The High Court delivered a judgment on 7 March 2024 in
Suriati binti Mohd Yusof v CTOS Data Systems Sdn Bhd [2024] MLJU 437 holding,
inter alia, the Defendant liable for losses suffered by the Plaintiff for information in a credit report issued by the Defendant which contained inaccurate details of the Plaintiff’s financial liabilities and classified her as a ‘serious delinquent’ based on the credit scoring methodology applied by the Defendant.
More significantly, the Court also held that the Defendant is not authorised to formulate a credit score or to create its own criteria or percentage to formulate a credit score under the Credit Reporting Agencies Act 2010 (“
CRA”).
Background facts
The Plaintiff was at all material times a director and shareholder of a company.
The Defendant is a registered credit reporting agency under the CRA and is a wholly-owned subsidiary of CTOS Digital Berhad, a company listed on the Main Market of Bursa Malaysia Securities Berhad.
Sometime in 2019, the Plaintiff discovered that her application for a car loan was rejected as a result of a negative credit report issued by the Defendant. On further inquiry, the Plaintiff found out that the data collated and kept by the Defendant was inaccurate and false, thus resulting in her negative credit rating. According to the Plaintiff, the information kept by the Defendant disclosing that the Plaintiff was indebted to a company called WEBE was inaccurate as she denied owing them any money.
The Plaintiff contended that the low credit score assigned to her by the Defendant led to a loss of confidence by financial institutions. The Plaintiff found out that the credit score was based on inaccurate criteria which was not updated.
The Plaintiff further contended that both the inaccurate information and the wrong credit score resulted in her being considered as not creditworthy leading to personal and business losses.
The Defendant in its defence contended that all information given was with the consent of the Plaintiff and that any information given by the Defendant included a disclaimer stating that any information given by the Defendant was subject to verification by the parties applying for the report. The Defendant also averred that its role was merely to collate the information and it was not its duty to verify its accuracy.
The CRA
The Defendant’s main role under the CRA
The learned trial judge, Justice Dato’ Haji Akhtar bin Tahir first referred to the following definitions set out in section 2 of the CRA:
"
credit information" means any information of a customer collected by a credit provider in the course of or in connection with the providing of credit, or any record or information of a customer processed in the course of or in connection with the carrying on of a credit reporting business, and may include information as listed in the First Schedule
1;
"
credit reporting business" means a business that involves the processing of credit information for the purpose of providing a credit report to another person, whether for profit, reward or otherwise, but shall not include the processing of credit information –
| (a) |
for the purpose of discharging regulatory functions or that is required or authorized by or under any law; or |
| (b) |
by a credit rating agency2; |
"
processing", in relation to credit information, means collecting, recording, holding or storing the credit information or carrying out any operation or set of operations on the credit information, including -
| (a) |
the organization, adaptation or alteration of credit information; |
| (b) |
the retrieval, consultation or use of credit information; |
| (c) |
the disclosure of credit information by transmission, transfer, dissemination or otherwise making available; or |
| (d) |
the alignment, combination, correction, erasure or destruction of credit information; |
Based on the above provisions, the Court held that the Defendant’s main role is to collect, record, hold, and store the information received. The Court added that the Defendant is also empowered to disseminate the information to its subscribers.
Accuracy of credit report
The learned Judge then cited section 29 of the CRA which reads:
| (1) |
A credit reporting agency shall not use or further process any credit information without taking such steps as are in the circumstances reasonable to ensure that the credit information is accurate, up-to-date, complete, relevant and not misleading. |
| (2) |
A credit reporting agency shall, when undertaking a comparison of credit information within its control with any other credit information for the purpose of producing or verifying information about an identifiable customer, take such measures as are reasonably practicable to avoid the incorrect matching of the credit information. |
| (3) |
Without limiting the generality of subsection (1), a credit reporting agency shall- |
| (a) |
establish and maintain controls to ensure that, as far as is reasonably practicable, only credit information that is accurate, up-to-date, complete, relevant and not misleading is used or further processed; |
| (b) |
monitor credit information to ensure that it is accurate, up-to-date, complete, relevant and not misleading; and |
| (c) |
conduct regular checks on compliance with the controls. |
According to the learned Judge, section 29 of the CRA clearly imposes a duty upon the Defendant to verify the credit information received both for the purpose of using or processing the credit information. Thus, the Court rejected the Defendant’s contention that the recipient of the information has a duty to independently verify the credit information as unfounded and unsubstantiated.
