Credit bureau Veda will refund consumers who paid for credit reports after it was found to have breached privacy rules in its marketing of the reports.In response to three separate complaints from a number of consumer advocates, the Privacy Commissioner found that Veda breached the Credit Reporting Code when it failed to prominently state that individuals have the right to obtain a free credit report in certain circumstances and also when it failed to take reasonable steps to ensure that free access to credit reports was as available and as easy to identify as paid access to reports.Veda disclosed personal information it held about individuals seeking free access to credit reports for the purpose of direct marketing, in breach of Australian Privacy Principle 7.And it charged for "expedited delivery" of a credit report in a circumstance where the individual had not sought access within the preceding 12-month period, which was also a breach.According to the Credit Reporting Code, which forms part of the Privacy Act, a credit reporting body providing information about a fee-based service must prominently state that individuals have a right to obtain credit reporting information free of charge in the following circumstances: if the access request relates to a credit provider's decision to refuse a credit application; if the access request relates to a decision by a credit reporting body or credit provider to correct credit repotting information about the individual; and once every 12 months.The credit reporting body must take reasonable steps to ensure that its service, whereby individuals may obtain their credit reporting information free of charge, is as available and easy to identify and access as its fee-based service.Three representative complaints were lodged with the Privacy Commissioner in 2014. Some of the issues raised in the complaints included the fact that consumers could arrange for a fee-based report over the phone but had to apply via the website for a free report, and that the identification requirements are more onerous for a free report than for a fee-based report.The complainants said Veda was not meeting the deadline for delivery of free reports and that the cost of fee-based access was excessive.In a decision issued last week, the Privacy Commissioner said that Veda, to its credit, had taken some steps towards improving the promotion and delivery of its free service since the complaints were lodged.However, the commissioner found that Veda continued to engage in conduct that constituted an interference with the privacy of the complainants.Over the next six months Veda must take action to ensure its free service is as available and easy to access as its fee-based service and it must refund individuals the cost of the expedited delivery charge in circumstances where those individuals had not sought access to credit reporting information within the preceding 12 months.It is the second time in two months that Veda has been ruled to have breached the Privacy Act. Last month it was ordered to apologise to a consumer and pay compensation for using false credit reporting