Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd [2016] AICmr 88 (9 December 2016) Decision and reasons for decision of Australian Privacy Commissioner, Timothy Pilgrim
Complainants: Financial Rights Legal Centre Inc
Consumer Action Law Centre
Financial Counselling Australia
Australian Privacy Foundation
Respondent: Veda Advantage Information Services and Solutions Ltd
Decision date: 9 December 2016
Application number: CP14/03515, CP14/04469, CP14/04470
Catchwords: Privacy — Privacy Act 1988 — Part IIIA — Privacy (Credit Reporting)
Code 2014 (Version 1.2) — APP 7
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 2
Contents
Determination ................................................................................................................ 4
Background .................................................................................................................... 4
The Veda Group .............................................................................................................. 5
The Law .......................................................................................................................... 5
Terminology ................................................................................................................... 8
The complaints ............................................................................................................... 9
Representative complaints ............................................................................................10
First representative complaint .......................................................................................11
Second representative complaint ...................................................................................11
Third representative complaint ......................................................................................13
Investigation process .....................................................................................................14
The first complaint .........................................................................................................14
Veda’s websites .............................................................................................................14
The prominence issue ....................................................................................................17
Findings in relation to prominence issue ........................................................................18
The online access issue ..................................................................................................23
Findings in relation to online access issue ......................................................................25
The phone access issue ..................................................................................................39
Findings in relation to the phone access issue ................................................................41
The onerous identification issue ....................................................................................43
Findings in relation to the onerous identification claim ..................................................45
The second complaint ....................................................................................................46
The timing issue .............................................................................................................46
Findings in relation to timing issue .................................................................................47
The direct marketing issue .............................................................................................47
Findings in relation to the tick box 1 ...............................................................................51
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 3
Findings in relation to tick box 2.....................................................................................55
The third complaint .......................................................................................................56
The 12-month issue .......................................................................................................56
Findings in relation to 12-month issue ............................................................................58
Expedited delivery .........................................................................................................60
The excessive charge issue .............................................................................................61
Findings in relation to excessive charges issue ................................................................62
The VedaScore issue ......................................................................................................64
Findings in relation to the VedaScore claim ....................................................................67
Declarations ..................................................................................................................70
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 4
Determination 1. Veda Advantage Information Services and Solutions Ltd (Veda) interfered with the privacy of the class of
individuals identified as ‘members of the public seeking to access a free copy of their credit report from
Veda Advantage’ in breach of the Privacy Act 1988 (Cth) (Privacy Act) by:
I. failing to prominently state that individuals have a right to obtain their credit reporting information
free of charge in certain circumstances, in contravention of paragraph 19.3(a) of the Privacy (Credit
Reporting) Code 2014 (version 1.2) (CR code)
II. failing to take reasonable steps to ensure that free access to credit reports was as available and as
easy to identify and access as paid access to credit reports, in contravention of paragraph 19.3(b) of
the CR code
III. using and disclosing personal information it held about individuals seeking free access to credit
reports for the purpose of direct marketing in breach of Australian Privacy Principle (APP) 7
IV. charging for the ‘expedited delivery’ of a credit report in breach of s 20R(5), in circumstances where
the individual (or access seeker) had not sought access to credit reporting information within the
preceding 12-month period.
Background
2. This determination relates to three representative complaints (the complaints) made under Part V of the
Privacy Act. The complaints are made jointly by consumer advocacy groups, Financial Rights Legal Centre
Incorporated, the Consumer Action Law Centre, Financial Counselling Australia and the Australian Privacy
Foundation (complainants) on behalf of a class of individuals identified as ‘members of the public seeking
to access a free copy of their credit report from Veda Advantage’ (class members, hereafter also referred
to as access seekers). The respondent to the complaint is Veda Advantage Information Services and
Solutions Limited (Veda).
3. It is complained that a number of Veda’s acts and practices relating to the provision of credit reporting
information (CRI), are in breach of the Privacy Act and the CR code.
4. Specifically, the complaints relate to alleged breaches of:
(a) section 20R of the Privacy Act (access to credit reporting information)
(b) APP 7 (direct marketing) under the Privacy Act; and
(c) paragraphs 19.3 and 19.4 of the CR code (access).
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 5
The Veda Group
5. The Veda Group Limited is an information services and aggregation business. It comprises a number of
separate companies, including the respondent in this matter, Veda Advantage Information Services and
Solutions Limited, which operates a credit reporting business. The respondent is a ‘credit reporting body’
under the Privacy Act1, and is the major credit reporting body in Australia. According to its website, Veda
is a ‘data analytics company and the leading provider of credit information and analysis in Australia and
New Zealand’.2
6. Veda collects, holds, uses and discloses information about individuals and corporations for the purpose of
providing information about the creditworthiness of an individual or corporation. It holds data on more
than 16.4 million individuals and 3.6 million companies and businesses.3 In February 2016, the Veda
Group Limited was acquired by Equifax Incorporated, a leading consumer credit reporting agency in the
United States and ‘a global leader in consumer, commercial and workforce information solutions’.4
The Law
7. The credit reporting provisions in Part IIIA of the Privacy Act govern the handling of information held by
credit reporting bodies (CRBs) and credit providers (CPs) relating to credit reporting.
8. Section 20R of the Privacy Act deals with access to credit reporting information. It relevantly states:
Access
(1) If a credit reporting body holds credit reporting information about an individual, the body must, on request by an access seeker in relation to the information, give the access seeker access to the information.
and
Dealing with requests for access
(3) The credit reporting body must respond to the request within a reasonable period, but not longer than 10 days, after the request is made.
(4) If the credit reporting body gives access to the credit reporting information, the access must be given in the manner set out in the registered CR code.
1 Under s 6(1) of the Privacy Act 1988 (Cth), credit reporting body is defined to mean: (a) an organisation, or (b) an agency
prescribed by the regulations; that carries on a credit reporting business.
2 https://www.veda.com.au/about-us. Accessed 10 August 2016.
3 https://www.veda.com.au/business. Accessed 10 August 2016.
4 https://www.veda.com.au/insights/equifax-completes-acquisition-australias-leading-credit-information-company-veda-group. Accessed 10 August 2016.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 6
Access charges
(5) If a request under subsection (1) in relation to the individual has not been made to the credit reporting body in the previous 12 months, the body must not charge the access seeker for the making of the request or for giving access to the information.
(6) If subsection (5) does not apply, any charge by the credit reporting body for giving access to the information must not be excessive and must not apply to the making of the request.
9. APP 7 deals with direct marketing. It states:
7.1 If an organisation holds personal information about an individual, the organisation must not use or disclose the information for the purpose of direct marketing.
The relevant exceptions to this is set out in APP 7.3:
7.3 Despite subclause 7.1, an organisation may use or disclose personal information (other than sensitive information) about an individual for the purpose of direct marketing if:
(a) the organisation collected the information from:
(i) the individual and the individual would not reasonably expect the organisation to use or disclose the information for that purpose; or
(ii) someone other than the individual; and
(b) either:
(i) the individual has consented to the use or disclosure of the information for that purpose; or
(ii) it is impracticable to obtain that consent; and
(c) the organisation provides a simple means by which the individual may easily request not to receive direct marketing communications from the organisation; and
(d) in each direct marketing communication with the individual:
(i) the organisation includes a prominent statement that the individual may make such a request; or
(ii) the organisation otherwise draws the individual’s attention to the fact that the individual may make such a request; and
(e) the individual has not made such a request to the organisation.
10. The CR code is a written code of practice about credit reporting under s 26N(1) of the Privacy Act. Under
s 26L of the Privacy Act, if an entity is bound by the registered CR code it must not do an act or engage in
a practice that breaches the code.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 7
11. The CR code adds to aspects of the credit reporting obligations imposed by Part IIIA, relevantly here,
obligations relating to access:
19. Access
19.3 If a CRB has a service whereby an individual (whether personally or through another access seeker) may
for a fee obtain their credit reporting information (fee-based service):
a. the information made available by the CRB about the fee-based service must prominently state that individuals have a right under Part IIIA to obtain their credit reporting information free of charge in the following circumstances:
i. if the access request relates to a CP's decision to refuse the individual's consumer credit application;
ii. if the access request relates to a decision by a CRB or CP to correct credit reporting information or credit eligibility information about the individual; and
iii. once every 12 months (this is in addition to any access given in accordance with
paragraphs 19.3(i) or (ii))
b. the CRB must take reasonable steps to ensure that its service, whereby individuals may obtain their credit reporting information free of charge, is as available and easy to identify and access as its fee-based service.
Source Notes: Sec 20R, 21T
19.4 Where credit reporting information is provided to an access seeker free of charge by a CRB as required
by Part IIIA, the Regulations or this CR code:
a. the CRB must provide the access seeker with access to:
i. all credit information in relation to the individual currently held in the databases that the CRB utilises for the purposes of making disclosures permitted under Part IIIA; and
ii. all current CRB derived information about the individual that is available;
b. the CRB must present the information clearly and accessibly and provide reasonable explanation and summaries of the information to assist the access seeker to understand the impact of the information on the individual's credit worthiness; and
c. if the CRB does not provide the information to the access seeker in the manner requested by the access seeker, the CRB must take reasonable steps to provide access in a way that meets the needs of the CRB and the individual.
Source Notes: Sec 20R, Explanatory Memorandum p.178
12. Section 13 of the Privacy Act provides that an act or practice of an entity is an interference with the
privacy of an individual if:
(a) the act or practice breaches a provision of Part IIIA in relation to personal information about the individual; or
(b) the act or practice breaches the registered CR code in relation to the personal information about the individual and the code that binds the entity.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 8
Terminology
13. The term ‘credit report’ which I refer to on various occasions in this determination and which appears
numerous times in correspondence from the complainants and Veda, is not a term used in the Privacy
Act or the CR code.
14. The appropriate term for an individual’s credit report is ‘credit reporting information’, which is defined
in s 6 of the Act to be: ‘... credit information, or CRB derived information, about the individual’.5
15. Credit information is defined in the Privacy Act at s 6N. There is no need to replicate the full definition
here, suffice to say that it is personal information about an individual (other than sensitive information)
that is, relevantly:
……..
(b) consumer credit liability information about the individual; or
(c) repayment history information about the individual; or
…….
(e) the type of consumer credit or commercial credit, and the amount of credit sought in an application;
i. that has been made by the individual to a credit provider; and
ii. in connection with which the provider has made an information request in relation to the individual; or
(f) default information about the individual; or
(g) payment information about the individual; or
……
16. Under subsection 6(1) of the Privacy Act, CRB derived information means any personal information
(other than sensitive information):
a. that is derived by a credit reporting body from credit information about the individual that is held by the
body; and
b. that has any bearing on the individual’s credit worthiness; and
c. that is used, has been used or could be used in establishing the individual’s eligibility for consumer
credit.
17. Personal information is defined in section 6(1) of the Privacy Act to mean information or an opinion
about an identified individual, or an individual who is reasonably identifiable:
a. whether the information or opinion is true or not; and
b. whether the information or opinion is recorded in a material form or not.
5 Privacy Act 1988 (Cth), s 6(1).
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 9
18. Over the years the provision of credit information to individuals by CRBs has generally been coined as
access to your ‘credit file’ or ‘credit report’. For convenience and comprehensiveness, I have used the
term ’credit report’ interchangeably with ‘credit reporting information’. Accordingly, where I have used
the term ‘credit report’ in the context of access to credit reporting information, I am referring to a
report provided to an individual by a CRB that includes all credit information about the individual and all
CRB derived information about the individual held by the CRB at the time of the request.
The complaints
19. The first complaint lodged on 15 August 2014 alleges that in contravention of section 19.3 of the CR
code:
(a) Veda has failed to prominently state that individuals have a right to obtain their credit reporting
information free of charge in certain circumstances (the prominence issue); and
(b) Veda has not taken reasonable steps to ensure that free access to credit reports online is as
available and as easy to identify and access as paid access to credit reports (the online access
issue); and
(c) individuals are not able to obtain a free credit report from Veda over the phone, but credit
reports issued via a fee-based service are available over the phone (the phone access issue); and
(d) Veda’s identification requirements to obtain a free credit report are more onerous than those for
credit reports issued via a fee-based service (the onerous identification issue).
20. The second complaint was lodged 20 October 2014 subsequent to Veda making free credit reports
available online on the Veda website by completing a form. The complainants allege that:
free credit reports are not being provided by Veda within the 10 day requirement under s 20R(3)
of the Act (the timing issue); and
tick boxes on Veda’s online application form for a free credit report lead to the marketing of
Veda’s fee-based services, in breach of APP 7 (the direct marketing issue). 6
21. The third complaint lodged on 20 October 2014 alleges that:
6 In their complaint dated 20 October 2014, the complainants identified as an issue the inconsistencies between free credit report
information on Veda’s ‘my credit file’ website, and the actual process of applying online for free credit report. In its submission dated 20 April 2005, Veda declared that the information on the ‘my credit file’ website had been corrected. The complainants confirmed this in their response to Veda’s submission. I understand that the claim regarding the discrepancy is no longer in issue, having been adequately dealt with.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 10
Veda is charging for access even when an individual has not requested a credit report within the
previous 12 months in contravention of s 20R(5) of the Privacy Act (the 12-month issue)
Veda is charging for the ‘expedited delivery’ of a credit report, in breach of s 20R(5), in
circumstances where the access seeker had not sought access to credit reporting information
within the preceding 12-month period (expedited delivery issue); and
the cost of a Veda credit report issued through its fee-based service is excessive, in contravention
of s 20R(6) of the Privacy Act (the charge issue) ; and
Veda does not include the individual’s VedaScore information in a free credit report, in
contravention of s 19.3(b) and 19.4(a) of the CR code (the VedaScore issue).
Representative complaints
22. The complaints have been made under s 36 of the Privacy Act, which provides for the making of
representative complaints. Additionally a representative complaint must meet the requirements of s 38
of the Privacy Act.7
23. Section 38(1) states that a representative complaint may be lodged under s 36 of the Privacy Act only if:
(a) the class members have complaints against the same person; and
(b) all the complaints are in respect of, or arise out of, the same, similar or related circumstances; and
(c) all the complaints give rise to a substantial common issue of law or fact.
24. Section 38(2) sets out further conditions for a representative complaint to be made. Specifically, it states that the representative complaint must:
(a) describe or otherwise identify the class members; and
(b) specify the nature of the complaints made on behalf of the class members
(c) specify the nature of the relief sought; and
(d) specify the questions of law or fact that are common to the complaints of the class members.
7 Section 36(2A) of the Privacy Act states that in the case of a representative complaint, s 36 has effect subject to s 38.
8 Veda’s submission to the OAIC, 20 April 2015.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 11
25. Veda has raised objections to the complaints being treated as representative complaints because, Veda
argues, the complaints have been made by the aforementioned consumer advocacy groups on behalf of
individuals who have complained to them about acts or practices that may be an interference with their
privacy.8
26. A person on behalf of an individual or individuals, as well as individuals themselves, can make a
complaint under s 36 of the Privacy Act. I am satisfied that the complaints received were validly made
under s 36. In respect of whether or not the complaints meet the requirements under s 38 of the Privacy
Act for representative complaints, I will consider each complaint in turn.
