpt from Veda Credit Reporting Policy

2. Access to Credit Reporting Information

Under the Act you have a right to a free copy of credit reporting information the CRB holds on you:

once every 12 months; or

when you have been declined credit by a credit provider wholly or partly because of

credit reporting information held by the CRB and you make your request for free

access within 90 days of being declined credit and provide the CRB with evidence of

the same.

You are also entitled to a free copy of credit reporting information the CRB holds on

you when it makes a change to your credit reporting information as a result of a

correction request made by you.

To obtain a free copy please go to www.veda.com.au/understanding-your-credit-file and click on the

ORDER NOW link under the column headed “Basic Credit File”.

If you do not have access to the internet you can write to the CRB at:

……..

The CRB does not hold personal information derived from credit information (such as bureau scores) as

this information is dynamically derived at the time the CRB receives a request for this information. If

you wish to obtain a bureau score or a copy of your credit information more frequently than once a

year, you may, if you wish, pay an annual fee and sign up to the Your Credit & Identity Service. For

more information go to www.veda.com.au.126

205. Veda says it does not charge for providing access to credit reports, and any cost incurred by access

seekers is for the Additional Services provided. It is unclear then how Veda can state in its credit policy

that if an access seeker wishes to obtain a copy of their credit information more frequently than once a

year, they may pay an annual fee and sign up to the ‘Your Credit & Identity’ Service.

206. That said, neither the complainants nor Veda have supported their claims with analytical or even

anecdotal evidence. I have no information before me to suggest that an access seeker has been refused

access to a credit report free of charge when they apply within 12 months of their last application for

free credit reporting information. Nor have I information to the contrary, that is, that access seekers

have obtained access to a credit report free of charge when they apply within 12 months of receiving

their last free report.

207. What is apparent though is that Veda’s claim of ‘no charge for credit reporting information’ is

controverted by information on both the Veda and ‘my credit file’ websites. An access seeker who had

informed themselves of the content of those websites, as well as their terms and conditions, would

126 Internet Archive Wayback Machine, Veda. September 2014.

http://web.archive.org/web/20140914234056/http://www.veda.com.au/credit-reporting-policy>.

http://web.archive.org/web/20140914234056/http:/www.veda.com.au/understanding-your-credit-file



reasonably assume that access to a credit report on request more than once a year required payment in

the form of a subscription to one of Veda’s product packages.

208. Notwithstanding all of this, charging for access to credit reports is not a breach of s 20R(5), as long as

under s 20R(6) the charge is not excessive, and once every year an access seeker can, on request, access

that information free of charge. The requirement here is that the CRB must give access to a free credit

report on request, not that the CRB gives access to a free credit report once a year. It is possible that an

individual might instead choose to pay for a credit report if they think there is additional value being

offered by a particular product package, and choose not to access the free service.

209. Providing that an individual has the opportunity to make the choice between access to a free credit

report and access to Veda product packages, there is no contravention if Veda does not provide a free

report once a year to subscribers who don’t ask for one. I have no information before me to suggest that

subscribers have been refused access to a free credit report on request. I am of the view that on the

balance of probabilities, Veda has not contravened s20R(5) of the Privacy Act and has not interfered

with the privacy of access seekers in this respect.

Expedited delivery

210. Veda has advised that it charges, or did so at the relevant time, $69.95 to provide a credit report within

24 hours of a request for access. It describes this service as one of its Additional Services. My

understanding is that this practice has now been discontinued.127

211. Veda argues that s 20R(3) of the Privacy Act only requires a CRB to provide a credit report within 10

days of the request.

212. Section 20R(3) of the Privacy Act specifically states that:

The credit reporting body must respond to the request within a reasonable period, but not longer than 10 days,

after the request is made.

213. The complainants claim that Veda’s imposition of a charge for expedited delivery is a charge for access

in breach of s 20R(5), unless Veda has had a request from the individual within the previous 12

months.128


128 Complainants’ submission in reply to the OAIC, 20 April 2015, 22, [90].


214. As noted at paragraph [79], the term ‘reasonable’ may be construed as what is appropriate in the

circumstances. This means that what amounts to an appropriate time taken to respond to a request for

credit reporting information will vary depending on the circumstances.

