Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1697633245348.pdf (Australia)
EXPOSURE DRAFT EXPOSURE DRAFT Credit reporting Contents Part A—Credit reporting 1 Division 1—Introduction and application of this Part Division 2—Credit reporting agencies Subdivision A—Introduction and application of this Division etc.
Subdivision B—Consideration of information privacy 1 Guide to this Part ............................................................................... 1 Credit to which this Part applies ........................................................ 1 2 2 Guide to this Division ........................................................................ 2 Application of this Division to credit reporting agencies .................. 2 Application of the Australian Privacy Principles to credit reporting agencies .............................................................................. 2 3 Open and transparent management of credit reporting information ........................................................................................ 3 5 Collection of solicited credit information .......................................... 5 Dealing with unsolicited credit information ...................................... 6 7 Use or disclosure of credit reporting information .............................. 7 Permitted CRA disclosures in relation to individuals ........................ 9 Use or disclosure of credit reporting information for the purposes of direct marketing ........................................................... 10 Use or disclosure of pre-screening determinations .......................... 12 Destruction of pre-screening determinations ................................... 13 100 101 102 103 104 105 106 107 108 109 110 111 112 Subdivision D—Dealing with credit reporting information etc.
Subdivision C—Collection of credit information Credit reporting ii EXPOSURE DRAFT Subdivision E—Integrity of credit reporting information Subdivision F—Access to, and correction of, information Subdivision G—Dealing with credit reporting information after 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 No use or disclosure of credit reporting information during a ban period ........................................................................................ 13 Adoption of government related identifiers ..................................... 15 Use or disclosure of de-identified information ................................ 15 16 Quality of credit reporting information............................................ 16 False or misleading credit reporting information ............................. 17 Security of credit reporting information .......................................... 17 18 Access to credit reporting information ............................................ 18 Correction of credit reporting information ...................................... 19 Individual may request the correction of credit information etc.
................................................................................................... 20 Notice of correction etc.

must be given ........................................... 21 22 the retention period ends etc.

Destruction etc.
of credit reporting information after the retention period ends ....................................................................... 22 Retention period for credit information—general ........................... 24 Retention period for credit information—personal insolvency information .................................................................... 25 Destruction of credit reporting information in cases of fraud .......... 27 Dealing with information if there is a pending correction request etc.
....................................................................................... 29 Dealing with information if an Australian law etc.
requires it to be retained ................................................................................... 30 32 32 Guide to this Division ...................................................................... 32 Application of this Division to credit providers............................... 32 33 Additional notification requirements for the collection of personal information ........................................................................ 33 Disclosure of credit information to a credit reporting agency.......... 33 Payment information must be disclosed to a credit reporting agency.............................................................................................. 35 Limitation on the disclosure of credit information during a ban period ........................................................................................ 35 36 Use or disclosure of credit eligibility information ........................... 36 Permitted CP uses in relation to individuals .................................... 38 Division 3—Credit providers Subdivision A—Introduction and application of this Division Subdivision B—Dealing with credit information Subdivision C—Dealing with credit eligibility information etc.
135 136 iii Credit reporting EXPOSURE DRAFT 137 138 139 140 141 142 Permitted CP disclosures between credit providers ......................... 39 Permitted CP disclosures relating to guarantees etc.
....................... 41 Permitted CP disclosures to mortgage insurers................................ 42 Permitted CP disclosures to debt collectors ..................................... 43 Permitted CP disclosures to other recipients ................................... 43 Notification of a refusal of an application for consumer credit ................................................................................................ 45 Subdivision D—Integrity of credit information and credit Subdivision E—Access to, and correction of, information 46 eligibility information Quality of credit eligibility information ........................................... 46 False or misleading credit information or credit eligibility information ...................................................................................... 46 Security of credit eligibility information ......................................... 47 48 Access to credit eligibility information............................................ 48 Correction of credit information ...................................................... 50 Correction of credit eligibility information ...................................... 51 Individual may request the correction of credit information etc.
................................................................................................... 52 Notice of correction etc.
must be given ........................................... 53 55 Guide to this Division ...................................................................... 55 Use or disclosure of information by mortgage insurers and trade insurers ................................................................................... 55 Use or disclosure of information by a related body corporate ......... 56 Use or disclosure of information by credit managers ...................... 57 Use or disclosure of information by advisers etc.
............................ 58 61 Guide to this Division ...................................................................... 61 Individual may complain to a credit reporting agency or credit provider ................................................................................. 61 Dealing with complaints .................................................................. 62 Notification requirements relating to certain complaints ................. 63 143 144 145 146 147 148 149 150 151 152 153 154 155 158 159 Division 5—Complaints 156 157 Division 4—Other recipients of information Division 6—Unauthorised obtaining of credit reporting information etc.
66 160 161 Obtaining credit reporting information from a credit reporting agency .............................................................................. 66 Obtaining credit eligibility information from a credit provider ........................................................................................... 67 Credit reporting iv EXPOSURE DRAFT Division 7—Civil penalty orders Subdivision A—Civil penalty provisions Subdivision B—Obtaining a civil penalty order Subdivision C—Civil proceedings and criminal proceedings 68 68 Civil penalty provisions ................................................................... 68 Ancillary contravention of civil penalty provisions ......................... 68 68 Civil penalty orders ......................................................................... 68 Civil enforcement of penalty ........................................................... 69 Conduct contravening more than one civil penalty provision .......... 69 Multiple contraventions ................................................................... 70 Two or more proceedings may be heard together ............................ 70 Civil evidence and procedure rules for civil penalty orders ............. 70 Contravening a civil penalty provision is not an offence ................. 70 71 Civil proceedings after criminal proceedings .................................. 71 Criminal proceedings during civil proceedings ............................... 71 Criminal proceedings after civil proceedings
 .................................. 71 Evidence given in proceedings for civil penalty order not admissible in criminal proceedings.................................................. 71 73 Treatment of partnerships ................................................................ 73 Treatment of unincorporated associations ....................................... 73 Treatment of trusts ........................................................................... 74 Conduct of directors, employees or agents of bodies corporate .......................................................................................... 75 Conduct of employees or agents of persons other than bodies corporate .......................................................................................... 75 162 163 164 165 166 167 168 169 170 171 172 173 174 179 Division 8—Miscellaneous 175 176 177 178 Part B—Other relevant provisions 77 Division 1—Definitions 180 Division 2—Definitions relating to credit reporting Subdivision A—Credit information etc.
77 Definitions ....................................................................................... 77 93 93 Meaning of credit information......................................................... 93 Meaning of default information ....................................................... 94 Meaning of information request ...................................................... 95 Meaning of new arrangement information ...................................... 96 Meaning of payment information .................................................... 97 Meaning of personal insolvency information .................................. 97 Meaning of repayment history information ..................................... 98 181 182 183 184 185 186 187 v Credit reporting EXPOSURE DRAFT Subdivision B—Credit provider 99 Meaning of credit provider .............................................................. 99 Agents of credit providers ............................................................. 100 Securitisation arrangements etc.
.................................................... 101 Acquisition of the rights of a credit provider ................................. 102 102 Meaning of access seeker .............................................................. 102 Meaning of credit and amount of credit ........................................ 103 Meaning of credit reporting business ............................................ 104 Meaning of recognised external dispute resolution scheme .......... 104 188 189 190 191 192 193 194 195 Subdivision C—Other definitions Credit reporting vi EXPOSURE DRAFT Credit reporting Part A Introduction and application of this Part Division 1 Section 100 Part A—Credit reporting Division 1—Introduction and application of this Part 100 Guide to this Part This Part deals with the privacy of personal information relating to credit reporting.
It applies in relation to credit that is or has been provided, or applied for, in Australia.

Division 2 sets out rules for credit reporting agencies.

Division 3 sets out rules for credit providers.

Division 4 sets out rules for certain recipients of information that has been disclosed by credit reporting agencies or credit providers under this Part.

Division 5 deals with complaints about credit reporting agencies or credit providers.
Division 6 deals with entities that obtain credit reporting information or credit eligibility information by false pretence, or when they are not authorised to do so under this Part.

Division 7 deals with pecuniary penalties for contraventions of civil penalty provisions.

Division 8 deals with the treatment of certain organisations and the conduct of directors, employees and agents.
101 Credit to which this Part applies This Part applies in relation to credit that is or has been provided, or applied for, in Australia.

1 Credit reporting 1 EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section 102 Division 2—Credit reporting agencies Subdivision A—Introduction and application of this Division etc.
102 Guide to this Division This Division sets out rules for credit reporting agencies.

Most of the rules relate to the handling of credit reporting information by credit reporting agencies.

The remaining rules relate to specified kinds of personal information and de-identified information.

The rules in this Division apply to credit reporting agencies that are APP entities instead of the Australian Privacy Principles.
103 Application of this Division to credit reporting agencies (1) This Division (other than sections 115, 121 and 122) applies to a credit reporting agency in relation to credit reporting information.

(2) Section 115 applies to a credit reporting agency in relation to de-identified information.

(3) Sections 121 and 122 apply to a credit reporting agency in relation to credit information, CRA derived information and CP derived information.
104 Application of the Australian Privacy Principles to credit reporting agencies (1) If a credit reporting agency is an APP entity, the Australian Privacy Principles do not apply to the agency in relation to credit information, CRA derived information or CP derived information.
2 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section 105 Note: Subject to this Division, the Australian Privacy Principles apply to the credit reporting agency in relation to other kinds of personal information.
(2) If a credit reporting agency is a small business operator, the following apply, subject to this Division, to the agency in relation to personal information that is not credit reporting information as if the agency were an organisation: (a) the Australian Privacy Principles; (b) any other provisions of this Act that relate to those principles.

(3) Subsection (2) has effect despite anything else in this Act.
Subdivision B—Consideration of information privacy 105 Open and transparent management of credit reporting information (1) The object of this section is to ensure that credit reporting agencies manage credit reporting information in an open and transparent way.

Compliance with this Division etc.


(2) A credit reporting agency must take such steps as are reasonable in the circumstances to implement practices, procedures and systems relating to the credit reporting business of the agency that: (a) will ensure that the agency complies with this Division and the Credit Reporting Code; and (b) will enable the agency to deal with inquiries or complaints from individuals about the agency’s compliance with this Division or the Credit Reporting Code.
Policy about the management of credit reporting information (3) A credit reporting agency must have a clearly expressed and up-to-date policy about the management of credit reporting information by the agency.
(4) Without limiting subsection (3), the policy must contain the following information: Credit reporting 3 EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section (a) the kinds of credit information that the credit reporting agency collects and how the agency collects that information; (b) the kinds of credit reporting information that the agency holds and how the agency holds that information; (c) the kinds of personal information that the agency usually derives from credit information that the agency holds; (d) the purposes for which the agency collects, holds, uses and discloses credit reporting information; (e) information about the effect of section 110 (which deals with direct marketing) and how the individual may make a request under subsection (5) of that section; (f) how an individual may access credit reporting information about the individual that is held by the agency and seek the correction of such information; (g) information about the effect of section 121 (which deals with individuals requesting the correction of credit information etc.
); (h) how an individual may complain about a failure of the agency to comply with this Division or the Credit Reporting Code and how the agency will deal with such a complaint.

Availability of policy etc.

(5) A credit reporting agency must take such steps as are reasonable in the circumstances to make the policy available: (a) free of charge; and (b) in such form as is appropriate.
(6) If an individual requests a copy, in a particular form, of the policy of a credit reporting agency, the agency must take such steps as are reasonable in the circumstances to give the individual a copy in that form.
4 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section 106 Subdivision C—Collection of credit information 106 Collection of solicited credit information Prohibition on collection (1) A credit reporting agency must not collect credit information about an individual.

Civil penalty: 2,000 penalty units.


Exceptions (2) Subsection (1) does not apply if the collection of the credit information is required or authorised by or under an Australian law, or an order of a court or tribunal.
(3) Subsection (1) does not apply if: (a) the credit reporting agency collects the credit information about the individual from a credit provider who is permitted under section 132 to disclose the information to the agency; and (b) the agency collects the information in the course of carrying on a credit reporting business; and (c) if the information is identification information about the individual—the agency also collects from the provider, or already holds, credit information of another kind about the individual.
(4) Subsection (1) does not apply if: (a) the credit reporting agency collects the credit information about the individual from an entity other than a credit provider; and (b) the agency collects the information in the course of carrying on a credit reporting business; and (c) the agency knows, or believes on reasonable grounds, that the individual is at least 18 years old; and (d) the information does not relate to an act, omission, matter or thing that occurred or existed before the individual turned 18; and Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section 107 (e) if the information is identification information about the individual—the agency also collects from the entity, or already holds, credit information of another kind about the individual; and (f) if the information is repayment history information about the individual—the agency collects the information from another credit reporting agency.
(5) Paragraph (4)(d) does not apply to identification information about the individual.

(6) Despite paragraph (4)(d), consumer credit liability information about the individual may relate to consumer credit that was entered into on a day before the individual turned 18, so long as the consumer credit was not terminated, or did not otherwise cease to be in force, on a day before the individual turned 18.
Means of collection (7) A credit reporting agency must collect credit information only by lawful and fair means.

Solicited credit information (8) This section applies to the collection of credit information that is solicited by a credit reporting agency.
107 Dealing with unsolicited credit information (1) If: (a) a credit reporting agency receives credit information about an individual; and (b) the agency did not solicit the information; the agency must, within a reasonable period after receiving the information, determine whether or not the agency could have collected the information under section 106 if the agency had solicited the information.
(2) The credit reporting agency may use or disclose the credit information for the purposes of making the determination under subsection (1).
6 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section 108 (3) If the credit reporting agency determines that it could have collected the credit information, sections 108 to 128 apply in relation to the information as if the agency had so collected the information.
(4) If the credit reporting agency determines that it could not have collected the credit information, the agency must, as soon as practicable, destroy the information.

Civil penalty: 1,000 penalty units.

(5) Subsection (4) does not apply if the credit reporting agency is required by or under an Australian law, or an order of a court or tribunal, to retain the credit information.

Subdivision D—Dealing with credit reporting information etc.
108 Use or disclosure of credit reporting information Prohibition on use or disclosure (1) If a credit reporting agency holds credit reporting information about an individual, the agency must not use or disclose the information.

