Privacy Act 1988

PART IIIA - CREDIT REPORTING  

Division 3 - Credit providers  

Subdivision C - Dealing with credit information  

SECTION 21D   DISCLOSURE OF CREDIT INFORMATION TO A CREDIT REPORTING BODY  

Prohibition on disclosure

21D(1)    
A credit provider must not disclose credit information about an individual to a credit reporting body (whether or not the body ' s credit reporting business is carried on in Australia).

Civil penalty: 2,000 penalty units.

Permitted disclosure

21D(2)    
Subsection (1) does not apply to the disclosure of credit information about the individual if:

(a)    

the credit provider:

(i) is a member of or subject to a recognised external dispute resolution scheme or is prescribed by the regulations; and

(ii) knows, or believes on reasonable grounds, that the individual is at least 18 years old; and

(b)    the credit reporting body is:

(i) an agency; or

(ii) an organisation that has an Australian link; and

(c)    the information meets the requirements of subsection (3) .

Note:

Section 21F limits the disclosure of credit information if there is a ban period for the information.

21D(3)    
Credit information about an individual meets the requirements of this subsection if:

(a)    the information does not relate to an act, omission, matter or thing that occurred or existed before the individual turned 18; and

(b)    if the information relates to consumer credit or commercial credit - the credit is or has been provided, or applied for, in Australia; and

(c)    

if the information is repayment history information or financial hardship information about the individual:

(i) the credit provider is a licensee or is prescribed by the regulations; and

(ii) the consumer credit to which the information relates is consumer credit in relation to which the provider also discloses, or a credit provider has previously disclosed, consumer credit liability information about the individual to the credit reporting body; and

(iii) the provider complies with any requirements relating to the disclosure of the information that are prescribed by the regulations; and

(d)    if the information is default information about the individual:

(i) the credit provider has given the individual a notice in writing stating that the provider intends to disclose the information to the credit reporting body; and

(ii) at least 14 days have passed since the giving of the notice.

21D(4)    
Paragraph (3)(a) does not apply to identification information about the individual.

21D(5)    
Despite paragraph (3)(a) , consumer credit liability information about the individual may relate to consumer credit that was entered into on a day before the individual turned 18, so long as the consumer credit was not terminated, or did not otherwise cease to be in force, on a day before the individual turned 18.

Written note of disclosure

21D(6)    
If a credit provider discloses credit information under this section, the provider must make a written note of that disclosure.

Civil penalty: 500 penalty units.

Interaction with the Australian Privacy Principles

21D(7)    
If a credit provider is an APP entity, Australian Privacy Principles 6 and 8 do not apply to the disclosure by the provider of credit information to a credit reporting body.