215. There is nonetheless a cap on what may be considered a ‘reasonable period’, i.e. 10 days. That is not to

say that one day, two days, three or four days could not be construed as ‘reasonable’ (and anything

more ‘unreasonable’) in any particular set of circumstances. Rather, it means that a CRB breaches the

provision if it takes more than 10 days to respond, regardless of the circumstances.

216. The complainants argue that Veda’s capacity to provide expedited delivery services within 24 hours

suggests that in its circumstances a ‘reasonable period’ for online requests is closer to one day than

10.129

217. In the event that an access seeker is seeking access to credit reporting information and hasn’t sought

this information within the preceding 12 months, Veda has an obligation to provide access to that

information free of charge within a reasonable period, but no more than 10 days. A ‘reasonable period’

may in certain circumstances be 24 hours.

218. The obligation to provide the credit reporting information free of charge still applies, regardless of at

what point in time within that 10-day limitation period Veda responds. The provision of credit reporting

information in these circumstances is not an Additional Service. Rather it is an obligation Veda must

undertake in accordance with s 20R(3) of the Privacy Act. There is nothing which permits Veda to charge

for a credit report on request where a request has not been made in the preceding 12 months.

219. I therefore find Veda’s practice of charging for the ‘expedited delivery’ of a credit report was in breach

of s 20R(5) in circumstances where the access seeker had not sought access to credit reporting

information within the preceding 12-month period.

The excessive charge issue

220. The complainants allege the Veda is also in breach of s 20R(6), which provides that where the access

seeker is not entitled to a free credit report, any charge by the CRB must not be excessive.130

221. In response Veda says that it does not and has not charged access seekers foraccess to credit reporting

information held by Veda. Veda contends that the charges made are in respect of Veda’s Additional

129 Complainants’ submission in reply to the OAIC, 20 April 2015, 22, [89].



Services only, not for access to credit reports, which are provided for free along with the Additional

Services. On this basis, Veda says, its processes are in compliance with section 20R(6).131

222. Veda claims that s 20R(6) does not apply to Veda’s charges for Additional Services, which are not

regulated by the Privacy Act or Code. Veda goes on to say:

It follows that the applicants’ claims that Veda’s charges (including charges for expedited delivery) are excessive

and unreasonable, are not matters which can be determined by the Commissioner, as they cannot constitute an

interference with the privacy of an individual and therefore cannot form the subject of a complaint under

section 36 of the Act.132

223. The complainants submit that if the only way for an access seeker to access their credit reporting

information for a second time within 12 months is through an Additional Service, then s20R(6) must

apply to the lowest cost Additional Service which grants an access seeker access to their information.133

224. The complainants claim that the cost of a Veda credit report is $79.95. They compare this cost to the

$30 cost of obtaining a credit report from Dunn & Bradstreet134 and the $0 cost of obtaining an Experian

credit report135.

225. The complainants also refer to a report issued by the New Zealand Privacy Commissioner, which

considered the NZ$51.95 cost of Veda’s credit report, and found the amount to be unreasonable and

excessive.136

Findings in relation to excessive charges issue

Cost of a Veda credit report

226. In its submissions, Veda has not provided a cost figure for giving access to a credit report on request.

This is because of its claim that access is freely given on request at all times. The complainants argue

that I should accept the lowest cost Additional Services package as the cost of a Veda credit report,

which at the relevant time was the ‘Veda Starter’ package and the ‘My Veda Alert’ package, both costing

$79.95 per year.

131 Veda’s submission to the OAIC, 20 April 2015,15-16, [16.1].

132Veda’s submission to the OAIC, 20 April 2015,15-16, [16.1].

133 Complainants’ submission in reply to the OAIC, 15 June 2015, 24, [ 101].

134 Dunn & Bradstreet is another credit information bureau in Australia and New Zealand.

135 Experian Information Solutions also provides a credit reporting service, and is a credit reporting body for the purposes of the Privacy Act.



227. Figure 18 details what is provided in each of the Additional Services packages. The ‘Veda Starter’

product includes, in addition to the one credit report per year, access to a VedaScore, online

membership, as well as access to the resolution centre and knowledge area. The ‘My Veda Alert’

product includes, in addition to the one credit report per year, credit alerts.

