(AAB Appeal No.22/2017)
An individual’s credit report contained his address history and contact number history – the appellant’s credit data held by a credit reference agency – collection, retention and use do not contravene the Code of Practice on Consumer Credit Data and the requirements of Ordinance
Coram:
Mr Erik Ignatius SHUM Sze-man (Deputy Chairman)
Mr Nelson CHENG Wai-hung (Member)
Miss Angelina Agnes KWAN (Member)
Date of Decision: 6 April 2018
The Complaint
The Appellant was dissatisfied with the credit report obtained from the credit reference agency which contained his address history and contact number history, some of which were so old that he could not even remember. The Appellant considered that the credit reference agency had excessively collected, retained and used his personal data.
The Privacy Commissioner’s Decision
The Privacy Commissioner took the view that the credit reference agency was permitted to collect general particulars of the Appellant under clause 3.1.1A of the Code of Practice on Consumer Credit Data (Code). Further, as long as there were other consumer credit data related to the Appellant held by the credit reference agency, the credit reference agency was permitted to retain the Appellant’s general particulars in its database under clause 3.6.7 of the Code. When a credit reference agency provided credit reference service to the credit providers, the Appellant’s general particulars could be included in his credit report. Given that there was no prima facie evidence of any contravention by the credit reference agency, the Privacy Commissioner exercised his discretion under section 39(2)(d) of the Ordinance and paragraph 8(e) of the Complaint Handling Policy not to further investigate the Appellant’s complaint.
The Appeal
The AAB agreed with the Respondent’s interpretation of the Code whereby the credit reference agency was permitted to collect an individual’s personal data including, inter alia, his address history and contact number history as long as the credit reference agency complied with clause 3.1.1A of the Code and DPP1 regarding collection of personal data in a lawful and fair manner relating to the function or activity of the data user.
To determine whether the act of collection was relevant to the function or activity of the data user, the AAB considered that the proper way to look at the matter was whether the data might be relevant in the context of identification of the person. Having regard to the circumstances of the case, the AAB considered that the accuracy of the identification process would be enhanced if an individual’s address history and contact number history were included in the credit report, and that was enough to show that such data was relevant.
Regarding the applicability of the Code, the AAB opined that the Code was a product of prolonged processes of drafting, consultation and balancing of the interests of various stakeholders (including data users, data subjects and the credit reference agency). The AAB came to the view that so long as the relevant regulations under the Code had a reasonable and rational underlying objective, it was to be duly recognised. It would be beyond the functions of the AAB to scrutinise and amend the Code.
In addition, the AAB agreed with the Privacy Commissioner’s interpretation of clause 3.6.7 of the Code such that as long as the credit reference agency’s database retained the Appellant’s consumer credit data, it had reasonable grounds to retain the Appellant’s general particulars for identification purpose. The credit reference agency was entitled to refuse from complying with the Appellant’s request for deletion of his address history and contact number history, and there was no contravention of the Code and the requirements of the Ordinance.
The AAB’s Decision
The AAB dismissed the appeal.
(Uploaded in March 2019)