PCPD - Common Questions on Sharing of Postivie Credit Data

Enquiries and Complaints

Common Questions on Sharing of Postivie Credit Data

[Image of About Your Consumer Credit Data]

[Image of Question] How can I contact the credit reference agency (CRA) to obtain my own credit report?

[Image of Answer] You may check contact details of the CRA from your credit provider and then approach it directly to obtain a copy of your own credit report. Under normal circumstances, a service charge will be incurred for using this service. Under the Code of Practice on Consumer Credit Data ("The Code"), a credit provider has the right to choose any CRA at its own discretion. However, the major CRA operating in Hong Kong is called "TransUnion Information Services Ltd" (www.transunion.hk).

[Image of Question] I am aware that residential mortgage loan data are not reportable to a CRA unless currently outstanding material default occurs. In the other way round, can a credit provider access the CRA database when it considers residential mortgage loan application?

[Image of Answer] The revised Code allows credit providers to access to the CRA database for both positive and negative data when they consider a new grant of credit. Under the Code, mortgage loan application falls within the term of 'new grant of credit', which means that a credit provider will be able to access the CRA database to obtain a credit report relating to the person who apply for a mortgage loan.

[Image of Question] I am applying for a personal loan with Bank A, of which I already have obtained a credit card facility from it. Can Bank A (1) access the CRA database to obtain a full credit report of mine? (2) make use of the same information to review my credit card facility, such as, increase my credit limit, during the 24-month transitional period?

[Image of Answer] (1) Yes. Bank A can obtain your credit report from the CRA database for the purpose of considering the grant of your personal loan application. This is the purpose for which the data are to be used.
(2) During the transitional period, the credit report obtained from (1) above will show positive and negative data about the accounts you hold. Such data so obtained should not be used to assess your credit card facility for an increase in credit limit. Restriction is placed on the use of positive data for increase in credit limit during the transitional period. The proper way for the credit provider is to make a "review" access to obtain a credit report which contains negative data only.

[Image of Question] If I act as a guarantor to my friend's loan from a bank, will the bank disclose my role as a guarantor to the CRA?

[Image of Answer]
Yes, the bank may report to a CRA the information about your capacity as a guarantor in a loan. A credit provider may provide credit data collected from the borrower, including account general data, to a CRA. As stated in Schedule 2 of the Code, account general data comprise "capacity of the individual (whether as a borrower or guarantor)".

[Image of Question] Does the Code cover the scenario of an individual being the guarantor for a corporate loan?

[Image of Answer] Yes. The definition of "consumer credit" does not restrict the purpose of the credit facility, but makes reference to the user of the facility only, i.e. whether it is granted to and for the use of an individual, or to and for the use of another person for whom an individual acts as a guarantor. As the meaning of the word "person" includes not only a natural person but also a legal person (e.g. a limited company), a corporate loan guaranteed by an individual will thus fall within the definition of "consumer credit" under the Code.

[Image of Question] Does "consumer credit" cover both secured and unsecured loans? Is it mandatory for credit providers to provide all loan account information of an individual (borrower or guarantor) to CRA?

[Image of Answer] The definition of "consumer credit" under clause 1.7 of the Code makes no distinction whether the loan is an unsecured or secured loan.
Clause 2.4 of the Code gives provision relating to the scope of data to be provided to the CRA and clause 2.4.3 makes specific provision on the account information that should not be provided.
However, pursuant to clause 2.4.3.3, account data relating to residential mortgage loan is specifically excluded from provision to the CRA unless such account data reveal a currently outstanding material default, in which case, the credit provider may provide to the CRA the account general data together with the default data relating to such material default.
Clause 2.4 says "... it may thereafter provide....". In other words, the requirement is not mandatory from the sense of the Code. It is entirely a matter for the credit provider to agree with the CRA on the types of loan products subject to the arrangement within the boundary of the Code. The Code sets the ground rules on what can or cannot be provided and shared in respect of consumer credit data and the provisions thereby followed by credit providers so that they are in compliance with the Personal Data (Privacy) Ordinance.

[Image of Question] If the applicant is already an existing customer, is the bank still required to give him/her notification when he/she applies for a new loan (clause 2.1) after the effective date of the revised Code?

[Image of Answer] The Revised Code takes effect on 2 June 2003. From that day onwards, the usage of consumer credit data is governed by the Revised Code. It is therefore good practice for credit providers to take all reasonably practicable steps to inform their customers as soon as practicable of the use and/or transfer of the data as well as their rights under the Revised Code.

