Tort: Negligence - Misrepresentation by defendant of credit information pertaining to plaintiff, leading to plaintiff's loan application being rejected due to negative report from defendant - Whether duty was on defendant and not recipient of information from defendant, to verify credit information received - Whether defendant breached duty of care to plaintiff by maintaining information pertaining to plaintiff despite being alerted that information was inaccurate - Whether defendant not empowered under Credit Reporting Agencies Act 2010 to formulate credit score or create its own criteria or percentage to formulate credit score

The defendant was tasked with collating credit reports from various sources including the Central Bank and other agencies for the purposes of dissemination to subscribers. Due to a negative report from the defendant, the plaintiff's loan application for the purchase of a car, was rejected. The plaintiff subsequently discovered that the data collected and kept by the defendant, were inaccurate and false; that the defendant had given her a low credit score leading to loss of confidence from financial institutions; and that the said credit score was based on inaccurate criteria that had not been updated. Hence the instant claim by the plaintiff for damages resulting from the defendant's negligence, breach of fiduciary duty in misrepresenting her credit rating that led to a loss of reputation, and personal as well as business losses. The defendant contended that the information given was with the consent of the plaintiff; that any information given was subject to verification by the parties applying for the report; and that its role was merely to collate the information and not to verify its accuracy.

Held (allowing the plaintiff's claim with costs):

(1) By virtue of s 29 of the Credit Reporting Agencies Act 2010 (2010 Act), the duty was on the defendant to verify the credit information received for the purpose of using or processing the credit information. The defendant's contention that the duty was on the recipient of the information to independently verify the credit information was unfounded and unsubstantiated. The defendant owed a duty of care to the plaintiff to provide accurate credit information. (paras 14-17)

(2) On the evidence, the defendant, despite being alerted by the plaintiff that the information against her was inaccurate, had chosen to ignore the communication and continued to maintain the information. The defendant had clearly breached the duty of care owed to the plaintiff by choosing to be indifferent even after being alerted by the plaintiff, and had overstepped the functions it was registered for. (paras 18-19)

(3) The defendant was merely a repository of the credit information to which subscribers had access. It was not empowered under the 2010 Act to formulate a credit score or create its own criteria or percentage to formulate a credit score. By doing so, it had gone beyond its statutory functions, thereby causing the plaintiff to suffer losses from being labelled as a delinquent by the defendant when it had no right to do so. (paras 21-22)

(4) In the circumstances, the plaintiff was entitled to be compensated for her personal losses only, and not her business losses which was not proven. (para 23)

Legislation referred to:

Credit Reporting Agencies Act 2010, s 29

Counsel:

For the plaintiff: Bryan Tan Xie Keat; M/s Goh Chin Han

For the defendant: Ashvinderjeet Kaur; M/s Kandiah Partnership

[Allowing the plaintiff's claim with costs.]

JUDGMENT

Akhtar Tahir J:

Introduction

[1] The Plaintiff's claim against the Defendant is for damages suffered as a result of the Defendant's negligence, breach of fiduciary duty in misrepresenting her credit rating leading to a loss of reputation, personal losses as well as business losses.

[2] The claim proceeded to a full trial with the Plaintiff calling 3 witnesses and the Defendant 1 witness. Apart from oral evidence, the parties also relied on the documents filed in the Bundle of Documents as well as statement of agreed facts and issue to be tried.

Brief Facts

[3] The Plaintiff was at the material time the Director and shareholder of Keranji Beach Resort Sdn Bhd ("the Resort") situated in Pulau Perhentian, Terengganu.

[4] The Defendant is a company incorporated under the Credit Reporting Agencies Act 2010 ("2010 Act") tasked with collating credit reports from various sources including the Central Bank and other agencies for purposes of dissemination to subscribers.

[5] The Plaintiff discovered sometime in May 2019 that as a result of a negative report from the Defendant her loan application for a car was rejected. Upon further inquiry the Plaintiff found out that the data collated by the Defendant and kept by the Defendant was inaccurate and false, giving her negative credit rating.

[6] One of the information kept by the Defendant which was inaccurate was related to a sum of money owed by the Plaintiff to a company called WEBE (formerly known as Packet One network SB) which the Plaintiff denied owing.

[7] Apart from inaccurate information the Plaintiff contends that the Defendant had given her a low credit score leading to loss of confidence from financial institutions. The Plaintiff found out that the credit score was based on inaccurate criteria which was not updated.

[8] Both the inaccurate information as well as a wrong credit score had resulted in the Plaintiff to be considered not creditworthy leading to personal and business losses.

[9] The Defendant in their defense contended that all information given was with the consent of the Plaintiff. Further the Defendant contends that any information given by the Defendant was with a disclaimer that any information given by the Defendant was subject to verification by the parties applying for the report. The Defendant's role was merely to collate the information and it was not the duty of the Defendant to verify its accuracy.

