(2) A person must not:
(a) in the course of trade or commerce:
(i) between Australia and places outside Australia; or
(ii) among the States; or
(iii) between a State and a Territory; or
(iv) among the Territories; or
(b) in the course of banking (other than State banking not extending beyond the limits of the State concerned); or
(c) in the course of insurance business (other than insurance business relating to State insurance not extending beyond the limits of the State concerned); or
(d) in a Territory;
carry on a credit reporting business unless the person is a corporation.
(3) A person must not act on a corporation's behalf in the course of carrying on a credit reporting business unless the person is a corporation.
(4) A person who knowingly or recklessly contravenes this section is guilty of an offence punishable, on conviction, by a fine not exceeding $30,000.
(2) A person must not:
(a) in the course of trade or commerce:
(i) between Australia and places outside Australia; or
(ii) among the States; or
(iii) between a State and a Territory; or
(iv) among the Territories; or
(b) in the course of banking (other than State banking not extending beyond the limits of the State concerned); or
(c) in the course of insurance business (other than insurance business relating to State insurance not extending beyond the limits of the State concerned); or
(d) in a Territory;
give to a person carrying on a credit reporting business personal information in circumstances to which this section applies unless the last-mentioned person is a corporation.
(3) A corporation must not give to a person carrying on a credit reporting business personal information in circumstances to which this section applies unless the last-mentioned person is a corporation.
(4) A person who knowingly or recklessly contravenes this section is guilty of an offence punishable, on conviction, by a fine not exceeding $12,000.
(5) For the purposes of this section, personal information is to be taken to be given to a person in circumstances to which this section applies if the person to whom the information is given is likely to use the information in the course of carrying on a credit reporting business.
(a) the inclusion of the information in the file is reasonably necessary in order to identify the individual; or
(b) the information is a record of:
(i) both:
(A) a credit provider having sought a credit report in relation to an individual in connection with an application for credit or commercial credit made by the individual to the credit provider; and
(B) the amount of credit or commercial credit sought in the application; or
(ia) a person who is a credit provider because of the application of subsection 11B(4B) having sought a credit report in relation to the individual for the purpose of assessing:
(A) the risk in purchasing a loan by means of a securitisation arrangement; or
(B) the risk in undertaking credit enhancement of a loan that is, or is proposed to be, purchased or funded by means of a securitisation arrangement;
being a loan given to, or applied for by, the individual or a person in relation to whom the individual is, or is proposing to be, a guarantor; or
(ii) a mortgage insurer having sought a credit report in connection with the provision of insurance to a credit provider in respect of mortgage credit given by the credit provider to the individual, or to a person in relation to whom the individual is, or is proposing to be, a guarantor; or
(iii) a trade insurer having sought a credit report in connection with the provision of insurance to a credit provider in respect of commercial credit given by the credit provider to the individual or another person; or
(iv) a credit provider having sought a credit report in connection with the individual having offered to act as guarantor in respect of a loan or an application for a loan; or
(v) a credit provider being a current credit provider in relation to the individual; or
(vi) credit provided by a credit provider to an individual, being credit in respect of which:
(A) the individual is at least 60 days overdue in making a payment, including a payment that is wholly or partly a payment of interest; and
(B) the credit provider has taken steps to recover the whole or any part of the amount of credit (including any amounts of interest) outstanding; or
(vii) a cheque, for an amount not less than $100, that:
(A) has been drawn by the individual; and
(B) has twice been presented and dishonoured; or
(viii) court judgments made against the individual; or
(ix) bankruptcy orders made against the individual; or
(x) the opinion of a credit provider that the individual has, in the circumstances specified, committed a serious credit infringement; or
(ba) the information is a record of an overdue payment by the individual as guarantor under a guarantee given against default by a person (the borrower) in repaying all or any of an amount of credit obtained by the borrower from a credit provider, and the following subparagraphs apply:
(i) the credit provider is not prevented under any law of the Commonwealth, a State or a Territory from bringing proceedings against the individual to recover the amount of the overdue payment;
(ii) the credit provider has given the individual notice of the borrower's default that gave rise to the individual's obligation to make the payment;
(iii) 60 days have elapsed since the day on which the notice was given;
(iv) the credit provider has, separately from and in addition to the giving of the notice referred to in subparagraph (ii), taken steps to recover the amount of the overdue payment from the individual.
(c) the information is included in a statement provided by the individual under subsection 18J(2) for inclusion in the file; or
(d) the information is included in a note included in the file under subsection 18F(4) or 18K(5).
(2) A credit reporting agency must not include in an individual's credit information file personal information recording the individual's:
(a) political, social or religious beliefs or affiliations; or
(b) criminal record; or
(c) medical history or physical handicaps; or
(d) race, ethnic origins or national origins; or
(e) sexual preferences or practices; or
(f) lifestyle, character or reputation.
