In ‘S’ and Veda Advantage Information Services and Solutions Limited [2012] AICmr 33 the Privacy Commissioner determined that Veda Advantage Information Services and Solutions Limited (Veda)’s practice of keeping 2 separate but cross-referenced credit files for the complainant (one in her original name and one in her then married name) interfered with the complainant’s privacy by failing to take reasonable steps to ensure that the personal information contained in the complainant’s credit information file was accurate, up to date, complete and not misleading, in breach of s 18G(a) of the Privacy Act 1988 (Cth) (Privacy Act).

The Privacy Commissioner concluded that:

“During the period 2006-09, the complainant’s credit information files contained a number of duplicated credit enquiry listings, where the enquiry details varied slightly but related to the same credit enquiry (and the same credit application). I consider that, on the balance of probabilities, at least some of those credit providers accessing the complainant’s cross-referenced credit files during that period would have misunderstood the similar enquiries listing information they contained. As such, I am of the view that Veda breached s 18R(1) of the Privacy Act when it provided that information to subscriber credit providers, and that Veda has interfered with the complainant’s privacy in this respect.”

Despite the complainant’s claims that as a result of Veda’s practice, she was unable to obtain credit which, in turn, resulted in her incurring significant financial loss the Privacy Commissioner was not satisfied that the complainant was refused credit or would have been able to obtain credit on more favourable terms had the similar listings not been made.

He rejected the claim for economic loss.

However he decided that the complainant was made anxious by Veda’s practice of duplicating enquiry listings and that this stress and anxiety has spanned the substantial period of time of her complaint about Veda’s practice. He awarded her compensation in the amount of $2000 for non-economic loss .

He accepted’s Veda’s submission that it investigated the matter in accordance with its normal practice and procedures. He did not consider the way in which Veda conducted its case was “high-handed, malicious, insulting or oppressive”. He refused to award aggravated damages.

Although Veda advised of the introduction, since mid-2009, of a ‘multiple identity report’ (MIR) feature, which has ‘fundamentally changed the way in which Veda provides credit reports to approximately 90% of its credit provider subscribers’, in relation to Veda’s practice of recording similar enquiry listings, he recommended that Veda:

• develop revised training packages and user information guides for subscribers, which clearly address the issue of similar enquiry listings and how to interpret them;
• engage an independent auditor to assess Veda’s cross-referencing processes, both the MIR option and the non-MIR alternative, in compliance with s 18G(a) of the Privacy Act.