First representative complaint
27. I am satisfied that in respect to the first complaint, the requirements for making a representative
complaint under s 38 have been met. Though this complaint deals with a wide range of issues, I am
satisfied that the claims made are connected by circumstances sufficiently related to warrant their
grouping as a representative complaint. All class members are affected in common by Veda’s practices
surrounding its services to provide access to credit reporting information free-of-charge. The
complainants allege inequities between accessing credit reporting information free-of-charge and
accessing this information through Veda’s fee-based service. This raises questions as to whether these
practices are in contravention of s 19.3 of the CR code.
28. The complainants on behalf of all class members seek a declaration that Veda must take action to ensure
that its provision of free-of-charge access to credit reporting information is as available, and as easy to
identify and access as its fee-based services.
Second representative complaint
29. The second complaint made on 20 October 2014 similarly includes a varying range of issues, this time
relating to the use of Veda’s online application form to lodge a request for a free credit report.
30. One of the issues raised with this second complaint is the claim that class members were not receiving
free-of-charge access to their credit reporting information within the 10-day period mandated by s 20(3)
of the Privacy Act (the timing issue).
31. Veda objects to the timing issue being included within the scope of the second complaint because the
complainants have based its inclusion on a single instance of a credit report not being received within 10
days.8 Veda submits that the timing issue should be treated as a separate complaint by the concerned
individual under s 36(1) of the Privacy Act.9
8 Veda’s submission to the OAIC, 20 April 2015, 8-9, [6.1]-[6.2].
9 Veda’s submission to the OAIC, 20 April 2015,9, [6.6].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 12
32. The complainants have confirmed the inclusion of this issue within the second complaint was based on a
single instance of a credit report being provided outside the 10-day requirement. The complainants
argue that it is reasonable to assume there may have been other instances where the statutory
timeframe has not been met.10
33. Under s 38, I must be satisfied that all the complaints are in respect of, or arise out of, the same, similar
or related circumstances, and all the complaints give rise to a substantial common issue of law or fact.
34. Veda points out there is nothing in the complaint that establishes:
that there are any class members with complaints against Veda in respect of, or arising out of, the
same or similar or related circumstances as the timing issue; or
that there are any complaints by class members that give rise to a substantial common issue of
law or fact as the timing issue.11
35. I disagree. Firstly, I note that the Privacy Act has a remedial purpose, and the purpose of representative
procedures is to reduce the need for multiple complaints. I further note that all the complaints by class
members under this representative complaint arise out of attempts to lodge an online application form
on Veda’s website to access credit reporting information free-of-charge. Class members are therefore
affected by a common circumstance. Veda is alleged in this complaint of having an online process in
place that disadvantages class members who are applying online for a free credit report over those
customers who apply online for their credit reporting information through one of Veda’s paid services.
There is a substantial common issue of fact: do impediments in fact exist for class members applying
online for a free credit report that don’t exist for those customers who pay a fee to access the online
service?
36. The fact that both the class member who is complaining of receiving their free credit report out-of-time
after lodging an application for one online, and the class member who is complaining of having to tick
boxes during the online application process that allegedly results in direct marketing activity, are having
difficulties with Veda’s free credit report online access service is, in my view, enough to constitute a
common issue of fact. The differences in the circumstances do not in my opinion prevent them from
being included in a representative complaint.
37. I am therefore satisfied that in respect of the second complaint, the requirements for the making of a
representative complaint under s 38 have been met.
10 Complainants’ submission in reply to the OAIC, 15 June 2015, 13, [46].
11 Veda’s submission to the OAIC, 20 April 2015, 9, [6.4].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 13
38. In relation to representative complaint two, the complainants on behalf of all class members seek a
declaration that Veda must take action to ensure that:
I. Veda has systems in place that prevent delays in providing requested free credit reports
II. Veda collects and maintains records for the monitoring of its compliance with s 20R of the
Privacy Act; and
III. a request for a free credit report is not used as a direct marketing opportunity in
contravention of APP 7.
Third representative complaint
39. In the third representative complaint, class members are allegedly affected by the practices of Veda in
relation to credit report charges:
paying for access to credit reporting information that should otherwise be free-of-charge
paying an excessive charge for credit reporting information
receiving less credit reporting information in Veda’s free credit report compared to the
information provided with a paid report.
40. The remedy sought by the complainants is a declaration by the Commissioner that:
I. Veda’s charge in relation to credit reporting information is excessive
II. that Veda provide its actual costs relating to the issuing of credit reporting information, and the
$79.95 amount charged by Veda be reduced to that amount; and
III. VedaScore information be provided in the free credit report.
41. In this third representative complaint, the circumstances of class members are tied by a common
integer; that is, the entitlement to credit reporting information free of charge and what comprises that
entitlement. I am satisfied that the issues outlined in this third complaint are sufficiently related to
warrant dealing with this as a representative complaint for the determination of the common issue so
defined. In respect of this third complaint, the requirements for the making of a representative
complaint have been met.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 14
Investigation process
42. The investigation of these representative complaints involved the following steps:
11 November 2014 — correspondence to Veda regarding the opening of an investigation
under s 40(1) of the Act
11 March 2015 — correspondence to Veda initiating the s 52 determination process
20 April 2015 — Veda’s initial submissions received
21 April 2015 — Veda’s initial submissions provided to the complainants
15 June 2015 — the complainant’s submissions received
30 March 2016 — OAIC representatives make an onsite visit to Veda’s premises to observe
firsthand how certain processes occur.
The first complaint
Veda’s websites
43. Veda maintains two websites, available at the domain names <www.veda.com.au> (the Veda website)
and <www.mycreditfile.com.au> (my credit file website).
44. Customers looking to obtain copies of their Veda credit reports can do so through the Veda website by
clicking on the ‘Get Your Credit Report’ button. This button re-directs users to the my credit file website.
45. At the relevant time12 the my credit file website detailed a caption beneath its ‘My Veda Alert’ heading,
which read as follows (figure 1):
‘My Veda Alert - Get your credit report to help ensure your credit history is accurate and up to date. Your credit file
will be despatched in one working day. You also receive email alerts whenever specific changes occur on your credit
file for 12 months. Buy Now $79.95’13
12 For the purposes of this determination, I shall accept as the time of the alleged breach, the date of the initial complaint on 15
August 2014 or thereabouts.
13 Initial representative complaint about Veda Advantage to the OAIC, 15 August 2014, 3.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 15
Figure 1 — Veda’s my credit file homepage
46. The complainants allege that a class member must scroll down the web page through a list of fee-for-
service options before being alerted by a button with the words ‘Free file, Find out more’ that they may
be able to access a free copy of their credit report (figure 2).
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 16
Figure 2 — first appearance of the option to get a free credit report
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 17
The prominence issue
47. Under paragraph 19.3(a) of the CR code, information made available by the CRB about the fee-based
service must prominently state that access seekers have a right to obtain, on request, their credit
reporting information free of charge in certain circumstances including once every 12 months.
48. The complainants argue that information made available on Veda’s websites about its paid services do
not prominently outline access seekers’ right of free access to credit reporting information in certain
circumstances. The complainants contend that on the my credit file website, although the ‘paid report’
option is very prominent, the ‘free report’ button is below the fold-line (see figure 2), and the statement
about the rights of access seekers to free reports is not prominent.
49. Veda on the other hand argues that it meets the requirements of paragraph 19.3(a) of the CR code:
‘both free and paid services are prominently identified, and available and accessible from the home page of the
website. The ‘free report’ button is prominent and physically close to the information regarding the paid service.’14
50. Veda contends that the correct interpretation of paragraph 19.3(a) in the context of a website-based
service, having regard to the purpose of the provision ’to give visibility to the rights to credit reporting
information free of charge’, is that the phrase ‘the information made available by the CRB about the fee-
based service’ means information made available on the website as a whole:
‘The paragraph does not require the placement of the specified statement regarding free reports, or a “free
report” button at every single instance where information regarding a fee-based service appears on a website.
This would be an absurd and unreasonable interpretation, which goes beyond the object or purpose of the
paragraph. Once a user is alerted to the possibility of a free report, the user does not then need to be reminded at
every step that a free report is available….
‘By analogy, in the circumstances of a hard copy brochure regarding a fee-based service, paragraph 19.3(a) could
not reasonably be interpreted to require multiple prominent statements regarding free reports, appearing in each
paragraph of the brochure where information regarding a fee-based service appeared.’
51. In this respect Veda notes that the first two relevant links to credit reports on the Veda website
homepage, entitled ’get your credit report’, link to the my credit file website, which contains a
prominent ’free report’ button, and contains the information regarding free reports required by
paragraph 19.3(a) of the CR code. The your credit and identity
(www.veda.com.au/yourcreditandidentity) web page is a subpage of the Veda website, with links on the
Veda homepage that are subordinate to those for the my credit file website.21
52. The complainants contend that websites are not comparable to brochures.
14 Veda’s submission to the OAIC, 20 April 2015, 2-3, [1.4].
21 Veda’s submission to the OAIC, 20 April 2015, 5-6, [3.4]-[3.5].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 18
‘Websites are amorphous, are navigated via hyperlinks and can consist of many dozens of separate pages.’15
Findings in relation to prominence issue
The Veda website
53. Veda claims that the primary site for information about its paid services is its my credit file website,
which is the website that also contains the free credit report information. The your credit and identity
web page is a subpage of the Veda website. As I understand it, the Veda website at the relevant time re-
directed customers to the my credit file website if the appropriate link ‘Get Your Credit Report’ was
clicked on, but the Veda website did not otherwise contain or provide links to free credit reporting
information.
54. I have reviewed various links from the Veda website homepage around the time the complaint was
made. The following web pages were linked to the Veda website homepage and made reference to paid
services that include accessing ‘your credit report’ but did not provide any information about accessing
credit reports free of charge:
I. https://web.archive.org/web/20140707102041/http://www.veda.com.au/yourcreditandidentity/pr
oduct-comparison (link from Veda homepage by clicking onto buttons ‘Get your credit score’ and
‘Get identity watch’ as at 7 July 2014) (figure 3)
15 Complainants’ submission in reply to the OAIC, 15 June 2015, 10, [33].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 19
Figure 3 — link from Veda homepage by clicking onto buttons ‘Get your credit score’ and ‘Get identity watch’
II. https://web.archive.org/web/20140712112900/http://www.veda.com.au/yourcreditandidentity/ch
eck (link from Veda homepage by clicking onto buttons ‘Check your credit file and Veda score’ /
‘Understand your credit file and Veda score’, as at 12 July 2014) (figure 4)
Figure 4 — link from Veda homepage by clicking onto buttons ‘Check your credit file and Veda score’ /
‘Understand your credit file and Veda score’
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 20
III. https://web.archive.org/web/20140712151905/http://www.veda.com.au/yourcreditandidentity/im
prove/improving-your-veda-score (link from Veda homepage by clicking onto button ‘Tips to
improve your credit file and Veda score’, as at 12 July 2014) (figure 5).
Figure 5 — link from Veda homepage by clicking onto button ‘Tips to improve your credit file and Veda score’
55. From these web pages, I could not discern any information about accessing credit reporting information
free of charge, despite my attempts to investigate through a series of optional click-throughs to other
pages on the Veda website.
56. The word ‘prominent’ is not defined in the Privacy Act and in the absence of any legislative intention to
the contrary, it may be ascribed its ordinary natural meaning. According to the Macquarie Dictionary the
word ‘prominent’ means in the relevant context ‘standing out so as to be easily seen; conspicuous; very
noticeable’.16
57. I agree with the complainants — brochures are not websites. Websites are not generally read in the
same front-to-back and left-to-right way as brochures. Users may enter the site from a subpage rather
than the home page, and may never go to the home page of a website.17 Veda’s contention that
providing free credit reporting information on only one web page is sufficient does not appear to take
this into account.
16 Macquarie Dictionary, Macquarie Dictionary Online, 6th ed (October 2013) < https://www.macquariedictionary.com.au/>.
https://www.macquariedictionary.com.au/features/word/search/?word=transfer&search_word_type=Dictionary>.
17 See for example, Sarah Morton. (November 2012). Writing Brochure Copy versus Website Copy, Sarah Morton Copywriter. (Accessed 15 August 2016). <https:sarahmortoncopwriter.com.au/writing-brochure-copy-versus-webiste-copy>.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 21
58. Keeping in mind the ordinary meaning of the word ‘prominent’, I am of the view that Veda has not met
the requirements of paragraph 19.3(a) of the CR code in relation to the information Veda has made
available about its fee-based services on its Veda website.
The ‘my credit file’ website
59. A review of the home page on the my credit file website shows if a class member scrolls down the web
page through a list of fee-for-service options, they will be alerted by a button with the words ‘Free file,
find out more’ that they may be able to access a free copy of their credit report (figure 2).
60. The words ‘Free File’ are in white text against a light red background and the button is readily viewable
and identifiable. I also note that a statement setting out the circumstances in which a free credit report
can be obtained is displayed on the same page, to the left of the ‘Free File’ button. The information is
directly below information about Veda’s fee-based service.
61. It is therefore apparent that information made available on the my credit file website about Veda’s fee-
based services also provides information about individuals’ right under the Privacy Act to access their
credit reports free of charge.18 The complainants argue that this information was at the relevant time not
‘prominently stated’ for the purposes of paragraph 19.3(a) of the CR code.
62. Examining the layout of the my credit file website home page as it was at the time the complaint was
made (figures 2 and 6), I note the following:
the statement about free access to credit reports (the relevant statement) is located below the
‘fold’ (that is, below that part of the web page that is visible without scrolling)
the text of the relevant statement is in Arial font, size 10
to the right side of the relevant statement appear the words ‘Free File, Find out more’ within a
large light red luminescent rectangle
the text directly above the relevant statement, stating that “for less than $1.55 a week, you can
better manage one of your most important assets” is in bold Helvetica font, size 13.5, and in
colour
to the right side of this text is a smaller rectangle (button) of a dark red colour featuring the words
‘Buy Now’.
18 <www.mycreditfile.com.au>; <www.mycreditfile.com.au/products-and-pricing>; <www.mycreditfile.com.au/personal/veda-
alert.dot>,
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 22
Figure 6
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 23
63. The home page of the ‘my credit file’ website, displays a series of colour photographs and two ‘buy now’
buttons (figure 6). The ‘Free File’ button, although large and colourful, is below the ‘fold’ and does not
come into view until the page is scrolled. It is not able to be seen on the web page at first instance (prior
to scrolling). In other words, it is not noticeable on the face of it, and in my view does not have the
necessary degree of prominence needed to meet the requirement of ‘prominently stated’ under
paragraph 19.3(a) of the CR code.
64. I therefore find that Veda has not met the requirements of paragraph 19.3(a) of the CR code in relation
to the information Veda has made available about its fee-based services on its ‘my credit file’ website. I
am of the view that Veda has engaged in conduct constituting an interference with the privacy of
individuals who are members of the class identified in the complaint.
