Page:Unauthorised Access to Credit Data in the TE Credit Reference System.pdf/10

 The Code of Practice on Consumer Credit Data ("the Code") was issued for the purpose of providing practical guidance with respect to any requirements under the Ordinance imposed on data users. In particular, paragraphs 3.3, 3.3.1, 3.3.2, 3.4A and 3.4B of the Code specify the retention period of account repayment data (including account repayment data revealing or not revealing material default ) in the credit reference agency's database. In case of material default, the credit reference agency can only retain the account repayment data in its database up to five years either from the date of final settlement of the amount in default or from the date of the individual's discharge from bankruptcy, whichever is earlier.

Softmedia stated that for a borrower to delete credit data from the TE Credit Reference System, it must first establish that the borrower (i) has completed all repayments and (ii) at least five years have passed from the date of final settlement of the debt. If these conditions are satisfied, the borrower may request the money lending company to notify Softmedia to delete the relevant credit data, but Softmedia will not proactively delete the credit data from the TE Credit Reference System.

Softmedia confirmed that the TE Credit Reference System holds over 50,000 credit records of which at least five years have passed from the date of final settlement of the debt.

The Commissioner understands that the industry has to use this material default information to assess whether to grant loans, and the absence of such payment information may impair the ability of money lending companies to assess a borrower's financial situation. Nevertheless, such consideration should not be a reason for indefinite retention of a borrower's credit record by a credit reference agency which is noncompliant with the requirements of Data Protection Principle 2(2). Softmedia must therefore set a retention period for credit data if repayments have been completed, and such data cannot be retained indefinitely.