The Malaysian Credit Reporting Agencies Act comes into force

Prior to the enforcement of the CRA Act, there were no specific controls over the activities of credit reporting agencies in collecting and processing credit information. Such unsupervised processing activities caused individuals inconvenience and even hardship, especially when inaccurate details regarding their creditworthiness were provided to banks which these individuals had approached for loans. The coming into force of the CRA Act, therefore, is very much welcomed by business institutions and consumers alike.

The Credit Reporting Agencies Act: The CRA Act provides that all credit reporting agencies are required to be registered under the Act to be allowed to carry on a credit reporting business. However, exemption is given to the Central Credit Reference Information System, as that is supervised by the Central Bank of Malaysia, otherwise known as Bank Negara Malaysia. It should also be noted however that any information which is processed by a credit reporting agency for the purpose of a credit reporting business will not be subject to the Personal Data Protection Act 2010.

The formalities: An application for registration of a credit reporting agency will need to be submitted, accompanied by the company’s statutory forms, latest audited accounts and any other information or documents which the Registrar deems necessary.

Credit reporting agencies are now required to have and maintain a minimum paid-up capital of MYR1 million or other amount prescribed by the Minister. Agencies which do not meet such requirement may carry on the credit reporting business only with the written consent of the Registrar.

The restrictions: The CRA Act places several restrictions in collecting and processing data. For instance, credit reporting agencies are restricted from collecting any credit information on any individual or company unless, the collection of such information is related to the activities of the credit reporting agencies; and the information collected is adequate, and not excessive.

The information: It is also imperative for a written notice to be given to customers1 on the processing of credit information informing them of the following, namely, (1) that the credit information is being processed together with the description of such information; (2) the purpose for processing the credit information; (3) the source of the information; (4) the contact details of the credit reporting agencies to facilitate the customer’s right to access and request correction of the credit information; (5) the subscribers2 or other persons to whom the credit reporting agencies may disclose the credit information; (6) the choices and means offered by the credit reporting agencies to customers on how to limit the processing of credit information; (7) whether it is obligatory or voluntary for customers to supply the credit information, (8) consequences for failure to supply such information; and (9) a summary of the customer’s rights.

Only subscribers have access to credit information collected and processed by the credit reporting agency. However, the obligation is placed on them to ensure that appropriate measures are taken to safeguard the credit information received. Security and accuracy of information processed by the credit reporting agency are important, bearing in mind the numerous complaints received by customers regarding misleading information provided by the credit reporting agency. Thus, the CRA Act requires credit reporting agencies to take practical steps to protect the credit information from any loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction by providing sufficient guarantees in respect of the technical and organisational security measures governing the processing to be carried out and by taking reasonable steps to ensure compliance with those measures.

The CRA Act also makes it mandatory for credit reporting agencies to ensure that credit information is accurate, up-to-date, complete, relevant and not misleading. Thus, any information which is found to be inaccurate, not up-to-date, incomplete, irrelevant or misleading may be corrected by the requestor or customer by way of writing to the credit reporting agencies in which the agencies are obligated to take steps to correct such information.

Conclusion: Credit reporting agencies play a vital role in promoting market efficiency in Malaysia, thus the passing of such a legislation to regulate credit reporting agencies is imperative and very much warranted. It is hoped however that the enforcement of the CRA Act is carried out by ensuring that the Registrar fulfills his duties by closely monitoring the conduct of all credit reporting agencies.

Endnotes
1. “Customer” means any person who is applying for credit from, or who has been granted credit by, a credit provider and who is the subject of the credit information.
2. “Subscribers” refer to persons who have entered into a subscriber agreement with the credit reporting agencies.