The 2010 Act

Business Of Credit Reporting

[10] The principle objective of the 2010 Act is to regulate the collection of credit information. What is credit information is defined as follows:

"credit information" means any information of a customer collected by a credit provider in the course of or in connection with the providing of credit, or any record or information of a customer processed in the course of or in connection with the carrying on of a credit reporting business, and may include information as listed in the First Schedule;

[11] The Defendant's role as a credit reporting agency is stated as:

"credit reporting business" means a business that involves the processing of credit information for the purpose of providing a credit report to another person, whether for profit, reward or otherwise, but shall not include the processing of credit information:

(a) for the purpose of discharging regulatory functions or that is required or authorized by or under any law; or

(b) by a credit rating agency;

[12] It is clear from the above provision that the Defendant plays dual role of collecting information and processing that information.

Processing is defined as:

"processing", in relation to credit information, means collecting, recording, holding or storing the credit information or carrying out any operation or set of operations on the credit information, including:

(a) the organization, adaptation or alteration of credit information;

(b) the retrieval, consultation or use of credit information;

(c) the disclosure of credit information by transmission, transfer, dissemination or otherwise making available; or

(d) the alignment, combination, correction, erasure or destruction of credit information;

[13] From the above provision the Defendant's main role is to collect, record, hold, and store the information received. The Defendant is also empowered to disseminate the information to its subscribers and this included financial institution. In this case the Defendant had a right to disseminate the credit information to the Small Medium Enterprise Development Bank Malaysia Sdn Bhd.

Accuracy Of Credit Report

[14] Section 29 of the 2010 Act imposes a duty upon the credit rating agency to ensure the accuracy of the credit report. The provision provides as follows:

(1) A credit reporting agency shall not use or further process any credit information without taking such steps as are in the circumstances reasonable to ensure that the credit information is accurate, up-to-date, complete, relevant and not misleading.

(2) A credit reporting agency shall, when undertaking a comparison of credit information within its control with any other credit information for the purpose of producing or verifying information about an identifiable customer, take such measures as are reasonably practicable to avoid the incorrect matching of the credit information.

(3) Without limiting the generality of subsection (1), a credit reporting agency shall:

(a) establish and maintain controls to ensure that, as far as is reasonably practicable, only credit information that is accurate, up-to-date, complete, relevant and not misleading is used or further processed;

(b) monitor credit information to ensure that it is accurate, up-to-date, complete, relevant and not misleading; and

(c) conduct regular checks on compliance with the controls.

[15] The provision above clearly imposes a duty upon the Defendant to verify the credit information received both for the purpose of using or processing the credit information. The Court therefore rules that the Defendant's contention that the recipient of the information has a duty to independently verify the credit information is unfounded and unsubstantiated.

[16] Further, the 2010 Act was enacted to empower the credit agencies like the Defendant to provide accurate credit information to facilitate financial agencies in approving and disbursing any financial aid to an applicant. Accurate information provided by the Defendant is vital in the decision making of financial institutions. The Defendant therefore had a duty of care to provide accurate credit information not only to the financial institutions but also to persons concerned against whom the information was related to.

[17] In short, the Court rules that the Defendant owed a duty of care towards the Plaintiff in providing accurate credit information.

Breach Of Duty

[18] In this case, the Plaintiff had led evidence that the Defendant was alerted that the information against her was inaccurate. The evidence in this case shows that the Defendant chose to ignore the communication from the Plaintiff and continued to maintain the said information. In the Court's view, the least the Defendant could have done was to either suspend the information awaiting verification or notify the subscribers or applicants that the information was being verified.

[19] By choosing to be indifferent even after being alerted by the Plaintiff, the Defendant had clearly breached the duty of care owed towards the Plaintiff.

Credit Score

[20] In this case the Defendant apart from giving out the credit information had also formulated a credit score based on certain criteria. The criteria includes payment history, amount owed, credit history length, credit mix and new credit. The criteria comes with their respective percentages which when added up, classifies the status of a person. In this case, using the above criteria, the Plaintiff has been classified as a serious delinquent.

[21] In the Court's view there is no provision in the 2010 Act empowering the Defendant to formulate a credit score or empowering the Defendant to create its own criteria or percentage to formulate a credit score. The Defendant is just supposed to be a repository of the credit information to which the subscribers have access to.

[22] By formulating a credit score, the Defendant has gone beyond its statutory functions and the Plaintiff has suffered losses as a result of being labeled as a delinquent by the Defendant when they have no right to do so.

[23] In the Court's view, although the Plaintiff had suffered losses, the Plaintiff could only prove personal losses but not business losses. The Plaintiff is therefore entitled to be compensated for only her personal losses.

Conclusion

[24] Based on the evidence adduced in this case the Court finds that the Defendant had breached the duty of care owed to the Plaintiff and had overstepped the functions it was registered for.

[25] This had caused the Plaintiff to suffer losses. The Court has limited the damages awarded for the personal losses suffered. The Plaintiff's reputation as well as her relationship with her husband had broken down as a result of the Defendant's negligence and breach of fiduciary duties.

[26] For the losses suffered the Court allowed the Plaintiff's claim and awarded a sum of RM200,000.00 as general damages. The Court also awarded a cost of RM50,000.00 to the Plaintiff.