Civil penalty: 2,000 penalty units.


Permitted uses (2) Subsection (1) does not apply to the use of the credit reporting information about the individual if: (a) the credit reporting agency uses the information in the course of carrying on the agency’s credit reporting business; or (b) the use is required or authorised by or under an Australian law, or an order of a court or tribunal; or (c) the use is a use prescribed by the regulations.
Permitted disclosures (3) Subsection (1) does not apply to the disclosure of credit reporting information about the individual if: 26 27 28 29 Credit reporting 7 EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section (a) the disclosure is a permitted CRA disclosure in relation to the individual; or (b) the disclosure is to another credit reporting agency; or (c) both of the following apply: (i) the disclosure is for the purposes of a recognised external dispute resolution scheme; (ii) a credit reporting agency or credit provider is a member of the scheme; or (d) both of the following apply: (i) the disclosure is to an enforcement body; (ii) the credit reporting agency is satisfied that the body, or another enforcement body, believes on reasonable grounds that the individual has committed a serious credit infringement; or (e) the disclosure is required or authorised by or under an Australian law, or an order of a court or tribunal; or (f) the disclosure is a disclosure prescribed by the regulations.
(4) However, if the credit reporting information is, or was derived from, repayment history information about the individual, the credit reporting agency must not disclose the information under paragraph (3)(a) or (f) unless the recipient of the information is a credit provider who is a licensee.

Civil penalty: 2,000 penalty units.

(5) If a credit reporting agency discloses credit reporting information under this section, the agency must make a written note of that disclosure.
Civil penalty: 500 penalty units.

No use or disclosure for the purposes of direct marketing (6) This section does not apply to the use or disclosure of credit reporting information for the purposes of direct marketing.

Note: Section 110 deals with the use or disclosure of credit reporting information for the purposes of direct marketing.
8 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section 109 109 Permitted CRA disclosures in relation to individuals (1) A disclosure by a credit reporting agency of credit reporting information about an individual is a permitted CRA disclosure in relation to the individual if: (a) the disclosure is to an entity specified in an item of the table; and (b) such conditions as are specified for the item are satisfied.
Permitted CRA disclosure Item If the disclosure is to ... the condition or conditions are ... 1 2 a credit provider a credit provider 3 a credit provider 4 a credit provider 5 a credit provider 6 a credit provider under subsection 190(1) the provider requests the information for a consumer credit related purpose of the provider in relation to the individual.
(a) the provider requests the information for a commercial credit related purpose of the provider in relation to a person; and (b) the individual expressly consents to the disclosure of the information to the provider for that purpose.

(a) the provider requests the information for a credit guarantee purpose of the provider in relation to the individual; and (b) the individual expressly consents, in writing, to the disclosure of the information to the provider for that purpose.
the credit reporting agency is satisfied that the provider, or another credit provider, believes on reasonable grounds that the individual has committed a serious credit infringement.

(a) the credit reporting agency holds consumer credit liability information that relates to consumer credit provided by the provider to the individual; and (b) the consumer credit has not been terminated, or has not otherwise ceased to be in force.
the provider requests the information for a securitisation related purpose of the provider in relation to the individual.

Credit reporting 9 EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section 110 Permitted CRA disclosure Item If the disclosure is to ... the condition or conditions are ... 7 8 a mortgage insurer a trade insurer the insurer requests the information for a mortgage insurance purpose of the insurer in relation to the individual.
(a) the insurer requests the information for a trade insurance purpose of the insurer in relation to the individual; and (b) the individual expressly consents, in writing, to the disclosure of the information to the insurer for that purpose.
(2) The consent of the individual under paragraph (b) of item 2 of the table in subsection (1) must be given in writing unless: (a) the credit provider referred to in that item requests the information for the purpose of assessing an application for commercial credit made by a person to the provider; and (b) the application has not been made in writing.
110 Use or disclosure of credit reporting information for the purposes of direct marketing Prohibition on direct marketing (1) If a credit reporting agency holds credit reporting information about an individual, the agency must not use or disclose the information for the purposes of direct marketing.

Civil penalty: 2,000 penalty units.
Permitted use for pre-screening (2) Subsection (1) does not apply to the use by the credit reporting agency of credit information about the individual for the purposes of direct marketing by, or on behalf of, a credit provider if: (a) the provider is a licensee; and (b) the direct marketing is about consumer credit that the provider provides; and 10 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section 110 (c) the information is not consumer credit liability information, or repayment history information, about the individual; and (d) the agency uses the information to determine whether or not the individual is eligible to receive the direct marketing communications of the credit provider; and (e) the individual has not made a request under subsection (5); and (f) the agency complies with any requirements that are set out in the Credit Reporting Code.
(3) In determining under paragraph (2)(d) whether or not the individual is eligible to receive the direct marketing communications of the credit provider, the credit reporting agency must have regard to the eligibility requirements nominated by the provider.

(4) A determination under paragraph (2)(d) is not credit reporting information about the individual.
Request not to use information for pre-screening (5) An individual may request a credit reporting agency that holds credit information about the individual not to use the information under subsection (2).

(6) If the individual makes a request under subsection (5), the credit reporting agency must not charge the individual for the making of the request or to give effect to the request.
Written note of use (7) If a credit reporting agency uses credit information under subsection (2), the agency must make a written note of that use.

Civil penalty: 500 penalty units.


1 26 27 Credit reporting 11 EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section 111 111 Use or disclosure of pre-screening determinations Use or disclosure by credit reporting agencies (1) If a credit reporting agency makes a pre-screening determination in relation to direct marketing by, or on behalf of, a credit provider, the agency must not use or disclose the determination.
Civil penalty: 2,000 penalty units.

(2) Subsection (1) does not apply if: (a) the credit reporting agency discloses the pre-screening determination for the purposes of the direct marketing by, or on behalf of, the credit provider; and (b) the recipient of the determination is an entity other than the provider.

(3) If the credit reporting agency discloses the pre-screening determination under subsection (2), the agency must make a written note of that disclosure.

Civil penalty: 500 penalty units.


Use or disclosure by recipients (4) If the credit reporting agency discloses the pre-screening determination under subsection (2), the recipient must not use or disclose the determination.

Civil penalty: 1,000 penalty units.

(5) Subsection (4) does not apply if the recipient uses the pre-screening determination for the purposes of the direct marketing by, or on behalf of, the credit provider.
(6) If the recipient uses the pre-screening determination under subsection (5), the recipient must make a written note of that use.

Civil penalty: 500 penalty units.
26 27 12 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section Interaction with the Australian Privacy Principles (7) If a credit reporting agency or recipient referred to in this section is an APP entity, Australian Privacy Principles 6 and 7 do not apply to the agency or recipient in relation to a pre-screening determination.
112 Destruction of pre-screening determinations (1) If an entity has possession or control of a pre-screening determination, the entity must destroy the determination if: (a) the entity no longer needs the determination for any purpose for which it may be used or disclosed under section 111; or (b) the entity is not required by or under an Australian law, or an order of a court or tribunal, to retain the determination.

Civil penalty: 1,000 penalty units.


(2) If an entity that has possession or control of a pre-screening determination is an APP entity, subsection (2) of Australian Privacy Principle 11 does not apply to the entity in relation to the determination.
113 No use or disclosure of credit reporting information during a ban period (1) If: (a) a credit reporting agency holds credit reporting information about an individual; and (b) the individual believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud); and (c) the individual requests the agency not to use or disclose the information under this Division; then, despite any other provision of this Division, the agency must not use or disclose the information during the ban period for the information.
Civil penalty: 2,000 penalty units.
Credit reporting 13 EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section (2) Subsection (1) does not apply if: (a) the individual expressly consents, in writing, to the use or disclosure of the credit reporting information under this Division; or (b) the use or disclosure of the credit reporting information is required by or under an Australian law, or an order of a court or tribunal.
Ban period (3) The ban period for credit reporting information about an individual is the period that: (a) starts when the individual makes a request under paragraph (1)(c); and (b) ends: (i) 14 days after the day on which the request is made; or (ii) if the period is extended under subsection (4)—on the day after the extended period ends.
(4) If: (a) there is a ban period for credit reporting information about an individual that is held by a credit reporting agency; and (b) before the ban period ends, the individual requests the agency to extend that period; and (c) the agency believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud); the agency must: (d) extend the ban period by such period as the agency considers is reasonable in the circumstances; and (e) give the individual written notification of the extension.
Civil penalty: 1,000 penalty units.

(5) A ban period for credit reporting information may be extended more than once under subsection (4).

14 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section No charge for request etc.
(6) If an individual makes a request under paragraph (1)(c) or (4)(b), a credit reporting agency must not charge the individual for the making of the request or to give effect to the request.

114 Adoption of government related identifiers (1) If: (a) a credit reporting agency holds credit reporting information about an individual; and (b) the information is a government related identifier of the individual; the agency must not adopt the government related identifier as its own identifier of the individual.
Civil penalty: 2,000 penalty units.

(2) Subsection (1) does not apply if the adoption of the government related identifier is required or authorised by or under an Australian law, or an order of a court or tribunal.

115 Use or disclosure of de-identified information Use or disclosure (1) If a credit reporting agency possesses or controls de-identified information, the agency must not use or disclose the information.
(2) Subsection (1) does not apply to the use of the de-identified information if: (a) the use is for the purposes of conducting research in relation to the assessment of the credit worthiness of individuals; and (b) the credit reporting agency complies with any Australian Privacy Rules made under subsection (3).
Information Commissioner may make rules (3) The Information Commissioner may, by legislative instrument, make rules relating to the use by a credit reporting agency of Credit reporting 15 EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section 116 de-identified information for the purposes of conducting research in relation to the assessment of the credit worthiness of individuals.
(4) Without limiting subsection (3), the rules may relate to the following matters: (a) the kinds of de-identified information that may or may not be used for the purposes of conducting the research; (b) whether or not the research is research in relation to the assessment of the credit worthiness of individuals; (c) the purposes of conducting the research; (d) consultation about the research; (e) how the research is conducted.
Subdivision E—Integrity of credit reporting information 116 Quality of credit reporting information (1) A credit reporting agency must take such steps as are reasonable in the circumstances to ensure that the credit information the agency collects is accurate, up-to-date and complete.

(2) A credit reporting agency must take such steps as are reasonable in the circumstances to ensure that the credit reporting information the agency uses or discloses is accurate, up-to-date, complete and relevant.
(3) Without limiting subsections (1) and (2), a credit reporting agency must: (a) enter into agreements with credit providers that require the providers to ensure that credit information that they disclose to the agency under section 132 is accurate, up-to-date and complete; and (b) ensure that regular audits are conducted by an independent person to determine whether those agreements are being complied with; and (c) identify and deal with suspected breaches of those agreements.
Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section False or misleading credit reporting information Offence (1) A credit reporting agency commits an offence if: (a) the agency uses or discloses credit reporting information under this Division (other than subsection 107(2)); and (b) the information is false or misleading in a material particular.
Penalty: 200 penalty units.

Civil penalty (2) A credit reporting agency must not use or disclose credit reporting information under this Division (other than subsection 107(2)) if the information is false or misleading in a material particular.

Civil penalty: 2,000 penalty units.


118 Security of credit reporting information (1) If a credit reporting agency holds credit reporting information, the agency must take such steps as are reasonable in the circumstances to protect the information: (a) from misuse, interference and loss; and (b) from unauthorised access, modification or disclosure.
(2) Without limiting subsection (1), a credit reporting agency must: (a) enter into agreements with credit providers that require the providers to protect credit reporting information that is disclosed to them under this Division: (i) from misuse, interference and loss; and (ii) from unauthorised access, modification or disclosure; and (b) ensure that regular audits are conducted by an independent person to determine whether those agreements are being complied with; and (c) identify and deal with suspected breaches of those agreements.
Credit reporting 17 EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section 119 Subdivision F—Access to, and correction of, information 119 Access to credit reporting information Access (1) If: (a) a credit reporting agency holds credit reporting information about an individual; and (b) an access seeker in relation to the information requests to be given access to the information; the agency must give the access seeker access to the information.
Exceptions to access (2) Despite subsection (1), the credit reporting agency is not required to give the access seeker access to the credit reporting information to the extent that: (a) giving access would be unlawful; or (b) denying access is required or authorised by or under an Australian law, or an order of a court or tribunal; or (c) giving access would be likely to prejudice one or more enforcement related activities by or on behalf of an enforcement body.
Dealing with requests for access (3) If an access seeker requests a credit reporting agency to give access to credit reporting information, the agency must respond to the request within a reasonable period, but not longer than 10 days, after the request is made.

Means of access (4) If a credit reporting agency gives access to credit reporting information under subsection (1), the access must be given in the manner set out in the Credit Reporting Code.
26 27 28 18 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section 120 Access charges (5) If: (a) an access seeker requests a credit reporting agency to give access to credit reporting information about an individual; and (b) a request of that kind has not been made to the agency in the previous 12 months; the agency must not charge the access seeker for the making of the request or for giving access to the information.
(6) If: (a) an access seeker requests a credit reporting agency to give access to credit reporting information about the individual; and (b) a request of that kind has been made to the agency in the previous 12 months; and (c) the agency charges the access seeker for giving access to the information; the charge must not be excessive and must not apply to the making of the request.
Refusal to give access (7) If: (a) an access seeker requests a credit reporting agency to give access to credit reporting information; and (b) the agency refuses to give access to the information because of subsection (2); the agency must, in writing: (c) give the access seeker reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and (d) notify the access seeker of the effect of sections 157 and 158 (which deal with complaints).
120 Correction of credit reporting information (1) If: Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section (a) a credit reporting agency holds credit reporting information about an individual; and (b) the agency is satisfied that, having regard to a purpose for which the information is held by the agency, the information is inaccurate, out-of-date, incomplete or irrelevant; the agency must take such steps (if any) as are reasonable in the circumstances to correct the information to ensure that, having regard to the purpose for which it is held, the information is accurate, up-to-date, complete and relevant.
(2) If: (a) the credit reporting agency corrects credit reporting information under subsection (1); and (b) the agency has previously disclosed the information under this Division (other than subsections 107(2) and 121(4)); the agency must, within a reasonable period, give each recipient of the information written notice of the correction.
(3) Subsection (2) does not apply if: (a) it is impracticable for the credit reporting agency to give the notice under that subsection; or (b) the credit reporting agency is required by or under an Australian law, or an order of a court or tribunal, not to give the notice under that subsection.

