1 Feb 2010, 09:00

A man applied to a credit reporter for a copy of his credit report. Upon receiving the report, he was shocked to find an enquiry on it from a private investigation firm.

The man was not satisfied with the outcome of a complaint to the credit reporter, and complained to our Office. In particular, the man complained that the private investigator had not provided the credit reporter with any evidence to support its reasons for accessing his credit report.

Principle 1 of the Privacy Act

Principle 1 of the Privacy Act provides that an agency shall only collect personal information that is necessary for a lawful purpose connected with the function of that agency.

The private investigator said that he had accessed the man's credit report for the purpose of court proceedings and that the information he sought - relating to the identity of the man as a potential witness - was necessary for those proceedings.

We agreed that, if the private investigator was able to establish that court proceedings were in progress or reasonably in contemplation at the time, he may have had a valid reason for collecting information of this sort from the man's credit report. However, the private investigator was unable to provide any evidence to support his submission. In fact, he was unsure whether this had been the reason for the search in the first place.

On that basis, we were not satisfied that the private investigator did have a lawful purpose to access the man's credit report and that he had breached principle 1 of the Act.

Principle 2 of the Privacy Act

Principle 2 of the Privacy Act provides that an agency shall collect personal information directly from the individual concerned, unless an exception applies. Principle 2 enables individuals to have some control over the information that is collected about them. Individuals can only do this if they know information is being collected. This is why an agency may only access an individual's credit report with the individual's authorisation unless an exception applies.

Again, the private investigator said that it was necessary to go straight to the credit reporter to collect information about the man as court proceedings were in progress. The private investigator was seeking to rely on principle 2(2)(d)(iv) of the Act to collect information from another source. The private investigator was unable to provide any evidence that court proceedings were in progress or reasonably in contemplation.

The private investigator also said that he went straight to the credit reporter because approaching potential witnesses by telephone could fail to gain their cooperation. The private investigator was seeking to rely on principle 2(2)(e) of the Act, which allows an agency to collect information from another source if collecting it from the individual would prejudice the purpose of the collection.

However, the private investigator already knew the man's address and we were satisfied that he could have approached the man in person to establish his identity and, if necessary, secure his cooperation. Therefore the private investigator could not rely on principle 2(2)(e) of the Act either.

The investigation indicated that the use of credit reports to establish the identity of witnesses was a relatively common practice. This may result in an adverse credit record in the eyes of some people.

In this case, the man was unable to show that he had suffered any harm as a result of the private investigator's enquiry. Further, the credit reporter had removed the enquiry following the man's complaint. However, we recommended to the private investigator that, given the potential for harm in such cases, private investigators should use other methods to carry out such work.


March 2010

Collection of personal information - private investigator - accessed credit report without knowledge or authorisation of individual - information collected not necessary for a lawful purpose - information collected should have been sought directly from individual - principle 2(2)(d)(iv) did not apply - principle 2(2)(e) did not apply - no harm suffered as a result - Privacy Act 1993, principle 1, principle 2