The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

Seeing Your Credit Rating

The Credit Referencing System in Ireland

Do you know your credit rating? Are you aware that the record of your dealings with your financial institution may be passed onto other financial institutions? Do you know how the system of credit referencing works, or how to go about seeing your own credit rating? This section will provide some details on this subject, and show you how to exercise your data protection rights in this area.

Background: The development of credit referencing in Ireland

For most people today, credit has become central to their way of life. There are very few who do not have some form of "credit agreement" - be it a mortgage, personal loan, leasing contract or hire-purchase agreement. Public opinion surveys commissioned by the Data Protection Commissioner reveal that people attach considerable importance to the privacy of their financial history and credit details.

The principal credit reference agency in Ireland is the Irish Credit Bureau Limited (ICB) which was established in 1965 by a number of financial institutions. The stated objectives of these institutions in establishing the ICB were -

to assist in lowering the cost of credit, enable faster decision making in the provision of credit, and aid in the avoidance of over-indebtedness of its members' customers.

The information which is held on the ICB database relates to credit agreements between these ICB members and their customers. A condition of such agreements is that the customer agrees that the financial institution may use the data supplied for the purpose of credit checking. Consequently, where an individual enters a credit agreement with an ICB member, details of the individual's performance in complying with the terms of the agreement are input to the ICB "credit file" database, which may be accessed by all member institutions of ICB. Each time a person applies for credit from an ICB member, that institution accesses the ICB's "credit file" to ascertain the applicant's performance under any previous credit agreements with ICB members.

The Data Protection Act provides individuals with important rights to ensure that their data are accurate and are used appropriately. However, for individuals to be in a position to exercise these rights effectively, they naturally need to be conscious of the degree to which their personal data are being kept, and to have some practical understanding of how the credit referencing system operates. To see what a credit record actually looks like, click to see a sample "credit file" record showing the credit history of a fictitious individual. This is the type of record an individual would receive from ICB in response to an access request under the Data Protection Act.

Back to Menu

Member Institutions of the Irish Credit Bureau Limited

Click here to view the current members of the Irish Credit Bureau.

Back to Menu

How to see your own credit record

Section 4 of the Data Protection Acts, 1988 & 2003, provides a general "right of access" for an individual to all information kept about him or her on computer or in structured manual files.

A person wishing to avail of this provision to access their ICB credit record should contact the ICB at the address -Irish Credit Bureau, Newstead, Clonskeagh Road, Dublin 14. Tel. (01) 260 0388. It is also possible to apply online at www.icb.ie.

When making an access request to the ICB or to any data controller, a person should supply such information as the data controller may reasonably require to satisfy itself of the person's identity (e.g. name, address, customer account number) and to assist it in locating relevant data held. The ICB receives up to 900 access requests a month, and it is their practice to request individuals to complete a standard access application form, which can be found on the ICB site www.icb.ie.

Back to Menu

Correcting your credit record

Under the Data Protection Acts, you can demand that any inaccurate information about you, should be corrected. If your ICB credit record is inaccurate, you can demand that it be put right, either by changing any inaccurate details on the record, or by adding a note that puts the information in a proper context.

Back to Menu

Freedom from automated decision making

Important decisions about your creditworthiness may not be made solely by computer or automated means unless you consent to this. Generally speaking, there has to be a human input to such decisions.

Back to Menu

Some Case Studies relevant to this topic

The following Case Studies, which have appeared in Annual Reports of the Data Protection Commissioner over recent years, may be of some interest. Click on the Case Study details to see the full text.

CASE STUDY 4/00 - Financial institutions – Irish Credit Bureau – credit referencing – incompatible disclosure – "close matches"

CASE STUDY 6/99 - financial institution - inaccurate credit rating - rectification - notification of third parties to whom incorrect data had been released

CASE STUDY 7/99 - debt collection service - acting on behalf of hospital - whether data had been "disclosed" for purposes of Data Protection Act - whether debt-collecting agency is entitled to build database of debtors

CASE STUDY 3/98 - joint bank account - issue of accuracy - disclosure - right of access

CASE STUDY 4/98 - credit record - issue of accuracy - review of credit referencing computer system

CASE STUDY 6/98 - local authority housing loan - disclosure of personal data by a local authority to a financial institution - whether such data are in the public domain - statutory discretion to make personal data publicly available does not take precedence over data protection law

CASE STUDY 8/98 - bank account details - disclosure to a person listed as a "disclosee" in the bank's entry in the Register of Data Controllers - Register entry not conclusive as to compliance with data protection principles

CASE STUDY 2/97 - data about two people combined in one record kept by a credit referencing agency – issue of accuracy

CASE STUDY 4/97 - "small print" on application forms – inadequate for fair obtaining

CASE STUDY 8/97 - credit record indicated that borrower had faced litigation and loan had been partly written off – issue of accuracy – previous concerns about fair obtaining revived

CASE STUDY 2/96 - a customer disputed his credit rating by a financial institution – issue of accuracy – the rating as understood by the institution

CASE STUDY 11/96 - disclosure to a bank by a credit referencing agency – adequacy of information supplied by the bank when making enquiry – how the credit referencing agency dealt with the enquiry

Back to Menu