The online access issue
65. The complainants also allege that access to a free credit report on the Veda and ‘my credit file’ websites
is not as available and as easy to identify and access as credit reports accessed through its paid services,
in breach of paragraph 19.3(b) of the CR code.19
66. Paragraph 19.3(b) of the CR code states that if a CRB has a service whereby an individual may obtain
their credit reporting information for a fee, the CRB must take reasonable steps to ensure that its
service, whereby individuals may obtain their credit reporting information free of charge, is as available
and easy to identify and access as its fee-based service.
67. In reference to the ‘my credit file’ website shown in figures 1 and 2, the complainants contend that a
free file is not as easy to access and identify as Veda’s fee-based service because:
o the reference to the free service is much further down the page
o unlike Veda’s fee-for-service options which provide for direct access via an online application
form, access to a free credit report requires access seekers to fill in an enquiries form at first
instance. The ordering form and instructions are subsequently emailed to the access seeker to
complete.20
68. The complainants also refer to the ‘’your credit and identity’ web page on the Veda website which
compares a number of Veda paid products including Starter, Access, ID and Plan. According to the
complainants the web page does not mention the option of free access to a credit report. They state
that it would be reasonable for a person looking at this web page to assume that these four products
were the only choices (figures 7 and 8).21
19 Initial representative complaint about Veda Advantage to the OAIC, 15 August 2014, 1.
20 First representative complaint about Veda Advantage to the OAIC, 15 August 2014, 3.
21 First representative complaint about Veda Advantage to the OAIC, 15 August 2014, 3.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 24
Figure 7.
Figure 8: the ‘your credit and identity’ web page after scrolling down.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 25
69. The complainants state that there are several links to the ‘your credit and identity’ web page and none of
the linked pages refer to the option of free access to a credit report.22
70. Veda does not accept that it did not comply with paragraph 19.3(b) of the CR Code. It argues that
paragraph 19.3(b) requires an assessment of what a reasonable person would be expected to implement
in the circumstances, and does not require Veda to treat its paid services and its service providing access
to free reports identically. Veda contends that rather, what is required is ‘reasonable substantial parity’ in
the availability of, identification of, and access to, free reports, having regard to all the circumstances.23
Current position
71. I acknowledge that since the first representative complaint was lodged, Veda has amended how it makes
information about its service providing access to credit reports free of charge available on its ‘my credit
file’ website. It has moved information about free credit reports to a horizontal level equivalent to the
Veda website’s first reference to a paid service, so that a viewer no longer has to scroll right down the
web page to view information about how to access a credit report free of charge. It has also amended its
‘your credit and identity’ web page on the Veda website so an initial comparison of Veda products
(‘Compare Our Products’) at the top of the web page includes a ‘free file’ option.24
72. Nonetheless, the current presentation mode of Veda’s websites is not relevant to the issues that I have to
decide here. My findings must be based on the steps Veda had in place at the time the complaint was
lodged. It must also be said that all the current website presentations show what could have been done
earlier. They do not, by any necessary implication, demonstrate that what was done earlier was in
contravention of the Act or the CR code.
73. My findings in relation to the online access issue are as follows.
Findings in relation to online access issue
74. Veda contends that it met the ‘reasonable steps’ standard mandated at paragraph 19.3 of the CR Code, by
making both free and paid services prominently identifiable, available and accessible from the homepage
of its ‘my credit file’ website.
75. The complainants argue that the requirement under paragraph 19.3 that Veda’s free service be ‘as
available’, ‘as easy to identify’ and ‘as easy to access’ as its fee-based service, “demands equivalence
22 Initial representative complaint about Veda Advantage, 15 August 2014, 3.
23 Veda’s submission to the OAIC, 20 April 2015, 2, [1.2]-[1.4].
24 https://www.veda.com.au/yourcreditandidentity/product-comparison.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 26
between the free service and the fee service of the three mandated outcomes: availability, ease of
identification, and ease of access”.25
76. In determining whether Veda has fulfilled its paragraph 19.3 obligations I must also consider the overall
objects of the Privacy Act including the facilitation of an efficient credit reporting system while ensuring
that the privacy of individuals is respected; and that the protection of the privacy of individuals must be
balanced with the interests of entities in carrying out their functions or activities.26
Reasonable steps
77. Paragraph 19.3 of the CR code names s 20R of the Privacy Act as its source. The explanatory
memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012 (‘explanatory
memorandum’) states:
This provision [s 20R] is based on the obligations set out in, and the structure of, APP 12, modified to apply specifically to credit reporting bodies. It is generally intended that access to credit reporting information should occur on the same terms as access to personal information held by an APP entity27.
78. Though the APPs do not apply to a credit reporting body in relation to personal information that is credit
reporting information28, the APP guidelines may provide some guidance in relation to what may be
considered ‘reasonable steps’.
79. ‘Reasonable steps’ is not defined in the Privacy Act, but I accept that the steps required to be taken do not
have to be exhaustive; rather reasonable where ‘reasonable’ means appropriate in the circumstances.29 It
is, however, the responsibility of the APP entity to be able to justify that its conduct was reasonable, and
that reasonable steps were taken. 30
Google search results
80. Veda contends that the results returned from internet search engines are highly relevant in assessing
what constitutes ‘reasonable steps’ under paragraph 19.3(b) of the CR code given that the standard
practices of internet users seeking information is to search via internet search engines rather than by
reviewing web pages.31
25 Complainants’ reply to Veda’s submission, 15 June 2015, 5, [14].
26 Privacy Act 1988 (Cth), s 2A.
27 Explanatory memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012
28 Privacy Act 1988 (Cth), s 20A(2).
29 Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines, B.99.
30 Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines, B.105, B.108.
31 Veda’s submission to the OAIC, 20 April 2015, [1.5].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 27
81. Search engines such as Google allow internet users to search for information of interest by entering
search terms into the search box on the search engine’s website or on users’ toolbars. A search will
produce both advertisements (‘sponsored links’)32 and ‘organic search results’ (i.e. the main search results
not influenced by advertising). Organic search results are ranked in order of relevance to the search terms
entered by the user.
82. In its 20 April 2015 submission Veda uses the example of a Google search conducted on 14 April 2015 on
the search phrase ‘credit report’ which returned a link to the ‘my credit file’ website under the heading
‘Order a Free Credit Report’. This link took the user directly to a web page titled ‘How to get your credit
report free of charge’ (figure 9).
Figure 9.
32 On a web page, advertisements are labelled ‘Ad’ or ‘Ads’ and are listed separately to the organic search results. They are triggered by
keywords supplied by the advertiser to the search provider, using an AdWords program. When a user enters search terms into the search engine that match the keywords of an advertiser, the search results will display the triggered sponsored links. Organisations like Veda using sponsored links pay the search provider every time a user clicks on the sponsored link.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 28
83. Veda contends that search results like this ‘clearly demonstrate that Veda has taken reasonable steps to
ensure that its service whereby individuals may obtain their credit reporting information free of charge
is as available and easy to identify and access as its fee-based service’.33
84. The complainants argue that it is not a ‘reasonable step’ to “trust in a Google search as providing parity
of availability, ease of identification and ease of access” between paid services and those services
provided free of charge.34
85. I agree that there are some difficulties with Veda’s contention. Firstly, search results will vary between
different devices and different users on different days. Searches of the same keywords - ‘credit report’ –
on 16 December 2014 (figure 10) and 5 May 2015 (figure 11), produced different search results, for
example.
33 Veda submission to the OAIC, 20 April 2015, 5-6, [3.4]-[3.6].
34 Complainants’ reply to Veda’s submission, 15 June 2015, 8, [22].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 29
Figure 10
86. For example, in contrast to the search results provided on 14 April 2015, the first Veda result returned
on the 5 May 2015 search by the complainants was http://www.veda.com.au/yourcredit and
identity/tips-mythbusters/fags/how-can-I-check-my-credit-history (figure 10). This web page did not
refer to free credit reports, providing only options for paid services.35
35 Complainant representatives’ response to Veda submission of 20 April 2015, 8, [22]-[25].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 30
Figure 11.
87. This is not surprising. Different search results may be obtained even when the same key words are
searched. This may be due to variances in a user’s physical location or in the search history of different
devices, or the keyword search being performed by different Google data centres.36
88. Secondly, I note the searches conducted by Veda to illustrate the relevance of Google search results to it
meeting its obligations under paragraph 19.3(b) of the CR code were undertaken sometime after the
date of the complaint. Their relevance as to what results might have been produced around the time of
the complaint is accordingly limited.
89. Thirdly, and perhaps most importantly, there is no information before me which indicates that Veda has
actually taken any steps to produce the search results it highlights in its submission.
36 McEvoy, M. (2015). 7 Reasons Google Search Results Vary Dramatically. Web Presence Solutions. Accessed 22 August 2016.
www.webpresencesolutions.net/7-reasons-google-search-results-vary-dramatically/>; Snipes, Susan. (2012). SEO Under Scrutiny: Reasons your Google search results are different than mine. Q Digital Studio. Accessed 19 August 2016. < <http://www.qdigitalstudio.com/library/reasons-your-google-search-results-are-different-than-mine>; Sullivan, Rob.(n.d.) SEO Questions – Why Do I See Different Google Results Than My Clients? Internet Seer. Accessed 19 August 2016. < http://www.internetseer.com/services/article.xtp?id=37037>.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 31
90. A business may maximise its exposure via organic search results through a process known as ‘search
engine optimisation’ to ensure that it appears first in the organic search results.37 This is a form of search
engine marketing and involves optimising each page of a website to include keyword phrases in headers,
sub headers, web page text, hyperlinks and, where appropriate, in image file names and alt tags, which
provide a text alternative to an image.
91. Veda engages from time to time in search engine optimisation strategies to market to individuals and/or
business customers.38 However, there is no evidence that Veda engaged in any search engine optimisation
strategies to try to bring its service of free access to credit reports to the attention of access seekers.
There is no information which suggests that Veda did anything by way of website optimisation to promote
its service whereby individuals may obtain their credit reports free of charge.
92. For this reason, I give little weight to the results returned from internet search engines in determining this
matter.
‘my credit file’ website
93. In its letter to the complainants dated 14 May 2014, Veda outlines the online process an access seeker
may take to access a free credit report:
(a) On Veda’s main website and landing page <www.veda.com.au>, a consumer can see information
about access to credit reports as well as other Veda services (figure 12).
37Search engine optimisation discussed by Katzmann J in Veda Advantage Limited v Malouf Group Enterprises Pty Limited [2016] FCA
255 (21 March 2016).
38 Noted in Veda Advantage Limited v Malouf Group Enterprises Pty Limited [2016] FCA 255 (21 March 2016), [12].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 32
Figure 12.
(b) When a consumer clicks on GET YOUR CREDIT REPORT, they are taken to Veda’s ‘My Credit File’
website which includes information about credit reports as well as a large ‘free file’ button (figure 13)
Figure 13.
(c) Clicking on the large red button brings consumers to the free credit file page. Very clear instructions
on how to order your free credit file are provided (figure 14).
(d) A consumer enters in details and the ordering form and instructions are emailed to the consumer to
complete (figure 15).39
39Veda letter to the complainants, 14 May 2014, 3-6.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 33
Figure 14.
Figure 15.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 34
94. Veda, in support of its contention that its free and paid services in relation to access to credit reports are
of “reasonable substantial parity”, points out that the ‘Free File’ button is prominent and physically close
to the information regarding Veda’s paid services (figures 6 and 7).40 I have discussed the issue of
prominence at [56]-[63].
95. The complainants note that the position of the ‘Free File’ button is, however, much further down the
web page (i.e. below the ‘fold line’). By this I take it to mean that the complainants are contending that
information about free credit reports is less easily identified or accessible than information about Veda’s
paid services because access seekers have to scroll further down the web page.
96. Veda argues that:
The ‘fold line’ is irrelevant, as reasonable, substantial parity is achieved by having both types of reports
prominently identified, available and accessible via the internet at the same place, being the ‘My Credit File’
home page. Nothing further is required.41
97. Secondary sources in the form of research findings suggest that although the concept of a fold was
important in early web history, nowadays people do scroll and it is not as integral to web advertising
today.42 Research findings on whether scrolling is an impediment to users are mixed.43 There is research
that indicates users’ attention is generally caught above the fold44, while other studies have found that
users spend more time on actual web content as they move down the page45. What does seem to be an
accepted finding amongst researchers is that users’ behaviour has changed over the years since the
inception of the personal computer and they are more likely to scroll than previously. Research has also
indicated that web designers are now being encouraged to design a page that encourages users to scroll
rather than to navigate away from the page.46
40 Veda’s submission to the OAIC, 20 April 2015, 2, [1.4].
41 Veda’s submission to the OAIC, 20 April 2015, 2-3, [1.4].
42 Motive, The Motive Web Design Glossary, (updated August 2009) <www.motive.co.nz/glossary/fold.php.
43 Mixed research findings noted by Matt Keogh (February 2015, updated June 2016) Does It Matter if Users Need to Scroll? Liquid Light. https://www.liquidlight.co.uk/blog/article/does-it-matter-if-users-need-to-scroll>. See also Haile, Tony. (March 2014). What You Think You know About the Web is Wrong? Time. http://time.com/12933/what-you-think-you-know-about-the-web-is-wrong/.
44 Schade, Amy. (February 2015). The Fold Manifesto: Why the Page Fold Still Matters. Nielsen Norman Group. <https://www.nngroup.com/articles/page-fold-manifesto>. Highlighted by Matt Keogh (February 2015, updated June 2016) Does It Matter if Users Need to Scroll? Liquid Light. https://www.liquidlight.co.uk/blog/article/does-it-matter-if-users-need-to-scroll>.
45 Josh. (August 2013). Scroll behaviour across the web. Chartbeat Blog. <blog.chartbeat.com/2013/08/12scroll-behavour-across-the-web>. Highlighted by Matt Keogh (February 2015, updated June 2016) Does It Matter if Users Need to Scroll? Liquid Light. https://www.liquidlight.co.uk/blog/article/does-it-matter-if-users-need-to-scroll>.
46 Schade, Amy. (February 2015) The Fold Manifesto: Why the Page Fold Still Matters, Nielsen Norman Group <https://www.nngroup.com/articles/page-fold-manifesto>. See also Cao, Jerry. (October 2015). The New Rules for Scrolling in Web Design. DesignMode. <designmode.com/scrolling-web-design.>
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 35
98. There is no doubt that scrolling is an extra action, but the issue here is, does having to scroll down to
information about how to access a free credit report lessen its availability or the ease with which this
information may be identified or accessed?
99. I accept that the images on a web page are not, unlike television for example, transitory; a viewer can
generally take as long as they wish to review the contents of the page.47 It is therefore difficult to see
how scrolling down half a page on the same web page could be seen to lessen the availability of the free
credit reporting information or lessen the ease with which it is accessed, within the ordinary meaning of
the word (i.e. access meaning ‘the opportunity to approach or enter a place’48). Nonetheless, as I noted
at paragraphs [56]-[63], information that is not viewable at first instance on a screen is not as prominent
as information that is instantly viewable on screen. For information to be as identifiable as other
information, it must be as easily recognisable. In my view, the information made available on the ‘my
credit file’ website does not enable access seekers to identify Veda’s free-based service as easily as its
fee-based services, and in this regard I find that Veda has not complied with paragraph 19.3(b) of the CR
code.