121 Individual may request the correction of credit information etc.
Request (1) An individual may request a credit reporting agency to correct personal information about the individual if: (a) the personal information is: (i) credit information about the individual; or (ii) CRA derived information about the individual; or (iii) CP derived information about the individual; and (b) the agency holds at least one kind of the personal information referred to in paragraph (a).
20 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section 122 Correction (2) If: (a) an individual requests a credit reporting agency to correct personal information under subsection (1); and (b) the agency is satisfied that the information is inaccurate, out-of-date, incomplete or irrelevant; the agency must take such steps (if any) as are reasonable in the circumstances to correct the information within: (c) the period of 30 days that starts on the day on which the request is made; or (d) such longer period as the individual has agreed to in writing.
Consultation (3) If the credit reporting agency considers that the agency cannot be satisfied of the matter referred to in paragraph (2)(b) in relation to the personal information without consulting either or both of the following (the interested party): (a) another credit reporting agency that holds or held the information; (b) a credit provider that holds or held the information; the agency must consult that interested party, or those interested parties, about the individual’s request.
(4) The use or disclosure of personal information about the individual for the purposes of the consultation is taken, for the purposes of this Act, to be a use or disclosure that is authorised by this subsection.

No charge (5) The credit reporting agency must not charge the individual for the making of the request or for correcting the information.

122 Notice of correction etc.


must be given (1) This section applies if an individual requests a credit reporting agency to correct personal information under subsection 121(1).

Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section 123 Notice of correction etc.
(2) If the credit reporting agency corrects the personal information under subsection 121(2), the agency must, within a reasonable period: (a) give the individual written notice of the correction; and (b) if the agency consulted an interested party under subsection 121(3) about the individual’s request—give the party written notice of the correction; and (c) if the correction relates to information that the agency has previously disclosed under this Division (other than subsections 107(2) and 121(4))—give each recipient of the information written notice of the correction.
(3) If the credit reporting agency does not correct the personal information under subsection 121(2), the agency must, within a reasonable period, give the individual written notice that: (a) states that the correction has not been made; and (b) sets out the agency’s reasons for not correcting the information; and (c) sets out the effect of sections 157 and 158 (which deal with complaints).
Exceptions (4) Paragraph (2)(c) does not apply if it is impracticable for the credit reporting agency to give the notice under that paragraph.

(5) Subsection (2) or (3) does not apply if the credit reporting agency is required by or under an Australian law, or an order of a court or tribunal, not to give the notice under that subsection.

Subdivision G—Dealing with credit reporting information after the retention period ends etc.

123 Destruction etc.


of credit reporting information after the retention period ends (1) This section applies if: Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section 123 (a) a credit reporting agency holds credit information about an individual; and (b) the retention period for the information ends.
Note: There is no retention period for identification information or credit information of a kind referred to in paragraph 181(k).

Destruction etc.

of credit information (2) The credit reporting agency must destroy the credit information, or ensure that the information is no longer personal information, within 1 month after the retention period for the information ends.

Civil penalty: 1,000 penalty units.


(3) Despite subsection (2), the credit reporting agency must neither destroy the credit information nor ensure that the information is no longer personal information, if immediately before the retention period ends: (a) there is a pending correction request in relation to the information; or (b) there is a pending dispute in relation to the information.

Civil penalty: 500 penalty units.


(4) Subsection (2) does not apply if the credit reporting agency is required by or under an Australian law, or an order of a court or tribunal, to retain the credit information.

Destruction etc.
of CRA derived information (5) The credit reporting agency must destroy any CRA derived information about the individual that was derived from the credit information, or ensure that the CRA derived information is no longer personal information: (a) if: (i) the CRA derived information was derived from 2 or more kinds of credit information; and (ii) the agency is required to do a thing referred to in subsection (2) to one of those kinds of credit information; Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section 124 at the same time that the agency does that thing to that credit information; or (b) otherwise—at the same time that the agency is required to do a thing referred to in subsection (2) to the credit information from which the CRA derived information was derived.
Civil penalty: 1,000 penalty units.

(6) Despite subsection (5), the credit reporting agency must neither destroy the CRA derived information nor ensure that the information is no longer personal information, if immediately before the retention period ends: (a) there is a pending correction request in relation to the information; or (b) there is a pending dispute in relation to the information.

Civil penalty: 500 penalty units.


(7) Subsection (5) does not apply if the credit reporting agency is required by or under an Australian law, or an order of a court or tribunal, to retain the CRA derived information.

124 Retention period for credit information—general The following table sets out the retention period for credit information: (a) that is information of a kind referred to in an item of the table; and (b) that is held by a credit reporting agency.
Retention period Item If the credit information is ... 1 consumer credit liability information the retention period for the information is ... the period of 2 years that starts on the day on which the consumer credit to which the information relates is terminated or otherwise ceases to be in force.
2 repayment history information the period of 2 years that starts on the 24 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section 125 Retention period Item If the credit information is ... information of a kind referred to in paragraph 181(d) or (e) default information payment information new arrangement information within the meaning of subsection 184(1) new arrangement information within the meaning of subsection 184(2) court proceedings information information of a kind referred to in paragraph 181(l) the retention period for the information is ... day on which the monthly payment to which the information relates is due and payable.
the period of 5 years that starts on the day on which the information request to which the information relates is made.

the period of 5 years that starts on the day on which the credit reporting agency collects the information.

the period of 5 years that starts on the day on which the credit reporting agency collects the default information to which the payment information relates.
the period of 2 years that starts on the day on which the credit reporting agency collects the default information referred to in that subsection.

the period of 2 years that starts on the day on which the credit reporting agency collects the information about the opinion referred to in that subsection.

the period of 5 years that starts on the day on which the judgment to which the information relates is made or given.
the period of 7 years that starts on the day on which the credit reporting agency collects the information.
125 Retention period for credit information—personal insolvency information (1) The following table has effect: Credit reporting 25 EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section 125 Item If personal insolvency information relates to ... 1 a bankruptcy of an individual 2 3 4 5 a personal insolvency agreement to which item 3 of this table does not apply a personal insolvency agreement in relation to which a certificate has been signed under section 232 of the Bankruptcy Act a debt agreement to which item 5 of this table does not apply a debt agreement that ends under section 185N of the Bankruptcy Act the retention period for the information is whichever of the following periods ends later ... (a) the period of 5 years that starts on the day on which the individual becomes a bankrupt; (b) the period of 2 years that starts on the day the bankruptcy ends.
(a) the period of 5 years that starts on the day on which the agreement is executed; (b) the period of 2 years that starts on the day the agreement is terminated or set aside under the Bankruptcy Act.

(a) the period of 5 years that starts on the day on which the agreement is executed; (b) the period that ends on the day on which the certificate is signed.
(a) the period of 5 years that starts on the day on which the agreement is made; (b) the period of 2 years that starts on the day: (i) the agreement is terminated under the Bankruptcy Act; or (ii) an order declaring that all the agreement is void is made under that Act.

(a) the period of 5 years that starts on the day on which the agreement is made; (b) the period that ends on the day on which the agreement ends.
Debt agreement proposals (2) If personal insolvency information relates to a debt agreement proposal, the retention period for the information is the period that ends on the day on which: 26 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section 126 (a) the proposal is withdrawn; or (b) the proposal is not accepted under section 185EC of the Bankruptcy Act; or (c) the acceptance of the proposal for processing is cancelled under section 185ED of that Act; or (d) the proposal lapses under section 185G of that Act.
Control of property (3) If personal insolvency information relates to a direction given, or an order made, under section 50 of the Bankruptcy Act, the retention period for the information is the period that ends on the day on which the control of the property to which the direction or order relates ends.

Note: See subsection 50(1B) of the Bankruptcy Act for when the control of the property ends.
(4) If the personal insolvency information relates to an authority signed under section 188 of the Bankruptcy Act, the retention period for the information is the period that ends on the day on which the property to which the authority relates is no longer subject to control under Division 2 of Part X of that Act.

Interpretation (5) An expression used in this section that is also used in the Bankruptcy Act has the same meaning in this section as it has in that Act.
126 Destruction of credit reporting information in cases of fraud (1) This section applies if: (a) a credit reporting agency holds credit reporting information about an individual; and (b) the information relates to consumer credit that has been provided by a credit provider to the individual, or a person purporting to be the individual; and (c) the agency is satisfied that: (i) the individual has been a victim of fraud (including identity fraud); and Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section (ii) the consumer credit was provided as a result of that fraud.
Destruction of credit reporting information (2) The credit reporting agency must: (a) destroy the credit reporting information; and (b) within a reasonable period after the information is destroyed: (i) give the individual a written notice that states that the information has been destroyed and sets out the effect of subsection (4); and (ii) give the credit provider a written notice that states that the information has been destroyed.

Civil penalty: 1,000 penalty units.


(3) Subsection (2) does not apply if the credit reporting agency is required by or under an Australian law, or an order of a court or tribunal, to retain the credit reporting information.
Notification of destruction to third parties (4) If: (a) a credit reporting agency destroys credit reporting information about an individual under subsection (2); and (b) the agency has previously disclosed the information to one or more recipients under Subdivision D of this Division; and (c) the individual requests the agency to notify all or any of those recipients of the matters referred to in paragraph (1)(c); the agency must, within a reasonable period after the request is made, give that notification.
Civil penalty: 500 penalty units.

(5) Subsection (4) does not apply if the credit reporting agency is required by or under an Australian law, or an order of a court or tribunal, not to give the notification.

28 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section 127 127 Dealing with information if there is a pending correction request etc.
(1) This section applies if a credit reporting agency holds credit reporting information about an individual and either: (a) subsection 123(3) applies in relation to the information; or (b) subsection 123(6) applies in relation to the information.

Notification of Information Commissioner (2) The credit reporting agency must, as soon as practicable, notify in writing the Information Commissioner of the matter referred to in paragraph (1)(a) or (b) of this section.

Civil penalty: 1,000 penalty units.


Use or disclosure (3) The credit reporting agency must not use or disclose the information under Subdivision D of this Division.

Civil penalty: 2,000 penalty units.


(4) However, the credit reporting agency may use or disclose the information under this subsection if: (a) the use or disclosure is for the purposes of the pending correction request, or pending dispute, in relation to the information; or (b) the use or disclosure of the information is required by or under an Australian law, or an order of a court or tribunal.
(5) If the credit reporting agency uses or discloses the information under subsection (4), the agency must make a written note of the use or disclosure.

Civil penalty: 500 penalty units.

Direction to destroy information etc.


(6) The Information Commissioner may, by legislative instrument, direct the credit reporting agency to destroy the information, or Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 2 Credit reporting agencies Section 128 ensure that the information is no longer personal information, by a specified day.
(7) If the Information Commissioner gives a direction under subsection (6) to the credit reporting agency, the agency must comply with the direction.

Civil penalty: 1,000 penalty units.

(8) To avoid doubt, section 115 applies in relation to de-identified information that the credit reporting agency possesses or controls as a result of complying with the direction.

128 Dealing with information if an Australian law etc.
requires it to be retained (1) This section applies if a credit reporting agency is not required: (a) to do a thing referred to in subsection 123(2) to credit information because of subsection 123(4); or (b) to do a thing referred to in subsection 123(5) to CRA derived information because of subsection 123(7); or (c) to destroy credit reporting information under subsection 126(2) because of subsection 126(3).
Use or disclosure (2) The credit reporting agency must not use or disclose the information under Subdivision D of this Division.

Civil penalty: 2,000 penalty units.

(3) However, the credit reporting agency may use or disclose the information under this subsection if the use or disclosure of the information is required by or under an Australian law, or an order of a court or tribunal.
(4) If the credit reporting agency uses or discloses the information under subsection (3), the agency must make a written note of the use or disclosure.

Civil penalty: 500 penalty units.


 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit reporting agencies Division 2 Section 128 Other requirements (5) Subdivision E of this Division (other than section 118) does not apply in relation to the use or disclosure of the information.

Note: Section 118 deals with the security of credit reporting information.
(6) Subdivision F of this Division does not apply in relation to the information.

Credit reporting 31 EXPOSURE DRAFT Part A Credit reporting Division 3 Credit providers Section 129 Division 3—Credit providers Subdivision A—Introduction and application of this Division 129 Guide to this Division This Division sets out rules for credit providers.
Most of the rules relate to the handling of credit information, or credit eligibility information, by credit providers.

The remaining rules relate to specified kinds of personal information.

The rules in this Division apply to credit providers that are APP entities in addition to, or instead of, the Australian Privacy Principles.
130 Application of this Division to credit providers (1) This Division (other than sections 149 and 150) applies to a credit provider in relation to credit information or credit eligibility information.

(2) Sections 149 and 150 apply to a credit provider in relation to credit information, CRA derived information and CP derived information.
(3) If the credit provider is an APP entity, this Division may apply to the provider in relation to information referred to in subsection (1) or (2) in addition to, or instead of, the Australian Privacy Principles.
32 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit providers Division 3 Section Subdivision B—Dealing with credit information 131 Additional notification requirements for the collection of personal information (1) At or before the time a credit provider collects personal information about an individual that the provider is likely to disclose to a credit reporting agency, the provider must: (a) notify the individual of the following matters: (i) the name and contact details of the agency; (ii) any other matter specified in the Credit Reporting Code; or (b) otherwise ensure that the individual is aware of those matters.
(2) If a credit provider is an APP entity, subsection (1) applies to the provider in relation to personal information in addition to Australian Privacy Principle 5.

132 Disclosure of credit information to a credit reporting agency Prohibition on disclosure (1) A credit provider must not disclose credit information about an individual to a credit reporting agency.