[Image of Question] Upon termination of an account with material default, is the bank still required to notify him/her of the right to have the terminated account data deleted, although he/she is not qualified to do so?

[Image of Answer] Pursuant to clause 2.3 of the Code, it is a recommended practice for a credit provider to give the notification to the individual concerned upon account termination. The notification is to inform the individual of his right (on condition that certain conditions are satisfied) to instruct the credit provider to make a request to the CRA to delete from its database any account data relating to the terminated account. Insofar as the notification is concerned, it does not matter whether or not the individual actually has the right to make the request (i.e. whether he satisfies the conditions or not).

[Image of Question] According to clause 2.14 of the Code, is a bank required to notify both the borrower and the guarantor before obtaining their credit reports for a review purpose? Can the bank only notify the borrower although it is obtaining both of their credit data?

[Image of Answer] Clause 2.14 of the Code requires a credit provider to take such steps as may be reasonably practicable to give the individual concerned a notification of access for review. Hence, if it is the borrower¡¦s data that is to be accessed for the purpose of a review, notification should be given to him. If the credit provider intends to make a review access on the credit data of both the borrower and guarantor, the credit provider should notify both of them before making the access.

[Image of Question] According to clause 2.14 of the Code, prior notification is required when a credit provider access the consumer credit data of an individual held by a CRA for the purpose of the review of existing consumer credit facilities. Is a notification letter suffice for this requirement?

[Image of Answer] According to clause 2.14 of the Code, where a credit provider accesses the consumer credit data of an individual held by a CRA for the purpose of the review of existing consumer credit facilities (whether within or outside the transitional period): the credit provider shall, before making such access, take such steps as may be reasonably practicable in the circumstances to notify the individual of the fact that his data are being so accessed upon the review of his existing consumer credit facilities; and the specific matter or matters, as provided for in clause 2.9.3, 2.9.4 or 2.9.5, to be considered by the credit provider upon such a review, except that no such notification by the credit provider shall be necessary where the review of existing consumer credit facilities has been initiated by a request from the individual; or where there is in place, at the time of the access, a loan restructuring arrangement in relation to debts owned by the individual to the credit provider.
The Code does not specify the means of delivering the notification under clause 2.14 by the credit providers. So long as the credit providers have taken practicable steps to inform the individual of the matters mentioned in clauses 2.14.1.1 and 2.14.1.2, it appears that the aforementioned requirements have been complied with.

[Image of Question] Pursuant to clause 2.15 of the Code, the credit provider should notify the individual as soon as reasonably practicable if the borrower's request for deletion of data after account termination is rejected, on the basis that any one of the conditions is not satisfied. In this case, can the bank notify the borrower that his request has been rejected verbally?

[Image of Answer] Clause 2.15 of the Code requires a credit provider to act on the instruction of the data subject for deletion of his account data from the CRA upon satisfying two conditions. It is also provided that in case any of the said conditions not being satisfied, the credit provider shall "notify the individual as soon as reasonably practicable its rejection of the instructions and the reasons for such rejection." The clause does not expressly require a written notification to be given under such circumstances. However, for the purpose of proof, it would certainly be advantageous if written notification is given.

[Image of Question] If the loan is guaranteed by a third party, should the borrower put forward the request for deletion of terminated account data together with the guarantor?

[Image of Answer] Clause 2.15 of the Code requires a credit provider to entertain the request from the account bearer. The fact that the relevant facility is guaranteed would not make the guarantor one of the account holders as referred to in clause 2.15 and would not therefore render his instruction a pre-requisite for deletion of account data relating to the borrower.

[Image of Question] According to clause 2.15 of the Code, does a guarantor have the right to ask the bank to instruct the CRA to delete the terminated account data from his file?

[Image of Answer] The right provided for in clause 2.15 refers to the individual to whom the account relates, namely, the borrower. The fact that a credit facility is guaranteed does not by itself give the guarantor the right to request deletion of data from the CRA after account termination. However, when the guarantor steps into the shoes of the borrower, say due to crystallization of the contingent liability, a separate account relationship with the credit provider may then be created. Thereafter, the guarantor shall enjoy all the rights that an individual borrower may have under the Code, including the right to request deletion of data from the CRA upon account termination by full repayment.

