Privacy and Consent in Broker Lead Capture

Key takeaways

• Tell people what you collect and why AT the point of collection, not only in a linked policy.
• Accessing a credit report requires the consumer's express, informed consent.
• Credit reporting information carries stricter rules than ordinary personal information.
• Data you no longer need must be destroyed or de-identified.

What must a lead capture form tell someone?

Australian Privacy Principle 5 requires you to notify a person, at or before the time you collect their information, of specified matters. In practice that is a short collection notice sitting with the form, not buried behind a link.

• Who you are and how to contact you.
• Why you are collecting the information and what you will do with it.
• Who you are likely to disclose it to - lenders, your aggregator, credit reporting bodies.
• That your privacy policy explains access, correction and complaints.
• Whether the information will go overseas, and where.

The last one catches brokers using offshore processing or overseas-hosted software. If your CRM or a virtual assistant sits outside Australia, that is a disclosure you need to make.

Where do credit reporting rules apply?

Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code impose a stricter regime on credit-related information than the general APPs. The moment you move from "what is your name" to "let us check your credit file", the rules change.

The marketing row is the one brokers most often get wrong. Information obtained for a credit assessment is not automatically available to feed a marketing database.

What about data breaches and retention?

The Notifiable Data Breaches scheme requires you to assess a suspected eligible breach and, if serious harm is likely, notify affected individuals and the OAIC. A broker file is a dense concentration of identity documents, income evidence and bank statements - precisely the material that causes serious harm when it leaks.

Two practical consequences. First, retention: the longer you hold documents you no longer need, the larger the breach you can suffer. Set a schedule that reflects your record-keeping obligations under the NCCP framework and destroy or de-identify beyond it. Second, access: shared drives full of client identity documents with no access control are the most common weak point in a small brokerage.

Privacy law changes periodically and your obligations depend on your specific setup. Confirm your practices with your licensee and, for anything unusual, get your own advice.

Frequently asked questions

Do I need consent to check a client's credit report?

Yes. Accessing consumer credit reporting information requires the individual's express and informed consent, obtained before the access. A general privacy acknowledgement on a web form is not sufficient for this purpose.

Can I use enquiry data for marketing?

Ordinary contact details collected with a clear notice can generally support related marketing with an unsubscribe, subject to the Spam Act. Credit reporting information is far more restricted and should not be used to build marketing segments.

How long should a broker keep client files?

Long enough to satisfy record-keeping obligations under the credit legislation and your licensee's policy, and no longer than you have a need for it. Set an explicit schedule rather than defaulting to keeping everything forever.

What happens if a broker suffers a data breach?

Assess promptly whether it is an eligible data breach likely to result in serious harm. If it is, you must notify affected individuals and the OAIC under the Notifiable Data Breaches scheme, and tell your licensee immediately.

Related reading

• Credit Scores in Australia: Equifax, Experian and illion
• NCCP Marketing Rules: What Brokers Can and Cannot Claim
• Email Nurture for a 9-Month Buying Cycle

Sources

• Australian Privacy Principles guidelines — OAIC
• Privacy (Credit Reporting) Code — OAIC
• Notifiable Data Breaches scheme — OAIC