Civil penalty: 2,000 penalty units.
Permitted disclosure (2) Subsection (1) does not apply if: (a) the credit provider is a member of a recognised external dispute resolution scheme; and (b) the provider knows, or believes on reasonable grounds, that the individual is at least 18 years old; and (c) the credit information does not relate to an act, omission, matter or thing that occurred or existed before the individual turned 18; and (d) if the information is repayment history information about the individual: Credit reporting 33 EXPOSURE DRAFT Part A Credit reporting Division 3 Credit providers Section 132 (i) the provider is a licensee; and (ii) the consumer credit to which the information relates is consumer credit in relation to which the provider also discloses, or a credit provider has previously disclosed, consumer credit liability information about the individual to the credit reporting agency; and (iii) the provider complies with any requirements relating to the disclosure of the information that are prescribed by the regulations; and (e) if the information is default information about the individual: (i) the provider has given the individual a notice in writing stating that the provider intends to disclose the information to the agency; and (ii) a reasonable period has passed since the giving of the notice.
Note: Section 134 limits the disclosure of credit information if there is a ban period for the information.

(3) Paragraph (2)(c) does not apply to identification information about the individual.
(4) Despite paragraph (2)(c), consumer credit liability information about the individual may relate to consumer credit that was entered into on a day before the individual turned 18, so long as the consumer credit was not terminated, or did not otherwise cease to be in force, on a day before the individual turned 18.

Written note of disclosure (5) If a credit provider discloses credit information under this section, the provider must make a written note of that disclosure.
Civil penalty: 500 penalty units.

Interaction with the Australian Privacy Principles (6) If a credit provider is an APP entity, Australian Privacy Principle 6 does not apply to the disclosure by the provider of credit information to a credit reporting agency.
Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit providers Division 3 Section Payment information must be disclosed to a credit reporting agency If: (a) a credit provider has disclosed default information about an individual to a credit reporting agency under section 132; and (b) after the default information was so disclosed, the amount of the overdue payment to which the information relates is paid; the provider must, within a reasonable period after the amount is paid, disclose payment information about the amount to the agency under that section.
Civil penalty: 500 penalty units.
134 Limitation on the disclosure of credit information during a ban period (1) This section applies if: (a) a credit reporting agency holds credit reporting information about an individual; and (b) a credit provider requests the agency to disclose the information to the provider for the purpose of assessing an application for consumer credit made to the provider by the individual, or a person purporting to be the individual; and (c) the agency is not permitted to disclose the information because there is a ban period for the information; and (d) during the ban period, the provider provides the consumer credit to which the application relates to the individual, or the person purporting to be the individual.
(2) If the credit provider holds credit information about the individual that relates to the consumer credit, the provider must not, despite sections 132 and 133, disclose the information to a credit reporting agency.

Civil penalty: 2,000 penalty units.

(3) Subsection (2) does not apply if the credit provider has taken such steps as are reasonable in the circumstances to verify the identity of the individual.
Credit reporting 35 EXPOSURE DRAFT Part A Credit reporting Division 3 Credit providers Section 135 Subdivision C—Dealing with credit eligibility information etc.

135 Use or disclosure of credit eligibility information Prohibition on use or disclosure (1) If a credit provider holds credit eligibility information about an individual, the provider must not use or disclose the information.

Civil penalty: 2,000 penalty units.
Permitted uses (2) Subsection (1) does not apply to the use of credit eligibility information about the individual if: (a) the use is for a consumer credit related purpose of the credit provider in relation to the individual; or (b) the use is a permitted CP use in relation to the individual; or (c) both of the following apply: (i) the credit provider believes on reasonable grounds that the individual has committed a serious credit infringement; (ii) the provider uses the information in connection with the infringement; or (d) the use is required or authorised by or under an Australian law, or an order of a court or tribunal; or (e) the use is a use prescribed by the regulations.
Permitted disclosures (3) Subsection (1) does not apply to the disclosure of credit eligibility information about the individual if: (a) the disclosure is a permitted CP disclosure in relation to the individual; or (b) the disclosure is to a related body corporate of the credit provider; or (c) the disclosure is to a person: (i) who manages credit provided by the credit provider for use in managing that credit; and 36 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit providers Division 3 Section 135 (ii) who is not acting as an agent of the provider; or (d) both of the following apply: (i) the credit provider believes on reasonable grounds that the individual has committed a serious credit infringement; (ii) the provider discloses the information to another credit provider or an enforcement body; or (e) both of the following apply: (i) the disclosure is for the purposes of a recognised external dispute resolution scheme; (ii) a credit provider or credit reporting agency is a member of the scheme; or (f) the disclosure is required or authorised by or under an Australian law, or an order of a court or tribunal; or (g) the disclosure is a disclosure prescribed by the regulations.
(4) However, if the credit eligibility information about the individual is, or was derived from, repayment history information about the individual, the credit provider must not disclose the information under subsection (3).

Civil penalty: 2,000 penalty units.


(5) Subsection (4) does not apply if: (a) the recipient of the credit eligibility information is another credit provider who is a licensee; or (b) the credit provider discloses the credit eligibility information under paragraph (3)(d) to an enforcement body; or (c) the credit provider discloses the credit eligibility information under paragraph (3)(e) or (f).
Written note of use or disclosure (6) If a credit provider uses or discloses credit eligibility information under this section, the provider must make a written note of that use or disclosure.

Civil penalty: 500 penalty units.


Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 3 Credit providers Section 136 Interaction with the Australian Privacy Principles (7) If a credit provider is an APP entity, Australian Privacy Principles 6 and 7 do not apply to the provider in relation to credit eligibility information.
(8) If: (a) a credit provider is an APP entity; and (b) the credit eligibility information is a government related identifier of the individual; subsection (2) of Australian Privacy Principle 9 does not apply to the provider in relation to the information.
136 Permitted CP uses in relation to individuals A use by a credit provider of credit eligibility information about an individual is a permitted CP use in relation to the individual if: (a) the relevant credit reporting information was disclosed to the provider under a provision specified in column 1 of the table for the purpose (if any) specified in that column; and (b) the provider uses the credit eligibility information for the purpose specified in column 2 of the table.
Permitted CP use Column 1 Item The relevant credit reporting information was disclosed to the credit provider under ... 1 2 item 1 of the table in subsection 109(1) for the purpose of assessing an application for consumer credit made by the individual to the provider.
item 2 of the table in subsection 109(1) for a particular commercial credit related purpose Column 2 The credit provider uses the credit eligibility information for ... (a) a securitisation related purpose of the provider in relation to the individual; or (b) the internal management purposes of the provider that are directly related to the provision or management of consumer credit by the provider.

that particular commercial credit related purpose.


38 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit providers Division 3 Section 137 Permitted CP use Column 1 Item The relevant credit reporting 3 4 5 6 information was disclosed to the credit provider under ... of the provider in relation to the individual.

item 2 of the table in subsection 109(1) for the purpose of assessing an application for commercial credit made by a person to the provider.
item 3 of the table in subsection 109(1) for a credit guarantee purpose of the provider in relation to the individual.

item 5 of the table in subsection 109(1).

item 6 of the table in subsection 109(1) for a particular securitisation related purpose of the provider in relation to the individual.
Column 2 The credit provider uses the credit eligibility information for ... the internal management purposes of the provider that are directly related to the provision or management of commercial credit by the provider.

(a) the credit guarantee purpose; or (b) the internal management purposes of the provider that are directly related to the provision or management of any credit by the provider.
the purpose of assisting the individual to avoid defaulting on his or her obligations in relation to consumer credit provided by the provider to the individual.

that particular securitisation related purpose.
137 Permitted CP disclosures between credit providers Consent (1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if: (a) the disclosure is to another credit provider (the recipient) for a particular purpose; and Credit reporting 39 EXPOSURE DRAFT Part A Credit reporting Division 3 Credit providers Section 137 (b) the individual expressly consents to the disclosure of the information to the recipient for that purpose.
(2) The consent of the individual under paragraph (1)(b): (a) must be given in writing unless: (i) the disclosure of the information to the recipient is for the purpose of assessing an application for consumer credit or commercial credit made to the recipient; and (ii) the application has not been made in writing; and (b) must be given to the credit provider or recipient.
Agents of credit providers (3) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if: (a) the provider is acting as an agent of another credit provider; and (b) while the provider is so acting, the provider is a credit provider under subsection 189(1); and (c) the provider discloses the information to the other credit provider in the provider’s capacity as such an agent.

Securitisation arrangements etc.
(4) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if: (a) the provider is a credit provider under subsection 190(1) in relation to credit; and (b) the credit has been provided by, or is credit for which an application has been made to, another credit provider (the original credit provider); and (c) the original credit provider is not a credit provider under that subsection; and (d) the information is disclosed to: (i) the original credit provider; or (ii) another credit provider who is a credit provider under that subsection in relation to the credit; and 40 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit providers Division 3 Section 138 (e) the disclosure of the information is reasonably necessary for: (i) purchasing, funding or managing, or processing an application for, the credit by means of a securitisation arrangement; or (ii) undertaking credit enhancement in relation to the credit.
Mortgage credit secured by the same real property (5) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if: (a) the disclosure is to another credit provider; and (b) both credit providers have provided mortgage credit to the individual in relation to which the same real property forms all or part of the security; and (c) the individual is at least 60 days overdue in making a payment in relation to the mortgage credit provided by either provider; and (d) the information is disclosed for the purpose of either provider deciding what action to take in relation to the overdue payment.
138 Permitted CP disclosures relating to guarantees etc.

Offer to act as a guarantor etc.
(1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if: (a) either: (i) the provider has provided credit to the individual; or (ii) the individual has applied to the provider for credit; and (b) the disclosure is to a person for the purpose of that person considering whether: (i) to offer to act as a guarantor in relation to the credit; or (ii) to offer property as security for the credit; and (c) the individual expressly consents to the disclosure of the information to the person for that purpose.
Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 3 Credit providers Section 139 (2) The consent of the individual under paragraph (1)(c) must be given in writing unless: (a) if subparagraph (1)(a)(i) applies—the application for the credit was not made in writing; or (b) if subparagraph (1)(a)(ii) applies—the application for the credit has not been made in writing.

Guarantors etc.
(3) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if: (a) the disclosure is to a person who: (i) is a guarantor in relation to credit provided by the provider to the individual; or (ii) has provided property as security for such credit; and (b) either: (i) the individual expressly consents to the disclosure of the information to the person; or (ii) if subparagraph (a)(i) applies—the information is disclosed to the person for a purpose related to the enforcement, or proposed enforcement, of the guarantee.
(4) The consent of the individual under subparagraph (3)(b)(i) must be given in writing unless the application for the credit was not made in writing.
139 Permitted CP disclosures to mortgage insurers A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if the disclosure is to a mortgage insurer: (a) for a mortgage insurance purpose of the insurer in relation to the individual; or (b) for any purpose arising under a contract for mortgage insurance that has been entered into between the provider and the insurer.
Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit providers Division 3 Section 140 140 Permitted CP disclosures to debt collectors (1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if: (a) the disclosure is to a person or body that carries on a business or undertaking that involves the collection of debts on behalf of others; and (b) the information is disclosed for the purpose of the collection of payments that are overdue in relation to: (i) consumer credit provided by the provider to the individual; or (ii) commercial credit provided by the provider to a person; and (c) the information is information of a kind referred to in subsection (2).
(2) The information for the purposes of paragraph (1)(c) is: (a) identification information about the individual; or (b) court proceedings information about the individual; or (c) personal insolvency information about the individual; or (d) if subparagraph (1)(b)(i) applies—default information about the individual if: (i) the information relates to a payment that the individual is overdue in making in relation to consumer credit that has been provided by the credit provider to the individual; and (ii) the provider does not hold, or has not held, payment information about the individual that relates to that overdue payment.
141 Permitted CP disclosures to other recipients Mortgage credit assistance schemes (1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if: (a) the disclosure is to a State or Territory authority; and Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 3 Credit providers Section 141 (b) the functions or responsibilities of the authority include: (i) giving assistance (directly or indirectly) that facilitates the provision of mortgage credit to individuals; or (ii) the management or supervision of schemes or arrangements under which such assistance is given; and (c) the information is disclosed for the purpose of enabling the authority: (i) to determine the extent of the assistance (if any) to give in relation to the provision of mortgage credit to the individual; or (ii) to manage or supervise such a scheme or arrangement.
Assignment of debts owed to credit providers etc.

(2) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if: (a) the disclosure is to one or more of the following (the recipient): (i) an entity; (ii) a professional legal adviser of the entity; (iii) a professional financial adviser of the entity; and (b) subsection (3) applies to the information.
(3) This subsection applies to the credit eligibility information if the recipient proposes to use the information: (a) in the process of the entity considering whether to: (i) accept an assignment of a debt owed to the credit provider; or (ii) accept a debt owed to the provider as security for credit provided to the provider; or (iii) purchase an interest in the provider or a related body corporate of the provider; or (b) in connection with exercising rights arising from the acceptance of such an assignment or debt, or the purchase of such an interest.
Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit providers Division 3 Section 142 142 Notification of a refusal of an application for consumer credit (1) This section applies if: (a) a credit provider refuses an application for consumer credit that is: (i) made by an individual; or (ii) made jointly by an individual and one or more other persons (the other applicants); and (b) the refusal is based wholly or partly on credit eligibility information about one or more of the following: (i) the individual; (ii) a person who is proposing to act as a guarantor in relation to the consumer credit; (iii) if the application is an application of a kind referred to in subparagraph (a)(ii)—one of the other applicants; and (c) a credit reporting agency disclosed the relevant credit reporting information to the provider for the purposes of assessing the application.
(2) The credit provider must, within a reasonable period after refusing the application, give the individual a written notice that: (a) states that the application has been refused; and (b) states that the refusal is based wholly or partly on credit eligibility information about one or more of the persons referred to in paragraph (1)(b); and (c) if that information is about the individual: (i) sets out the name and contact details of the credit reporting agency that disclosed the relevant credit reporting information to the provider; and (ii) sets out any other matter specified in the Credit Reporting Code.
26 27 28 29 Credit reporting 45 EXPOSURE DRAFT Part A Credit reporting Division 3 Credit providers Section 143 26 Subdivision D—Integrity of credit information and credit eligibility information 143 Quality of credit eligibility information (1) A credit provider must take such steps (if any) as are reasonable in the circumstances to ensure that the credit eligibility information the provider collects is accurate, up-to-date and complete.
(2) A credit provider must take such steps (if any) as are reasonable in the circumstances to ensure that the credit eligibility information the provider uses or discloses is accurate, up-to-date, complete and relevant.

