Michael Sukkar (Deakin, Liberal Party, Assistant Minister to the Treasurer) Share this | Hansard source

I move:

That this bill be now read a second time.

This bill will amend the National Consumer Credit Protection Act and the Privacy Act. This important reform will require our four largest banks to participate fully in the comprehensive credit reporting system, delivering benefits to lenders and borrowers alike, while preserving and enhancing the important security and consumer protections enshrined in the Privacy Act.

In introducing this bill today, we are implementing a commitment that the government set out in its response to the Productivity Commission's landmark inquiry into data availability and use, as announced at the time of the 2017-18 budget. In that report, the Productivity Commission recommended that we move to mandate participation in the comprehensive credit reporting system if less than 40 per cent of accounts were being reported in mid-2017. We agreed with this recommendation, giving industry a further six months to meet the target.

When the government announced our commitment to legislate in November 2017, there was simply no prospect that the target would be met by the end of the year.

Australians have been waiting for comprehensive credit reporting for a long time. The amendments to the Privacy Act establishing the voluntary comprehensive credit reporting system were passed by this House in 2012, following extensive consideration by the Australian Law Reform Commission. The financial system inquiry recommended that the financial system take up comprehensive credit reporting in 2014. The industry standard for comprehensive credit reporting—the Principles of Reciprocity and Data Exchange—was authorised by the Australian Consumer and Competition Commission in 2015.

And yet, as of last year, Australia was still waiting for industry to move forward on this issue.

This is why we are committing to this legislation. Australia is an international laggard in credit reporting. Many of our largest trading partners—including the United States of America, the UK, New Zealand and Japan—have well-established comprehensive credit reporting systems. On this matter, we are falling behind even developing economies such as South Africa and India.

But movement forward in Australia has been stymied by the lack of a 'critical mass' of credit reporting data.

There is a critical first mover problem at play here—without sufficient data in the comprehensive credit reporting system, there is very little benefit for any individual credit provider to invest the time and capital required in building systems and arrangements to access it.

This lack of data means that lenders have a more difficult task meeting their responsible lending obligations. It means that more loans are declined by lenders who simply cannot verify a customer's creditworthiness. And it means that many loans are mispriced, leaving borrowers with good credit histories paying higher interest rates than they otherwise would.

With this legislation, we are changing that equation.

The major banks account for more than 80 per cent of household lending, and hence hold a huge quantity of credit information. Our expectation is that the inclusion of this data in the system, alongside the industry-established principles of reciprocity, will create a 'critical mass' of credit data that provides strong incentives for smaller credit providers to participate in the credit reporting system.

This bill sets out the mandatory credit information fields that must be provided by the major banks to eligible credit reporting bureaus—identification information, payment information, default information, credit liability information, repayment history information, and new arrangement information.

The major banks must supply mandatory credit information on 50 per cent of all eligible accounts within a 90-day window from 1 July 2018, and on their remaining accounts within a 90-day window from 1 July 2019.

This information must be supplied to every eligible credit reporting body—that is, every credit reporting body that meets the standards under the Privacy Act, and had a contract with the bank on 2 November 2017.

This means in effect that every major bank will be required to supply the mandatory credit information to Australia's three largest credit reporting bodies—Equifax, Experian and Illion.

While the bill limits the initial mandatory bulk supply to these three bodies, nothing in the bill prevents additional credit reporting bodies from entering into supply agreements with credit providers and competing with the established bodies. The government strongly supports competition in the credit reporting market.

Once the major banks have supplied the required information, credit providers will be able to access the information from the credit reporting bodies in the event that a customer makes a credit inquiry, alongside analysis and credit scores based on this information.

This means that credit providers will be able to make lending and risk pricing decisions on the basis of comprehensive information, rather than a small fragment of the overall picture.

All lenders who participate in comprehensive credit reporting will have an enhanced capacity to meet their responsible lending obligations. Those obligations are an important part of consumer protection arrangements.

Small credit providers, including innovative fintech firms and new entrants, will be better able to serve customers and assess the lending capacity of potential borrowers.

Placing smaller lenders on a more level playing field with the major banks, in respect of access to credit information, will drive competition in the consumer lending market.

