Can a private debt collection agency legally get my bank details from my lender?

The situation

I am writing to seek some guidance regarding a situation here in Victoria. About three weeks ago, on the 14th of October, I was contacted by a small, private debt collection agency called 'QuickRecover'. They claimed that I owed a former landlord $1,250 for some unpaid rent from a tenancy that ended last year. I have already checked my own records and I am certain that I have paid every cent of that amount, including the bond. When I told the agent over the phone that I didn't owe anything, they became quite aggressive. They told me they had already managed to get my recent credit eligibility information and bank transaction history directly from my primary bank to prove I have the funds to pay. I am extremely confused because I never gave this agency permission to talk to my bank, and I certainly didn't sign any paperwork allowing them to access my private financial history. I tried calling my bank to see if they had shared anything, but they just told me they couldn't discuss my account over the phone. Is it actually legal for a random company like this to go straight to my bank and grab my private credit details just because they think I owe them money?

Detailed Analysis

Under the Privacy Act 1988, there are strict rules about how 'credit eligibility information'—which is information used to assess whether someone can meet a credit obligation—is handled.

Regarding 'QuickRecover' and their claim to have obtained your bank transaction history, the law is very specific about who can get this data. Section 24A states that an entity commits an offence if "the entity obtains credit eligibility information; and... the entity is not: (i) an entity to which the provider is permitted to disclose the information... or (ii) an access seeker for the information"^[1]. This means if the agency is not a permitted recipient, they have broken the law by obtaining that data.

There is a narrow exception for debt collectors. Section 21M allows a credit provider to disclose information to a person who "carries on a business or undertaking that involves the collection of debts on behalf of others"^[2]. However, this permission is limited to specific types of information, such as your identification, court proceedings, or default information^[2]. It does not automatically grant them a 'blank cheque' to view your entire bank transaction history or recent credit eligibility details just because they believe you owe a debt.

If QuickRecover obtained your transaction history through 'false pretence'—which means using a trick or a lie to get the information—they may have committed a criminal offence^[1].

It is uncertain whether the information they claim to have is actually 'credit eligibility information' as defined by the Act, or if they are misrepresenting what they have accessed to intimidate you. Furthermore, the law does not settle whether a private landlord (who is not a 'credit provider') can authorize a debt collector to access your bank records through a third party.

Statutory Citations

Related Questions

• Can my bank be held responsible for how they shared my private details?
• Can the court force my bank to take over my ex's personal loan?
• Can the Privacy Commissioner force me to hand over my company records regarding a data leak?