(3) The Commissioner may determine, in writing, the kinds of information that are, for the purposes of paragraph (1)(a), reasonably necessary to be included in an individual's credit information file in order to identify the individual.
(4) Where the Commissioner so determines, information that is not of a kind so determined is to be taken not to be information that is permitted to be included in an individual's credit information file under paragraph (1)(a).
(5) A determination is to be made by notice published in the Gazette.
(6) A notice so published is a disallowable instrument for the purposes of section 46A of the Acts Interpretation Act 1901.
(7) A credit reporting agency must not open a credit information file in relation to an individual unless it has information, concerning the individual, to include in the file that is information of a kind referred to in paragraph (1)(b) or (ba).
(8) A credit provider must not give to a credit reporting agency personal information relating to an individual if:
(a) a credit reporting agency is prohibited, under subsection (1), from including the information in the individual's credit information file; or
(b) the credit provider does not have reasonable grounds for believing that the information is correct; or
(c) the credit provider did not, at the time of, or before, acquiring the information, inform the individual that the information might be disclosed to a credit reporting agency.
(2) For the purposes of subsection (1), the maximum permissible periods for the keeping of personal information of the kind referred to in paragraph 18E(1)(b) are as follows:
(a) in the case of information of a kind referred to in subparagraph (i), (ia), (ii), (iii) or (iv) of that paragraph--the period of 5 years commencing on the day on which the credit report concerned was sought;
(b) in the case of information of a kind referred to in subparagraph (v) of that paragraph--the period of 14 days commencing on the day on which the credit reporting agency is notified under subsection (5) that the credit provider concerned is no longer a current credit provider in relation to the individual concerned;
(c) in the case of information of a kind referred to in subparagraph (vi) of that paragraph--the period of 5 years commencing on the day on which the credit reporting agency was informed of the overdue payment concerned;
(d) in the case of information of a kind referred to in subparagraph (vii) of that paragraph--the period of 5 years commencing on the day on which the second dishonouring of the cheque occurred;
(e) in the case of information of a kind referred to in subparagraph (viii) of that paragraph--the period of 5 years commencing on the day on which the court judgment concerned was made;
(f) in the case of information of a kind referred to in subparagraph (ix) of that paragraph--the period of 7 years commencing on the day on which the bankruptcy order concerned was made;
(g) in the case of information of a kind referred to in subparagraph (x) of that paragraph--the period of 7 years commencing on the day on which the information was included in the credit information file concerned.
(2A) For the purposes of subsection (1), the maximum permissible period for the keeping of personal information of the kind referred to in paragraph 18E(1)(ba) is the period of 5 years beginning on the day when the credit reporting agency is informed of the overdue payment concerned.
(3) Where:
(a) a credit reporting agency has been given information that an individual is overdue in making a payment in respect of credit provided by a credit provider; and
(b) the individual ceases to be overdue in making the payment or contends that he or she is not overdue in making the payment;
the credit provider must, as soon as practicable, inform the credit reporting agency that the individual has ceased to be overdue in making the payment, or contends that he or she is not overdue in making the payment, as the case may be.
(4) On being informed that the individual is no longer overdue in making the payment, or that the individual contends that he or she is not overdue in making the payment, the credit reporting agency must include in the individual's credit information file a note to that effect.
(5) Where a credit provider ceases to be a current credit provider in relation to an individual, the credit provider must, as soon as practicable, notify that fact to any credit reporting agency that was previously informed that the credit provider was a current credit provider in relation to the individual.
(a) take reasonable steps to ensure that personal information contained in the file or report is accurate, up-to-date, complete and not misleading; and
(b) ensure that the file or report is protected, by such security safeguards as are reasonable in the circumstances, against loss, against unauthorised access, use, modification or disclosure, and against other misuse; and
(c) if it is necessary for the file or report to be given to a person in connection with the provision of a service to the credit reporting agency or credit provider, ensure that everything reasonably within the power of the credit reporting agency or credit provider is done to prevent unauthorised use or disclosure of personal information contained in the file or report.
(2) A credit provider, or a credit reporting agency, in possession or control of a credit report containing personal information concerning an individual must take all reasonable steps to ensure that the individual can obtain access to that report.
(3) An individual's rights of access under this section may also be exercised by a person (other than a credit provider, mortgage insurer or trade insurer) authorised, in writing, by the individual to exercise those rights on the individual's behalf in connection with:
(a) an application, or a proposed application, by the individual for a loan; or
(b) the individual having sought advice in relation to a loan.