(3) If a credit provider is an APP entity, Australian Privacy Principle 10 does not apply to the provider in relation to credit eligibility information.
144 False or misleading credit information or credit eligibility information Offences (1) A credit provider commits an offence if: (a) the provider discloses credit information under section 132; and (b) the information is false or misleading in a material particular.

Penalty: 200 penalty units.

(2) A credit provider commits an offence if: (a) the provider uses or discloses credit eligibility information under this Division; and (b) the information is false or misleading in a material particular.
Penalty: 200 penalty units.

46 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit providers Division 3 Section 145 Civil penalties (3) A credit provider must not disclose credit information under section 132 if the information is false or misleading in a material particular.

Civil penalty: 2,000 penalty units.

(4) A credit provider must not use or disclose credit eligibility information under this Division if the information is false or misleading in a material particular.
Civil penalty: 2,000 penalty units.

145 Security of credit eligibility information (1) If a credit provider holds credit eligibility information, the provider must take such steps as are reasonable in the circumstances to protect the information: (a) from misuse, interference and loss; and (b) from unauthorised access, modification or disclosure.
(2) If: (a) a credit provider holds credit eligibility information about an individual; and (b) the provider no longer needs the information for any purpose for which the information may be used or disclosed by the provider under this Division; and (c) the provider is not required by or under an Australian law, or an order of a court or tribunal, to retain the information; the provider must take such steps as are reasonable in the circumstances to destroy the information or to ensure that the information is no longer personal information.
Civil penalty: 1,000 penalty units.

(3) If a credit provider is an APP entity, Australian Privacy Principle 11 does not apply to the provider in relation to credit eligibility information.
Credit reporting 47 EXPOSURE DRAFT Part A Credit reporting Division 3 Credit providers Section 146 Subdivision E—Access to, and correction of, information 146 Access to credit eligibility information Access (1) If: (a) a credit provider holds credit eligibility information about an individual; and (b) an access seeker in relation to the information requests to be given access to the information; the provider must give the access seeker access to the information.
Exceptions to access (2) Despite subsection (1), the credit provider is not required to give the access seeker access to the credit eligibility information to the extent that: (a) giving access would be unlawful; or (b) denying access is required or authorised by or under an Australian law, or an order of a court or tribunal; or (c) giving access would be likely to prejudice one or more enforcement related activities by or on behalf of an enforcement body.
Dealing with requests for access (3) If an access seeker requests a credit provider to give access to credit eligibility information about the individual, the provider must respond to the request within a reasonable period after the request is made.

Means of access (4) If a credit provider gives access to credit eligibility information under subsection (1), the access must be given in the manner set out in the Credit Reporting Code.
26 27 28 48 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit providers Division 3 Section 146 Access charges (5) If: (a) a credit provider is an agency; and (b) an access seeker requests the provider to give access to credit eligibility information about the individual; the provider must not charge the access seeker for the making of the request or for giving access to the information.
(6) If: (a) a credit provider is an organisation or small business operator; and (b) an access seeker requests the provider to give access to credit eligibility information about the individual; and (c) the provider charges the access seeker for giving access to the information; the charge must not be excessive and must not apply to the making of the request.
Refusal to give access (7) If: (a) an access seeker requests a credit provider to give access to credit eligibility information about the individual; and (b) the provider refuses to give access to the information because of subsection (2); the provider must, in writing: (c) give the access seeker reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and (d) notify the access seeker of the effect of sections 157 and 158 (which deal with complaints).
Interaction with the Australian Privacy Principles (8) If a credit provider is an APP entity, Australian Privacy Principle 12 does not apply to the provider in relation to credit eligibility information.
Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 3 Credit providers Section 147 147 Correction of credit information (1) If: (a) a credit provider holds credit information about an individual; and (b) the provider is satisfied that, having regard to a purpose for which the information is held by the provider, the information is inaccurate, out-of-date, incomplete or irrelevant; the provider must take such steps (if any) as are reasonable in the circumstances to correct the information to ensure that, having regard to the purpose for which it is held, the information is accurate, up-to-date, complete and relevant.
Notice of correction (2) If: (a) the credit provider corrects credit information under subsection (1); and (b) the provider has previously disclosed the information under this Division or under the Australian Privacy Principles; the provider must, within a reasonable period, give each recipient of the information written notice of the correction.
(3) Subsection (2) does not apply if: (a) it is impracticable for the credit provider to give the notice under that subsection; or (b) the credit provider is required by or under an Australian law, or an order of a court or tribunal, not to give the notice under that subsection.
Interaction with the Australian Privacy Principles (4) If a credit provider is an APP entity, Australian Privacy Principle 13: (a) applies to the provider in relation to credit information that is identification information; but (b) does not apply to the provider in relation to any other kind of credit information.
Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit providers Division 3 Section 148 Note: Identification information may be corrected under this section or Australian Privacy Principle 13.
148 Correction of credit eligibility information (1) If: (a) a credit provider holds credit eligibility information about an individual; and (b) the provider is satisfied that, having regard to a purpose for which the information is held by the provider, the information is inaccurate, out-of-date, incomplete or irrelevant; the provider must take such steps (if any) as are reasonable in the circumstances to correct the information to ensure that, having regard to the purpose for which it is held, the information is accurate, up-to-date, complete and relevant.
Notice of correction (2) If: (a) the credit provider corrects credit eligibility information under subsection (1); and (b) the provider has previously disclosed the information under this Division; the provider must, within a reasonable period, give each recipient of the information written notice of the correction.
(3) Subsection (2) does not apply if: (a) it is impracticable for the credit provider to give the notice under that subsection; or (b) the credit provider is required by or under an Australian law, or an order of a court or tribunal, not to give the notice under that subsection.
Interaction with the Australian Privacy Principles (4) If a credit provider is an APP entity, Australian Privacy Principle 13: (a) applies to the provider in relation to credit eligibility information that is identification information; but Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 3 Credit providers Section 149 (b) does not apply to the provider in relation to any other kind of credit eligibility information.
Note: Identification information may be corrected under this section or Australian Privacy Principle 13.

149 Individual may request the correction of credit information etc.
Request (1) An individual may request a credit provider to correct personal information about the individual if: (a) the personal information is: (i) credit information about the individual; or (ii) CRA derived information about the individual; or (iii) CP derived information about the individual; and (b) the provider holds at least one kind of the personal information referred to in paragraph (a).
Correction (2) If: (a) an individual requests a credit provider to correct personal information under subsection (1); and (b) the provider is satisfied that the information is inaccurate, out-of-date, incomplete or irrelevant; the provider must take such steps (if any) as are reasonable in the circumstances to correct the information within: (c) the period of 30 days that starts on the day on which the request is made; or (d) such longer period as the individual has agreed to in writing.
Consultation (3) If the credit provider considers that the provider cannot be satisfied of the matter referred to in paragraph (2)(b) in relation to the personal information without consulting either or both of the following (the interested party): (a) a credit reporting agency that holds or held the information; (b) another credit provider that holds or held the information; 52 Credit reporting EXPOSURE DRAFT Credit reporting Part A Credit providers Division 3 Section 150 the provider must consult that interested party, or those interested parties, about the individual’s request.
(4) The use or disclosure of personal information about the individual for the purposes of the consultation is taken, for the purposes of this Act, to be a use or disclosure that is authorised by this subsection.

No charge (5) The credit provider must not charge the individual for the making of the request or for correcting the information.
Interaction with the Australian Privacy Principles (6) If a credit provider is an APP entity, Australian Privacy Principle 13: (a) applies to the provider in relation to personal information referred to in paragraph (1)(a) of this section that is identification information; but (b) does not apply to the provider in relation to any other kind of personal information referred to in that paragraph.

Note: Identification information may be corrected under this section or Australian Privacy Principle 13.
150 Notice of correction etc.

must be given (1) This section applies if an individual requests a credit provider to correct personal information under subsection 149(1).

Notice of correction etc.
(2) If the credit provider corrects personal information about the individual under subsection 149(2), the provider must, within a reasonable period: (a) give the individual written notice of the correction; and (b) if the provider consulted an interested party under subsection 149(3) about the individual’s request—give the party written notice of the correction; and Credit reporting 53 EXPOSURE DRAFT Part A Credit reporting Division 3 Credit providers Section 150 (c) if the correction relates to information that the provider has previously disclosed under this Division (other than subsection 149(4)) or under the Australian Privacy Principles (other than subsection 5(2))—must give each recipient of the information written notice of the correction.
(3) If the credit provider does not correct the personal information under subsection 149(2), the provider must, within a reasonable period, give the individual written notice that: (a) states that the correction has not been made; and (b) sets out the provider’s reasons for not correcting the information; and (c) sets out the effect of sections 157 and 158 (which deal with complaints).
Exceptions (4) Paragraph (2)(c) does not apply if it is impracticable for the credit provider to give the notice under that paragraph.

(5) Subsection (2) or (3) does not apply if the credit provider is required by or under an Australian law, or an order of a court or tribunal, not to give the notice under that subsection.
54 Credit reporting EXPOSURE DRAFT Credit reporting Part A Other recipients of information Division 4 Section 151 Division 4—Other recipients of information 151 Guide to this Division This Division sets out rules for certain recipients of information that has been disclosed by credit reporting agencies or credit providers under this Part.

The rules in this Division apply to recipients that are APP entities instead of any relevant Australian Privacy Principles.
152 Use or disclosure of information by mortgage insurers and trade insurers Prohibition on use or disclosure (1) If: (a) a mortgage insurer or trade insurer holds or held personal information about an individual; and (b) the information was disclosed to the insurer by a credit reporting agency or credit provider under this Part; the insurer must not use or disclose the information, or any personal information about the individual derived from that information.

Civil penalty: 2,000 penalty units.
Permitted uses (2) Subsection (1) does not apply to the use of the information if: (a) for the mortgage insurer—the use is for: (i) a mortgage insurance purpose of the insurer in relation to the individual; or (ii) any purpose arising under a contract for mortgage insurance that has been entered into between the credit provider and the insurer; or Credit reporting 55 26 27 28 EXPOSURE DRAFT Part A Credit reporting Division 4 Other recipients of information Section 153 (b) for the trade insurer—the use is for a trade insurance purpose of the insurer in relation to the individual; or (c) the use is required or authorised by or under an Australian law, or an order of a court or tribunal.
Permitted disclosure (3) Subsection (1) does not apply to the disclosure of the information if the disclosure is required or authorised by or under an Australian law, or an order of a court or tribunal.

Interaction with the Australian Privacy Principles (4) If the mortgage insurer or trade insurer referred to in subsection (1) is an APP entity, Australian Privacy Principles 6 and 7 do not apply to the insurer in relation to the information referred to in that subsection.
(5) If: (a) the mortgage insurer or trade insurer referred to in subsection (1) is an APP entity; and (b) the information referred to in that subsection is a government related identifier of the individual; subsection (2) of Australian Privacy Principle 9 does not apply to the insurer in relation to the information.
153 Use or disclosure of information by a related body corporate Prohibition on use or disclosure (1) If: (a) a body corporate holds or held credit eligibility information about an individual; and (b) the information was disclosed to the body by a credit provider under paragraph 135(3)(b); the body must not use or disclose the information, or any personal information about the individual derived from that information.

Civil penalty: 1,000 penalty units.


 Credit reporting EXPOSURE DRAFT Credit reporting Part A Other recipients of information Division 4 Section 154 Permitted uses or disclosures (2) Subsection (1) does not apply to the use or disclosure of the information by the body corporate if the body would be permitted to use or disclose the information under section 135 if the body were the credit provider.
(3) In determining whether the body corporate would be permitted to use or disclose the information under section 135, assume that the body is whichever of the following is applicable: (a) the credit provider that has provided the relevant credit to the individual; (b) the credit provider to which the relevant application for credit was made by the individual.
Interaction with the Australian Privacy Principles (4) If the body corporate referred to in subsection (1) is an APP entity, Australian Privacy Principles 6 and 7 do not apply to the body in relation to the information referred to in that subsection.
(5) If: (a) the body corporate referred to in subsection (1) is an APP entity; and (b) the information referred to in that subsection is a government related identifier of the individual; subsection (2) of Australian Privacy Principle 9 does not apply to the body in relation to the information.
154 Use or disclosure of information by credit managers Prohibition on use or disclosure (1) If: (a) a person holds or held credit eligibility information about an individual; and (b) the information was disclosed to the person by a credit provider under paragraph 135(3)(c) for use in managing credit provided by the provider; Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 4 Other recipients of information Section 155 the person must not use or disclose the information, or any personal information about the individual derived from that information.
Civil penalty: 1,000 penalty units.

Permitted uses (2) Subsection (1) does not apply to the use of the information if: (a) the person uses the information in managing credit provided by the credit provider; or (b) the use is required or authorised by or under an Australian law, or an order of a court or tribunal.
Permitted disclosure (3) Subsection (1) does not apply to the disclosure of the information if the disclosure is required or authorised by or under an Australian law, or an order of a court or tribunal.

Interaction with the Australian Privacy Principles (4) If the person referred to in subsection (1) is an APP entity, Australian Privacy Principles 6 and 7 do not apply to the person in relation to the information referred to in that subsection.
(5) If: (a) the person referred to in subsection (1) is an APP entity; and (b) the information referred to in that subsection is a government related identifier of the individual; subsection (2) of Australian Privacy Principle 9 does not apply to the person in relation to the information.