Download the Code of Practice on Consumer Credit Data (Revised on June 2003)

End of Page

[Complaint Handling Policy] [Common Questions] [Games] [Personal Information Collection Statement]

[About PCPD] [The Ordinance] [Review of the Ordinance] [PCPD Activities] [Information Centre] [Privacy Zone for Youngsters]
[Publications & Videos] [Enquiries & Complaints] [Case Notes] [Contact Us] [Search] [Site Directory] [Graphical Version]
[Chinese Version]

[Image of Question]	How can I contact the credit reference agency (CRA) to obtain my own credit report?
[Image of Answer]	You may check contact details of the CRA from your credit provider and then approach it directly to obtain a copy of your own credit report. Under normal circumstances, a service charge will be incurred for using this service. Under the Code of Practice on Consumer Credit Data ("The Code"), a credit provider has the right to choose any CRA at its own discretion. However, the major CRA operating in Hong Kong is called "TransUnion Information Services Ltd" (www.transunion.hk).

[Image of Question]	I am aware that residential mortgage loan data are not reportable to a CRA unless currently outstanding material default occurs. In the other way round, can a credit provider access the CRA database when it considers residential mortgage loan application?
[Image of Answer]	The revised Code allows credit providers to access to the CRA database for both positive and negative data when they consider a new grant of credit. Under the Code, mortgage loan application falls within the term of 'new grant of credit', which means that a credit provider will be able to access the CRA database to obtain a credit report relating to the person who apply for a mortgage loan.

[Image of Question]	I am applying for a personal loan with Bank A, of which I already have obtained a credit card facility from it. Can Bank A (1) access the CRA database to obtain a full credit report of mine? (2) make use of the same information to review my credit card facility, such as, increase my credit limit, during the 24-month transitional period?
[Image of Answer]	(1) Yes. Bank A can obtain your credit report from the CRA database for the purpose of considering the grant of your personal loan application. This is the purpose for which the data are to be used. (2) During the transitional period, the credit report obtained from (1) above will show positive and negative data about the accounts you hold. Such data so obtained should not be used to assess your credit card facility for an increase in credit limit. Restriction is placed on the use of positive data for increase in credit limit during the transitional period. The proper way for the credit provider is to make a "review" access to obtain a credit report which contains negative data only.

[Image of Question]	If I act as a guarantor to my friend's loan from a bank, will the bank disclose my role as a guarantor to the CRA?
[Image of Answer]	Yes, the bank may report to a CRA the information about your capacity as a guarantor in a loan. A credit provider may provide credit data collected from the borrower, including account general data, to a CRA. As stated in Schedule 2 of the Code, account general data comprise "capacity of the individual (whether as a borrower or guarantor)".