Greater competition in the lending market should benefit consumers, by being offered greater access to finance and better pricing.

Those customers who are currently disadvantaged by the existing negative system—by having a thin credit file, or by having a single default marked against them—will have a better chance to build and repair their credit history prior to applying for a major loan.

Small-business owners, entrepreneurs, and sole traders will be empowered to borrow to build their businesses on the basis of strong consumer credit histories.

We are alert to risks for vulnerable consumers. Nothing about this bill changes the important protections in the credit act against predatory or misleading conduct by credit providers. ASIC retains all its powers to act to protect customers from misconduct in the lending sector.

Customers who suffer from temporary hardships should not be impeded or discouraged from making appropriate arrangements with their credit providers.

To ensure that the provisions in the Privacy Act dealing with hardship cases remain appropriate, the Attorney-General has asked his department to conduct a review of the arrangements for hardship reporting under the Privacy Act and credit reporting code.

In this legislation, we are building on already-established frameworks to build the comprehensive credit reporting of the future.

Through regulations under this bill, we will ensure that those banks and credit providers that are already supplying comprehensive credit data, including NAB, will continue to benefit from the protections and principles embedded in the existing industry established framework.

Where credit providers and credit reporting bodies are subject to requirements under the bill, they will be subject to penalties if they fail to comply.

Enforcement of these requirements will be responsibility of ASIC, who will be granted the appropriate powers to collect information and require audits to confirm that these requirements are ultimately being met.

Credit providers and credit reporting bodies will also be required to provide statements to the Treasurer in January of 2019 and 2020 certifying their compliance with the initial supply provisions of the bill.

Clearly, industry is well placed to meet the timeframes and requirements set out in this bill, which align closely to existing industry standards.

The security of consumer information is of high importance to the government.

This bill strengthens the privacy and security provisions established under the Privacy Act.

We are well aware of the risks of data breaches and privacy infringements in the credit-reporting environment.

The government has already acted to strengthen the Privacy Act's approach to data breaches, with the mandatory Notifiable Data Breaches scheme coming into effect in February of this year. That scheme introduced serious penalties for failing to appropriately notify customers of a data breach.

The Australian Information Commissioner will continue to have oversight of the management of Australians' personal data, including credit information.

All requirements for credit providers and credit reporting bodies to maintain security standards and protect data against unlawful access or misuse will continue to operate.

In addition, we are extending the security provisions under the Privacy Act to ensure that all credit reporting bodies store their data in Australia, or in a secure cloud service certified by the Australian Signals Directorate.

And we are requiring credit providers to satisfy themselves that a credit-reporting body is meeting reasonable security standards, before they supply the mandatory credit information. Under their existing bilateral arrangements, banks already perform audits and ensure that the credit-reporting bodies continue to upgrade their security systems to meet the changing environments of various threats. These important activities will continue under the comprehensive credit-reporting system.

The inclusion of these provisions follows extensive consultation with industry, consumer groups, and security agencies, and will allow Australians to rest easy, knowing that their credit reporting information is stored safely and securely.

In addition to the security provisions, this bill allows for innovation and change in the credit-reporting sector.

Should new means of information exchange be developed, or new industry frameworks for credit sharing come into existence, the bill will allow for that through the prescribing of regulations.

If it becomes apparent that mandatory supply should be extended to cover second-tier credit providers, the bill will allow for that through, again, the prescribing of regulations.

The bill also contains a statutory review provision, with a review to be completed by 1 January 2022.

We expect that this review will provide an opportunity for the government to confirm that the system is operating as intended; and to consider the impacts of the system on consumers and industry, whether the scope of the system should be expanded, and whether alternate frameworks for credit reporting would be more appropriate given technological changes or, again, changes in the security environment.

In closing, I note that this bill will bring Australia into line with our international peers, by ensuring that our largest banks participate fully in the comprehensive credit-reporting system.

We expect that consumers and small businesses will see the benefits of this scheme, as the lending market becomes more competitive and more effective at delivering loans.

The extensive consultation undertaken in developing the bill will ensure that the approach taken is both workable and effective.

As always, full details of the measures are contained in the explanatory memorandum.

Debate adjourned.

See this speech in context