155 Use or disclosure of information by advisers etc.
Prohibition on use or disclosure (1) If: (a) any of the following (the recipient) holds or held credit eligibility information about an individual: 58 Credit reporting 26 27 28 29 EXPOSURE DRAFT Credit reporting Part A Other recipients of information Division 4 Section 155 (i) an entity; (ii) a professional legal adviser of the entity; (iii) a professional financial adviser of the entity; and (b) the information was disclosed to the recipient by a credit provider under subsection 141(2); the recipient must not use or disclose the information, or any personal information about the individual derived from that information.
Civil penalty: 1,000 penalty units.
Permitted uses (2) Subsection (1) does not apply to the use of the information if: (a) for a recipient that is the entity—the information is used for a matter referred to in subsection 141(3); or (b) for a recipient that is the professional legal adviser, or professional financial adviser, of the entity—the information is used: (i) in the adviser’s capacity as an adviser of the entity; and (ii) in connection with advising the entity about a matter referred to in subsection 141(3); or (c) the use is required or authorised by or under an Australian law, or an order of a court or tribunal.
Permitted disclosure (3) Subsection (1) does not apply to the disclosure of the information if the disclosure is required or authorised by or under an Australian law, or an order of a court or tribunal.

Interaction with the Australian Privacy Principles (4) If a recipient is an APP entity, Australian Privacy Principles 6 and 7 do not apply to the recipient in relation to the information referred to in subsection (1) of this section.
(5) If: (a) a recipient is an APP entity; and Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 4 Other recipients of information Section 155 (b) the information referred to in subsection (1) is a government related identifier of the individual; subsection (2) of Australian Privacy Principle 9 does not apply to the recipient in relation to the information.
60 Credit reporting EXPOSURE DRAFT Credit reporting Part A Complaints Division 5 Section 156 26 27 Division 5—Complaints 156 Guide to this Division This Division deals with complaints about credit reporting agencies or credit providers.

Individuals may complain if credit reporting agencies or credit providers do not give access to, or correct, personal information.
They may also complain about acts or practices that may be a credit reporting infringement.

If a complaint is made, the respondent for the complaint must investigate the complaint and make a determination about the complaint.
157 Individual may complain to a credit reporting agency or credit provider Complaints relating to access or correction (1) An individual may complain to a credit reporting agency if: (a) the agency refuses to give access to credit reporting information about the individual because of subsection 119(2); or (b) the agency does not correct personal information under subsection 121(2).
(2) An individual may complain to a credit provider if: (a) the provider refuses to give access to credit eligibility information about the individual because of subsection 146(2); or (b) the provider does not correct personal information under subsection 149(2).
Credit reporting 61 EXPOSURE DRAFT Part A Credit reporting Division 5 Complaints Section 158 Complaints about credit reporting infringements (3) An individual may complain to a credit reporting agency about an act or practice engaged in by the agency that may be a credit reporting infringement in relation to the individual.

(4) An individual may complain to a credit provider about an act or practice engaged in by the provider that may be a credit reporting infringement in relation to the individual.
Nature of complaint (5) If an individual makes a complaint, the individual must specify the nature of the complaint.

(6) The complaint may relate to personal information that has been destroyed or that is no longer personal information.

No charge (7) The credit reporting agency or credit provider must not charge the individual for the making of the complaint or for dealing with the complaint.
158 Dealing with complaints (1) If an individual makes a complaint under section 157, the respondent for the complaint: (a) must, within 7 days after the complaint is made, give the individual a written notice that: (i) acknowledges the making of the complaint; and (ii) sets out how the respondent will deal with the complaint; and (b) must investigate the complaint.
Consultation about the complaint (2) If the respondent for the complaint considers that it is necessary to consult a credit reporting agency or credit provider about the complaint, the respondent must consult the agency or provider.
Credit reporting EXPOSURE DRAFT Credit reporting Part A Complaints Division 5 Section 159 (3) The use or disclosure of personal information about the individual for the purposes of the consultation is taken, for the purposes of this Act, to be a use or disclosure that is authorised by this subsection.
Determination about the complaint (4) After investigating the complaint, the respondent must, within the period referred to in subsection (5), make a determination about the complaint and give the individual a written notice that: (a) sets out the determination; and (b) explains that, if the individual is not satisfied with the determination, the individual may: (i) access a recognised external dispute resolution scheme of which the respondent is a member; or (ii) make a complaint to the Information Commissioner under this Act.
(5) The period for the purposes of subsection (4) is: (a) the period of 30 days that starts on the day on which the complaint is made; or (b) such longer period as the individual has agreed to in writing.
Failure to make a determination (6) If, at the end of the period referred to in subsection (5) that applies in relation to the complaint, the respondent has not made a determination about the complaint, the individual may: (a) access a recognised external dispute resolution scheme of which the respondent is a member; or (b) make a complaint to the Information Commissioner under this Act.
159 Notification requirements relating to certain complaints (1) This section applies if: (a) an individual makes a complaint under paragraph 157(1)(b) or (2)(b); or Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 5 Complaints Section 159 (b) an individual makes a complaint under subsection 157(3) about an act or practice that may contravene section 120 or 121 (which deal with the correction of personal information by credit reporting agencies); or (c) an individual makes a complaint under subsection 157(4) about an act or practice that may contravene section 147, 148 or 149 (which deal with the correction of personal information by credit providers).
Notification of complaint etc.

(2) If: (a) the respondent for the complaint is a credit reporting agency; and (b) the complaint relates to credit information or credit eligibility information that a credit provider holds; the respondent must, in writing: (c) notify the provider of the making of the complaint as soon as practicable after it is made; and (d) notify the provider of the making of a determination about the complaint under subsection 158(4) as soon as practicable after it is made.
(3) If: (a) the respondent for the complaint is a credit provider; and (b) the complaint relates to: (i) credit reporting information that a credit reporting agency holds; or (ii) credit information or credit eligibility information that another credit provider holds; the respondent must, in writing: (c) notify the agency or other provider (as the case may be) of the making of the complaint as soon as practicable after it is made; and (d) notify the agency or other provider (as the case may be) of the making of a determination about the complaint under subsection 158(4) as soon as practicable after it is made.
Credit reporting EXPOSURE DRAFT Credit reporting Part A Complaints Division 5 Section 159 Notification of recipients of disclosed information (4) If: (a) a credit reporting agency discloses credit reporting information to which the complaint relates under Division 2 of this Part; and (b) at the time of the disclosure, a determination about the complaint under subsection 158(4) has not been made; the agency must, at that time, notify in writing the recipient of the information of the complaint.
(5) If: (a) a credit provider discloses personal information to which the complaint relates under Division 3 of this Part or under the Australian Privacy Principles; and (b) at the time of the disclosure, a determination about the complaint under subsection 158(4) has not been made; the provider must, at that time, notify in writing the recipient of the information of the complaint.
Exceptions (6) Subsection (2), (3), (4) or (5) does not apply if: (a) it is impracticable for the credit reporting agency or credit provider to give the notification under that subsection; or (b) the credit reporting agency or credit provider is required by or under an Australian law, or an order of a court or tribunal, not to give the notification under that subsection.
Credit reporting 65 EXPOSURE DRAFT Part A Credit reporting Division 6 Unauthorised obtaining of credit reporting information etc.

Section 160 26 27 28 Division 6—Unauthorised obtaining of credit reporting information etc.
160 Obtaining credit reporting information from a credit reporting agency Offences (1) An entity commits an offence if: (a) the entity obtains credit reporting information; and (b) the information is obtained from a credit reporting agency; and (c) the entity is not: (i) an entity to which the agency is permitted to disclose the information under Division 2 of this Part; or (ii) an access seeker for the information.

Penalty: 200 penalty units.


(2) An entity commits an offence if: (a) the entity obtains credit reporting information; and (b) the information is obtained from a credit reporting agency; and (c) the information is obtained by false pretence.

Penalty: 200 penalty units.


Civil penalties (3) An entity must not obtain credit reporting information from a credit reporting agency if the entity is not: (a) an entity to which the agency is permitted to disclose the information under Division 2 of this Part; or (b) an access seeker for the information.

Civil penalty: 2,000 penalty units.

66 Credit reporting EXPOSURE DRAFT Credit reporting Part A Unauthorised obtaining of credit reporting information etc.
Division 6 Section 161 (4) An entity must not obtain, by false pretence, credit reporting information from a credit reporting agency.

Civil penalty: 2,000 penalty units.


161 Obtaining credit eligibility information from a credit provider Offences (1) An entity commits an offence if: (a) the entity obtains credit eligibility information; and (b) the information is obtained from a credit provider; and (c) the entity is not: (i) an entity to which the provider is permitted to disclose the information under Division 3 of this Part; or (ii) an access seeker for the information.

Penalty: 200 penalty units.


(2) An entity commits an offence if: (a) the entity obtains credit eligibility information; and (b) the information is obtained from a credit provider; and (c) the information is obtained by false pretence.

Penalty: 200 penalty units.


Civil penalties (3) An entity must not obtain credit eligibility information from a credit provider if the entity is not: (a) an entity to which the provider is permitted to disclose the information under Division 3 of this Part; or (b) an access seeker for the information.

Civil penalty: 2,000 penalty units.

(4) An entity must not obtain, by false pretence, credit eligibility information from a credit provider.

Civil penalty: 2,000 penalty units.
Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 7 Civil penalty orders Section 162 Division 7—Civil penalty orders Subdivision A—Civil penalty provisions 162 Civil penalty provisions A subsection of this Act (or a section of this Act that is not divided into subsections) is a civil penalty provision if the words “civil penalty” and one or more amounts in penalty units are set out at the foot of the subsection (or section).
163 Ancillary contravention of civil penalty provisions (1) An entity must not: (a) attempt to contravene a civil penalty provision; or (b) aid, abet, counsel or procure a contravention of a civil penalty provision; or (c) induce (by threats, promises or otherwise) a contravention of a civil penalty provision; or (d) be in any way, directly or indirectly, knowingly concerned in, or party to, a contravention of a civil penalty provision; or (e) conspire with others to effect a contravention of a civil penalty provision.
(2) An entity that contravenes subsection (1) in relation to a civil penalty provision is taken to have contravened the provision.

Subdivision B—Obtaining a civil penalty order 164 Civil penalty orders Application for order (1) Within 6 years of an entity contravening a civil penalty provision, the Information Commissioner may apply to the Federal Court or Federal Magistrates Court for an order that the entity pay the Commonwealth a pecuniary penalty.
68 Credit reporting 26 27 28 EXPOSURE DRAFT Credit reporting Part A Civil penalty orders Division 7 Section 165 Court may order entity to pay pecuniary penalty (2) If the court is satisfied that the entity has contravened a civil penalty provision, the court may order the entity to pay to the Commonwealth a pecuniary penalty.

(3) An order under subsection (2) is a civil penalty order.
Determining pecuniary penalty (4) The pecuniary penalty must not be more than: (a) if the entity is a body corporate—5 times the maximum number of penalty units referred to in the civil penalty provision; or (b) otherwise—the maximum number of penalty units referred to in the civil penalty provision.
(5) In determining the pecuniary penalty, the court must take into account all relevant matters, including: (a) the nature and extent of the contravention; and (b) the nature and extent of any loss or damage suffered because of the contravention; and (c) the circumstances in which the contravention took place; and (d) whether the entity has previously been found by a court in proceedings under this Act to have engaged in any similar conduct.
165 Civil enforcement of penalty (1) A pecuniary penalty is a debt payable to the Commonwealth.

(2) The Commonwealth may enforce a civil penalty order as if it were an order made in civil proceedings against the entity to recover a debt due by the entity.

The debt arising from the order is taken to be a judgment debt.
166 Conduct contravening more than one civil penalty provision (1) If conduct constitutes a contravention of 2 or more civil penalty provisions, proceedings may be instituted under this Division Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 7 Civil penalty orders Section 167 against an entity in relation to the contravention of any one or more of those provisions.
(2) However, the entity is not liable to more than one pecuniary penalty under this Division in relation to the same conduct.

167 Multiple contraventions (1) The Federal Court or Federal Magistrates Court may make a single civil penalty order against an entity for multiple contraventions of a civil penalty provision if: (a) proceedings for the contraventions are founded on the same facts; or (b) the contraventions form, or are part of, a series of contraventions of the same or a similar character.
(2) However, the pecuniary penalty must not exceed the sum of the maximum pecuniary penalties that could be ordered if a separate civil penalty order were made for each of the contraventions.

168 Two or more proceedings may be heard together The Federal Court or Federal Magistrates Court may direct that 2 or more proceedings for civil penalty orders are to be heard together.
169 Civil evidence and procedure rules for civil penalty orders The Federal Court or Federal Magistrates Court must apply the rules of evidence and procedure for civil matters when hearing proceedings for a civil penalty order.

170 Contravening a civil penalty provision is not an offence A contravention of a civil penalty provision is not an offence.
70 Credit reporting EXPOSURE DRAFT Credit reporting Part A Civil penalty orders Division 7 Section Subdivision C—Civil proceedings and criminal proceedings 171 Civil proceedings after criminal proceedings The Federal Court or Federal Magistrates Court must not make a civil penalty order against an entity for a contravention of a civil penalty provision if the entity has been convicted of an offence constituted by conduct that is substantially the same as the conduct constituting the contravention.
172 Criminal proceedings during civil proceedings (1) Proceedings for a civil penalty order against an entity for a contravention of a civil penalty provision are stayed if: (a) criminal proceedings are commenced or have already been commenced against the entity for an offence; and (b) the offence is constituted by conduct that is the same, or substantially the same, as the conduct alleged to constitute the contravention.
(2) The proceedings for the civil penalty order may be resumed if the entity is not convicted of the offence.

Otherwise, those proceedings are dismissed.

173 Criminal proceedings after civil proceedings Criminal proceedings may be commenced against an entity for conduct that is substantially the same as conduct constituting a contravention of a civil penalty provision regardless of whether a civil penalty order in relation to the contravention has been made against the entity.
174 Evidence given in proceedings for civil penalty order not admissible in criminal proceedings (1) Evidence of information given, or evidence of production of documents, by an individual is not admissible in criminal proceedings against the individual if: (a) the individual previously gave the evidence or produced the documents in proceedings for a civil penalty order against the Credit reporting 71 EXPOSURE DRAFT Part A Credit reporting Division 7 Civil penalty orders Section 174 individual for a contravention of a civil penalty provision (whether or not the order was made); and (b) the conduct alleged to constitute the offence is the same, or substantially the same, as the conduct alleged to constitute the contravention.
(2) However, subsection (1) does not apply to criminal proceedings in relation to the falsity of the evidence given by the individual in the proceedings for the civil penalty order.
72 Credit reporting EXPOSURE DRAFT Credit reporting Part A Miscellaneous Division 8 Section 175 Division 8—Miscellaneous 175 Treatment of partnerships (1) If, apart from this subsection, this Part would impose an obligation on a partnership, the obligation is imposed instead on each partner but may be discharged by any of the partners.