Veda’s www.veda.com.au website
100. The complainants also claim that the web page www.veda.com.au/yourcreditandidentity linked to
Veda’s main website, at the relevant time, compared a number of Veda’s paid products (Starter, Access,
ID and Plan) which included a service to provide customers with their credit report (figure 16). The
complainants contend that the web page did not include any information which identified a service for
customers to access their credit report free of charge. The complainants contend that:
It would be reasonable for a person looking at this web page to assume that these four products were the only
options.49
47 See Australian Competition and Consumer Commission v Hillside (Australia New Media) Pty Ltd trading as Bet365 [2015] FCA 1007
for support of this view.
48 Macquarie Dictionary, Macquarie Dictionary Online, 6th ed (October 2013) < https://www.macquariedictionary.com.au/>. https://www.macquariedictionary.com.au/features/word/search/?word=transfer&search_word_type=Dictionary>.
49 Complainants’ representative complaint to the OAIC, 15 August 2014, 3.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 36
Figure 16.
101. Veda contends that this web page, as well as its Veda home page and ‘my credit file’ website, had links
to Veda’s credit policy “which clearly sets out how individuals can obtain free access to their credit
reporting information”50.
102. I accept that nowadays a majority of class members have a reasonable understanding of how to
navigate the web. Clicking-through to other pages does not necessarily mean that something is less
accessible. Nonetheless, at the relevant time the digital pathway from Veda’s ‘my credit and identity’
web page to information embedded in Veda’s credit policy about accessing credit reports free of charge
was lengthy and not user-friendly. In order to navigate successfully, an access seeker would need to
already be aware that information about access to Veda’s free service could be found within Veda’s
credit policy.
103. Having to discern how to access a credit report free of charge by firstly being aware that the
information was embedded in a ‘credit policy’ page, and then clicking through to that page, is not as
easy as being presented with that information on the home or landing page. I therefore consider that
the Veda website does not enable access seekers to identify Veda’s free-based service as easily as its
fee-based service, and I find that Veda has not complied with paragraph 19.3(b) of the CR code in this
regard.
50 Veda response to the complainants, 14 May 2014, (Appendix C to Representative complaint about Veda Advantage dated 15
August 2014).
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 37
104. The complainants further contend that Veda’s free service is not as easy to access and is not as
available as the paid service. To access the free service, access seekers needed to submit an ‘enquiries
form’ through Veda’s portal. I note from a review of the web pages at the relevant time51 that clicking
on the ‘’Free File, find out more’ button on the ‘my credit file’ home page took access seekers to a page
titled ‘How to get your credit report free of charge’. To obtain a free copy of their credit report, access
seekers had to complete the Veda Free Credit File Form. Certain identification details (name, phone
number, email address, state, and ‘yes/no’ to marketing) needed to be submitted on an online ‘order
form’. Once this form was submitted, access seekers would ‘immediately receive’ by email another form
to request a free copy of their credit report (figure 15).
105. Veda confirms this process in its 14 May 2014 response to the complainants, which is outlined at
paragraph [93].
106. In contrast, individuals accessing Veda’s paid services at the relevant time, could apply directly online
for their credit report. There was no additional requirement to complete an enquiries form and receive
further email instructions from Veda on how to apply for their credit report.
107. In its 14 May 2014 response to the complainants, Veda advises that it is investing in “a new portal
aligning processes and requirements for free reports with those available for paid services”. Veda states:
Customers seeking a free report will have the same straight through process as applies for paid reports, that is,
they will be able to type-in their information onto an online application form.
108. It is evident that at the relevant time a further step had to be undertaken to obtain a credit report free
of charge. Customers accessing a credit report through Veda’s paid services, on the other hand, could
readily apply online. The online process for paid access was evidently more accessible than that for free
access. Veda accepts that the ‘same straight through process’ as applied to paid reports did not apply to
reports accessed free of charge.52
109. I accept that Veda was at the relevant time “making efforts to streamline the process for requesting a
free credit report”, but I have no substantive information available to me which explains why the online
process for access to free credit reports was implemented differently from the outset, or why there was
such a lag in addressing the variance between the access processes of the paid and unpaid services. I
note that there were “some teething problems with some of the new IT infrastructure” and “an
unprecedented demand for free credit reports”.53
110. In ‘S’ and Veda Advantage Information Services and Solutions Limited54, which the complainants
helpfully referred to, I considered whether or not Veda had taken reasonable steps to ensure that
51 https://web.archive.org/web/20140731202413/http://www.veda.com.au/mcfpage.
52 Veda’s response to the complainant’s complaint, 14 May 2014.
53 Veda’s response to the complainant’s complaint, 14 May 2014.
54 [2012] AICmr 33 at [61].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 38
personal information contained in the complainant’s credit file or report was ‘accurate, up-to-date,
complete and not misleading’ as required under s 18G, a former provision of the Privacy Act which
existed prior to the 12 March 2014 reforms. In making an assessment of the ‘reasonable steps’ I
relevantly considered:
• the size and nature of an organisation such as Veda and how Veda's practices may impact on a large
number of individuals and credit providers, and
• the ease with which any particular step can be implemented.
111. In their response to Veda’s 20 April 2015 submission, the complainants point out that:
Veda has not shown that it would be arduous or costly to implement practices that provide equivalent
availability, ease of identification of, and ease of access to free credit reporting information to the
availability, ease of identification of, and ease of access to fee-based credit reporting information.
We submit that given Veda’s size and nature, the large number of individuals affected, the object of the
Act and Code to make credit reports freely available to enable errors and omissions to be rectified, the
ease of access to and prominence of Veda’s fee-based services the Commissioner should find that Veda has
not complied with paragraph 19.3(b) of the CR code.55
112. I note that Veda is by its own admission ‘the leading provider of credit information in Australia’. As a
credit reporting body, it claims a market share of 96% with a database of 16.5 million credit-active
Australians.56 It was put on notice about the ‘sizeable changes’57 arising from the 2014 legislative
reforms well before the passing of the Privacy Amendment (Enhancing Privacy Protection) Act 2012, and
was, or should have been aware, of the impact of the changes on its customers58. The onus was on Veda
to justify that it took reasonable steps (as were appropriate in the circumstances) to ensure its free
service was as available and as easy to access as its fee-based services. I am not satisfied that it did so. In
my view, Veda did not meet its obligations under paragraph 19.3(b) of the CR code in this regard.
55 Complainant’s reply to Veda’s submission, 9, [28]-[29].
56 Explanatory Memorandum, Privacy Amendment (enhancing Privacy Protection) Bill 2012, citing Veda Advantage ‘About Us’, accessed 23 July 2009 from <http://www.vedaadvantage.com/about-veda/au_our-data.dot>.
57 Veda response to the complainants, 14 May 2014, (Appendix C to representative complaint about Veda Advantage dated 15 August 2014).
58 See for example, Explanatory Memorandum, Privacy Amendment (enhancing Privacy Protection) Bill 2012, citing Veda Advantage responds to ALRC Privacy Review proposal in Wot News, accessed 23 July 2009 from <http://wotnews.com.au/like/veda_advantage_responds_to_the_alrc_privacy_review_proprosal/1666111>.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 39
The phone access issue
113. The complainants allege that access seekers are not able to obtain a credit report free of charge from
Veda over the phone, while credit reports can be obtained over the phone via Veda’s paid services.59
114. The complainants contend that this is a breach of paragraph 19.3(b) of the CR code which relevantly
states that the CRB must take reasonable steps to ensure that its service whereby individuals may obtain
their credit report free of charge is as available and easy to identify and access as its fee-based service.60
115. The complainants state:
The phone number for Veda … leads to a message that states a free copy of your credit report can be
obtained by visiting the Veda website. There is an option to get a paid copy of a credit report over the
phone, but there is no option to get a free credit report over the phone.61
116. The complainants detail the experiences of an access seeker’s attempts to order a free credit report
over the phone:
In their automated section it asks you whether you are seeking your credit report. On following the prompts,
it takes you to a pre-recorded message that explains that you are entitled to receive a free credit report
every 12 months, and within 90 days of a credit application. It then continues to explain that you can order
the free credit report online or by sending specific information to a postal address.
You are then prompted to go through to a customer service operator. When requesting the free credit
report, I was told by the operator that it could not be done through her and that I could only order the
‘express’ report for $67.62
117. The access seeker’s second attempt to order a free credit report went as follows:
This time the customer service operator that picked up said that I could only receive the free report if I had
internet (which I had told both that I did not have). She said that if I did not have internet the only other
option open to me was to purchase an express report for $67, as it is "easier and better" than the free report
anyway. When I pressed her why I couldn't get a free one on the phone she said that it was a Veda process,
they could only sell the 'express' credit reports on the phone, nothing else.
She also noted that if I purchased the express report I would get all the updates for free. I questioned back to
her, "Are you saying that if I don't have the internet I cannot get a free credit report like I was told I could".
59 Initial representative complaint to the OAIC, 15 August 2014, 1-3.
60 Initial representative complaint to the OAIC, 15 August 2014, 1-3.
61 Initial representative complaint to the OAIC, 15 August 2014, 1-3..
62 Complainant’s reply to Veda’s submission, Attachment 2, ‘Veda Shadow Shopping’, 5 May 2015.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 40
She said "That is up to you, if you don't have the internet you don't have any other option but to buy the
express credit report".63
118. The complainants contend these experiences highlight that in contrast to accessing a credit report by
phone through a paid service, requesting a credit report free of charge by phone is not an option, i.e. an
access seeker is limited to ordering online or making a request by post. In other words, the complainants
are contending the Veda’s free service is not as available and as easy to access as its paid services.
119. Veda submits, as already noted at [75], that paragraph 19.3(b) of the CR code does not require identical
treatment of paid services and free reports in every respect:
Rather, what is required is reasonable, substantial parity in the availability of, identification of and access to
free reports, having regard to all the circumstances.64
120. Veda also makes the following contentions:
the Explanatory Note for paragraph 19.3(b) of the CR code (the Explanatory Note) refers only to a
CRB making available means to address all information requirements for free reports online, if this
option is available for the purposes of a fee-based service65
the prevalence of smartphones and internet access services, as well as the wide availability of
internet access including through cafes and internet cafes, means that phone access to credit
reporting information is a superfluous access channel.66 In other words, telephone-based access is
not reasonably required for the purpose of obtaining free reports, where online access is available
individuals may also access free reports by submitting a request in writing. Further, in the case of
persons with a relevant disability, Veda has provided and continues to provide access to free
reports by telephone on request67
in determining what is reasonably required under paragraph 19.3(b), a relevant factor is the
substantial additional cost and resources required to provide free access to credit reports over
the phone.68
121. By way of response, the complainants state:69
63 Complainant’s response to Veda’s submission, Attachment 2, ‘Veda Shadow Shopping’, 5 May 2015.
64 Veda’s submission to the OAIC, 20 April 2015, 6, [4.2].
65 Veda’s submission to the OAIC, 20 April 2015, 5, [3.3].
66 Veda’s submission to the OAIC, 20 April 2015, 7, [4.4]..
67 Veda’s submission to the OAIC, 20 April 2105, 7, [4.8].
68 Veda’s submission to the OAIC, 20 April 2015, 7, [4.7].
69 Complainants’ submission in reply to the OAIC, 15 June 2015, 11, [36].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 41
…when considering what are reasonable steps, it should be noted that it is likely to be the most
disadvantaged individuals who do not have access to the internet. The following information from the
Australian Bureau of Statistics is sobering:
In 2012–13, 98% of households with household income of $120,000 or more had internet access, compared
to 57% of households with household income of less than $40,000.70
…. there are 2.32 million people that are either completely illiterate or mostly illiterate between 15 and 74
years of age in Australia. Telephone access is an important avenue for the poorest households and those
with the lowest literacy levels. People in these categories are more likely than most to have experienced
troubled credit history.71
Findings in relation to the phone access issue
Explanatory note
122. Veda argues that the proper interpretation of the Explanatory Note is that s 19.3(b) of the Code refers
only to online access for credit reports.72
123. The Explanatory Note provides:
This gives visibility to rights to credit reporting information free of charge and minimises access barriers. As
a result of the requirement that the free service must be as easy to access as the fee-based service, a CRB
would have to permit an individual to address all information requirements online in order to obtain credit
reporting information free of charge, if this option were available for the purposes of the fee-based
service.
124. Firstly, I note that the explanatory notes are not part of the registered CR code. They were included in
the draft Code, and as noted in that draft, aimed to assist readers to understand the purpose and intent
of the CR code provisions. The explanatory notes constitute guidance and do not have mandatory status.
In particular, they are not binding on the Information Commissioner.73
70 Complainants’ submission in reply to the OAIC, 15 June 2015, 11, [36] citing Australian Bureau of Statistics
< http://www.abs.gov.au/ausstats/[email protected]/Lookup/8146.0Chapter12012-13 >.
71 Complainants’ submission in reply to the OAIC, 15 June 2015, 11 [36], citing Australian Bureau of Statistics
< http://www.abs.gov.au/ausstats/[email protected]/Lookup/4228.0Main+Features20211-12>.
72 Veda submission to the OAIC, 20 April 2015, paragraph [4.5].
73 The OAIC’s Guidelines for developing codes provide:
[2.29] Although the Information Commissioner is not required to consider the explanatory material the Information Commissioner may use the explanatory material to inform his or her understanding of the intended operation of the code.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 42
125. In any case, the Note is not, in my view, meant to limit the application of the CR code to online access
to free credit reports. It is merely intended to illustrate that if there is an option available to subscribers
to a fee-based service which addresses all information requirements online, a CRB would also have to
provide that same option in relation to its free service.
The phone as an unnecessary access channel
126. I do not agree with Veda’s contention that the telephone is a superfluous access channel where an
internet-based service for credit reporting information is available74 or that the requirements of
paragraph 19.3(b) are satisfied in this context by giving individuals the option to access free reports by
submitting a request in writing.75 Paragraph 19.3(b) of the CR code mandates that Veda take reasonable
steps to ensure that its free service is as available and easy to identify and access as its fee-based
service. I accept the complainants’ contention that telephone access is an important way for many
people, which may include the poorest households and those with the lowest literacy levels, to access
services.76 As the information provided by the complainants demonstrates, a significant number of
Australians are likely to have difficulty navigating and completing a form online to obtain their credit
report.77
127. Veda submits, and I agree, that in assessing what constitutes ‘reasonable steps’ for the purposes of
paragraph 19.3(b), consideration must be given to the cost and resources required of Veda to provide
phone access to credit reports free of charge.78 Keeping this in mind, I note that Veda is the leading
provider of credit information and analysis in Australia.79 According to its 2015 annual report Veda made
a profit after income tax of more than $78 million, and revenue from continuing operations of more
than $338 million.80 Veda has indicated that the additional cost and resources required to provide free
access to credit reports over the phone would be ‘substantial’, but it has not quantified the costs
involved in any way, or demonstrated how such costs would, or could be, onerous to the operations,
functions, and/or activities of its organisation. Accordingly, I give this contention little weight in
assessing what are ‘reasonable steps’ in the circumstances.
