Under the ASIC protocol, personal information about a prospective representative or relevant mortgage broker can only be shared with their consent.
Before requesting a reference, you must obtain written consent from a prospective representative or relevant mortgage broker for the reference(s) to be obtained.
Your obligation as a licensee to seek the consent of the individual when requesting a reference is set out in section 6 of the ASIC protocol.
Compliance with this obligation ensures that personal information is being handled consistently with the consent of a prospective representative or relevant mortgage broker, and that the collection, use, disclosure and storage of that personal information by licensees does not breach the Australian Privacy Principles contained in the Privacy Act 1988 (Privacy Act).
Under the Australian Privacy Principles (APP) guidelines (July 2019), consent must be given for a specific purpose, and information must only be collected, used and disclosed for that purpose. Information you collect under the ASIC protocol must only be used, disclosed and stored for the purpose of:
- considering either:
- a prospective representative’s suitability for employment or authorisation, or
- whether to act as an intermediary in relation to a relevant mortgage broker, and
- complying with the general conduct obligations of a licensee.
If you are an APP entity, you will also need to comply with APP 5 by notifying the prospective representative or relevant mortgage broker about the collection of their personal information.
Template consent forms
ASIC has provided template consent forms you must use when complying with the ASIC protocol: see Schedules 1 and 2 to the ASIC protocol.
If consent or a reference is refused
You will not be able to request a reference from a referee licensee(s) under the ASIC protocol if a prospective representative or relevant mortgage broker does not give you written consent to request a reference.
The prospective representative or relevant mortgage broker can also withdraw their consent at any time. Unless it is withdrawn earlier, a consent will cease 12 months after it is given: see Withdrawal and ceasing of consent.
While the ASIC protocol does not prohibit you as the recruiting licensee employing or authorising a prospective representative in these circumstances, you will need to consider, and be able to demonstrate that you complied with, your general conduct obligations as a licensee if you decide to employ or authorise the prospective representative.
The ASIC protocol also does not prohibit you employing or authorising a prospective representative if you have taken reasonable steps to request a reference and a referee licensee fails to comply with their obligation to give you a reference, or if you receive a reference that contains adverse information about the prospective representative. In these circumstances, you will similarly need to consider, and be able to demonstrate that you complied with, your general conduct obligations if you decide to employ or authorise the prospective representative.
For example, you will need to ensure that the prospective representative is adequately trained, is competent and complies with relevant legislation. This means you may need to do additional background checks or assessments before employing or authorising the individual, as well as additional monitoring and supervision after they are employed or authorised.
If you are a future mortgage intermediary, it is a matter for you to decide whether to act as an intermediary for a relevant mortgage broker where:
- the relevant mortgage broker has withdrawn their consent
- a referee licensee has failed to give you a reference about the relevant mortgage broker, or
- you receive a reference that contains adverse information about the relevant mortgage broker.
Note: RG 104 and RG 205 provide guidance on licensee obligations relating to monitoring and supervising representatives.
Withdrawal and ceasing of consent
A prospective representative or relevant mortgage broker who has previously given consent for references to be obtained may withdraw their consent in writing (including by email) at any time. You cannot then rely on their past consent to request a reference or update from a licensee under the ASIC protocol or for any future use or disclosure of their personal information.
Unless withdrawn earlier, a consent will cease 12 months after it is given.
Where consent is withdrawn (or has ceased) and the referee licensee(s) has not yet given you a reference or update, you must also provide written notice to the referee licensee(s) of that withdrawal (or cessation).
Note: The APP guidelines (July 2019) provide further information on withdrawing consent.