(2) Where:
(a) a credit reporting agency in possession or control of a credit information file, or a credit provider or credit reporting agency in possession or control of a credit report, does not amend personal information contained in that file or report, by making a correction, deletion or addition, in accordance with a request by the individual concerned; and
(b) the individual requests the credit reporting agency or credit provider to include in that file or report a statement provided by the individual of the correction, deletion or addition sought;
the credit reporting agency or credit provider must take reasonable steps to include the statement in the file or report within 30 days after being requested to do so.
(3) Where the credit reporting agency or credit provider considers a statement included pursuant to subsection 18J(2) to be of undue length in the circumstances, the credit reporting agency or credit provider may refer the statement to the Commissioner for such reduction as is considered appropriate and, if the statement is altered, the statement as altered is to be included in the file or report.
(a) the information is contained in a credit report given to a credit provider who requested the report for the purpose of assessing an application for credit made by the individual to the credit provider; or
(ab) the information:
(i) is contained in a credit report given to a person who is a credit provider because of the application of subsection 11B(4B); and
(ii) the person requested the report for the purpose of assessing the risk in purchasing a loan by means of a securitisation arrangement, being a loan given to or applied for by:
(A) the individual; or
(B) a person in relation to whom the individual is, or is proposing to be, a guarantor; or
(ac) the information:
(i) is contained in a credit report given to a person who is a credit provider because of the application of subsection 11B(4B); and
(ii) the person requested the report for the purpose of assessing the risk in undertaking credit enhancement of a loan that is, or is proposed to be, purchased or funded by means of a securitisation arrangement, being a loan given to or applied for by:
(A) the individual; or
(B) a person in relation to whom the individual is, or is proposing to be, a guarantor; or
(b) the information is contained in a credit report given to a credit provider who requested the report for the purpose of assessing an application for commercial credit made by a person to the credit provider, and the individual to whom the report relates has specifically agreed to the report being given to the credit provider for that purpose; or
(c) the information is contained in a credit report given to a credit provider who requested the report for the purpose of assessing whether to accept the individual as a guarantor in respect of:
(i) a loan provided by the credit provider to a person other than the individual; or
(ii) a loan for which an application has been made by a person other than the individual to the credit provider;
and the first-mentioned individual has specifically agreed, in writing, to the report being given to the credit provider for that purpose; or
(d) the information is contained in a credit report given to a mortgage insurer for the purpose of assessing:
(i) whether to provide insurance to, or the risk of providing insurance to, a credit provider in respect of mortgage credit given by the credit provider to the individual; or
(ii) the risk of the individual defaulting on mortgage credit in respect of which the mortgage insurer has provided insurance to a credit provider; or
(iii) the risk of the individual being unable to meet a liability that might arise under a guarantee entered into, or proposed to be entered into, in respect of mortgage credit given by a credit provider to another person; or
(e) the information is contained in a credit report given to a trade insurer for the purpose of assessing:
(i) whether to provide insurance to, or the risk of providing insurance to, a credit provider in respect of commercial credit given by the credit provider to the individual or another person; or
(ii) the risk of a person defaulting on commercial credit in respect of which the trade insurer has provided insurance to a credit provider;
and the individual to whom the report relates has specifically agreed, in writing, to the report being given to the trade insurer for that purpose; or
(f) the credit reporting agency has, at least 30 days before the disclosure, received information of a kind referred to in subparagraph 18E(1)(b)(vi), and the information is contained in a credit report given to a credit provider referred to in the credit information file as a credit provider who is a current credit provider in relation to the individual; or
(g) the information is contained in a credit report given to a credit provider who requested the report for the purpose of the collection of payments that are overdue in respect of credit provided to the individual by the credit provider; or
(h) the information is contained in a credit report given to a credit provider who requested the report for the purpose of the collection of payments that are overdue in respect of commercial credit provided to a person by the credit provider, and:
(i) the individual to whom the report relates has specifically agreed, in writing, to the report being given to the credit provider for that purpose; or
(ii) that individual had specifically agreed, in writing, to a credit report relating to the individual being given to the credit provider for the purpose of the credit provider assessing the application that the first-mentioned person made to the credit provider for the provision of the commercial credit concerned; or
(iii) the credit provider provided the commercial credit concerned before the commencement of this section; or
(j) the information is contained in a credit report given to another credit reporting agency; or
(k) the information is contained in a record in which the only personal information relating to individuals is publicly available information; or
(m) the disclosure is required or authorised by or under law; or
(n) the credit reporting agency is satisfied that a credit provider or law enforcement authority believes on reasonable grounds that the individual has committed a serious credit infringement and the information is given to that credit provider or law enforcement authority or to any other credit provider or law enforcement authority.
(1A) For the purposes of paragraph (1)(b), the individual's agreement to the report being given to the credit provider must be in writing unless:
(a) the report is requested for the purpose of assessing an application for commercial credit that was at first instance made orally; and
(b) the application has not yet been made in writing.