[2.30] The Information Commissioner will not approve the explanatory material nor will the Information Commissioner be bound by the explanatory material, <https://www.oaic.gov.au/agencies-and-organisations/advisory-guidelines/guidelines-for-developing-codes#part-2-developing-codes>.
74 Veda’s submission to the OAIC, 20 April 2015, 7, [4.6].
75 Veda’s submission to the OAIC, 20 April 2015, 7, [4.8].
76 Complainants’ submission to the OAIC, 15 June 2015, 11-12, [36]-[37].
77 Complainants’ submission in reply to the OAIC, 15 June 2015, 11, [36].
78 Veda’s submission to the OAIC, 20 April 2015, 7, [4.7].
79 https://www.veda.com.au/about-us
80 Veda Group Limited. (25 September 2015). Annual Report 2015 < http://investors.veda.com.au/Investor-Relations/?page=Annual-Reports >
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 43
128. The credit reporting provisions in Part IIIA of the Privacy Act and the CR code are intended to provide
additional consumer protections by enhancing obligations and processes dealing with amongst other
things, access.81 The complainants provided a first-hand account of someone who didn’t have internet,
and was advised that they had no option but to ‘buy the express credit report’.82 The complainants have
also provided information supporting the notion that low income and/or otherwise disadvantaged
individuals may not have access to the internet. It is evident that phone ‘may be their only workable
access point to get their credit report’.83
129. Keeping this in mind, and the notion of access as ‘opportunity of approach’84, it is difficult to see how
the s 19.3(b) provision could be interpreted in any other way than an obligation to provide similar
opportunities over the phone (and through all other access channels) for Veda’s free service as with its
fee-based services.
130. Accordingly, I cannot accept that in this regard Veda took steps that were appropriate in the
circumstances to ensure its free service was ‘as available’ and as ‘easy to access’ as its paid services. In
my view, Veda did not meet its obligations under paragraph 19.3(b) of the CR Code.
The onerous identification issue
131. The complainants contend that between 12 March 2014 and 3 September 201485 Veda’s identification
verification requirements for a free credit report were more onerous than for a paid credit report, and
that this is a breach of paragraph 19.3(b) of the CR Code which relevantly states that the CRB must take
reasonable steps to ensure that its free service is as available and easy to identify and access as its fee-
based service.86
132. Paragraph 19.1 of the CR code provides that a CRB must not provide access [to a credit report] without
first obtaining such evidence as is reasonable in the circumstances to satisfy itself as to the identity of
the person making the request and of the person's entitlement to access under Part IIIA of the Privacy
Act, the Regulations and the CR code.
81 Privacy Amendment (Enhancing Privacy Protection) Bill 2012, Explanatory Memorandum.
82 Complainant’s submission in reply to the OAIC, 15 June 2015, Attachment 2, Veda telephone access memo 05052015.
83 Complainants’ complaint to Veda, 14 April 2014, 5.
84 As defined in the Macquarie Dictionary, Macquarie Dictionary Online, 6th edition (October 2013) <https://www.macquariedictionary.com.au >.
85 The identification verification requirements for obtaining access to free credit reports online were amended by Veda on
September 201485 in an effort to streamline the process for requesting a free credit report online. The complainants have not
indicated there is a continuing issue in relation to the amended identification verification requirements. Veda has confirmed that
it no longer requires any identity verification from individuals seeking free access to their credit report, additional to the
requirements for those subscribing to a fee-based service: Veda submission to the OAIC, 20 April 2015, 8. 86 Initial representative complaint about Veda Advantage, 15 August 2014, 1-2.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 44
133. At the relevant time identification verification requirements to obtain access to a credit report via one
of Veda’s fee-based services were as follows87:
• Name and date of birth
• Driver’s licence number (if available)
• Employment
• Previous creditor (if known)
• Contact details
• Current address
• Previous addresses (optional)
• Pay by credit card
134. In contrast the identification verification requirements for obtaining a free credit report were (the
differences from above being in bold)88:
• Full name and date of birth
• Driver’s licence number (and there is no option if a driver’s licence is not held)
• Two forms of identification: 1) copy of driver’s licence, passport, birth certificate or proof of age
card, as well as 2) a document issued by an official body which includes your name and address
(i.e. rates notice, utility bill or bank statement)
• Your current employer (although no option to not have an employer)
• Name of organisation to which you last applied for credit (although not optional)
• Your current residential addresses
• Your previous addresses (although unlike the paid product, there is no option to not have a previous
address)
• A daytime phone number
• How you’d like the file sent
135. The complainants say there is no reason why the identification requirements for access to a credit
report (whether it is paid or free) should differ.89
136. Veda acknowledges that there were, prior to 3 September 2014, differences in the identification
verification process between its free and paid services. It contends however that its process at the
relevant time satisfied the requirements of paragraph 19.3(b) because the provision of credit card
details for access through paid services made verification requirements ‘inherently more
straightforward’.90
87 Representative complaint about Veda Advantage, 15 August 2014, 4-5.
88 Initial representative complaint about Veda Advantage, 15 August 2014, 4-5.
89 Initial representative complaint about Veda Advantage, 15 August 2014, 4-5.
90 Veda’s submission to the OAIC, 20 April 2015,8, [5.3].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 45
Findings in relation to the onerous identification claim
137. The points of difference between the identification verification requirements for free and paid services
are three-fold:
I. Providing details about driver’s licence number, previous addresses, previous creditors and
current employer is optional when an access seeker accesses their credit report through a
paid service. Providing these details is not optional through Veda’s free service.
II. When accessing a credit report free of charge, access seekers are required to provide two
additional forms of identification:
(c) licence, passport, birth certificate or proof of age card, and
(d) a document issued by an official body including name and address (e.g. bank statement, rates
notice)
III. When accessing a credit report through a paid service, individuals are required to pay by
credit card.
138. The complainants argue that Veda has not provided any evidence that identification is made easier by
the provision of credit card details.91 I note that Veda has not made any information available about the
steps it may undertake to verify the identities of cardholders subscribing to its paid services.
139. Paragraph 19.3(a) obliges CRBs like Veda to undertake some form of identity verification before
providing access to credit reports to ensure that the requestor is who they are claiming to be. The use of
an individual’s credit card to obtain a credit report for a fee provided Veda with an additional ‘identity
document’ not required by access seekers seeking free access. It follows that some other form of
identity document or documents must be obtained from those who seek a free credit report.
140. I accept that the information Veda needs to gather from its customers to satisfy paragraph 19.3(a) is an
assessment for Veda to make. The Privacy Act mandates that the interests of the individual must be
balanced with the interests of entities with respect to their functions and/or activities.92The provision of
different documents to inform a requestor’s identity does not mean that free access is not as available
and easy to access as paid access. Nonetheless it is unclear why Veda insisted on so many additional
pieces of documentation (i.e. information regarding previous creditors, previous addresses,
licence/passport/birth certificate, and bank statements/rate notices) as a substitute for credit card
information.
91 Complainants’ submission to the OAIC, 15 June 2015, [43].
92 Privacy Act 1988 (Cth), s 2A.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 46
141. Veda has contended that credit cards details make identification ‘inherently more straightforward’,
but has unfortunately not explained this statement in any way. In considering the notion of access as
‘opportunity of approach’ it is difficult to see how the paragraph 19.3(b) provision could be interpreted
in any other way than an obligation to require similar identification processes for both fee paying and
non-fee paying customers.
142. In my view on the information I have available to me, the identity documents requested from access
seekers applying for a free credit report were sufficiently more voluminous to impede the ‘opportunity
to approach’ or the ‘readiness for use’ of credit report access.
143. Accordingly, I cannot accept that in relation to its identity verification processes at the relevant time,
Veda took steps that were appropriate in the circumstances to ensure its free service was ‘as available’
and as ‘easy to access’ as its paid services. In my view, Veda did not meet its obligations under
paragraph 19.3(b) of the CR code in this regard.
144. I therefore find that the first complaint has been substantiated, and Veda has engaged in conduct that
constitutes an interference with the privacy of class members.
The second complaint
The timing issue
145. Section 20R of the Privacy Act provides that a CRB must respond to a request for access to credit
reporting information within a reasonable period, but not more than 10 days after the request was
made.
146. The complainants allege that an access seeker has complained that their report was not received within
the 10-day period.93 The complainants acknowledge that they are unaware of other complaints by
access seekers in relation to this issue, but argue that:
While it is possible that it was an isolated instance, there is no reason to think that it was one.94
147. In relation to the reason why the credit report in this instance was delivered outside the statutory
timeframe, Veda says:
Veda’s investigations have revealed that the report delivery issue complained of arose as the result of an
emergency software deployment occurring at the precise time at which that particular online request was
lodged. The emergency software release resulted in the request being inadvertently deleted. This was an
93 Complainants’ complaint to Veda, 20 October 2014, 13.
94 Complainants’ submission in reply, 15 June 2015, 13, [46].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 47
isolated incident, of short duration. Veda has taken steps designed to prevent the incident from
reoccurring.95
148. The complainants argue that it is reasonable to suggest that other access seekers may have been
similarly affected:
Veda’s response … shows that failure to provide the particular report within time was caused by a problem
at its end: the effect of an emergency software deployment at the precise time when the online request was
lodged. The 180,000 free credit reports provided by Veda between March 2014 and April 2015 average out
to approximately 450 - 500 reports per day. It seems most likely that more than one request for a free report
was affected by the same software deployment issue.96
Findings in relation to timing issue
149. Veda has admitted that in one instance a credit report was not delivered to the access seeker within
the 10-day timeframe. This constitutes a breach of s 20R(3) of the Privacy Act.
150. Notwithstanding this, and as pointed out by Veda, the incident was isolated and not ongoing. Veda has
advised that “it has taken steps to prevent the incident from recurring”97 though has provided no further
information on remedial actions to date.
151. The complainants suggest there may be other instances of a s 20R(3) breach, but I have not been
provided with any evidence of this. This matter must be decided on what information I have available to
me, not on speculation of what might have been.
152. Although I accept there was one instance of a class member receiving their credit report after the
requisite 10-day period, there is no information to suggest that there is or was any systemic problem
with Veda’s compliance with s 20R caused by software deployment or anything else. Accordingly,
though I find there was a singular breach of s 20R(3), there is no evidence of ongoing non-compliance,
and I determine that it is inappropriate for any further action to be taken in relation to this issue.
The direct marketing issue
153. The complainants assert that at the relevant time, when a class member completed Veda’s online
application form for a free credit report the member was presented with two tick boxes. Box 1 states:
Veda can contact me on the details supplied above regarding my application for a copy of my credit report.98
95 Veda’s submission to the OAIC, 20 April 2015, 10, [7.3].
96Complainants’ submission in reply to the OIAC, 15 June 2015, 13, [46].
97 Veda’s submission to the OAIC, 20 April 2015, [7.3].
98 Second representative complaint, 20 October 2014, 2.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 48
Box 2 provides:
I would like to be contacted by telephone/email with finance, insurance and other offers relating to finance. I
consent to Veda providing my personal information including my contact details to relevant corporate partners
for this purpose.99
154. The complainants contend that the wording of the statements associated with the tick boxes is
misleading and in breach of APP 7.
155. APP 7 deals with direct marketing. APP 7.1 provides that:
If an organisation holds personal information about an individual, the organisation must not use or disclose
the information for the purpose of direct marketing.
156. APP [7.2]-[7.5] provide a number of exceptions to the prohibition of use and disclosure for the purpose
of direct marketing. Of relevance to this matter is APP7.2 and APP 7.3.
157. APP 7.2 provides that an organisation may use and disclose personal information (other than sensitive
information) about an individual for the purpose of direct marking if the organisation collected the
information from the individual and the individual would reasonably expect the organisation to use or
disclose the information for that purpose. The organisation must also provide a simple means by which
the individual may easily request not to receive direct marketing; and the individual must have not
already made such a request to the organisation.
158. APP 7.3 relies on consent (where it is not impracticable to do so) in situations where the information is
collected from an individual and that individual would not have reasonably expected the organisation to
use or disclose the information for that purpose, or where the information is collected from someone
other than the individual. Additionally, the organisation must do the following:
(b) the organisation provides a simple means by which the individual may easily request not to receive direct
marketing communications from the organisation; and
(c) in each direct marketing communication with the individual:
(i) the organisation includes a prominent statement that the individual may make such a request;
or
(ii) the organisation otherwise draws the individual’s attention to the fact that the individual may
make such a request: and
(d) the individual has not made such a request to the organisation.
159. Section 20A(2) of the Privacy Act states:
99 Second representative complaint, 20 October 2014, 2.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 49
(2) The Australian Privacy Principles do not apply to a credit reporting body in relation to personal information
that is:
(a) credit reporting information; or
(b) CP derived information; or
(c) a pre-screening assessment.
Note: The Australian Privacy Principles apply to the credit reporting body in relation to other kinds of personal
information.
160. The complainants contend that:
… the APPs do apply in these circumstances because the information provided in connection with an
individual’s application for a credit report is not itself credit reporting information.100
161. I agree. I also note that Veda has not disputed that the APPs apply in these circumstances. Given this, I
will not consider this point further.
Current presentation
162. Since the time of the complaint the application form for a free credit report has undergone two
transformations in relation to its tick box statements. Veda advised at the time it lodged its 20 April
2015 submission that it had changed tick box 1 to state:
Veda can contact me on the details supplied above regarding my application for a copy of my credit report and
the options available to me.
163. A further amendment resulted in an application form with one rather than two tick boxes. The tick box
currently states:
You agree to Veda Group and its corporate partners using and disclosing your personal information to contact
you about other goods and services and using your information for direct marketing purposes including
contact by phone, mail, SMS or electronic means (figure 17).
164. As similarly noted at paragraph [73], the relevance of the post–complaint presentation of Veda’s
websites to the issue I have to decide here is limited. It simply demonstrates what could have been done
earlier, and does not necessarily imply that what was done earlier was in contravention of the Privacy
Act and/or the CR code.
100 Complainants’ submission to the OAIC, 15 June 2015, [56].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 50
Tick box 1
165. The complainants contend that tick box 1 is misleading:
…Based on our experiences to date Veda does not contact the individual for further information but
instead uses this as an opportunity to sell a paid credit report to individuals applying for their free credit
report.101
166. Veda denies that it does not comply with AAP 7. It claims that the wording in tick box 1 constitutes a
request for consent which, if ticked, entitles Veda to contact the individual to sell its paid services in
respect of credit reports.
167. Veda argues that the wording ‘regarding my application for a copy of my credit report’ is sufficient to
constitute consent for this purpose in so far as the access seeker is alerted to the differences between
the credit report applied for and the premium or ancillary services which are also available to the access
seeker.
