Privacy & The Credit Reporting Code: What They Are & Why They Matter
Australia's privacy framework, together with the credit reporting code, sets out how personal and credit information must be protected and handled.
In this explainer
- Explain how privacy law and the credit reporting code fit together
- Describe the general protections they provide
- Show why privacy matters across the whole recovery process
- List questions to ask a provider about privacy and credit data
- Describe how Merion protects personal information
7 min
What it is
Australia's privacy framework governs how organisations collect, use, store, disclose, and secure personal information, and gives people rights over their own data. The credit reporting code is an industry code that sits within that framework and adds specific rules for credit information. The OAIC oversees both.
This page is a general explainer. The privacy principles and the credit reporting code are detailed and change over time; verify the current rules with the OAIC.
Key requirements
At a general level, privacy law expects organisations to collect only what they need, be transparent about how they handle information, keep it accurate and secure, use and disclose it only for proper purposes, and give people access and correction rights. The credit reporting code adds more specific protections around credit information, including who may handle it and how.
Together they create a layered set of protections: general privacy obligations for personal information, and stricter, more detailed rules for credit information.
Why it matters for debt recovery
Recovery is information-intensive. A collector handles names, contact details, account information, and sometimes sensitive details about hardship — and may touch credit information. Mishandling any of this can breach privacy law, harm individuals, and damage the creditor. A partner with strong privacy practices protects everyone in the chain.
For a creditor, privacy maturity is one of the most important things to assess, because a breach by your partner can become your problem.
What to ask a provider
Ask: how do you collect, store, and secure personal information? How do you limit access to only what is needed? How do you handle access and correction requests? How do you treat credit information under the applicable code? How would you respond to a data breach, and would you notify us?
How Merion approaches it
Merion handles personal information carefully — collecting only what is needed, securing it, limiting access, and using it only for proper purposes — and treats credit information in line with the applicable code. We support people who want to access or correct their information. Read more in the Trust Centre. For the authoritative privacy principles and credit reporting code, consult the OAIC.
This page is general information only and is not legal advice.
Key takeaways
- Privacy law and the credit reporting code set out how personal and credit information is protected
- The OAIC oversees both; credit information attracts stricter, more detailed rules
- Recovery is information-intensive, so privacy maturity is critical when choosing a partner
- Verify the current privacy principles and credit reporting code with the OAIC
Frequently asked questions
How do privacy law and the credit reporting code relate?
The credit reporting code sits within the broader privacy framework and adds specific rules for credit information. Both are overseen by the OAIC. Verify the current detail with the OAIC.
Why is privacy so important in collection?
Because recovery handles a lot of personal information, sometimes including sensitive hardship details and credit data. Mishandling it can breach the law and harm both individuals and the creditor.
How does Merion protect personal information?
Merion collects only what is needed, secures it, limits access, uses it only for proper purposes, and treats credit information in line with the applicable code. The authoritative rules sit with the OAIC.
Security and compliance you can verify
Merion handles every account on the facts, within the rules, and with data protected by design. Ask us anything.