(2) A credit reporting agency must not disclose personal information contained in an individual's credit information file, or in any other record containing information derived from the file, that is in the possession or control of the credit reporting agency if the file or other record contains personal information that the credit reporting agency would be:
(a) prohibited from including in an individual's credit information file under section 18E; or
(b) required to delete from such a file under section 18F.
(3) Subsection (2) does not prohibit the credit reporting agency from disclosing personal information that it would be prohibited from including in an individual's credit information file under section 18E if:
(a) the credit reporting agency included the information in a credit information file or other record before the commencement of this section; and
(b) the information is information of a kind that the Commissioner has determined, in writing, to be information that the credit reporting agency may disclose without contravening that subsection.
(4) A credit reporting agency that knowingly or recklessly contravenes subsection (1) or (2) is guilty of an offence punishable, on conviction, by a fine not exceeding $150,000.
(5) Where a credit reporting agency discloses personal information contained in an individual's credit information file, it must include in the file a note of that disclosure.
(6) A credit reporting agency must not include in a credit report given to a credit provider under paragraph (1)(a) any information relating to an individual's commercial activities (other than information that the credit reporting agency is permitted under section 18E to include in the individual's credit information file).
(7) A determination under paragraph (3)(b) is to be made by notice published in the Gazette.
(8) A notice so published is a disallowable instrument for the purposes of section 46A of the Acts Interpretation Act 1901.
(aa) the report was obtained under paragraph 18K(1)(a) or (ab) and the credit provider uses the report or information for the purpose of assessing the risk in purchasing a loan by means of a securitisation arrangement, being a loan given to or applied for by:
(i) the individual; or
(ii) a person in relation to whom the individual is, or is proposing to be, a guarantor; or
(ab) the report was obtained under paragraph 18K(1)(a) or (ac) and the credit provider uses the report or information for the purpose of assessing the risk in undertaking credit enhancement of a loan that is, or is proposed to be, purchased or funded by means of a securitisation arrangement, being a loan given to or applied for by:
(i) the individual; or
(ii) a person in relation to whom the individual is, or is proposing to be, a guarantor; or
(a) the report was obtained under paragraph 18K(1)(b) and the credit provider uses the report or information for the purpose of assessing an application for commercial credit made by a person to the credit provider; or
(b) the report was obtained under paragraph 18K(1)(c) and the credit provider uses the report or information for the purpose of assessing whether to accept the individual as a guarantor in respect of:
(i) a loan provided by the credit provider to a person other than the individual; or
(ii) a loan for which an application has been made by a person other than the individual to the credit provider; or
(ba) the report was obtained under paragraph 18K(1)(a), (b) or (c) and the credit provider uses the report or information for the internal management purposes of the credit provider, being purposes directly related to the provision or management of loans by the credit provider; or
(c) the report was obtained under paragraph 18K(1)(f) and the credit provider uses the information for the purpose of assisting the individual to avoid defaulting on his or her credit obligations; or
(d) the credit provider uses the report or information for the purpose of the collection of payments that are overdue in respect of credit provided to the individual by the credit provider; or
(da) the report was obtained under paragraph 18K(1)(h) and the credit provider uses the report or information for the purpose of the collection of payments that are overdue in respect of commercial credit provided to a person by the credit provider; or
(e) use of the report or information for that other purpose is required or authorised by or under law; or
(f) the credit provider believes on reasonable grounds that the individual has committed a serious credit infringement, and the report or information is used in connection with that infringement.
(2) A credit provider that knowingly or recklessly contravenes subsection (1) is guilty of an offence punishable, on conviction, by a fine not exceeding $150,000.
(3) A credit provider that is or has been in possession or control of a credit report must not:
(a) use the report unless all personal information concerning individuals that is not information of a kind referred to in subsection 18E(1) has been deleted from the report; or
(b) use any personal information derived from the report if the information is not information of a kind referred to in subsection 18E(1).
(4) Where a credit provider has received a credit report for the purpose of assessing an application for credit made to the credit provider by an individual, the credit provider must not, in assessing the application, use information that:
(a) concerns the individual's commercial activities or commercial credit worthiness; and
(b) was obtained from a person or body carrying on a business or undertaking involving the provision of information about the commercial credit worthiness of persons;
unless the individual has specifically agreed to the information being obtained by the credit provider for that purpose.
(4A) For the purposes of subsection (4), the individual's agreement to the information being obtained by the credit provider must be in writing unless:
(a) the information is obtained for the purpose of assessing an application for credit that was at first instance made orally; and
(b) the application has not yet been made in writing.
(5) References in subsection (3) to information that is not information of a kind referred to in subsection 18E(1) do not include references to information the disclosure of which is taken, because of the application of subsection 18K(3), not to be in contravention of subsection 18K(2).