168. Veda goes on to claim that express consent to Veda contacting the access seeker for direct marketing
purposes had been given by virtue of clauses 11, 12 and 13 of the user agreement which the class
member must have read and agreed to in order to request a free report:102
11. Veda and its related companies may, at any time, use your personal information to send you information
about Veda and its related companies products and services. This will include promotional material including but
not limited to communications of the following kind:
101 Second representative complaint, 20 October 2014, 2.
102 Veda’s submission to the OAIC, 20 April 2015, 10-11, [8.1].
Figure 17.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 51
........
12. Veda may do so by using a variety of means including:
electronic means such as emails, SMS, MMS or similar devices
hardcopy to your nominated address; and
subject to Do Not Call Register, call you.
13. In doing so, Veda will be expressly relying on the consent that you have provided on the website when you
ordered the My Credit File or My Veda Alert report. At all times you are free to choose not to receive some
or all of the marketing communications sent by Veda or on Veda's behalf. In order to exercise that choice,
you need to communicate that to:
Veda
PO BOX [address]
Or call us on xxxx xxx xxx
In doing so, Veda may disclose any of this information to its related bodies corporate or service providers of
Veda or its related bodies corporate where such disclosure is required to conduct the marketing activities set
out above.103
169. Veda accepts that contacting an access seeker to clarify information that an individual has included in
their request for a credit report is a permitted use under APP 6 and does not require consent. Veda’s
view is the request for consent at tick box 1 was a request for direct marketing.
170. The complainants contend that the consent is not effective because the access seeker is not adequately
informed before giving consent, and the consent is involuntary.104 They claim that the statement at tick
box 1 is misleading and the user agreement terms and conditions are lengthy and not able to be readily
accessed (access is not granted until the class member reaches the ‘submit’ page).105
Findings in relation to the tick box 1
Consent
171. The APP guidelines, relevant at the time the complaints were lodged, at B.29 and B.30 gave
consideration to the meaning of 'consent':
Consent means ‘express consent or implied consent’ (s 6(1)). The four key elements of consent are:
the individual is adequately informed before giving consent
103 Veda’s submission to the OAIC, 20 April 2015, Annexure C.
104 Complainant’s reply to Veda’s submission, 15 June 2015, 17-18, [65]-[69].
105 Complainants’ reply to Veda’s submissions, 15 June 2015, 17-18, [65]-[69].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 52
the individual gives consent voluntarily
the consent is current and specific, and
the individual has the capacity to understand and communicate their consent.
B.30 Express consent is given explicitly, either orally or in writing. This could include a handwritten signature,
an oral statement, or use of an electronic medium or voice signature to signify agreement.106
172. Informed consent means an individual must be aware of the implications of providing or withholding
consent. The guidelines provided that an APP entity should ensure that an individual is properly and
clearly informed about how their personal information will be handled, so they can decide whether to
give consent.107
173. According the APP guidelines, consent is voluntary ‘if an individual has a genuine opportunity to
provide or withhold consent’:
B. 37 Consent is not voluntary where there is duress, coercion or pressure that could overpower the person’s
will.
B.38 Factors relevant to deciding whether consent is voluntary include:
the alternatives open to the individual, if they choose not to consent
the seriousness of any consequences if an individual refuses to consent
any adverse consequences for family members or associates of the individual if the individual refuses
to consent. 108
174. It is apparent that access seekers have the option of not ticking tick box 1, and there is nothing to
suggest that not ticking the box has serious or adverse consequences for the access seeker attempting
to obtain their credit report free of charge. I have for example no information before me to suggest that
failure to tick box 1 rendered access seekers ineligible for a free credit report.
175. Given this, I cannot accept that consent is involuntarily given. I do accept that although it might be clear
to Veda that ticking box 1 constitutes consent sufficient to cover Veda contacting access seekers for
direct marking purposes, this might not be so clear to access seekers themselves.
176. Veda claims that access seekers are informed that they are providing consent when they tick the boxes,
because they are so advised by clauses 11-13 of the user agreement. Though I agree the user agreement
106APP guidelines (v 1.1, 1 March 2014), B.29-B.30. These provisions now at B.43-B.44 have not been amended in the updated
version of the guidelines (v 1.2, 1 April 2015).
107 Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines (v 1.1, 1 March 2014), B.41. This provision now at B.47 has not been amended in the updated version of the guidelines (v1.2, 1 April 2015).
108 APP Guidelines, (v 1.1, 1 March 2014), B.37 – B.38. The updated version of the guidelines (v 1.2, 1 April 2015) does not amend these provisions.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 53
is lengthy, I accept that an ordinary and reasonable member of the class could have been expected to
read the terms and conditions in the user agreement, and be aware that, in accordance with clause 13, if
they provided ‘express’ consent when they ordered their ‘My Credit File’ report, Veda and its related
companies could use their personal information to send them information about Veda and its related
companies’ products and services.
177. Notwithstanding this, in my view, an ordinary and reasonable access seeker would not necessarily think
that they were providing express consent for such uses and disclosures where they ticked tick box 1. Tick
box 1 provides for Veda contacting the access seeker regarding their application for a copy of their
credit report and their available options. While tick box 2 is much clearer about using an access seeker’s
personal information to send them information about the products and services of Veda and its related
companies, there is no clear suggestion of this at all with respect to tick box 1.
178. I am mindful that the Privacy Act is beneficial legislation which makes provision to protect the privacy
of individuals.109 It doing so, it promotes the human rights principle of freedom from interference with
privacy, contained in article 17 of the International Covenant on Civil and Political Rights to which
Australia is a party. To give credence to that principle, any express consent obtained must therefore be
sufficiently precise with regard to the kind of information to which the consent relates. 110
179. The statement “Veda can contact me … regarding my application for a copy of my credit report” limits
the purpose of contact to ‘my application’. It makes no reference to the access seeker being contacted
for any other purpose. It is difficult to see, even if one accepts a very broad and liberal interpretation of
what ‘my application’ might encompass, how such consent extends to consent for Veda and its related
companies to contact the access seeker about their services and products. In my view it cannot be
stretched in the way submitted by Veda.
180. In my view it is reasonable for an ordinary and reasonable access seeker, who did not sign tick box 2,
but signed tick box 1, to assume that they were providing consent only in relation to Veda’s
communications with them about their application. In my view, despite reading the terms and
conditions of the user agreement, an ordinary and reasonable access seeker would not have reasonably
expected that a tick of box 1 was express consent for direct marketing purposes.
181. If Veda wished to ensure that access seekers consented to being contacted by Veda for direct
marketing purposes, then it should have expressed this plainly. In my view, the wording of the
statement associated with tick box 1 was such that access seekers were not adequately informed about
the consent they were providing when they ticked that box. Accordingly, I find that access seekers who
ticked tick box 1 were not consenting to the use or disclosure of their information for the purpose of
direct marketing, nor was it within their reasonable expectations that their information would be used
or disclosed for that purpose. I find that Veda was in breach of APP 7 in this respect.
109 Privacy Act 1988 (Cth), s 2A.
110 Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWA, TAP 43, [97].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 54
Tick box 2
182. The complainants have also raised issues with the second tick box (tick box 2). They advise that the
statement associated with the tick box 2, that is:
I would like to be contacted by telephone/email with finance, insurance and other offers relating to
finance. I consent to Veda providing my personal information including my contact details to relevant
corporate partners for this purpose.111
is not sufficiently specific because “the conditions of the consent are hidden in the detail of the lengthy
User Agreement and because the purpose for which consent is being obtained is not made clear”.112
183. The complainants contend that:
it needs to be expressly stated that the ‘offers relating to finance’ are marketing contacts
information about who are the relevant corporate partners needs to be disclosed
it should be made clear that eligibility for a credit report is not contingent on consent to
disclosure to third parties for direct marketing purposes.113
184. The complainants have referred to a number of Privacy Commissioner case notes which they argue
support their requested changes to tick box 2. 114 The case notes are not persuasive, with only one of
relevance to the present set of circumstances.115 Moreover given the case notes have no legal status,
and are not binding, I afford them little weight in my consideration of this issue.
185. Veda denies that it has contravened APP 7 with respect to the statement offered at tick box 2. Veda
argues that by ticking tick box 2, access seekers have consented to the use or disclosure of their personal
information collected by Veda for the purpose of direct marketing.
186. Veda contends that the wording of tick box 2 clearly describes (i) that the consent is for disclosure of
personal information to specified types of entities; and (ii) the specific purpose of the disclosure of the
information by Veda. Veda notes that although “relevant corporate partners” are not individually
identified, this is not a requisite element of consent under APP 7.116
111 The second representative complaint, 20 October 2014, 2.
112 Complainants’ submission in reply to the OAIC, 15 June 2015, 18-19, [71-[72]].
113 Complainants’ submission in reply to the OIAC, 15 June 2015, 18-19, [71]-[72].
114 OPC v Employment Services Company [2005] PrivCmr 13; N V Private Insurer [2004] PrivCmrA 1 (1 January 2004); A and Insurer [2002] PrivCmrA1 (1 December 2002)
115 N v Private Insurer [2004] PrivCmrA 1 (1 January 2004).
116 Veda’s submission to the OAIC, 20 April 2015, 11-12, [9.1].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 55
Findings in relation to tick box 2
187. As I similarly noted at paragraph [174] in relation to tick box 1, access seekers are not compelled to tick
tick box 2, and there is nothing to suggest that not ticking the box has serious or adverse consequences
for the access seeker attempting to obtain their credit report free of charge. There is no information
before me to suggest that failure to tick tick box 2 rendered access seekers ineligible for a free credit
report. The option to tick, or not tick, tick box 2 makes it apparent that eligibility for a credit report is not
contingent on consenting to the disclosure of personal information to third parties for direct marketing
purposes.
188. ‘Direct marketing’ is a term not defined in the Privacy Act. It is however described in the explanatory
memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012, as:
… the use and/or disclosure of personal information to communicate directly with an individual to promote
goods and services. A direct marketer may communicate with an individual through a variety of channels,
including telephone, SMS, mail, email and online advertising. 117
189. The statement found at tick box 2 falls within that definition. Veda’s user agreement at clauses 11-13
confirms that consent provided on its website when the credit reporting information is ordered is
consent for Veda and its related bodies corporate and service providers to use the personal information
of access seekers to send them information about Veda and its related companies products and
services. It clearly states at clause 13 that these activities are ‘marketing activities’. An ordinary and
reasonable member of the class could have been expected to read the terms and conditions provided to
make sure they were adequately informed.
190. In my view Veda has, to a sufficient degree, outlined the purpose of the use or disclosure of personal
information for the purpose of securing informed consent.
191. Likewise, within the statement at tick box 2, Veda has, in my opinion, sufficiently outlined the third
parties to whom disclosure may be made for the purposes of direct marketing. An individual must also
be sufficiently informed about each of the proposed collections, uses and/or disclosures, and how their
personal information will be handled so that they can make an informed decision about whether or not
to give consent. There is no specific requirement to specify to whom the information is proposed to be
disclosed. There is a question as to whether or not Veda’s related entities could rely on consent
obtained by Veda without being identified; however, this is a separate issue and does not need to be
determined here.
117 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, 81.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 56
192. Veda informs the access seeker at the statement associated with tick box 2 that if consent is given,
their information will be disclosed to its ‘corporate partners’. The user agreement indicates that direct
marketing activities may be deployed by Veda and its ‘related bodies corporate’ and ‘service providers’.
The information is provided in plain English and I believe adequately identifies the type of entity to
which information may be disclosed, sufficient for Veda to meet its obligation of ensuring individuals are
properly and clearly informed about how their personal information will be handled so they can decide
whether to give consent.
193. In my view the statement at tick box 2 is sufficiently clear to signal that a ticked box means the access
seeker has provided informed consent to the use or disclosure of their information for the purpose of
direct marketing. On this basis, in relation to the statement associated with tick box 2, in my view Veda
has not breached APP 7.
194. Nonetheless as a result of my finding in relation to tick box 1, I determine that the second complaint
has been substantiated, and at the relevant time Veda engaged in conduct that constitutes an
interference with the privacy of class members.
The third complaint
The 12-month issue
195. Section 20R(5) of the Privacy Act provides that a CRB is not permitted to charge for access if the access
seeker has not made a request for access within the preceding 12 months. The complainants contend
that Veda is charging for access to a credit report even when the access seeker has not requested a
credit report in the previous 12 months and that this is a breach of s 20R(5).118 They contend that an
audit of individual applications for credit reporting information within the preceding 12 months is
required and any individual who has paid for a credit report when they have not accessed a credit report
in the previous 12 months must be refunded the fee.119
196. Veda denies its practice of providing access to credit reports is in breach of s 20R(5). Veda claims that
since the commencement of the Privacy Amendment (Enhancing Privacy Protection) Act 2012 on 12
March 2014, it has not charged access seekers for making requests in relation to credit reporting
information held by Veda or for giving access to that information. It declares that this free credit
reporting information is available to an access seeker regardless of whether or not the access seeker has
made an access request in the previous 12 months.120
118 Third representative complaint, 20 October 2014, 2.
119 Third representative complaint, 20 October 2014, 2..
120 Veda’s submission to the OAIC, 20 April 2015, 13-14, [11.1].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 57
197. Veda says that although it does not charge for giving access to credit reports it does charge for the
premium and ancillary services provided in addition to the credit report (Additional Services).121 In other
words, individuals purchasing products from Veda are said to be purchasing “value-added services”, not
the credit report.
198. Veda acknowledges that it does not check whether individuals who are paying for Additional Services
have had access to their credit reporting information in the preceding twelve months. Veda appears to
be claiming that such a process is unnecessary because all requests for access to credit reports are met
free-of-charge .122
199. The complainants argue that Veda’s claim it never imposes charges for requests for access to credit
reporting information is incorrect. They argue that through the marketing of its products, Veda imposes
charges for credit reports because individuals are forced to purchase some other product in order to
obtain the “free” credit report.123
200. The complainants refer to the products comparison table at paragraph 11.1 of Veda’s 20 April 2015
submission reproduced here at Figure 18 (the table), which outlines the various packages of Additional
Services individuals can access. They point out that the table shows that the ‘My Veda Alert’ and ‘Veda
Starter’ packages restrict the number of credit reports to 1 per year and that other paid products are
restricted to 2 or 4 credit reports per year. They say that this does not fit with the claim made by Veda
that access to credit reports is free to all individuals who request them regardless of whether they have
been provided with a free credit report in the previous 12 months.
121 Veda’s submission to the OAIC, 20 April 2015, 13-14, [11.1]
122 Veda’s submission to the OAIC, 20 April 2015, 14, [11.2].
123 Complainants’ submission in reply to the OAIC, 19-21, [74]-[83].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 58
Figure 18.
201. The complainants also point out that access seekers are led to believe that any access to credit reports
outside of the circumstances listed on the ‘my credit file’ website (i.e. where a credit application has
been declined, where a correction request has been lodged and corrected, and where a free copy has
been requested once every 12 months), is only available through paid services.124 At the relevant time,
the ‘my credit file website’ stated: “there are certain circumstances under which you can get a copy of
your credit report for free”. The complainants argue that this implies in all other circumstances an
individual will have to pay to receive a credit report.125 I agree with the complainants’ submission on this
point.