228. It is clear that the cost of Veda’s products includes Additional Services. I accept that Additional Services

do not constitute credit reporting information and are therefore not regulated by the Privacy Act or the

CR code. The complainants do not dispute that credit alerts, online membership, and access to the

resolution centre and knowledge area do not constitute credit reporting information. Nonetheless, the

complainants argue that the VedaScore is CRB derived information that should be included when credit

reporting information is provided to an access seeker free of charge. I outline the reasons for my

decision that the VedaScore does not constitute credit reporting information at [251]-[267].

229. There is no doubt that the information provided on Veda’s own websites is completely at odds with

Veda’s assertions in its submissions that the cost of a credit report is $0, and the cost of the Veda credit

reporting packages relate exclusively to the Additional Services. Certainly, Veda has not provided any

information to suggest how its ‘free credit reports on request at all times’ approach is achieved through

its current processes. On the other hand, nor have the complainants provided any evidence which

refutes Veda’s claim of free credit reports.

230. However, whether or not Veda charges for a credit report on request, it is entitled to do so under s

20R(6) provided the charge is not excessive (and the access seeker has not requested one in the last 12

months). It would seem on balance from the information I have at hand that Veda does not permit

access to limited content in the form of the credit report in its paid credit reporting services, with access

only provided on purchase with a membership package that includes this information plus the

Additional Services. If that is the case, and in the absence of contrary evidence provided by Veda, I am of

the view that notionally some of the $79.95 fee must be attributable to that part of the package that

comprises the credit reporting information to which an access seeker is entitled to access on request

under s 20R. Assuming Veda charges a notional fee for that information, I must determine whether the

notional fee for access to that information is excessive.

231. The word ‘excessive’ is not defined in the Act. According to the Macquarie Dictionary ‘excessive’ is

defined as “exceeding the usual or proper limit or degree; characterised by excess”.137 When considering

the excessiveness of a charge, I have had regard to the explanatory memorandum to the Privacy

Amendment (Enhancing Privacy Protections) Bill 2012, which provides that the obligation to not charge

excessive fees for access to credit reporting information is the same test that applies in relation to

access to other personal information under APP 12.8.138 According to the APP guidelines at [12.79],

137 Macquarie Dictionary, Macquarie Dictionary Online, 6th ed. (October 2013) https://www.macquariedictionary.com.au/.

138 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protections) Bill 2012.

https://www.macquariedictionary.com.au/


whether a charge is excessive will depend on the nature of the organisation, including the organisation’s

size, resources and functions, and the nature of the personal information held.139

232. In order to consider what is the ‘usual or proper limit or degree’ in relation to charging for credit

reports , the complainants have requested that I consider charges imposed by other credit reporting

bodies.140 I am, however, not satisfied that I have sufficient information to adequately draw a pricing

comparison between Veda and its competitors. It would be necessary to know much more about the

costing structures, business models and operational contingencies faced not only by Veda, but that of its

competitors to assess whether reasonable comparisons could be drawn between those entities, and

whether there would be a need to adjust competitors’ credit reporting charges before determining

whether or not Veda’s notional charge (whatever might constitute that charge) was excessive.

233. Similarly, I am not satisfied that the New Zealand (NZ) Privacy Commissioner’s finding in his report of

March 2014 (NZ Report), in which he found the amount of $51.95 charged by Veda Advantage Limited in

New Zealand was unreasonable, is sufficient to support the claim that Veda’s charge on credit reports in

Australia is excessive.141

234. As Veda rightly points out, neither the NZ Act or NZ Code has application to Veda’s services or charges

in Australia, and the obligations imposed under that regulatory framework do not correspond with any

relevant obligations on Veda in Australia under the Privacy Act or CR Code.142 I would need to be

satisfied, and I am not, that notwithstanding the different regulatory frameworks between Australia and

New Zealand and the differences in factual circumstances, the sum of $51.95 was a reasonable

comparator, or that I had sufficient information to take into account all the adjustments that would

need to be made to that figure for it to become a reasonable comparator.

235. While I find that Veda, in the absence of contrary evidence, does charge a nominal fee for access to

credit reporting information that is bundled up in its membership packages, I have insufficient

information available to me to determine what constitutes a ‘usual or proper’ fee, and therefore

whether or not any notional fee charged by Veda is excessive. It may be that the difference between

what in Veda’s circumstances would constitute a ‘usual or proper’ fee and the notional fee is excessive,

but I do not have enough information before me to make that determination at this time.