[Image of Question]	Does the Code cover the scenario of an individual being the guarantor for a corporate loan?
[Image of Answer]	Yes. The definition of "consumer credit" does not restrict the purpose of the credit facility, but makes reference to the user of the facility only, i.e. whether it is granted to and for the use of an individual, or to and for the use of another person for whom an individual acts as a guarantor. As the meaning of the word "person" includes not only a natural person but also a legal person (e.g. a limited company), a corporate loan guaranteed by an individual will thus fall within the definition of "consumer credit" under the Code.
[Image of Question]	Does "consumer credit" cover both secured and unsecured loans? Is it mandatory for credit providers to provide all loan account information of an individual (borrower or guarantor) to CRA?
[Image of Answer]	The definition of "consumer credit" under clause 1.7 of the Code makes no distinction whether the loan is an unsecured or secured loan. Clause 2.4 of the Code gives provision relating to the scope of data to be provided to the CRA and clause 2.4.3 makes specific provision on the account information that should not be provided. However, pursuant to clause 2.4.3.3, account data relating to residential mortgage loan is specifically excluded from provision to the CRA unless such account data reveal a currently outstanding material default, in which case, the credit provider may provide to the CRA the account general data together with the default data relating to such material default. Clause 2.4 says "... it may thereafter provide....". In other words, the requirement is not mandatory from the sense of the Code. It is entirely a matter for the credit provider to agree with the CRA on the types of loan products subject to the arrangement within the boundary of the Code. The Code sets the ground rules on what can or cannot be provided and shared in respect of consumer credit data and the provisions thereby followed by credit providers so that they are in compliance with the Personal Data (Privacy) Ordinance.
[Image of Question]	If the applicant is already an existing customer, is the bank still required to give him/her notification when he/she applies for a new loan (clause 2.1) after the effective date of the revised Code?
[Image of Answer]	The Revised Code takes effect on 2 June 2003. From that day onwards, the usage of consumer credit data is governed by the Revised Code. It is therefore good practice for credit providers to take all reasonably practicable steps to inform their customers as soon as practicable of the use and/or transfer of the data as well as their rights under the Revised Code.
[Image of Question]	Upon termination of an account with material default, is the bank still required to notify him/her of the right to have the terminated account data deleted, although he/she is not qualified to do so?
[Image of Answer]	Pursuant to clause 2.3 of the Code, it is a recommended practice for a credit provider to give the notification to the individual concerned upon account termination. The notification is to inform the individual of his right (on condition that certain conditions are satisfied) to instruct the credit provider to make a request to the CRA to delete from its database any account data relating to the terminated account. Insofar as the notification is concerned, it does not matter whether or not the individual actually has the right to make the request (i.e. whether he satisfies the conditions or not).
[Image of Question]	According to clause 2.14 of the Code, is a bank required to notify both the borrower and the guarantor before obtaining their credit reports for a review purpose? Can the bank only notify the borrower although it is obtaining both of their credit data?
[Image of Answer]	Clause 2.14 of the Code requires a credit provider to take such steps as may be reasonably practicable to give the individual concerned a notification of access for review. Hence, if it is the borrower¡¦s data that is to be accessed for the purpose of a review, notification should be given to him. If the credit provider intends to make a review access on the credit data of both the borrower and guarantor, the credit provider should notify both of them before making the access.
[Image of Question]	According to clause 2.14 of the Code, prior notification is required when a credit provider access the consumer credit data of an individual held by a CRA for the purpose of the review of existing consumer credit facilities. Is a notification letter suffice for this requirement?
[Image of Answer]	According to clause 2.14 of the Code, where a credit provider accesses the consumer credit data of an individual held by a CRA for the purpose of the review of existing consumer credit facilities (whether within or outside the transitional period): the credit provider shall, before making such access, take such steps as may be reasonably practicable in the circumstances to notify the individual of the fact that his data are being so accessed upon the review of his existing consumer credit facilities; and the specific matter or matters, as provided for in clause 2.9.3, 2.9.4 or 2.9.5, to be considered by the credit provider upon such a review, except that no such notification by the credit provider shall be necessary where the review of existing consumer credit facilities has been initiated by a request from the individual; or where there is in place, at the time of the access, a loan restructuring arrangement in relation to debts owned by the individual to the credit provider. The Code does not specify the means of delivering the notification under clause 2.14 by the credit providers. So long as the credit providers have taken practicable steps to inform the individual of the matters mentioned in clauses 2.14.1.1 and 2.14.1.2, it appears that the aforementioned requirements have been complied with.
[Image of Question]	Pursuant to clause 2.15 of the Code, the credit provider should notify the individual as soon as reasonably practicable if the borrower's request for deletion of data after account termination is rejected, on the basis that any one of the conditions is not satisfied. In this case, can the bank notify the borrower that his request has been rejected verbally?
[Image of Answer]	Clause 2.15 of the Code requires a credit provider to act on the instruction of the data subject for deletion of his account data from the CRA upon satisfying two conditions. It is also provided that in case any of the said conditions not being satisfied, the credit provider shall "notify the individual as soon as reasonably practicable its rejection of the instructions and the reasons for such rejection." The clause does not expressly require a written notification to be given under such circumstances. However, for the purpose of proof, it would certainly be advantageous if written notification is given.
[Image of Question]	If the loan is guaranteed by a third party, should the borrower put forward the request for deletion of terminated account data together with the guarantor?
[Image of Answer]	Clause 2.15 of the Code requires a credit provider to entertain the request from the account bearer. The fact that the relevant facility is guaranteed would not make the guarantor one of the account holders as referred to in clause 2.15 and would not therefore render his instruction a pre-requisite for deletion of account data relating to the borrower.
[Image of Question]	According to clause 2.15 of the Code, does a guarantor have the right to ask the bank to instruct the CRA to delete the terminated account data from his file?
[Image of Answer]	The right provided for in clause 2.15 refers to the individual to whom the account relates, namely, the borrower. The fact that a credit facility is guaranteed does not by itself give the guarantor the right to request deletion of data from the CRA after account termination. However, when the guarantor steps into the shoes of the borrower, say due to crystallization of the contingent liability, a separate account relationship with the credit provider may then be created. Thereafter, the guarantor shall enjoy all the rights that an individual borrower may have under the Code, including the right to request deletion of data from the CRA upon account termination by full repayment. Download the Code of Practice on Consumer Credit Data (Revised on June 2003)