The Privacy Act 1988 significantly restricts and governs third-party information sharing in debt collection. Debt collectors and creditors must protect the privacy of debtors by ensuring that personal information is only disclosed in accordance with strict legal requirements. Before sharing any information, collectors must confirm the identity of the debtor and are prohibited from revealing details about the debt to third parties, including family members, colleagues, or employers, without explicit consent from the debtor.
Disclosure of personal information to third parties is only permitted under specific circumstances, such as when required or authorised by law, when the individual has provided express consent, or when necessary for the enforcement of a guarantee or loan management. For example, a credit provider may disclose certain credit eligibility information to a debt collector for the primary purpose of collecting overdue payments, but only limited types of information—such as identification details, court proceedings, or insolvency information—are allowed to be shared, and only when necessary for debt recovery.
The Privacy Act also imposes obligations on organisations to ensure that any third party receiving personal information, such as an external debt collection agency, upholds equivalent privacy standards. This includes taking steps to protect the information disclosed and ensuring that it is not used for purposes beyond those for which it was provided.
In summary, the Privacy Act mandates that personal information in debt collection is handled with strict confidentiality, and sharing with third parties is highly regulated and only permitted under defined legal bases, with robust safeguards to prevent misuse or unauthorised disclosure.