The VedaScore issue

236. Section 20R(1) of the Privacy Act provides:

139 APP guidelines (v 1.1, 1 April 2014). There is no amendment to this [12.79] provision in the updated guidelines (v 1.2, 1 March

2015).


141 New Zealand Privacy Commissioner, Report by the Privacy Commissioner into Veda Advantage’s charge for urgent request for personal information (24 March 2014).

142 Veda’s submissions to the OAIC, 20 April 2015, 15-16, [16.1].


If a credit reporting body holds credit reporting information about an individual, the body must, on request

by an access seeker in relation to the information, give the access seeker access to the information.

237. Section 6 of the Privacy Act defines ‘credit reporting information’ as follows:

Credit reporting information about an individual means credit information, or CRB derived information, about the individual.

238. ‘CRB derived information’ under s 6(1) of the Act means any personal information (other than sensitive

information) about the individual:

(a) that is derived by a credit reporting body from credit information about the individual that is held by the

body; and

(b) that has any bearing on the individual’s credit worthiness; and

(c) that is used, has been used or could be used in establishing the individual’s eligibility for consumer credit.

239. ‘Credit information’ has the meaning given by 6N of the Act, and I have outlined relevant provisions at

paragraph [15].

240. Paragraph 19.4(a)(ii) of the CR code states:

Where credit reporting information is provided to an access seeker free of charge by a CRB as required by Part IIIA,

the Regulations or this CR code:

a. the CRB must provide the access seeker with access to:

(i) all credit information in relation to the individual currently held in the databases that the

CRB utilises for the purpose of making disclosures permitted under Part IIIA; and

(ii) all current CRB derived information about the individual that is available.

241. The complainants contend that paragraph 19.4(a)(ii) clearly requires the derived information (being

the VedaScore) to be disclosed in the free credit report.143

242. Veda contends that Veda’s access obligations under Part IIIA and the CR code only extend to

information that it holds. It submits that a VedaScore is dynamically generated at the time of the

request by an access seeker for a paid service, and is consequently not held or available at the time

credit reporting information is provided for free to an access seeker.144

243. Veda’s argument is based on the following premise:




The Code is a “CR code” registered under Division 3 of Part IIIB of the Privacy Act. Section 26N(2) of the Privacy

Act relevantly provides that a CR code must set out how one or more of the provisions of Part IIIA are to be

applied or complied with. Section 26N(3) goes on to provide that a CR code may impose additional

requirements to those imposed by Part IIIA, so long as the additional requirements are not contrary to, or

inconsistent with that Part. Veda submits that, in accordance with section 26N of the Privacy Act, paragraph

19.4(a)(ii) must be interpreted as setting out how section 20R(1) of the Privacy Act is to be applied, and may

not be interpreted as imposing additional requirements that are contrary to or inconsistent with that

section.145

244. Veda says any interpretation of paragraph 19.4(a) of the CR code that requires the CRB to provide

credit reporting information that it does not hold would be contrary to, or inconsistent with, subsection

20(R)(1) for the purposes of section 26N(3).146

245. Veda argues that the VedaScore is not ‘held’ for the purposes of the Privacy Act and the CR code, but

additionally is not within the scope of ‘available’ CRB derived information in paragraph 19.4(a)(ii). Veda

points out the definition of ‘available’, which is defined in the Macquarie Dictionary as “suitable or ready

for use, at hand, of use or service”, is premised on the idea that the item or thing in question is already

in existence.147 Veda says this is not the case with the VedaScore. Veda explains that a VedaScore does

not come into being until an access seeker signs up to Veda’s ‘Your Credit and Identity’ service which

provides access to a portal, in which VedaScores are dynamically generated. 148

246. In response the complainants refer to the Explanatory Memorandum to the Privacy Amendment

(Enhancing Privacy Protections) Bill 2012 which provides at page 147:

This provision permits the individual to obtain access to their credit reporting information. This includes

both the credit information about the individual and the CRB derived information about the individual (for

example, any credit scoring or analysis about the individual).149

247. The complainants contend that it was the intention of parliament that credit scores be given to an

access seeker upon request.150



147 Macquarie Dictionary, 6th ed. (Oct 2016). Macquarie Dictionary Online. <https://www.macquariedictionary.com.au/features/word/search/?word=available&search_word_type=Dictionary>.