(2) If, apart from this subsection, a credit reporting offence would be committed by a partnership, the offence is taken to have been committed by each partner.
(3) If, apart from this subsection, a partnership would contravene a civil penalty provision, the contravention is taken to have been committed by each partner.
(4) A partner does not commit a credit reporting offence because of subsection (2), or contravene a civil penalty provision because of subsection (3), if the partner: (a) does not know of the circumstances that constitute the contravention of the provision concerned; or (b) knows of those circumstances but takes all reasonable steps to correct the contravention as soon as possible after the partner becomes aware of those circumstances.
Note: In criminal proceedings, a defendant bears an evidential burden in relation to the matters in subsection (4) (see subsection 13.3(3) of the Criminal Code).

176 Treatment of unincorporated associations (1) If, apart from this subsection, this Part would impose an obligation on an unincorporated association, the obligation is imposed instead on each member of the association’s committee of management but may be discharged by any of the members.
(2) If, apart from this subsection, a credit reporting offence would be committed by an unincorporated association, the offence is taken to have been committed by each member of the association’s committee of management.
Credit reporting EXPOSURE DRAFT Part A Credit reporting Division 8 Miscellaneous Section 177 (3) If, apart from this subsection, an unincorporated association would contravene a civil penalty provision, the contravention is taken to have been committed by each member of the association’s committee of management.
(4) A member of an unincorporated association’s committee of management does not commit a credit reporting offence because of subsection (2), or contravene a civil penalty provision because of subsection (3), if the member: (a) does not know of the circumstances that constitute the contravention of the provision concerned; or (b) knows of those circumstances but takes all reasonable steps to correct the contravention as soon as possible after the member becomes aware of those circumstances.
Note: In criminal proceedings, a defendant bears an evidential burden in relation to the matters in subsection (4) (see subsection 13.3(3) of the Criminal Code).

177 Treatment of trusts (1) If, apart from this subsection, this Part would impose an obligation on a trust, the obligation is imposed instead on each trustee of the trust but may be discharged by any of the trustees.
(2) If, apart from this subsection, a credit reporting offence would be committed by a trust, the offence is taken to have been committed by each trustee of the trust.

(3) If, apart from this subsection, a trust would contravene a civil penalty provision, the contravention is taken to have been committed by each trustee of the trust.
(4) A trustee of a trust does not commit a credit reporting offence because of subsection (2), or contravene a civil penalty provision because of subsection (3), if the trustee: (a) does not know of the circumstances that constitute the contravention of the provision concerned; or (b) knows of those circumstances but takes all reasonable steps to correct the contravention as soon as possible after the trustee becomes aware of those circumstances.
Credit reporting EXPOSURE DRAFT Credit reporting Part A Miscellaneous Division 8 Section Note: In criminal proceedings, a defendant bears an evidential burden in relation to the matters in subsection (4) (see subsection 13.3(3) of the Criminal Code).
178 Conduct of directors, employees or agents of bodies corporate (1) If, in enforcement proceedings in relation to conduct engaged in by a body corporate, it is necessary to establish the state of mind of the body corporate, it is sufficient to show: (a) that a director, employee or agent of the body engaged in that conduct within the scope of his or her actual or apparent authority; and (b) that the director, employee or agent had the state of mind.
(2) If: (a) a director, employee or agent of a body corporate engages in conduct on behalf of the body; and (b) the conduct is within the scope of the actual or apparent authority of the director, employee or agent; the conduct is taken, for the purposes of enforcement proceedings, to have also been engaged in by the body unless the body establishes that it took reasonable precautions and exercised due diligence to avoid the conduct.
179 Conduct of employees or agents of persons other than bodies corporate (1) If, in enforcement proceedings in relation to conduct engaged in by a person other than a body corporate, it is necessary to establish the state of mind of the person, it is sufficient to show: (a) that an employee or agent of the person engaged in that conduct within the scope of his or her actual or apparent authority; and (b) that the employee or agent had the state of mind.
(2) If: (a) an employee or agent of a person other than a body corporate engages in conduct on behalf of the person; and (b) the conduct is within the scope of the actual or apparent authority of the employee or agent; Credit reporting 75 EXPOSURE DRAFT Part A Credit reporting Division 8 Miscellaneous Section 179 the conduct is taken, for the purposes of enforcement proceedings, to have also been engaged in by the person unless the person establishes that the person took reasonable precautions and exercised due diligence to avoid the conduct.
76 Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions Division 1 Section 180 Part B—Other relevant provisions Division 1—Definitions 180 Definitions In this Act: access seeker: see subsection 192(1).

agency: see section 16. amount of credit: see subsection 193(2).

APP entity means an agency or organisation.

Australia, when used in a geographical sense, includes the external Territories.
Australian law means: (a) an Act of the Commonwealth or of a State or Territory; or (b) regulations, or any other instrument, made under such an Act; or (c) a rule of common law or equity.
Australian Privacy Principle has a meaning affected by section 18. bank means: (a) the Reserve Bank of Australia; or (b) a body corporate that is an authorised deposit-taking institution within the meaning of the Banking Act 1959; or (c) a person who carries on State banking within the meaning of paragraph 51(xiii) of the Constitution.

Bankruptcy Act means the Bankruptcy Act 1966. ban period: see subsection 113(3).
Credit reporting 77 EXPOSURE DRAFT Part B Other relevant provisions Division 1 Definitions Section 180 child: without limiting paragraph (b) of the definition of family in this section, someone is a child of an individual for the purposes of that paragraph if he or she is a child of the individual within the meaning of the Family Law Act 1975. civil penalty order: see subsection 164(3).
civil penalty provision: see section 162. collects: an entity collects personal information only if the entity collects personal information for inclusion in a record or generally available publication.

commercial credit means credit (other than consumer credit) that is applied for by, or provided to, a person.
commercial credit related purpose of a credit provider in relation to a person is the purpose of: (a) assessing an application for commercial credit made by the person to the provider; or (b) the collection of payments that are overdue in relation to commercial credit provided by the provider to the person.

committee of management of an unincorporated association means a body (however described) that governs, manages or conducts the affairs of the association.
Commonwealth enactment means: (a) an Act of the Commonwealth other than: (i) the Australian Capital Territory (Self-Government) Act 1988; or (ii) the Northern Territory (Self-Government) Act 1978; or (iii) an Act of the Commonwealth providing for the administration or government of an external Territory; or (b) an Ordinance of the Australian Capital Territory; or (c) an instrument (including rules, regulations or by-laws) made under: (i) an Act of the Commonwealth, other than an Act referred to in subparagraph (a)(i), (ii) or (iii); or Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions Division 1 Section 180 (ii) an Ordinance of the Australian Capital Territory; or (d) any other legislation to the extent that it applies: (i) as a law of the Commonwealth, other than legislation in so far as it is applied by an Act referred to in subparagraph (a)(ii) or (iii); or (ii) as a law of the Australian Capital Territory.
consent means express consent or implied consent.
consumer credit means credit: (a) for which an application has been made by an individual to a credit provider, or that has been provided to an individual by a credit provider, in the course of the provider carrying on a business or undertaking as a credit provider; and (b) that is intended to be used wholly or primarily: (i) for personal, family or household purposes; or (ii) to acquire, maintain, renovate or improve residential property for investment purposes; or (iii) to refinance consumer credit that has been provided wholly or primarily to acquire, maintain, renovate or improve residential property for investment purposes.
consumer credit liability information: if a credit provider provides consumer credit to an individual, the following information about the consumer credit is consumer credit liability information about the individual: (a) the name of the provider; (b) whether the provider is a licensee; (c) the type of consumer credit; (d) the day on which the consumer credit is entered into; (e) the terms or conditions of the consumer credit: (i) that relate to the repayment of the amount of credit; and (ii) that are prescribed by the regulations; (f) the maximum amount of credit available under the consumer credit; (g) the day on which the consumer credit is terminated or otherwise ceases to be in force.
Credit reporting EXPOSURE DRAFT Part B Other relevant provisions Division 1 Definitions Section 180 consumer credit related purpose of a credit provider in relation to an individual is the purpose of: (a) assessing an application for consumer credit made by the individual to the provider; or (b) the collection of payments that are overdue in relation to consumer credit provided by the provider to the individual.
corporation means a body corporate that: (a) is a foreign corporation (within the meaning of paragraph 51(xx) of the Constitution); or (b) is a trading or financial corporation (within the meaning of that paragraph) formed within the limits of Australia; or (c) is incorporated in a Territory, other than the Northern Territory.
court proceedings information about an individual means information about a judgment of an Australian court: (a) that is made or given against the individual in proceedings (other than criminal proceedings); and (b) that relates to any credit that has been provided to, or applied for by, the individual.
CP derived information about an individual means any personal information (other than sensitive information) about the individual: (a) that is derived from credit reporting information about the individual that was disclosed to a credit provider by a credit reporting agency under Division 2 of Part A; and (b) that has any bearing on the individual’s credit worthiness; and (c) that is used, has been used or could be used in establishing the individual’s eligibility for consumer credit.
CRA derived information about an individual means any personal information (other than sensitive information) about the individual: (a) that is derived by a credit reporting agency from credit information about the individual that is held by the agency; and (b) that has any bearing on the individual’s credit worthiness; and 80 Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions Division 1 Section 180 (c) that is used, has been used or could be used in establishing the individual’s eligibility for consumer credit.
credit: see subsections 193(1) and (3).

credit card means an article that is one or more of the following: (a) an article of a kind commonly known as a credit card or charge card; (b) a similar article intended for use in obtaining cash, goods or services by means of credit; (c) an article of a kind that persons carrying on business commonly issue to customers, or prospective customers, for use in obtaining goods or services from those persons by means of credit.
credit eligibility information about an individual means: (a) credit reporting information about the individual that was disclosed to a credit provider by a credit reporting agency under Division 2 of Part A; or (b) CP derived information about the individual.
credit enhancement, in relation to credit, means: (a) the process of insuring risk associated with purchasing or funding the credit by means of a securitisation arrangement; or (b) any other similar process related to purchasing or funding the credit by those means.
credit guarantee purpose of a credit provider in relation to an individual is the purpose of assessing whether to accept the individual as a guarantor in relation to: (a) credit provided by the provider to a person other than the individual; or (b) credit for which an application has been made to the provider by a person other than the individual.
credit information: see section 181. credit provider: see sections 188 to 191. credit reporting agency means: Credit reporting EXPOSURE DRAFT Part B Other relevant provisions Division 1 Definitions Section 180 (a) an organisation; or (b) a small business operator; or (c) an agency prescribed by the regulations; that carries on a credit reporting business.

credit reporting business: see subsections 194(1) and (4).
credit reporting information about an individual means credit information, or CRA derived information, about the individual.

credit reporting infringement means a contravention of a provision of Part A or the Credit Reporting Code.
credit reporting offence means: (a) an offence against a provision of Part A; or (b) an offence against section 6 of the Crimes Act 1914 if the offence relates to an offence referred to in paragraph (a) of this definition; or (c) an offence against section 11.1, 11.2, 11.2A, 11.4 or 11.5 of the Criminal Code if the offence relates to an offence referred to in paragraph (a) of this definition.
credit worthiness of an individual means the individual’s: (a) eligibility to be provided with consumer credit; or (b) history in relation to consumer credit; or (c) capacity to repay an amount of credit that relates to consumer credit.

de facto partner has the meaning given by the Acts Interpretation Act 1901. default information: see section 182. de-identified information means credit reporting information that is no longer personal information.
enforcement body means: (a) the Australian Federal Police; or (b) the Australian Commission for Law Enforcement Integrity; or (c) the Australian Crime Commission; or 82 Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions Division 1 Section 180 (d) the CrimTrac Agency; or (e) Customs; or (f) the Australian Prudential Regulation Authority; or (g) the Australian Securities and Investments Commission; or (h) the Office of the Director of Public Prosecutions, or a similar body established under a law of a State or Territory; or (i) the police force or police service of a State or Territory; or (j) the Independent Commission Against Corruption of New South Wales; or (k) the New South Wales Crime Commission; or (l) the Police Integrity Commission of New South Wales; or (m) the Office of Police Integrity of Victoria; or (n) the Crime and Misconduct Commission of Queensland; or (o) the Corruption and Crime Commission of Western Australia; or (p) another agency, or State or Territory authority, to the extent that it is responsible for: (i) administering, or performing a function under, a law that imposes a penalty or sanction, or a law prescribed by the regulations; or (ii) administering a law relating to the protection of the public revenue; or (q) another authority or body prescribed by the regulations that is established under a law of a State or Territory to conduct criminal investigations or inquiries.
enforcement proceedings means: (a) proceedings for a credit reporting offence; or (b) proceedings for a civil penalty order.
enforcement related activity means: (a) the prevention, detection, investigation, prosecution or punishment of: (i) criminal offences; or (ii) breaches of a law imposing a penalty or sanction; or (b) the conduct of surveillance activities, intelligence gathering activities or monitoring activities; or Credit reporting EXPOSURE DRAFT Part B Other relevant provisions Division 1 Definitions Section 180 (c) the enforcement of laws relating to the confiscation of the proceeds of crime; or (d) the protection of the public revenue; or (e) the prevention, detection, investigation or remedying of misconduct of a serious nature, or other conduct prescribed by the regulations; or (f) the preparation for, or conduct of, proceedings before any court or tribunal, or the implementation of orders made by a court or tribunal.
engage in conduct includes fail or refuse to engage in conduct.

entity means: (a) an agency; or (b) an organisation; or (c) a small business operator.
family, in relation to an individual, includes (without limitation): (a) a de facto partner of the individual; and (b) someone who is the child of the individual, or of whom the individual is the child; and (c) anyone else who would be a member of the individual’s family if someone referred to in paragraph (a) or (b) is taken to be a member of the individual’s family.