202. The complainants argue that for all practical purposes Veda charges for credit reports, and without a
system in place to monitor whether or not an access seeker has applied for a free credit report in the
preceding 12 months, it falls in breach of s 20R(5).
Findings in relation to 12-month issue
203. I accept for the reasons outlined by the complainants in [201] that Veda’s ‘my credit file’ website
contains information that is inconsistent with its claim that it does not charge for access to credit
reports.
124 Complainants’ submission in reply to the OAIC, 19-21, [74]-[87].
125 Complainant’s submission in reply to the OAIC, 15 June 2015, 19-20, [76]-[77].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 59
204. I also note that at the relevant time, Veda’s credit reporting policy on the Veda website stated:
Excerpt from Veda Credit Reporting Policy
2. Access to Credit Reporting Information
Under the Act you have a right to a free copy of credit reporting information the CRB holds on you:
once every 12 months; or
when you have been declined credit by a credit provider wholly or partly because of
credit reporting information held by the CRB and you make your request for free
access within 90 days of being declined credit and provide the CRB with evidence of
the same.
You are also entitled to a free copy of credit reporting information the CRB holds on
you when it makes a change to your credit reporting information as a result of a
correction request made by you.
To obtain a free copy please go to www.veda.com.au/understanding-your-credit-file and click on the
ORDER NOW link under the column headed “Basic Credit File”.
If you do not have access to the internet you can write to the CRB at:
……..
The CRB does not hold personal information derived from credit information (such as bureau scores) as
this information is dynamically derived at the time the CRB receives a request for this information. If
you wish to obtain a bureau score or a copy of your credit information more frequently than once a
year, you may, if you wish, pay an annual fee and sign up to the Your Credit & Identity Service. For
more information go to www.veda.com.au.126
205. Veda says it does not charge for providing access to credit reports, and any cost incurred by access
seekers is for the Additional Services provided. It is unclear then how Veda can state in its credit policy
that if an access seeker wishes to obtain a copy of their credit information more frequently than once a
year, they may pay an annual fee and sign up to the ‘Your Credit & Identity’ Service.
206. That said, neither the complainants nor Veda have supported their claims with analytical or even
anecdotal evidence. I have no information before me to suggest that an access seeker has been refused
access to a credit report free of charge when they apply within 12 months of their last application for
free credit reporting information. Nor have I information to the contrary, that is, that access seekers
have obtained access to a credit report free of charge when they apply within 12 months of receiving
their last free report.
207. What is apparent though is that Veda’s claim of ‘no charge for credit reporting information’ is
controverted by information on both the Veda and ‘my credit file’ websites. An access seeker who had
informed themselves of the content of those websites, as well as their terms and conditions, would
126 Internet Archive Wayback Machine, Veda. September 2014.
http://web.archive.org/web/20140914234056/http://www.veda.com.au/credit-reporting-policy>.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 60
reasonably assume that access to a credit report on request more than once a year required payment in
the form of a subscription to one of Veda’s product packages.
208. Notwithstanding all of this, charging for access to credit reports is not a breach of s 20R(5), as long as
under s 20R(6) the charge is not excessive, and once every year an access seeker can, on request, access
that information free of charge. The requirement here is that the CRB must give access to a free credit
report on request, not that the CRB gives access to a free credit report once a year. It is possible that an
individual might instead choose to pay for a credit report if they think there is additional value being
offered by a particular product package, and choose not to access the free service.
209. Providing that an individual has the opportunity to make the choice between access to a free credit
report and access to Veda product packages, there is no contravention if Veda does not provide a free
report once a year to subscribers who don’t ask for one. I have no information before me to suggest that
subscribers have been refused access to a free credit report on request. I am of the view that on the
balance of probabilities, Veda has not contravened s20R(5) of the Privacy Act and has not interfered
with the privacy of access seekers in this respect.
Expedited delivery
210. Veda has advised that it charges, or did so at the relevant time, $69.95 to provide a credit report within
24 hours of a request for access. It describes this service as one of its Additional Services. My
understanding is that this practice has now been discontinued.127
211. Veda argues that s 20R(3) of the Privacy Act only requires a CRB to provide a credit report within 10
days of the request.
212. Section 20R(3) of the Privacy Act specifically states that:
The credit reporting body must respond to the request within a reasonable period, but not longer than 10 days,
after the request is made.
213. The complainants claim that Veda’s imposition of a charge for expedited delivery is a charge for access
in breach of s 20R(5), unless Veda has had a request from the individual within the previous 12
months.128
127 Veda’s submission to the OAIC, 20 April 2015, 14-15, [11.1].
128 Complainants’ submission in reply to the OAIC, 20 April 2015, 22, [90].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 61
214. As noted at paragraph [79], the term ‘reasonable’ may be construed as what is appropriate in the
circumstances. This means that what amounts to an appropriate time taken to respond to a request for
credit reporting information will vary depending on the circumstances.
215. There is nonetheless a cap on what may be considered a ‘reasonable period’, i.e. 10 days. That is not to
say that one day, two days, three or four days could not be construed as ‘reasonable’ (and anything
more ‘unreasonable’) in any particular set of circumstances. Rather, it means that a CRB breaches the
provision if it takes more than 10 days to respond, regardless of the circumstances.
216. The complainants argue that Veda’s capacity to provide expedited delivery services within 24 hours
suggests that in its circumstances a ‘reasonable period’ for online requests is closer to one day than
10.129
217. In the event that an access seeker is seeking access to credit reporting information and hasn’t sought
this information within the preceding 12 months, Veda has an obligation to provide access to that
information free of charge within a reasonable period, but no more than 10 days. A ‘reasonable period’
may in certain circumstances be 24 hours.
218. The obligation to provide the credit reporting information free of charge still applies, regardless of at
what point in time within that 10-day limitation period Veda responds. The provision of credit reporting
information in these circumstances is not an Additional Service. Rather it is an obligation Veda must
undertake in accordance with s 20R(3) of the Privacy Act. There is nothing which permits Veda to charge
for a credit report on request where a request has not been made in the preceding 12 months.
219. I therefore find Veda’s practice of charging for the ‘expedited delivery’ of a credit report was in breach
of s 20R(5) in circumstances where the access seeker had not sought access to credit reporting
information within the preceding 12-month period.
The excessive charge issue
220. The complainants allege the Veda is also in breach of s 20R(6), which provides that where the access
seeker is not entitled to a free credit report, any charge by the CRB must not be excessive.130
221. In response Veda says that it does not and has not charged access seekers foraccess to credit reporting
information held by Veda. Veda contends that the charges made are in respect of Veda’s Additional
129 Complainants’ submission in reply to the OAIC, 20 April 2015, 22, [89].
130 Third representative complaint, 20 October 2014, 3.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 62
Services only, not for access to credit reports, which are provided for free along with the Additional
Services. On this basis, Veda says, its processes are in compliance with section 20R(6).131
222. Veda claims that s 20R(6) does not apply to Veda’s charges for Additional Services, which are not
regulated by the Privacy Act or Code. Veda goes on to say:
It follows that the applicants’ claims that Veda’s charges (including charges for expedited delivery) are excessive
and unreasonable, are not matters which can be determined by the Commissioner, as they cannot constitute an
interference with the privacy of an individual and therefore cannot form the subject of a complaint under
section 36 of the Act.132
223. The complainants submit that if the only way for an access seeker to access their credit reporting
information for a second time within 12 months is through an Additional Service, then s20R(6) must
apply to the lowest cost Additional Service which grants an access seeker access to their information.133
224. The complainants claim that the cost of a Veda credit report is $79.95. They compare this cost to the
$30 cost of obtaining a credit report from Dunn & Bradstreet134 and the $0 cost of obtaining an Experian
credit report135.
225. The complainants also refer to a report issued by the New Zealand Privacy Commissioner, which
considered the NZ$51.95 cost of Veda’s credit report, and found the amount to be unreasonable and
excessive.136
Findings in relation to excessive charges issue
Cost of a Veda credit report
226. In its submissions, Veda has not provided a cost figure for giving access to a credit report on request.
This is because of its claim that access is freely given on request at all times. The complainants argue
that I should accept the lowest cost Additional Services package as the cost of a Veda credit report,
which at the relevant time was the ‘Veda Starter’ package and the ‘My Veda Alert’ package, both costing
$79.95 per year.
131 Veda’s submission to the OAIC, 20 April 2015,15-16, [16.1].
132Veda’s submission to the OAIC, 20 April 2015,15-16, [16.1].
133 Complainants’ submission in reply to the OAIC, 15 June 2015, 24, [ 101].
134 Dunn & Bradstreet is another credit information bureau in Australia and New Zealand.
135 Experian Information Solutions also provides a credit reporting service, and is a credit reporting body for the purposes of the Privacy Act.
136 Third representative complaint, 20 October 2104, 3.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 63
227. Figure 18 details what is provided in each of the Additional Services packages. The ‘Veda Starter’
product includes, in addition to the one credit report per year, access to a VedaScore, online
membership, as well as access to the resolution centre and knowledge area. The ‘My Veda Alert’
product includes, in addition to the one credit report per year, credit alerts.
228. It is clear that the cost of Veda’s products includes Additional Services. I accept that Additional Services
do not constitute credit reporting information and are therefore not regulated by the Privacy Act or the
CR code. The complainants do not dispute that credit alerts, online membership, and access to the
resolution centre and knowledge area do not constitute credit reporting information. Nonetheless, the
complainants argue that the VedaScore is CRB derived information that should be included when credit
reporting information is provided to an access seeker free of charge. I outline the reasons for my
decision that the VedaScore does not constitute credit reporting information at [251]-[267].
229. There is no doubt that the information provided on Veda’s own websites is completely at odds with
Veda’s assertions in its submissions that the cost of a credit report is $0, and the cost of the Veda credit
reporting packages relate exclusively to the Additional Services. Certainly, Veda has not provided any
information to suggest how its ‘free credit reports on request at all times’ approach is achieved through
its current processes. On the other hand, nor have the complainants provided any evidence which
refutes Veda’s claim of free credit reports.
230. However, whether or not Veda charges for a credit report on request, it is entitled to do so under s
20R(6) provided the charge is not excessive (and the access seeker has not requested one in the last 12
months). It would seem on balance from the information I have at hand that Veda does not permit
access to limited content in the form of the credit report in its paid credit reporting services, with access
only provided on purchase with a membership package that includes this information plus the
Additional Services. If that is the case, and in the absence of contrary evidence provided by Veda, I am of
the view that notionally some of the $79.95 fee must be attributable to that part of the package that
comprises the credit reporting information to which an access seeker is entitled to access on request
under s 20R. Assuming Veda charges a notional fee for that information, I must determine whether the
notional fee for access to that information is excessive.
231. The word ‘excessive’ is not defined in the Act. According to the Macquarie Dictionary ‘excessive’ is
defined as “exceeding the usual or proper limit or degree; characterised by excess”.137 When considering
the excessiveness of a charge, I have had regard to the explanatory memorandum to the Privacy
Amendment (Enhancing Privacy Protections) Bill 2012, which provides that the obligation to not charge
excessive fees for access to credit reporting information is the same test that applies in relation to
access to other personal information under APP 12.8.138 According to the APP guidelines at [12.79],
137 Macquarie Dictionary, Macquarie Dictionary Online, 6th ed. (October 2013) https://www.macquariedictionary.com.au/.
138 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protections) Bill 2012.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 64
whether a charge is excessive will depend on the nature of the organisation, including the organisation’s
size, resources and functions, and the nature of the personal information held.139
232. In order to consider what is the ‘usual or proper limit or degree’ in relation to charging for credit
reports , the complainants have requested that I consider charges imposed by other credit reporting
bodies.140 I am, however, not satisfied that I have sufficient information to adequately draw a pricing
comparison between Veda and its competitors. It would be necessary to know much more about the
costing structures, business models and operational contingencies faced not only by Veda, but that of its
competitors to assess whether reasonable comparisons could be drawn between those entities, and
whether there would be a need to adjust competitors’ credit reporting charges before determining
whether or not Veda’s notional charge (whatever might constitute that charge) was excessive.
233. Similarly, I am not satisfied that the New Zealand (NZ) Privacy Commissioner’s finding in his report of
March 2014 (NZ Report), in which he found the amount of $51.95 charged by Veda Advantage Limited in
New Zealand was unreasonable, is sufficient to support the claim that Veda’s charge on credit reports in
Australia is excessive.141
234. As Veda rightly points out, neither the NZ Act or NZ Code has application to Veda’s services or charges
in Australia, and the obligations imposed under that regulatory framework do not correspond with any
relevant obligations on Veda in Australia under the Privacy Act or CR Code.142 I would need to be
satisfied, and I am not, that notwithstanding the different regulatory frameworks between Australia and
New Zealand and the differences in factual circumstances, the sum of $51.95 was a reasonable
comparator, or that I had sufficient information to take into account all the adjustments that would
need to be made to that figure for it to become a reasonable comparator.
235. While I find that Veda, in the absence of contrary evidence, does charge a nominal fee for access to
credit reporting information that is bundled up in its membership packages, I have insufficient
information available to me to determine what constitutes a ‘usual or proper’ fee, and therefore
whether or not any notional fee charged by Veda is excessive. It may be that the difference between
what in Veda’s circumstances would constitute a ‘usual or proper’ fee and the notional fee is excessive,
but I do not have enough information before me to make that determination at this time.
The VedaScore issue
236. Section 20R(1) of the Privacy Act provides:
139 APP guidelines (v 1.1, 1 April 2014). There is no amendment to this [12.79] provision in the updated guidelines (v 1.2, 1 March
2015).
140 Third representative complaint, 20 October 2014, 3.
141 New Zealand Privacy Commissioner, Report by the Privacy Commissioner into Veda Advantage’s charge for urgent request for personal information (24 March 2014).
142 Veda’s submissions to the OAIC, 20 April 2015, 15-16, [16.1].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 65
If a credit reporting body holds credit reporting information about an individual, the body must, on request
by an access seeker in relation to the information, give the access seeker access to the information.
237. Section 6 of the Privacy Act defines ‘credit reporting information’ as follows:
Credit reporting information about an individual means credit information, or CRB derived information, about the individual.
238. ‘CRB derived information’ under s 6(1) of the Act means any personal information (other than sensitive
information) about the individual:
(a) that is derived by a credit reporting body from credit information about the individual that is held by the
body; and
(b) that has any bearing on the individual’s credit worthiness; and
(c) that is used, has been used or could be used in establishing the individual’s eligibility for consumer credit.
239. ‘Credit information’ has the meaning given by 6N of the Act, and I have outlined relevant provisions at
paragraph [15].
240. Paragraph 19.4(a)(ii) of the CR code states:
Where credit reporting information is provided to an access seeker free of charge by a CRB as required by Part IIIA,
the Regulations or this CR code:
a. the CRB must provide the access seeker with access to:
(i) all credit information in relation to the individual currently held in the databases that the
CRB utilises for the purpose of making disclosures permitted under Part IIIA; and
(ii) all current CRB derived information about the individual that is available.