149 Complainants’ submission in reply to the OAIC, 25, [109].



248. Moreover, the complainants argue that in accordance with the definition of CRB derived information

set out in s 6(1) of the Privacy Act, CRB derived information does not need to be held by the CRB; rather

it is the credit information that is held, not the CRB derived information.151 The complainants reason

that as a result, paragraph 19.4(a)(ii) of the CR code sits “comfortably within the limits of s 26N(3) of the

Privacy Act” and there is no prevailing inconsistency between these provisions.152

249. The complainants further contend that the VedaScore falls within the scope of available CRB derived

information for the purposes of paragraph 19.4(a)(ii) of the CR code because the ‘dynamic process’ of

generating a credit report generates the VedaScore or can readily be made to do so.153

250. The complainants finally note that a credit score is available for free and included in the Experian credit

report.154

Findings in relation to the VedaScore claim

251. In my view, in order for the VedaScore to be subject to the access obligations under Part IIIA of the

Privacy Act and the CR code, it must be credit reporting information that is held by Veda. Both credit

information and CRB derived information fall within the meaning of credit reporting information.

252. Section 20R of the Privacy Act clearly stipulates that a credit reporting body must give access to credit

reporting information it ‘holds’. This is reflected in the explanatory memorandum of the Privacy

Amendment (Enhancing Privacy Protection Bill 2012, which says the following about section 20R:

Subclause (1) states the general obligation that if a credit reporting body holds credit reporting information

about an individual, the body must, on request by an access seeker, give the access seeker access to the

information.

This provision is based on the obligations set out in, and the structure of, APP 12, modified to apply specifically

to credit reporting bodies. It is generally intended that access to credit reporting information should occur on

the same terms as access to personal information held by an APP entity.155

253. APP 12, which deals with access to personal information, states:

If an APP entity holds personal information about an individual, the entity must, on request by the individual,

give the individual access to the information.


152 Complainants’ submission in reply to the OAIC, 15 June 2015, 27, [119]-[120].


154 Complainants’ submission in reply to the OAI, 15 June 2015, 27, [121].

155 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, https://www.legislation.gov.au/Details/C2012B00077/Explanatory%20Memorandum/Text.

https://www.legislation.gov.au/Details/C2012B00077/Explanatory%20Memorandum/Text


254. The explanatory memorandum suggests it was the intention of parliament that credit scores be given

to access seekers upon request where the CRB holds that information (emphasis added).

255. Section 6(1) of the Privacy Act provides that an entity ‘holds’ personal information if the entity has

possession or control of a record that contains the personal information. The Act relevantly defines

‘record’ to include an electronic or other device. Veda’s computer system is a ‘record’ in Veda’s

possession and control for the purposes of the Act.

256. The issue for determination is whether a VedaScore can be said to be credit reporting information that

is contained in Veda’s computer system.

257. In response to my issuing a notice to produce under s 44 of the Privacy Act Veda provided further

information on how VedaScores are generated by Veda’s computer system and accessed by individuals

and credit providers.

Consumer subscribers to Veda’s paid services are provided with access to a portal. This portal is

created once the subscription has been processed and the features available to subscribers are

determined by the particular product to which the individual has subscribed. A VedaScore is

generated once the portal is created. These scores are not event-driven and are automatically

generated from credit information held by Veda at particular points in time. As part of the service

attached to certain products (Veda Access and Veda Plan for example) past scores dynamically

generated are auto-held by the system so that an individual can see how their score has changed

over time with changes in their credit history (score tracker). Past scores remain in the portal for

12 months. Once a subscription ends, the portal closes down and the information generated

within that portal, including the VedaScores, is destroyed.

For credit provider subscribers, the situation is different. VedaScores are event-driven and

calculated through the application of a mathematical algorithm. Identical algorithms return

different outcomes depending on the inputs, such as the identity of the credit provider, and the

reason for access. The score returned also reflects the level of information that the credit provider

has requested be included in the score. As I understand it, this means a credit provider may yield a

different VedaScore for a particular individual at any one point in time, and different credit

providers will yield different VedaScores for the same individual at the same point in time.

