The complainant was involved in correspondence with a bank about arrangements for repayment of a debt. The bank reported this debt to a credit reference agency who listed the complainant as a defaulter. The complainant requested that the agency remove all details relating to this matter from their records on the grounds that he had an agreement for repayment of the debt which had been in force when the default had been listed. The agency refused to delete the information about the debt from its records.

The complainant asked me to investigate the agency's refusal.

I focused my investigation on whether the agency's decision to refuse to delete the information listing the complainant as a defaulter was a breach of information privacy principles 7 of the Privacy Act.

I noted that the obligations of the agency in terms of information privacy principles 7 were to "... take such steps (if any) to correct ... information as are, in the circumstances, reasonable, to ensure that, having regard to the purposes for which the information may lawfully be used, the information is accurate, up to date, complete and not misleading".

The agency in response to the complainant's request contacted the bank concerned who advised that the listing referred to a legitimate debt and asked that it be maintained. The agency then asked the complainant to deal with the bank directly on the issue.

I considered whether or not the agency should have taken any further steps to correct the default listing. I understood that the policy of the agency when a listing is challenged is to check with their client to seek confirmation as to whether the listing should, in the client's view, remain on the file. If the client confirms the listing (as in this case) then the agency refers the individual back to that client.

I found that this would be a reasonable practice in most circumstances. It is the client who holds the relevant information who is in a position to check the indebtedness or otherwise of the individual concerned. I did not consider that the agency could reasonably be expected to go back to the bank and ask to access all the relevant background information and decide for themselves whether or not the complainant's version of the facts or the bank's version of the facts was correct. I noted that this would be not only an indirect way of resolving the conflict and place a possibly onerous burden on the agency but that such a step may in itself raise issues for the agency under the Privacy Act. I therefore formed the opinion that there was a proper basis for the refusal to correct the information.

I then considered the further provision of information privacy principles 7 that where an agency is not willing to correct information it shall "if so requested by the individual concerned, take such steps (if any) as are reasonable in the circumstances to attach to the information any statement provided by that individual of the correction sought" (information privacy principles 7(1)(3)). During the course of my investigation I asked the agency why it had not noted on its file that the complainant disputed the default listing. The agency was of the view that the complainant was not disputing that he had defaulted on the debt but was disputing the fact of the listing itself. I found in the circumstances that the agency did not consider that an annotation of the complainant's file had been requested or would be appropriate. I noted that while the distinction that the agency had drawn was a fine one, there was no doubt that the complainant had not requested a correction statement be attached to his file.

I noted that although information privacy principles 6 requires the rights of correction to be referred to when an individual is given access to personal information, Information privacy principles 7 does not require the agency to draw the requester's attention to the right to attach to the information a statement of correction.

I then considered whether the obligation for an agency to provide reasonable assistance to individuals who wish to make an information privacy request (section 38) extends to advising the individual of their right to have a statement of correction attached. I found that section 38 imposed no such an obligation.

In this case the complainant made his request in accordance with the Act (section 38(b)) and even though the complainant considered he had made the request to the correct agency, the credit reference agency gave him information about raising the matter with the Bank, thus providing reasonable assistance in terms of Section 38©.

The obligations of an agency in refusing a request are set out in section 44 and information privacy principles 7(5) which provide that where refusing any request the agency shall -

- give the reason for the refusal; and
- if the individual so requests the grounds in support of that reason; and
- give the individual information about how to make a complaint to the Privacy Commissioner; and
- inform the individual of the action taken as a result of the request.

A request for the attachment of a statement or correction is a distinct request from the request for correction. I was of the opinion that it would be unreasonable to put a gloss on section 44 by an interpretation of section 38 which adds an obligation to inform of other requests which may be made.

In some cases it may well be that the tone or words of the letter requesting a correction put an obligation on the agency to make the attachment or to offer to do so. I did not consider that this was the case here.

In conclusion I found that without a refusal to attach a statement there could not be said to be a breach of information privacy principles 7.

I also noted that even if I had found that the failure to attach a statement of correction sought or to advise the complainant of the right to ask for such a statement amounted in the circumstances to a breach of information privacy principles 7, I would not have been prepared to refer the matter to the Proceedings Commissioner. There was no evidence of any loss or damage to reputation suffered by the complainant as a result of the agency's actions or omissions. No inquiries of the complainant had been made to the agency during the period in which the default had been listed.

It was my opinion that the complaint did not have substance and I discontinued my investigation on this basis.

Failure of Credit Reference Agency to Correct Information - Information Privacy Principles 7 of the Privacy Act 1993

Correction of personal information - Credit reporting agency - Debt not disputed - Complainant wanted debt deleted because of an agreement for repayment - Agency provided reasonable assistance - Privacy Act 1993, ss 38 and 44 - Information privacy principle 7