Can a bank keep my old credit pre-check documents after my loan was rejected?

The situation

I am writing to you from Melbourne, Victoria, because I am feeling quite uneasy about my personal data. Back in February 2023, I applied for a small personal loan of about $15,000 with a major national bank to help with some home renovations. During that application process, they performed a pre-screening assessment to see if I was eligible for the credit. However, the bank eventually sent me a letter on 15 March 2023 stating that my application had been unsuccessful and they would not be proceeding with the loan. It has now been over a year since that decision was made, and I have had no further dealings with them regarding that specific request. I recently spoke to a customer service representative on the phone to ask if they still had my assessment details on file, and they wouldn't give me a straight answer, just saying it was kept according to their internal data management programme. I have already checked their general privacy policy online, but it doesn't clarify what happens to these specific pre-screening documents once the purpose of the application is finished. I want to know if they are actually allowed to keep that assessment sitting in their system indefinitely, or if they are legally required to destroy it now that the loan process is long over and they no longer need it for that application.

Detailed Analysis

Whether the bank can keep your February 2023 pre-screening assessment for the $15,000 loan depends on two specific conditions.

Under the Privacy Act 1988, if a bank has a pre-screening assessment—which is a preliminary check to see if you qualify for credit—they have a duty to get rid of it under certain circumstances. Specifically, the law states that "the entity must destroy the assessment if: (a) the entity no longer needs the assessment for any purpose for which it may be used or disclosed under section 20H; and (b) the entity is not required by or under an Australian law, or a court/tribunal order, to retain the assessment"^[1].

This means that because your loan was rejected on 15 March 2023, the bank's original purpose for the assessment (deciding on your loan) has concluded. If they have no other valid reason to use that data for purposes allowed under section 20H^[2], and no other Australian law (such as tax or anti-money laundering laws) forces them to keep it, they are legally required to destroy it^[1].

However, the law does not settle whether the bank's 'internal data management programme' constitutes a valid reason to keep the data. It is unclear if the bank is claiming they need the data for a purpose permitted under section 20H, such as direct marketing, or if they are relying on a specific Australian law that mandates data retention for a set number of years. Because the bank has not provided a clear answer, it is impossible to say for certain if they are currently in breach of the law.

Statutory Citations

Related Questions

• Can I cancel our binding financial agreement because my ex hid his debts?
• Can I get my deposit back if the real estate agent lied about the land's zoning?
• Can my landlord refuse my rental application because of my ethnic background?
• Will my partner's visa application be stuck if they stop processing certain visas?
• Can I ask for a second review of my visa refusal through the guidance and appeals panel?