VedaScores generated in the credit provider space are not held. They are destroyed after each

completed transaction in the subscriber portal. Information about the access to scores is,

however, included in Veda transaction logs, which are generated within a different and separate

database system. The logs can be retained anywhere from six months to two years.

Scores are generated through an automated process. A mathematical algorithm is applied to the

source information (existing credit reporting information) within Veda’s database coupled with


subscriber inputs to dynamically generate a score. The algorithm is set in time but periodically

reviewed and updated.

Veda says that the credit report merely arranges credit information that is held by Veda in a form

that is appropriate for consumers (an access will be recorded on the file as ‘access’). In contrast,

Veda says, the VedaScore is new information that is derived from credit information.

258. Based on this information, as I see it, there is no fixed score that can be attributed to an individual even

at any one particular point in time, because the score generated will be different depending on whether

the score has been requested by the individual or a credit provider. It will also depend on which type of

credit provider has requested access, and what categories of information have been requested by the

credit provider.

259. Further a VedaScore does not come into existence until the point of access, and the outcome will differ

depending on the inputs at the time of access. So for individuals wishing to access a score, a score does

not come into being until the creation of a portal (created through subscription), when the score is then

auto-generated at particular points in time. Prior to that, a score simply doesn’t exist. For credit

providers wishing to access a score, the score does not come into being until the point of access when

the algorithm is applied to the existing credit information (source information) factoring in various

inputs at the time of the access request. When credit providers exit their portal, the score is destroyed –

it is not retained.

260. When an access seeker requests a free credit report, there is no score in existence contained within

Veda’s database. There is no portal for the access seeker to access, unless they are paid subscribers. Nor

is there any type of fixed score retained in the credit provider space that could be accessed by the

access seeker. All that exists at the time of the request for a free credit report is existing credit

information (source information).

261. Relevantly the explanatory memorandum provides at item 14:

To derive information from other information (the source information) is to obtain or deduce other

personal information from the source information.156

262. The VedaScore is derived information from the source information, however it is only obtained

following the application of an algorithm to source information, factoring in various inputs at the time of

access. It does not come into being until that derivation process has occurred. In other words, there is

no VedaScore that is held by Veda at the time an access seeker who is not a subscriber requests a credit

report free of charge.

156 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012,


263. I acknowledge that Veda does hold information about credit provider access to VedaScores, which has

been recorded in transaction logs. On the information before me, it is unclear exactly in what form this

information appears, but as I understand it, it is only recognisable as a VedaScore once a ‘complex

extraction process’ has been employed.

264. In my view, a transaction log record is not CRB derived information because in its existing form (prior to

any extraction process), it is not information that has any bearing on the individual’s credit worthiness

nor is it information that is used, has been used, or could be used in establishing eligibility for consumer

credit. Until there is some physical alteration or effect on the transaction log from the extraction

process, it cannot be considered information which falls within the definition of CRB derived

information, or indeed credit information.

265. In my view, a VedaScore does not constitute credit reporting information that Veda holds at the time of

an access request for a free credit report, simply because at that time, a score doesn’t exist. Veda is

therefore not in breach of the Act (or the CR code) for failing to provide access to VedaScores when a

request for free access to credit reporting information is made.

266. Notwithstanding this, I find that the third complaint has been substantiated in relation to Veda’s

practice of charging for the ‘expedited delivery’ of a credit report in circumstances where the access

seeker had not sought access to credit reporting information within the preceding 12-month period. This

practice was in breach of s 20R(5) of the Privacy Act and constitutes an interference with the privacy of

class members.

Declarations

267. In accordance with s52(1)(b) I make the following declarations:

I. I declare that the first complaint is substantiated under s 52(1)(b) of the Privacy Act on the

following findings:

i. Veda, at the relevant time, failed to prominently state on its websites that individuals

have a right to obtain their credit reporting information free of charge in certain

circumstances (the prominence issue) in contravention of s 19.3(a) of the CR code; and

ii. Veda, at the relevant time, did not take reasonable steps to ensure that free access to

credit reports was as available and as easy to identify and access as paid access to

credit reports in contravention of s 19.3(b) of the CR code (the online access and

phone access issues).

