From October this year the depth and breadth of sensitive information held about New Zealanders' credit histories by privately owned agencies will increase rapidly.
And the Privacy Commission concedes that the "external" oversight put in place to ensure this information is not misused will be the responsibility of the credit reporting agencies themselves rather than being truly independent.
Last year Privacy Commissioner Marie Shroff approved changes to the Credit Reporting Privacy Code which will for the first time allow credit reporters Veda Advantage and Dun and Bradstreet to begin collecting "positive" information about New Zealanders' credit history as well as other information including driver's licence numbers.
Until now, these agencies, which are consulted whenever New Zealanders apply to banks and other lenders for credit, have been able to hold only "neutral" address and identity data or "negative" information where customers failed to meet their credit obligations.
Shroff said New Zealanders were often unaware of the very important, hidden activity taking place in the credit reporting system where credit providers such as banks, hire purchase finance providers and utilities like phone companies both supply and purchase credit information.
The commission first moved to regulate credit reporting in 2004 in response to a rising tide of complaints from the public.
But since then the industry has pushed hard to be allowed to collect positive information and driver's licence numbers.
It says this will increase the accuracy of its information and also allow credit to be granted to borrowers who might otherwise miss out.
But Shroff points out that this argument is not entirely compelling. The United States had a comprehensive positive credit reporting system for years "and it didn't seem to prevent the home loan crisis".
The move to positive reporting was a "major shift" for consumers, many of whom were questioning why credit reporters should have access to everyday information, or be able to peer into their financial lives.
The commission had moved on the matter "extremely carefully".
"We had to get the balance right and I think we have."
Assistant Privacy Commissioner Blair Stewart said the biggest of the changes coming into effect in October was allowing credit reporting agencies to collect driver's licence numbers.
The industry argued it would introduce a very high level of identity accuracy but "many people would see it as potentially quite intrusive".
However, the commission chose to allow it with the "major control" that a licence number must be "hashed" or encoded into a different number to prevent details being shared.
"It prevents them from developing an alternative national database of driver licence numbers," said Stewart.
In relation to positive credit reporting, which begins in April 2012, Shroff said limits on the use of that information and the industry's undertaking for independent audit were important factors in allaying her concerns.
The new information can be released to credit providers only with the customer's consent, and it cannot be used for direct marketing, or be viewed by employers or landlords.
However, Shroff concedes the new oversight is not as independent as it might be.
The technical requirement is for someone who is not a director or an employee of the company. Prospective candidates are likely to be any one of a number of privacy experts including lawyers, or someone experienced in IT auditing.
But it is essentially someone the company selects and pays for themselves, says Shroff, although whoever is selected must report to the Privacy Commissioner.
"It's a middle ground between doing it internally and having no external scrutiny and a full-blown external audit."
It is a softer regime than either Australia's or Hong Kong's.
"We have stepped back from those more stringent requirements," says Shroff.
However, the commission will be carefully monitoring the new regime, "and there is capacity to move more strongly particularly if we extend positive reporting to the things that the credit reporters want, which are repayment history and credit balance".
Shroff said the commission was "certainly concerned about the accountability of credit reporters with their huge databases which are intrusive into people's financial lives".
There would continue to be a complaints mechanism and some transparency in that people could ask to see their credit records.
"Nevertheless at the system level you've got to ask how truly accountable to the public credit reporters are. We'll be looking at that quite closely."
NEW POWERS
Information currently available to credit reporting agencies:
* Negative information: Includes instances where the borrower failed to make repayments on time or defaulted on their loan, hire purchase agreement or utility bill and bankruptcies.
* Neutral information: Includes identity information, address details, how long you have lived at that address.
Information that will become available to agencies:
* Positive information: May include information on the type of credit account a person has, the limit on each account, who is providing the credit and the status of the account. Other information may include payment history and current balance.