241. The complainants contend that paragraph 19.4(a)(ii) clearly requires the derived information (being
the VedaScore) to be disclosed in the free credit report.143
242. Veda contends that Veda’s access obligations under Part IIIA and the CR code only extend to
information that it holds. It submits that a VedaScore is dynamically generated at the time of the
request by an access seeker for a paid service, and is consequently not held or available at the time
credit reporting information is provided for free to an access seeker.144
243. Veda’s argument is based on the following premise:
143 Third representative complaint, 20 October 2014, 3.
144 Veda’s submission to the OAIC, 20 April 2015, 17-18, [17.1].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 66
The Code is a “CR code” registered under Division 3 of Part IIIB of the Privacy Act. Section 26N(2) of the Privacy
Act relevantly provides that a CR code must set out how one or more of the provisions of Part IIIA are to be
applied or complied with. Section 26N(3) goes on to provide that a CR code may impose additional
requirements to those imposed by Part IIIA, so long as the additional requirements are not contrary to, or
inconsistent with that Part. Veda submits that, in accordance with section 26N of the Privacy Act, paragraph
19.4(a)(ii) must be interpreted as setting out how section 20R(1) of the Privacy Act is to be applied, and may
not be interpreted as imposing additional requirements that are contrary to or inconsistent with that
section.145
244. Veda says any interpretation of paragraph 19.4(a) of the CR code that requires the CRB to provide
credit reporting information that it does not hold would be contrary to, or inconsistent with, subsection
20(R)(1) for the purposes of section 26N(3).146
245. Veda argues that the VedaScore is not ‘held’ for the purposes of the Privacy Act and the CR code, but
additionally is not within the scope of ‘available’ CRB derived information in paragraph 19.4(a)(ii). Veda
points out the definition of ‘available’, which is defined in the Macquarie Dictionary as “suitable or ready
for use, at hand, of use or service”, is premised on the idea that the item or thing in question is already
in existence.147 Veda says this is not the case with the VedaScore. Veda explains that a VedaScore does
not come into being until an access seeker signs up to Veda’s ‘Your Credit and Identity’ service which
provides access to a portal, in which VedaScores are dynamically generated. 148
246. In response the complainants refer to the Explanatory Memorandum to the Privacy Amendment
(Enhancing Privacy Protections) Bill 2012 which provides at page 147:
This provision permits the individual to obtain access to their credit reporting information. This includes
both the credit information about the individual and the CRB derived information about the individual (for
example, any credit scoring or analysis about the individual).149
247. The complainants contend that it was the intention of parliament that credit scores be given to an
access seeker upon request.150
145 Veda’s submission to the OAIC, 20 April 2015, 18, [17.2].
146 Veda’s submission to the OAIC, 20 April 2015,18, [17.2].
147 Macquarie Dictionary, 6th ed. (Oct 2016). Macquarie Dictionary Online. <https://www.macquariedictionary.com.au/features/word/search/?word=available&search_word_type=Dictionary>.
148 Veda’s submission to the OAIC, 20 April 2015, 18, [17.2].
149 Complainants’ submission in reply to the OAIC, 25, [109].
150 Complainants’ submission in reply to the OAIC, 15 June 2015, 25, [110].
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 67
248. Moreover, the complainants argue that in accordance with the definition of CRB derived information
set out in s 6(1) of the Privacy Act, CRB derived information does not need to be held by the CRB; rather
it is the credit information that is held, not the CRB derived information.151 The complainants reason
that as a result, paragraph 19.4(a)(ii) of the CR code sits “comfortably within the limits of s 26N(3) of the
Privacy Act” and there is no prevailing inconsistency between these provisions.152
249. The complainants further contend that the VedaScore falls within the scope of available CRB derived
information for the purposes of paragraph 19.4(a)(ii) of the CR code because the ‘dynamic process’ of
generating a credit report generates the VedaScore or can readily be made to do so.153
250. The complainants finally note that a credit score is available for free and included in the Experian credit
report.154
Findings in relation to the VedaScore claim
251. In my view, in order for the VedaScore to be subject to the access obligations under Part IIIA of the
Privacy Act and the CR code, it must be credit reporting information that is held by Veda. Both credit
information and CRB derived information fall within the meaning of credit reporting information.
252. Section 20R of the Privacy Act clearly stipulates that a credit reporting body must give access to credit
reporting information it ‘holds’. This is reflected in the explanatory memorandum of the Privacy
Amendment (Enhancing Privacy Protection Bill 2012, which says the following about section 20R:
Subclause (1) states the general obligation that if a credit reporting body holds credit reporting information
about an individual, the body must, on request by an access seeker, give the access seeker access to the
information.
This provision is based on the obligations set out in, and the structure of, APP 12, modified to apply specifically
to credit reporting bodies. It is generally intended that access to credit reporting information should occur on
the same terms as access to personal information held by an APP entity.155
253. APP 12, which deals with access to personal information, states:
If an APP entity holds personal information about an individual, the entity must, on request by the individual,
give the individual access to the information.
151 Complainants’ submission in reply to the OAIC, 15 June 2015, 26, [112].
152 Complainants’ submission in reply to the OAIC, 15 June 2015, 27, [119]-[120].
153 Complainants’ submission in reply to the OAIC, 15 June 2015, 26, [113].
154 Complainants’ submission in reply to the OAI, 15 June 2015, 27, [121].
155 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, https://www.legislation.gov.au/Details/C2012B00077/Explanatory%20Memorandum/Text.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 68
254. The explanatory memorandum suggests it was the intention of parliament that credit scores be given
to access seekers upon request where the CRB holds that information (emphasis added).
255. Section 6(1) of the Privacy Act provides that an entity ‘holds’ personal information if the entity has
possession or control of a record that contains the personal information. The Act relevantly defines
‘record’ to include an electronic or other device. Veda’s computer system is a ‘record’ in Veda’s
possession and control for the purposes of the Act.
256. The issue for determination is whether a VedaScore can be said to be credit reporting information that
is contained in Veda’s computer system.
257. In response to my issuing a notice to produce under s 44 of the Privacy Act Veda provided further
information on how VedaScores are generated by Veda’s computer system and accessed by individuals
and credit providers.
Consumer subscribers to Veda’s paid services are provided with access to a portal. This portal is
created once the subscription has been processed and the features available to subscribers are
determined by the particular product to which the individual has subscribed. A VedaScore is
generated once the portal is created. These scores are not event-driven and are automatically
generated from credit information held by Veda at particular points in time. As part of the service
attached to certain products (Veda Access and Veda Plan for example) past scores dynamically
generated are auto-held by the system so that an individual can see how their score has changed
over time with changes in their credit history (score tracker). Past scores remain in the portal for
12 months. Once a subscription ends, the portal closes down and the information generated
within that portal, including the VedaScores, is destroyed.
For credit provider subscribers, the situation is different. VedaScores are event-driven and
calculated through the application of a mathematical algorithm. Identical algorithms return
different outcomes depending on the inputs, such as the identity of the credit provider, and the
reason for access. The score returned also reflects the level of information that the credit provider
has requested be included in the score. As I understand it, this means a credit provider may yield a
different VedaScore for a particular individual at any one point in time, and different credit
providers will yield different VedaScores for the same individual at the same point in time.
VedaScores generated in the credit provider space are not held. They are destroyed after each
completed transaction in the subscriber portal. Information about the access to scores is,
however, included in Veda transaction logs, which are generated within a different and separate
database system. The logs can be retained anywhere from six months to two years.
Scores are generated through an automated process. A mathematical algorithm is applied to the
source information (existing credit reporting information) within Veda’s database coupled with
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 69
subscriber inputs to dynamically generate a score. The algorithm is set in time but periodically
reviewed and updated.
Veda says that the credit report merely arranges credit information that is held by Veda in a form
that is appropriate for consumers (an access will be recorded on the file as ‘access’). In contrast,
Veda says, the VedaScore is new information that is derived from credit information.
258. Based on this information, as I see it, there is no fixed score that can be attributed to an individual even
at any one particular point in time, because the score generated will be different depending on whether
the score has been requested by the individual or a credit provider. It will also depend on which type of
credit provider has requested access, and what categories of information have been requested by the
credit provider.
259. Further a VedaScore does not come into existence until the point of access, and the outcome will differ
depending on the inputs at the time of access. So for individuals wishing to access a score, a score does
not come into being until the creation of a portal (created through subscription), when the score is then
auto-generated at particular points in time. Prior to that, a score simply doesn’t exist. For credit
providers wishing to access a score, the score does not come into being until the point of access when
the algorithm is applied to the existing credit information (source information) factoring in various
inputs at the time of the access request. When credit providers exit their portal, the score is destroyed –
it is not retained.
260. When an access seeker requests a free credit report, there is no score in existence contained within
Veda’s database. There is no portal for the access seeker to access, unless they are paid subscribers. Nor
is there any type of fixed score retained in the credit provider space that could be accessed by the
access seeker. All that exists at the time of the request for a free credit report is existing credit
information (source information).
261. Relevantly the explanatory memorandum provides at item 14:
To derive information from other information (the source information) is to obtain or deduce other
personal information from the source information.156
262. The VedaScore is derived information from the source information, however it is only obtained
following the application of an algorithm to source information, factoring in various inputs at the time of
access. It does not come into being until that derivation process has occurred. In other words, there is
no VedaScore that is held by Veda at the time an access seeker who is not a subscriber requests a credit
report free of charge.
156 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012,
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 70
263. I acknowledge that Veda does hold information about credit provider access to VedaScores, which has
been recorded in transaction logs. On the information before me, it is unclear exactly in what form this
information appears, but as I understand it, it is only recognisable as a VedaScore once a ‘complex
extraction process’ has been employed.
264. In my view, a transaction log record is not CRB derived information because in its existing form (prior to
any extraction process), it is not information that has any bearing on the individual’s credit worthiness
nor is it information that is used, has been used, or could be used in establishing eligibility for consumer
credit. Until there is some physical alteration or effect on the transaction log from the extraction
process, it cannot be considered information which falls within the definition of CRB derived
information, or indeed credit information.
265. In my view, a VedaScore does not constitute credit reporting information that Veda holds at the time of
an access request for a free credit report, simply because at that time, a score doesn’t exist. Veda is
therefore not in breach of the Act (or the CR code) for failing to provide access to VedaScores when a
request for free access to credit reporting information is made.
266. Notwithstanding this, I find that the third complaint has been substantiated in relation to Veda’s
practice of charging for the ‘expedited delivery’ of a credit report in circumstances where the access
seeker had not sought access to credit reporting information within the preceding 12-month period. This
practice was in breach of s 20R(5) of the Privacy Act and constitutes an interference with the privacy of
class members.
Declarations
267. In accordance with s52(1)(b) I make the following declarations:
I. I declare that the first complaint is substantiated under s 52(1)(b) of the Privacy Act on the
following findings:
i. Veda, at the relevant time, failed to prominently state on its websites that individuals
have a right to obtain their credit reporting information free of charge in certain
circumstances (the prominence issue) in contravention of s 19.3(a) of the CR code; and
ii. Veda, at the relevant time, did not take reasonable steps to ensure that free access to
credit reports was as available and as easy to identify and access as paid access to
credit reports in contravention of s 19.3(b) of the CR code (the online access and
phone access issues).
II. I declare that the second complaint is substantiated under s 52(1)(b) of the Privacy Act on the
following finding:
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 71
i. Veda at the relevant time used personal information it held about class members for
the purpose of direct marketing in breach of APP 7 (the direct marketing issue).
III. I declare that the third complaint is substantiated under s 52(1)(b) of the Privacy Act on the
following finding:
i. Veda’s practice of charging for the ‘expedited delivery’ of a credit report was in breach of
s 20R(5) in circumstances where the access seeker had not sought access to credit
reporting information within the preceding 12-month period.
268. To its credit, Veda has taken some steps toward improving the promotion and delivery of its free
service of access to credit reports since the complaints were lodged.
269. Veda has, for example, moved the ‘free file’ button presently appearing on its ‘my credit file’ web
pages to a horizontal level equivalent to the first reference to a paid service. It has amended its ‘your
credit and identity’ web page to accommodate the option of free access to credit reports in its online
comparison of Veda product information. It has streamlined its online application process for free access
to credit reports, including the amending of Veda’s online request for consent to market Veda products
and those of its related bodies and service providers. It has also amended its identification processes for
access seekers wishing to access a free report, such that its online verification process for access seekers
requesting a free report is now the same process as that for access seekers requesting their credit report
through one of Veda’s paid services. Furthermore, it has discontinued its ‘expedited delivery’ service in
circumstances where an individual has simply requested access to their credit reporting information (the
‘immediate delivery’ of credit reporting information remains part of a plethora of services offered within
various Veda product packages).
270. Notwithstanding these significant changes, I am of the view that Veda continued to engage in conduct
which constitutes an interference with the privacy of class members. Consequently, I declare, in
accordance with s 52(1)(b)(ii) of the Privacy Act, that within 6 months of the date of the determination,
Veda shall:
I. take action to ensure its service of providing free access to credit reporting information is as
available, and as easy to identify and access as it is through its fee-based services, including but not
necessarily limited to the following action:
(i) ensuring class members are able to access credit reports free of charge over the phone in the
same way that reports which are paid for can be ordered by telephone.
Financial Rights Legal Centre Inc. & Others and Veda Advantage Information Services and Solutions Ltd │ 72
II. confirm with me that the action at [i] has been undertaken, advising me of website revisions to
inform consumers that free credit reports may be ordered by phone, as well as by post and online;
amendments to the application procedure for applying for free credit reports over the phone and
any other actions that may be necessary to satisfactorily carry out the action declared at [i] to
ensure that Veda is no longer engaging in conduct which constitutes an interference with the
privacy of class members.
III. refund individuals the cost of its expedited delivery charge, in circumstances where those
individuals had not sought access to credit reporting information within the preceding 12-months
period.
Timothy Pilgrim
Australian Privacy Commissioner
9 December 2016
Review rights
A party may apply under s 96 of the Privacy Act 1988 to have a decision under s 52(1) or (1A) to make a determination
reviewed by the Administrative Appeals Tribunal (AAT). The AAT provides independent merits review of
administrative decisions and has power to set aside, vary, or affirm a privacy determination. An application to the
AAT must be made within 28 days after the day on which the person is given the privacy determination (s 29(2) of
the Administrative Appeals Tribunal Act 1975). An application fee may be payable when lodging an application for
review to the AAT. Further information is available on the AAT’s website (www.aat.gov.au) or by telephoning 1300
366 700.
A party may also apply under s 5 of the Administrative Decisions (Judicial Review) Act 1977 to have the determination
reviewed by the Federal Circuit Court or the Federal Court of Australia. The Court may refer the matter back to the
OAIC for further consideration if it finds the Information Commissioner’s decision was wrong in law or the
Information Commissioner’s powers were not exercised properly. An application to the Court must be lodged
within 28 days of the date of the determination. An application fee may be payable when lodging an application to
the Court. Further information is available on the Court’s website (http://www.federalcourt.gov.au/) or by
contacting your nearest District Registry.