Justice Akhtar added that the CRA was enacted to empower the credit agencies, such as the Defendant, to provide accurate credit information to facilitate financial agencies in approving and disbursing any financial aid to an applicant. Hence, the provision by the Defendant of information that is accurate is vital in the decision making of the financial institutions. The Court concluded that the Defendant therefore owed a duty of care to provide accurate credit information not only to the financial institutions but also to persons in respect of whom the information relates to.
Breach of duty
Based on the evidence adduced at the trial, the learned Judge was satisfied that the Plaintiff had notified the Defendant that the information against her was inaccurate and that the Defendant had ignored the Plaintiff’s notice and continued to maintain the information. By choosing to be indifferent even after being alerted by the Plaintiff, the Defendant had clearly breached the duty of care owed to the Plaintiff. In the Court’s view, the least the Defendant could have done was to suspend the information pending verification or notify the subscribers or applicants that the information was being verified.
Credit score
The Court found there is no provision in the CRA empowering the Defendant to formulate a credit score or to create its own criteria or percentage to formulate a credit score. The Defendant is just supposed to be a repository of the credit information to which the subscribers have access to.
The Judge added that “[
b]
y formulating a credit score the Defendant has gone beyond its statutory functions and
the Plaintiff has suffered a loss as a result of being labeled as a delinquent by the Defendant when they have no right to do so.”
The Court’s decision
Having considered the evidence adduced, the High Court held that the Defendant has breached the duty of care owed to the Plaintiff as well as overstepped the functions they were registered for. As the Court was satisfied that this had caused the Plaintiff to suffer losses, it awarded the Plaintiff a sum of RM200,000 as general damages for the personal losses suffered by her (which included damage to her reputation and the breakdown of her relationship with her husband). The Court made it clear that it did not award any damages to the Plaintiff for business losses as she was unable to prove such losses.
Comments
The Court’s findings that the Defendant had breached its duty of care to the Plaintiff turns on the facts of the case. The Court is likely to have given significant weight to the fact that the Defendant did not take any steps to verify or suspend its information on the Plaintiff after being informed by her that the information was inaccurate.
The more significant aspect of this decision is the Court’s finding that the CRA only allows the Defendant to be a repository of credit information which is accessible to their subscribers and does not empower the Defendant to formulate a credit score or create its own criteria or percentage to formulate a credit score. This finding strikes at the core of the Defendant’s business model as presently structured.
The Defendant has appealed the High Court’s decision to the Court of Appeal.
3 The Chief Executive Officer of the Defendant’s holding company has also issued a media statement that the Defendant is licensed to provide credit scoring services under the CRA.
4 According to the Defendant’s holding company, the issue relating to the formulation of a credit score was not pleaded in the Plaintiff’s statement of claim and the Defendant had not been afforded a full opportunity to be heard on the issue during the proceedings in the High Court.
5
It remains to be seen whether the Court of Appeal will uphold the interpretation given by the learned High Court Judge as to the scope of “credit reporting business” under the CRA. This may turn on the meaning that the Court of Appeal would give to the expressions “
adaptation” or “
alteration” of credit information in paragraph (a) of the definition of “processing” in section 2 of the CRA.
Case Note by Kok Chee Kheong (Partner) and Siti Ayenaa Binti Mohd Anis (Associate) of the Corporate Practice of Skrine.
1 The First Schedule contains details relating to credit information that may be provided under the CRA.
2 A “credit rating agency” refers to a person who is registered under the Capital Markets and Services Act 2007 to provide investment advice in relation to the provision of ratings for debentures.