(6) The Commissioner may determine, in writing, the manner in which information of a kind referred to in subsection (4) may, under that subsection, be used (including the manner in which an individual's agreement may be obtained for the purposes of that subsection).
(7) A determination is to be made by notice published in the Gazette.
(8) A notice so published is a disallowable instrument for the purposes of section 46A of the Acts Interpretation Act 1901.
(a) a credit provider refuses an application by an individual for credit (including an application made jointly by that individual and one or more other persons); and
(b) the refusal is based wholly or partly on information derived from a credit report relating to that individual that a credit reporting agency has given to the credit provider for the purpose of assessing the application;
the credit provider must give the individual a written notice:
(c) stating:
(i) that the application has been refused; and
(ii) that the refusal was based wholly or partly, as the case requires, on information derived from a credit report relating to that individual that a credit reporting agency has given to the credit provider; and
(iii) the name and address of the credit reporting agency; and
(d) notifying that individual of his or her right under this Act to obtain access to his or her credit information file maintained by the credit reporting agency.
(2) If:
(a) a credit provider refuses an application by an individual for credit, being an application made jointly by that individual and one or more other persons; and
(b) the refusal is based wholly or partly on information derived from a credit report relating to one of those other persons that a credit reporting agency has given to the credit provider for the purpose of assessing the application;
the credit provider must give to that individual a written notice stating:
(c) that the application has been refused; and
(d) that the refusal was based wholly or partly, as the case requires, on information derived from a credit report relating to that person that a credit reporting agency has given to the credit provider.
(3) If:
(a) a credit provider refuses an application by an individual for credit (including an application made jointly by that individual and one or more other persons); and
(b) the refusal is based wholly or partly on information derived from a credit report relating to another person who was proposing to be a guarantor in respect of the credit;
the credit provider must give that individual a written notice stating:
(c) that the application has been refused; and
(d) that the refusal was based wholly or partly, as the case requires, on information derived from a credit report relating to that person that a credit reporting agency has given to the credit provider.
(a) the report or information is disclosed to a credit reporting agency for the purpose of being used:
(i) to create a credit information file in relation to the individual concerned; or
(ii) to include information in a credit information file, maintained by the credit reporting agency, in relation to the individual concerned; or
(b) the individual concerned has specifically agreed to the disclosure of the report or information to another credit provider for the particular purpose; or
(ba) the report or information is disclosed:
(i) to the guarantor of a loan provided by the credit provider to the individual concerned; and
(ii) for any purpose related to the enforcement or proposed enforcement of the guarantee; or
(bb) the report or information is disclosed to a mortgage insurer:
(i) for the purpose of assessing whether to provide insurance to, or the risk of providing insurance to, a credit provider in respect of mortgage credit given by the credit provider to the individual concerned or applied for by the individual concerned to the credit provider; or
(ii) for the purpose of assessing the risk of the individual defaulting on mortgage credit in respect of which the mortgage insurer has provided insurance to the credit provider; or
(iii) for any purpose arising under a contract for mortgage insurance that has been entered into between the credit provider and the mortgage insurer; or
(bc) the report or information is disclosed:
(i) to a person or body generally recognised and accepted in the community as being a person appointed, or a body established, for the purpose of settling disputes between credit providers, acting in their capacity as credit providers, and their customers; and
(ii) for the purpose of settling a dispute between the credit provider and the individual concerned; or
(bd) the report or information is disclosed:
(i) to a Minister, Department or authority, of a State or Territory whose functions or responsibilities include giving assistance (directly or indirectly) that facilitates the giving of mortgage credit to individuals; and
(ii) for the purpose of enabling the Minister, Department or authority to determine the extent of assistance (if any) it will give in relation to the giving of mortgage credit to the individual concerned; or
(bda) the report or information is disclosed:
(i) to a Minister, Department or authority, of a State or Territory whose functions or responsibilities include the management or supervision of schemes or arrangements under which assistance is given (directly or indirectly) that facilitates the giving of mortgage credit to individuals; and
(ii) for the purpose of enabling the Minister, Department or authority to manage or supervise any such scheme or arrangement; or
(be) the report or information:
(i) is disclosed to a person or body carrying on a business of supplying goods or services; and
(ii) is disclosed for the purpose of enabling that person or body to decide whether to accept, as payment for goods or services supplied to the individual concerned, payment by means of credit card or electronic transfer of funds; and
(iii) does not contain or include any personal information derived from a credit report, other than:
(A) information of a kind referred to in paragraph 18E(1)(a); and
(B) information as to whether the individual has a line of credit with the credit provider, or funds deposited with the credit provider, sufficient to meet the payment concerned; or
(bf) the report or information:
(i) is disclosed to a person or body that is considering taking an assignment of, or discharging on the individual's behalf, a debt owed by the individual to the credit provider; and
