Bank entitled to retain fraud note and refer future lending applications

Categories:

Privacy/confidentiality, Lending,

Summary:

In 2019, Ruby experienced personal difficulties and there was an incident recorded by her bank.

In the years following, Ruby took steps to recover her financial position and maintained her commitments without further issue.

Ruby did not dispute the details of the incident, which the bank made a note of for risk management purposes. However, she became concerned about an instruction placed on her file requiring staff to refer any future loan applications she made to the bank’s fraud investigations team. She complained that this was unnecessary, given the time that had passed and her improved conduct, and she was concerned there was no mechanism to reassess the referral instruction.

Published:

August 2026

Our investigation

Banks have obligations under the Privacy Act 2020, and these include ensuring personal information is kept for only as long as is reasonably necessary for a lawful purpose. The Act does not set fixed time limits, but instead allows banks to retain information if it remains relevant to their functions, including managing risk.

We found the bank was entitled to keep a record of the incident for risk management purposes. We considered it retained the information for a lawful purpose connected to its operations. The referral instruction did not prevent Ruby from applying for a loan, nor did it pre-determine the outcome of any application. It simply required additional internal review.

We were satisfied that the bank had acted fairly towards Ruby, and that she had suffered no significant loss or inconvenience as a result of the instruction.