12 May 2016, 09:00

The Privacy Commissioner John Edwards has found inadequacies in the way the three major credit reporting agencies – Veda, Centrix and Dun and Bradstreet – respond to requests for personal information from individuals.

The check found that two of the three national consumer credit reporters failed to respond to at least two access requests.

The three agencies all delivered reports within the legal timeframes when requests were made through the agency’s website. Report requests through phone, letter or in person took longer or did not arrive at all. In some cases, a response arrived in 20 days or fewer, but only to advise consumers to make their requests online. 

“People who make information requests through offline methods have the same access rights as people who make requests through online methods. When consumers are not able to use online methods, agencies need to assist them to make valid requests through other channels,” Mr Edwards said.

Mystery shoppers

The Commissioner found the inadequacies in a “mystery consumer” exercise, in which contractors were hired to seek their own credit reports, then report back on their experience.

The contractors did not tell the credit reporting agencies why they were seeking their information, or that they had been hired to do so by the Privacy Commissioner.

“This is the first time we’ve worked with mystery consumers to investigate agency practice,” Mr Edwards said. “It certainly won’t be the last. We intend on using this method to examine other agencies, both public and private, as it’s a great way to see how they behave ‘in the wild’.”  

The results of this spot check have been shared with the credit reporting agencies. 

The spot check revealed a number of other aspects of credit reporting agency practice, such as:

• All three agencies are complying with their obligation to charge no more than $10 for an expedited report.
• Centrix provided reports in an average of 5.6 working days, Dun and Bradstreet 10.5 and Veda 16.5. This is a significant discrepancy.

Full report on the mystery consumer exercise.

Notes for editors

Credit reporting

The Privacy Act gives individuals the right to access information held about them by nearly all organisations in the country. These rights are strengthened in relation to information held by credit reporters by the Credit Reporting Privacy Code 2004 issued by the Privacy Commissioner. The code provides that individuals are entitled to access their credit report free of charge in most cases. In the limited circumstances that charges are permitted, the maximum charge is $10. Information about the code is available at the Privacy Commissioner’s website.

The spot checks

The field work for the spot checks was conducted between June and October 2015. Fewer than 30 checks were made of each of the three national consumer credit reporters. The results are illustrative of the particular requests to the companies concerned and should not be reported as a representative statistical sample.

Privacy Week        

Privacy Week is an annual week marked throughout the Asia-Pacific region in May. There's more information here.

New Zealand’s Privacy Week activities include:

• Visit of the first UN Special Rapporteur on the right to privacy –      Prof. Joe Cannataci
• Wellington Privacy Forum – 11 May, Intercontinental Hotel
• Auckland Privacy Forum – 12 May, Crowne Plaza Hotel
• Technology & Privacy Forums, 9 and 10 May, Wellesley Hotel,      Wellington
• Release of ‘mystery shopper’ report into credit reporters
• New Zealand’s first “Right to Know Day”, 12 May
• Launch of “AboutMe” – and online tool for personal information      requests
•  

For more details and information about what is happening during the week, visit www.privacy.org.nz.

ENDS

For further information, contact Sam Grover 021 959 050.