Office of the Privacy Commissioner | Inquiry into illion’s arrangement with its related company Credit Simple
Read the Privacy Commissioner’s Inquiry into illion's Arrangement with its related company Credit Simple report (opens to PDF).
Executive summary
The executive summary of the report was written by Privacy Commissioner John Edwards.
This Inquiry has examined illion’s relationship with its related company Credit Simple in accordance with the requirements imposed on illion under the Credit Reporting Privacy Code 2004. The Code applies to the handling of credit information by credit reporters. The Code applies specific rules to credit reporters to ensure the protection of individual privacy.
In 2010 and 2011 the Code was amended to introduce Amendment Nos 4 and 5 to authorise positive reporting, which is a more intrusive system (due to the collection of significant amounts of credit information).
The introduction of positive reporting was accompanied by strict limits on practice and special safeguards including restrictions on the use and disclosure of credit information for marketing purposes to complement responsible lending practices.
Code requirements were strengthened in 2018 through Amendment No 14 by introducing limits on arrangements with related companies to restrict the use of credit information in marketing activities, making it clear a credit reporter cannot use a related company to circumvent its obligations under the Code, particularly for marketing and direct marketing activities.
illion as a credit reporter is subject to the Code. This inquiry investigates the Arrangement between illion and its related company Credit Simple and whether it complies with clause 5(2) of the Code. The Code not only places obligations on credit reporters but also ensures related companies are subject to the same obligations under the Code as credit reporters.
illion and Credit Simple as related companies are in an Arrangement created through an Access Seeker Services Agreement (NZ). This Agreement allows Credit Simple to request credit reports on behalf of individuals from illion. However, an individual must authorise Credit Simple to make a request to access their credit information from illion. Credit Simple not only acts as an agent for individuals to gain access to their credit information from illion on the Credit Simple platform. In addition, Credit Simple provides marketing offers and a quotation enquiry service to individuals who use Credit Simple’s platform. These marketing offers and the quotation enquiry service, use credit information which is prohibited by the Code. Additionally, Credit Simple uses its registration process to seek unrelated additional authorisations from individuals requesting to access their credit information from illion. Therefore, Credit Simple is engaging in activities that are prohibited by the Code and illion would be in breach if those activities were undertaken by illion.
I have found the Arrangement between illion and its related company Credit Simple circumvents the application of the Code for marketing purposes and the bundling of unrelated authorisations into a statutory right to access. The Arrangement is therefore, in breach of the Code.
The Code was carefully set up to protect vulnerable consumers from marketing and to promote responsible lending. The Arrangement between illion and its related company Credit Simple breaches the Code and risks undermining features of the Code that were created to encourage risk-based pricing and ensure the limited marketing activities permitted by the Code are conducted by credit reporters only.
The Code expressly states that if a credit reporter is in an Arrangement with a related company the Arrangement should not circumvent the application of the Code and the Arrangement should not enable the related company to use or disclosure credit information sourced from the credit reporter in way which would breach the Code if the use or disclose credit information were done directly by the credit reporter.
The Code has always ensured that credit information is not used or disclosed for marketing activities. The several amendments to the Code have served to reinforce the restriction on the use and disclosure of the credit information for marketing purposes.
I have found illion in breach of its obligations under the Code, particularly clause 5(2), rules 4(2), 10(1B) and 11(3)(b).
Related content
Read the Terms of Reference for this inquiry (opens to PDF).