(ii) does not contain or include any personal information derived from a credit report, other than:
(A) information of a kind referred to in paragraph 18E(1)(a); and
(B) information as to the amount of the debt, or the amount required to be paid in order to discharge the debt; or
(bg) the report or information is disclosed to a person who is a guarantor in respect of, or who has provided property as security for, a loan given by the credit provider to the individual concerned, and:
(i) the individual has specifically agreed to the disclosure of the report or information to any such person; or
(ii) the following circumstances apply:
(A) the guarantee or security was given before the commencement of this paragraph;
(B) the report or information is disclosed for the purpose of giving to the person information that is relevant to the amount or possible amount of the person's liability under the contract of guarantee or security;
(C) the credit provider has, prior to the disclosure, informed the individual that such disclosures may take place; or
(bh) the report or information is disclosed to a person for the purpose of that person considering whether to offer to act as guarantor in respect of, or to offer property as security for:
(i) a loan given by the credit provider to the individual concerned; or
(ii) a loan for which the individual concerned has applied to the credit provider;
and the individual has specifically agreed to the disclosure of the report or information to any such person for that purpose; or
(c) the report (not being a credit report) or information:
(i) is disclosed to a person or body carrying on a business or undertaking that involves the collection of debts on behalf of others; and
(ii) is disclosed for the purpose of the collection of payments that are overdue in respect of credit provided to the individual concerned by the credit provider; and
(iii) does not contain or include any personal information derived from a credit report, other than:
(A) information of a kind referred to in paragraph 18E(1)(a); and
(B) information of a kind referred to in subparagraph 18E(1)(b)(vi), not being information that relates to an overdue payment in respect of which a note to the effect that the individual is no longer overdue in making the payment has been included, under subsection 18F(4), in the credit information file from which the credit report was prepared; and
(C) information of a kind referred to in subparagraph 18E(1)(b)(viii) or (ix); or
(ca) the report (not being a credit report) or information:
(i) is disclosed to a person or body carrying on a business or undertaking that involves the collection of debts on behalf of others; and
(ii) is disclosed for the purpose of the collection of payments that are overdue in respect of commercial credit provided to a person by the credit provider; and
(iii) does not contain or include any personal information derived from a credit report, other than information of a kind referred to in paragraph 18E(1)(a) or subparagraph 18E(1)(b)(viii) or (ix); or
(d) where the credit provider is a corporation--the report or information is disclosed to a corporation that is related to the credit provider; or
(e) the report or information is disclosed to a corporation (including the professional legal advisers or professional financial advisers of that corporation) that proposes to use the report or information:
(i) in the process of considering whether to:
(A) accept an assignment of a debt owed to the credit provider; or
(B) accept a debt owed to the credit provider as security for a loan to the credit provider; or
(C) purchase an interest in the credit provider (including, in a case where the credit provider is a corporation, a corporation that is related to the credit provider); or
(ii) in connection with exercising rights arising from any acceptance or purchase of a kind referred to in subparagraph (i); or
(f) the report or information is disclosed to a person who manages loans made by the credit provider, for use in managing those loans; or
(fa) the report or information is disclosed to another credit provider in the following circumstances:
(i) the credit provider and the other credit provider have each provided to the individual concerned mortgage credit in respect of which the same real property forms all or part of the security;
(ii) the individual is at least 60 days overdue in making a payment in respect of the mortgage credit provided by either credit provider;
(iii) the disclosure is for the purpose of either credit provider deciding what action to take in relation to the overdue payment; or
(g) disclosure of the report or information to that other person for the particular purpose is required or authorised by or under law; or
(ga) the report or information is disclosed to:
(i) the individual; or
(ii) a person (other than a credit provider, mortgage insurer or trade insurer) authorised, in writing, by the individual to seek access to the report or information; or
(gb) the report or information is disclosed in the following circumstances:
(i) the individual concerned maintains an account with the credit provider;
(ii) the report or information relates to the operation of the account;
(iii) the report or information is disclosed to another person who is authorised by the individual to operate the account;
(iv) either:
(A) the report or information contains no information about the credit worthiness, credit standing, credit history or credit capacity of the individual concerned, other than basic transaction information; or
(B) the disclosure takes place in the ordinary course of the other person operating the account in the way authorised by the individual concerned; or
(h) the credit provider believes on reasonable grounds that the individual concerned has committed a serious credit infringement and the report or information is given to another credit provider or a law enforcement authority.
(1A) For the purposes of paragraph (1)(b), the individual's agreement to the disclosure of the report or information to another credit provider:
(a) must be in writing unless:
(i) the disclosure is sought for the purpose of assessing an application for credit or commercial credit that was initially made orally; and
(ii) the application has not yet been made in writing; and
(b) must be given to:
(i) the credit provider with possession or control of the report or information; or
(ii) the other credit provider.
