PCPD - Privacy Commissioner's Finding against HSBC was set aside by the Administrative Appeals Board

Date: 29 June 2010

Privacy Commissioner's Finding against HSBC was set aside by the Administrative Appeals Board

Background

1.    The Privacy Commissioner for Personal Data (“the Commissioner”) had issued a Code of Practice on Consumer Credit Data (“the Code”) which seeks to regulate the business activities of Credit Reference Agencies (“CRA”) and credit providers (banks, financial institutions, etc.).

2.    A CRA operates a central credit database which collects individuals’ financial information provided by its member subscribers who are credit providers and in return supply them at their request the processed credit data.

3.    The Code, by giving guidance on how credit providers may properly share and access consumer credit data, seeks to strike a balance between protection of individuals’ privacy right in relation to their credit data and “the need to know” on the part of credit providers in their lending business. It is a compromise which has generally worked well in the past.

4.    The Code permits a credit provider to access the consumer credit data held by a CRA to review existing consumer credit facilities granted to an individual or monitor the indebtedness of the individual when there is currently a default by the individual as the borrower. The word “review” means consideration by the credit provider of an increase in the credit amount; the curtailing of the credit (including the cancellation of credit or a decrease in credit amount); or putting in place or the implementation of a scheme of arrangement with the individual.

The Complaint

5.    The Complainant who held credit cards issued by HSBC discovered that HSBC had accessed his consumer credit data on a monthly basis without his knowledge. He felt his personal data privacy had been violated and consequently lodged a complaint with the Commissioner.

6.    The Complainant had not been in default with his payments nor had he asked for any increase of credit limit, renewal of credit facilities, preferential program or loan restructuring.

7.    HSBC admitted that it had been pursuing a monthly credit monitoring exercise (the said practice), not only on the complainant but also on all its customers who have existing credit facilities. The data collected were analyzed by HSBC’s automated system to generate a risk profile (or score) that would alert HSBC which can then increase, decrease or cancel individual customers’ credit facilities.   HSBC claimed that it had given notification to its customers of the credit monitoring exercise in the regular credit card statements.

The Commissioner’s Decision

8.    The Commissioner considered the said practice amounted to conducting credit surveillance and monitoring the Complainant’s credit data, neither of which was permitted under the Code (see para 3 above). Hence he viewed the collection of the Complainant’s credit data by HSBC as unnecessary and excessive (a contravention of Data Proteciton Principle 1(1)).

9.    Inasmuch as HSBC’s main objective was not to review the Complainant’s credit facilities as stated (in small print) in one of its credit card statements to the Complainant, the Commissioner considered HSBC’s notification misleading. Hence he took the view that the means of collection of the Complainant’s credit data was unfair (a contravention of Data Protection Principle 1(2)).

10.    The Commissioner issued an Enforcement Notice requiring HSBC to cease the said practice; destroy all credit data obtained from the CRA about the Complainant as well as other customers through the said practice.

11.    HSBC appealed to the Administrative Appeals Board (“AAB”) against the Commissioner’s decision.

AAB’s Decision

12.    On 3 June 2010, the AAB decided by a two-third majority to allow the appeal and set aside the Enforcement Notice on the ground that HSBC had not contravened any Data Protection Principles.

13.    However, one member of the AAB accepted the Commissioner’s views that it was wrong for HSBC to freely access its customers’ information without restriction and use same to pursue its own business interests in minimizing its overall credit exposure to risk without due regard to the Code.

14.    The other two members disagreed and held that employing the automated system as a way to review the Complainant’s credit facilities fell within the meaning of the Code even though it was not so direct as the traditional manual way of review. Although the reviews were so frequent that it became a monitoring exercise, it did not take away the character of reviewing the complainant’s credit facilities for the purpose mentioned in the notification i.e. increasing, decreasing or canceling credit amounts. In fact, the Complainant’s credit card amount was increased in September 2005. Also, it was not wrong for HSBC to undertake regular risk-based assessments and reviews of all credit facilities which was a lawful purpose directly related to a function and activity of HSBC. The method employed by HSBC through the automated system required such a large amount of information to do the analysis and for that reason, it could not be said that its collection of personal data was excessive.

15.    These two members also accepted that the collection of credit data was not unfair or unlawful or excessive given that HSBC had considered it effective to use the behavioral credit method which involved the collection of a large amount of personal credit data.

The Commissioner’s Perspective

16.    The Commissioner had made his decision from the perspective of a privacy regulator seeking to protect bank customers’ personal data privacy. He had wanted to restrict access to the positive consumer credit data within what he considered was the limits under the Code. The AAB’s dissenting view lent support to his decision.

17.    The Commissioner noted that AAB’s decision was made on the specific facts and circumstances of the Complainant’s case, including the fact that his credit facilities had been increased by HSBC during the period. As there are other similar complaints with different facts and circumstances in the pipeline, the differing views expressed by AAB in this Appeal may well be tested in a future appeal.

The Way Forward

18.    The Commissioner wishes to remind the public that a credit report is important to them and they should be aware of their rights under the Code. They can obtain their own credit reports from the CRA to check the accuracy of their credit data, who has accessed their personal data and the frequency of such access. Members of the public may ascertain the policy of access to their credit reports adopted by different banks before entering into relationships with them.

19.    Given the sensitive nature of consumer credit data and that the CRAs maintain and process credit data of millions of people regularly, it is in the public interest to ensure that its personal data system is safe and operating in compliance with the law. For that reason, the Commissioner had decided in March this year to carry out an inspection of the personal data system operated by a major CRA. The inspection is currently in progress.

END

Click here to view the AAB's decision