II. I declare that the second complaint is substantiated under s 52(1)(b) of the Privacy Act on the

following finding:


i. Veda at the relevant time used personal information it held about class members for

the purpose of direct marketing in breach of APP 7 (the direct marketing issue).

III. I declare that the third complaint is substantiated under s 52(1)(b) of the Privacy Act on the

following finding:

i. Veda’s practice of charging for the ‘expedited delivery’ of a credit report was in breach of

s 20R(5) in circumstances where the access seeker had not sought access to credit

reporting information within the preceding 12-month period.

268. To its credit, Veda has taken some steps toward improving the promotion and delivery of its free

service of access to credit reports since the complaints were lodged.

269. Veda has, for example, moved the ‘free file’ button presently appearing on its ‘my credit file’ web

pages to a horizontal level equivalent to the first reference to a paid service. It has amended its ‘your

credit and identity’ web page to accommodate the option of free access to credit reports in its online

comparison of Veda product information. It has streamlined its online application process for free access

to credit reports, including the amending of Veda’s online request for consent to market Veda products

and those of its related bodies and service providers. It has also amended its identification processes for

access seekers wishing to access a free report, such that its online verification process for access seekers

requesting a free report is now the same process as that for access seekers requesting their credit report

through one of Veda’s paid services. Furthermore, it has discontinued its ‘expedited delivery’ service in

circumstances where an individual has simply requested access to their credit reporting information (the

‘immediate delivery’ of credit reporting information remains part of a plethora of services offered within

various Veda product packages).

270. Notwithstanding these significant changes, I am of the view that Veda continued to engage in conduct

which constitutes an interference with the privacy of class members. Consequently, I declare, in

accordance with s 52(1)(b)(ii) of the Privacy Act, that within 6 months of the date of the determination,

Veda shall:

I. take action to ensure its service of providing free access to credit reporting information is as

available, and as easy to identify and access as it is through its fee-based services, including but not

necessarily limited to the following action:

(i) ensuring class members are able to access credit reports free of charge over the phone in the

same way that reports which are paid for can be ordered by telephone.


II. confirm with me that the action at [i] has been undertaken, advising me of website revisions to

inform consumers that free credit reports may be ordered by phone, as well as by post and online;

amendments to the application procedure for applying for free credit reports over the phone and

any other actions that may be necessary to satisfactorily carry out the action declared at [i] to

ensure that Veda is no longer engaging in conduct which constitutes an interference with the

privacy of class members.

III. refund individuals the cost of its expedited delivery charge, in circumstances where those

individuals had not sought access to credit reporting information within the preceding 12-months

period.

Timothy Pilgrim

Australian Privacy Commissioner

9 December 2016

Review rights

A party may apply under s 96 of the Privacy Act 1988 to have a decision under s 52(1) or (1A) to make a determination

reviewed by the Administrative Appeals Tribunal (AAT). The AAT provides independent merits review of

administrative decisions and has power to set aside, vary, or affirm a privacy determination. An application to the

AAT must be made within 28 days after the day on which the person is given the privacy determination (s 29(2) of

the Administrative Appeals Tribunal Act 1975). An application fee may be payable when lodging an application for

review to the AAT. Further information is available on the AAT’s website (www.aat.gov.au) or by telephoning 1300

366 700.

A party may also apply under s 5 of the Administrative Decisions (Judicial Review) Act 1977 to have the determination

reviewed by the Federal Circuit Court or the Federal Court of Australia. The Court may refer the matter back to the

OAIC for further consideration if it finds the Information Commissioner’s decision was wrong in law or the

Information Commissioner’s powers were not exercised properly. An application to the Court must be lodged

within 28 days of the date of the determination. An application fee may be payable when lodging an application to

the Court. Further information is available on the Court’s website (http://www.federalcourt.gov.au/) or by

contacting your nearest District Registry.

http://www.aat.gov.au/

http://www.austlii.edu.au/au/legis/cth/consol_act/adra1977396/s5.html

http://www.federalcourt.gov.au/

Documents

Financial Rights Legal Centre Inc. & Others and Veda ... · Veda Advantage Information Services and Solutions Ltd (Veda) interfered with the privacy of the class of individuals identified