(1B) For the purposes of paragraphs (1)(bg) and (bh), the individual's agreement to the disclosure of the report or information must be in writing unless:
(a) the disclosure relates to an application for a loan that was initially made orally; and
(b) the application has not yet been made in writing.
(1C) Paragraph (1)(ga) does not affect the operation of paragraph (1)(g) in relation to an individual obtaining access to credit report under section 18H.
(1D) For the purposes of paragraph (1)(gb), basic transaction information is any one or more of the following:
(a) the account balance;
(b) the amount of available credit in relation to the account;
(c) the minimum payment (if any) due on the account;
(d) information relating to transactions on the account by the other person.
(2) A credit provider that knowingly or recklessly contravenes subsection (1) is guilty of an offence punishable, on conviction, by a fine not exceeding $150,000.
(3) A credit provider that is or has been in possession or control of a credit report, or a report containing personal information derived from a credit report, must not:
(a) disclose the report to another person unless all personal information concerning individuals that is not information of a kind referred to in subsection 18E(1) has been deleted from the report; or
(b) disclose to another person any personal information derived from the report if the information is not information of a kind referred to in subsection 18E(1).
(4) References in subsection (3) to information that is not information of a kind referred to in subsection 18E(1) do not include references to information the disclosure of which is taken, because of the application of subsection 18K(3), not to be in contravention of subsection 18K(2).
(5) The Commissioner may determine, in writing, the manner in which a report or personal information derived from a report may, under subsection (1), be disclosed (including the manner in which an individual's agreement may be obtained for the purposes of paragraph (1)(b)).
(6) Where the Commissioner so determines, a report or information that is disclosed in a manner contrary to the determination is to be taken, except for the purposes of subsection (2), to have been disclosed contrary to subsection (1).
(7) A determination is to be made by notice published in the Gazette.
(8) A notice so published is a disallowable instrument for the purposes of section 46A of the Acts Interpretation Act 1901.
(9) In this section, unless the contrary intention appears:
report means:
(a) a credit report; or
(b) subject to subsection (10), any other record or information, whether in a written, oral or other form, that has any bearing on an individual's credit worthiness, credit standing, credit history or credit capacity;
but does not include a credit report or any other record or information in which the only personal information relating to individuals is publicly available information.
(10) For the purposes of the application of this section to a credit provider that is not a corporation, a record or information (other than a credit report) is not taken to be a report for the purposes of this section unless it is being or has been prepared by or for a corporation.
(a) assessing whether to provide insurance to, or the risk of providing insurance to, a credit provider in respect of mortgage credit given by the credit provider to the individual concerned or applied for by the individual concerned to the credit provider; or
(b) assessing the risk of the individual concerned defaulting on mortgage credit in respect of which the mortgage insurer has provided insurance to a credit provider; or
(ba) assessing the risk of the individual concerned being unable to meet a liability that might arise under a guarantee entered into, or proposed to be entered into, in respect of mortgage credit given by the credit provider to another person; or
(c) any purpose arising under the contract for mortgage insurance that has been entered into between a credit provider and the mortgage insurer;
unless use of the report or information for that other purpose is required or authorised by or under law.
(2) A trade insurer that is or has been in possession or control of a credit report must not use the report or any personal information derived from the report for any purpose other than assessing:
(a) whether to provide insurance to, or the risk of providing insurance to, a credit provider in respect of commercial credit given by the credit provider to another person; or
(b) the risk of a person defaulting on commercial credit in respect of which the trade insurer has provided insurance to a credit provider;
unless use of the report or information for that other purpose is required or authorised by or under law.
(3) A mortgage insurer or trade insurer that is or has been in possession or control of a credit report must not:
(a) use the report unless all personal information concerning individuals that is not information of a kind referred to in subsection 18E(1) has been deleted from the report; or
(b) use any personal information derived from the report if the information is not information of a kind referred to in subsection 18E(1).
(4) References in subsection (3) to information that is not information of a kind referred to in subsection 18E(1) do not include references to information the disclosure of which is taken, because of the application of subsection 18K(3), not to be in contravention of subsection 18K(2).
(5) A mortgage insurer or trade insurer that is or has been in possession or control of a credit report must not disclose the report or any personal information derived from the report to another person for any purpose unless disclosure of the report or information to that other person for that purpose is required or authorised by or under law.
(6) A mortgage insurer or trade insurer that knowingly or recklessly contravenes subsection (1), (2) or (5) is guilty of an offence punishable, on conviction, by a fine not exceeding $150,000.
(7) A reference in this section (other than subsection (3)) to a credit report is taken to include a reference to a report or information disclosed to a mortgage insurer under paragraph 18N(1)(bb).
(a) use the report or information, or any personal information derived from the report or information, otherwise than for a purpose for which, or in circumstances under which, a credit provider would be permitted under section 18L to use the report or information; or
(b) disclose the report or information, or any personal information derived from the report or information, to another person otherwise than for a purpose for which, or in circumstances under which, a credit provider would be permitted under section 18N to disclose the report or information to another person.
(2) A corporation that has obtained a report or information under paragraph 18N(1)(e) must not use the report or information, or any personal information derived from the report or information, for any purpose other than:
(a) for use in the process of considering whether to:
(i) accept an assignment of a debt owed to the credit provider from whom the report or information was obtained; or
(ii) accept a debt owed to the credit provider as security for a loan to the credit provider; or
(iii) purchase an interest in the credit provider (including, where the credit provider is a corporation, a corporation that is related to the credit provider); or
(b) for use in connection with exercising rights arising from any acceptance or purchase of a kind referred to in paragraph (a).
(3) A professional legal adviser or professional financial adviser of a corporation who has obtained a report or information under paragraph 18N(1)(e) must not use the report or information, or any personal information derived from the report or information, for any purpose other than use by the person, in his or her capacity as such a professional legal or financial adviser, in connection with advising the corporation:
(a) whether to accept an assignment of a debt owed to the credit provider from whom the report or information was obtained; or
(b) whether to accept a debt owed to the credit provider as a security for a loan to the credit provider; or
(c) whether to purchase an interest in the credit provider (including, in a case where the credit provider is a corporation, a corporation that is related to the credit provider);
(d) in connection with exercising rights arising from any acceptance or purchase of a kind referred to in paragraph (a), (b) or (c);
unless use of the report or information, or the information so derived, is required or authorised by or under law.
(4) A person who has obtained a report or information under paragraph 18N(1)(f) must not use the report or information, or any personal information derived from the report or information, for any purpose other than use by the person in managing loans made by the credit provider from whom the person obtained the report or information, unless use of the report or information, or the information so derived, for that other purpose is required or authorised by or under law.
(5) A person who has obtained a report or information under paragraph 18N(1)(e) or (f) must not disclose the report or information, or any personal information derived from the report or information, to another person unless disclosure of the report or information, or the information so derived, is required or authorised by or under law.
(6) If:
(a) a person was, because of the application of subsection 11B(4B), a credit provider in relation to a loan; and
(b) the person has ceased to be such a credit provider in relation to the loan; and
(c) the person had, while such a credit provider in relation to the loan, obtained possession or control of a credit report;
the person must not use the report, or any personal information derived from the report, otherwise than for a purpose for which, or in circumstances under which, a credit provider would be permitted under section 18L to use the report or information.
(7) Subject to subsection (7A), if:
(a) a person was, because of the application of subsection 11B(4B), a credit provider in relation to a loan; and
(b) the person has ceased to be such a credit provider in relation to the loan; and
(c) the person had, while such a credit provider in relation to the loan, obtained possession or control of a report (within the meaning of subsection 18N(9));
the person must not disclose the report, or any personal information derived from the report, to another person otherwise than for the purposes for which, or in circumstances under which, a credit provider would be permitted under section 18N to disclose the report or information to another person.
(7A) For the purposes of the application of subsection (7) to a person other than a corporation, a record or information (other than a credit report) is not taken to be a report for the purposes of that subsection unless it is being or has been prepared by or for a corporation.
(8) In spite of anything in this section to the contrary, this section does not impose any obligations on a person in relation to a report or information obtained under paragraph 18N(1)(e) or (f), or in relation to any personal information derived from such a report or information, unless:
(a) the person is a corporation; or
(b) the credit provider from whom the person obtained the report or information is a corporation.
(9) A person who knowingly or recklessly contravenes this section is guilty of an offence punishable, on conviction, by a fine not exceeding $30,000.
(2) A credit reporting agency or credit provider that knowingly or recklessly contravenes subsection (1) is guilty of an offence punishable, on conviction, by a fine not exceeding $75,000.
(2) A person must not obtain access to a credit report in the possession or control of a credit provider or credit reporting agency unless:
(a) the person is given the report in accordance with this Act; or
(b) the access is otherwise authorised by this Act.
(3) A person who knowingly or recklessly contravenes this section is guilty of an offence punishable, on conviction, by a fine not exceeding $30,000.
Penalty: $30,000.
(2) A person must not, by a false pretence, obtain access to a credit report in the possession or control of a credit provider or credit reporting agency.
Penalty: $30,000.
(2) Paragraph 18E(8)(c) does not apply in relation to information acquired by a credit provider before 25 February 1992.
(3) Section 18F applies in relation to personal information that was, immediately before 25 February 1992, contained in an individual's credit information file as if the references to the days mentioned in the paragraphs of subsection 18F(2) were all references to 25 February 1992.