Federal Court means the Federal Court of Australia.
generally available publication means a magazine, book, article, newspaper or other publication that is or will be generally available to members of the public: (a) whether or not it is published in print, electronic or any other form; and (b) whether or not it is available on the payment of a fee.

government related identifier: see subsection 10(4).
guarantee includes an indemnity given against the default of a person in making a payment in relation to credit that has been applied for by, or provided to, the person.

 Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions Division 1 Section 180 holds: an entity holds personal information if the entity has possession or control of a record that contains the personal information.
identification information about an individual means: (a) the individual’s full name; or (b) an alias or previous name of the individual; or (c) the individual’s date of birth; or (d) the individual’s sex; or (e) the individual’s current or last known address, and 2 previous addresses (if any); or (f) the name of the individual’s current or last known employer; or (g) if the individual holds a driver’s licence—the individual’s driver’s licence number.

identifier: see subsections 10(5) and (6).


information request: see section 183. interested party: see subsections 121(3) and 149(3).

licensee has the meaning given by the National Consumer Credit Protection Act 2009. managing credit does not include an act relating to the collection of overdue payments in relation to credit.

misconduct includes fraud, negligence, default, breach of trust, breach of duty, breach of discipline or any other misconduct in the course of duty.
mortgage credit means consumer credit: (a) that is provided in connection with the acquisition, maintenance, renovation or improvement of real property; and (b) in relation to which the real property is security.
mortgage insurance purpose of a mortgage insurer in relation to an individual is the purpose of assessing: Credit reporting EXPOSURE DRAFT Part B Other relevant provisions Division 1 Definitions Section (a) whether to provide insurance to, or the risk of providing insurance to, a credit provider in relation to mortgage credit: (i) provided by the provider to the individual; or (ii) for which an application to the provider has been made by the individual; or (b) the risk of the individual defaulting on mortgage credit in relation to which the insurer has provided insurance to a credit provider; or (c) the risk of the individual being unable to meet a liability that might arise under a guarantee provided, or proposed to be provided, in relation to mortgage credit provided by a credit provider to another person.
mortgage insurer means an organisation or small business operator that carries on a business or undertaking that involves providing insurance to credit providers in relation to mortgage credit provided by providers to other persons.

National Personal Insolvency Index has the meaning given by the Bankruptcy Act.
new arrangement information: see section 184. order of a court or tribunal means an order, direction or other instrument made by: (a) a court; or (b) a tribunal; or (c) a judge (including a judge acting in a personal capacity) or a person acting as a judge; or (d) a magistrate (including a magistrate acting in a personal capacity) or a person acting as a magistrate; or (e) a member or an officer of a tribunal; and includes an order, direction or other instrument that is of an interim or interlocutory nature.
organisation: see section 17. payment information: see section 185.
86 Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions Division 1 Section 180 penalty unit has the meaning given by section 4AA of the Crimes Act 1914. pending correction request in relation to credit information or CRA derived information means: (a) a request made under subsection 121(1) in relation to the information if a notice has not been given under subsection 122(2) or (3) in relation to the request; or (b) a request made under subsection 149(1) in relation to the information if: (i) the credit reporting agency referred to in subsection 123(3) has been consulted about the request under subsection 149(3); and (ii) a notice has not been given under subsection 150(2) or (3) in relation to the request.
pending dispute in relation to credit information or CRA derived information means: (a) a complaint made under section 157 that relates to the information if a determination about the complaint has not been made under subsection 158(4); or (b) a matter that relates to the information and that is still being dealt with by a recognised external dispute resolution scheme; or (c) a complaint made to the Information Commissioner under this Act that relates to the information and that is still being dealt with.
permitted CP disclosure: see sections 137 to 141. permitted CP use: see section 136. permitted CRA disclosure: see section 109. personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not.
Credit reporting EXPOSURE DRAFT Part B Other relevant provisions Division 1 Definitions Section 180 personal insolvency information: see section 186. pre-screening determination means a determination made under paragraph 110(2)(d).

purchase, in relation to credit, includes the purchase of rights to receive payments relating to the credit.
recognised external dispute resolution scheme: see section 195. record includes: (a) a document; or (b) an electronic or other device; but does not include: (c) a generally available publication; or (d) anything kept in a library, art gallery or museum for the purposes of reference, study or exhibition; or (e) Commonwealth records (within the meaning of the Archives Act 1983) that are in the open access period for the purposes of that Act; or (f) records (within the meaning of the Archives Act 1983) in the care (within the meaning of that Act) of the National Archives of Australia (the Archives) in relation to which: (i) the Archives has entered into arrangements with a person other than a Commonwealth institution (within the meaning of that Act); and (ii) those arrangements provide for the extent to which the Archives or other persons are to have access to those records; or (g) documents placed by or on behalf of a person (other than an agency) in the memorial collection (within the meaning of the Australian War Memorial Act 1980); or (h) letters or other articles in the course of transmission by post.
Note: For document, see section 25 of the Acts Interpretation Act 1901. related body corporate has the meaning given by the Corporations Act 2001. repayment history information: see subsection 187(1).
Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions Division 1 Section 180 residential property has the meaning given by section 204 of the National Credit Code (within the meaning of the National Consumer Credit Protection Act 2009).

respondent for a complaint made under section 157 means the credit reporting agency or credit provider to which the complaint is made.
retention period: see sections 124 and 125. securitisation arrangement means an arrangement: (a) involving the funding, or proposed funding, of: (i) credit that has been, or is to be, provided by a credit provider; or (ii) the purchase of credit by a credit provider; by issuing instruments or entitlements to investors; and (b) under which payments to investors in relation to such instruments or entitlements are principally derived, directly or indirectly, from such credit.
securitisation related purpose of a credit provider in relation to an individual is the purpose of: (a) assessing the risk in purchasing, by means of a securitisation arrangement, credit that has been provided to, or applied for by: (i) the individual; or (ii) a person for whom the individual is, or is proposing to be, a guarantor; or (b) assessing the risk in undertaking credit enhancement in relation to credit: (i) that is, or is proposed to be, purchased or funded by means of a securitisation arrangement; and (ii) that has been provided to, or applied for by, the individual or a person for whom the individual is, or is proposing to be, a guarantor.
sensitive information means personal information that is: (a) information or an opinion about an individual’s: (i) racial or ethnic origin; or Credit reporting EXPOSURE DRAFT Part B Other relevant provisions Division 1 Definitions Section 180 (ii) political opinions; or (iii) membership of a political association; or (iv) religious beliefs or affiliations; or (v) philosophical beliefs; or (vi) membership of a professional or trade association; or (vii) membership of a trade union; or (viii) sexual orientation or practices; or (ix) criminal record; or (b) health information about an individual; or (c) genetic information about an individual that is not otherwise health information; or (d) biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or (e) biometric templates.
serious credit infringement means: (a) an act done by an individual that involves fraudulently obtaining consumer credit, or attempting fraudulently to obtain consumer credit; or (b) an act done by an individual that involves fraudulently evading the individual’s obligations in relation to consumer credit, or attempting fraudulently to evade those obligations; or (c) an act done by an individual if: (i) a reasonable person would consider that the act indicates an intention, on the part of the individual, to no longer comply with the individual’s obligations in relation to consumer credit provided by a credit provider; and (ii) the provider has, after taking such steps as are reasonable in the circumstances, been unable to contact the individual about the act.
solicits: an entity solicits personal information if the entity requests another entity to provide the personal information, or to provide a kind of information in which that personal information is included.
Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions Division 1 Section 180 state of mind of a person includes: (a) the knowledge, intention, opinion, belief or purpose of the person; and (b) the person’s reasons for the intention, opinion, belief or purpose.
State or Territory authority means: (a) a Minister of a State or Territory; or (b) a Department of a State or Territory; or (c) a body or tribunal, whether incorporated or unincorporated, established or appointed for a public purpose by or under a law of a State or Territory, other than: (i) an incorporated company, society or association; or (ii) an association of employers or employees that is registered or recognised under such a law that deals with the resolution of industrial disputes; or (d) a body, whether incorporated or unincorporated, established or appointed, otherwise than under a law of a State or Territory, by: (i) a Governor of a State; or (ii) the Government of the Australian Capital Territory or the Northern Territory; or (iii) the Government of Norfolk Island; or (iv) a Minister of a State or Territory; or (v) a person holding an executive office mentioned in section 12 of the Norfolk Island Act 1979; or (e) a person who holds or performs the duties of: (i) an office established by or under a law of a State or Territory; or (ii) an appointment made under such a law; other than the head of a Department of a State or Territory (however described); or (f) a person who holds or performs the duties of an appointment made, otherwise than under a law of a State or Territory, by: (i) a Governor of a State; or (ii) the Government of the Australian Capital Territory or the Northern Territory; or Credit reporting 33
26 27 28 29 30 31 32 33 34 35 36 EXPOSURE DRAFT Part B Other relevant provisions Division 1 Definitions Section 180 (iii) the Government of Norfolk Island; or (iv) a Minister of a State or Territory; or (v) a person holding an executive office mentioned in section 12 of the Norfolk Island Act 1979; or (g) a court of a State or Territory.
trade insurance purpose of a trade insurer in relation to an individual is the purpose of assessing: (a) whether to provide insurance to, or the risk of providing insurance to, a credit provider in relation to commercial credit provided by the provider to the individual or another person; or (b) the risk of a person defaulting on commercial credit in relation to which the insurer has provided insurance to a credit provider.
trade insurer means an organisation or small business operator that carries on a business or undertaking that involves providing insurance to credit providers in relation to commercial credit provided by providers to other persons.

92 Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions relating to credit reporting Division 2 Section 181 Division 2—Definitions relating to credit reporting Subdivision A—Credit information etc.
181 Meaning of credit information Credit information about an individual is personal information (other than sensitive information) that is: (a) identification information about the individual; or (b) consumer credit liability information about the individual; or (c) repayment history information about the individual; or (d) a statement that an information request has been made in relation to the individual by a credit provider, mortgage insurer or trade insurer; or (e) the type of consumer credit or commercial credit, and the amount of credit, sought in an application: (i) that has been made by the individual to a credit provider; and (ii) in connection with which the provider has made an information request in relation to the individual; or (f) default information about the individual; or (g) payment information about the individual; or (h) new arrangement information about the individual; or (i) court proceedings information about the individual; or (j) personal insolvency information about the individual; or (k) publicly available information about the individual: (i) that relates to the individual’s activities in Australia and the individual’s credit worthiness; and (ii) that is not court proceedings information about the individual or information about the individual that is entered or recorded on the National Personal Insolvency Index; or (l) the opinion of a credit provider that the individual has committed, in circumstances specified by the provider, a Credit reporting EXPOSURE DRAFT Part B Other relevant provisions Division 2 Definitions relating to credit reporting Section 182 serious credit infringement in relation to consumer credit provided by the provider to the individual.
182 Meaning of default information Consumer credit defaults (1) Default information about an individual is information about a payment (including a payment that is wholly or partly a payment of interest) that the individual is overdue in making in relation to consumer credit that has been provided by a credit provider to the individual if: (a) the individual is at least 60 days overdue in making the payment; and (b) the provider has given a written notice to the individual informing the individual of the overdue payment and requesting that the individual pay the amount of the overdue payment; and (c) the provider is not prevented by or under any Australian law from bringing proceedings against the individual to recover the amount of the overdue payment; and (d) the amount of the overdue payment is equal to or more than: (i) $100; or (ii) such higher amount as is prescribed by the regulations.
Guarantor defaults (2) Default information about an individual is information about a payment that the individual is overdue in making as a guarantor under a guarantee given against any default by a person (the borrower) in repaying all or any of the debt deferred under consumer credit provided by a credit provider to the borrower if: (a) the provider has given the individual written notice of the borrower’s default that gave rise to the individual’s obligation to make the overdue payment; and (b) the notice requests that the individual pay the amount of the overdue payment; and (c) at least 60 days have passed since the day on which the notice was given; and 94 Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions relating to credit reporting Division 2 Section 183 (d) in addition to giving the notice, the provider has taken other steps to recover the amount of the overdue payment from the individual; and (e) the provider is not prevented by or under any Australian law from bringing proceedings against the individual to recover the amount of the overdue payment.
183 Meaning of information request Credit provider (1) A credit provider has made an information request in relation to an individual if the provider has sought information about the individual from a credit reporting agency: (a) in connection with an application for consumer credit made by the individual to the provider; or (b) in connection with an application for commercial credit made by a person to the provider; or (c) for a credit guarantee purpose of the provider in relation to the individual; or (d) for a securitisation related purpose of the provider in relation to the individual.
Mortgage insurer (2) A mortgage insurer has made an information request in relation to an individual if: (a) the insurer has sought information about the individual from a credit reporting agency; and (b) the information was sought in connection with the provision of insurance to a credit provider in relation to mortgage credit provided by the provider to: (i) the individual; or (ii) a person for whom the individual is, or is proposing to be, a guarantor.
Credit reporting 95 EXPOSURE DRAFT Part B Other relevant provisions Division 2 Definitions relating to credit reporting Section 184 Trade insurer (3) A trade insurer has made an information request in relation to an individual if: (a) the insurer has sought information about the individual from a credit reporting agency; and (b) the information was sought in connection with the provision of insurance to a credit provider in relation to commercial credit provided by the provider to the individual or another person.
184 Meaning of new arrangement information Consumer credit defaults (1) If: (a) a credit provider has disclosed default information about an individual to a credit reporting agency; and (b) the default information relates to a payment that the individual is overdue in making in relation to consumer credit (the original consumer credit) that has been provided by the provider to the individual; and (c) because of the individual being so overdue: (i) the terms or conditions of the original consumer credit that relate to the repayment of the amount of credit are varied; or (ii) the individual is provided with other consumer credit (the new consumer credit) by a credit provider that relates, wholly or in part, to that amount of credit; then new arrangement information about the individual is a statement that those terms or conditions of the original consumer credit have been varied, or that the individual has been provided with the new consumer credit.
Serious credit infringements (2) If: (a) a credit provider is of the opinion that an individual has committed a serious credit infringement in relation to Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions relating to credit reporting Division 2 Section 185 consumer credit (the original consumer credit) provided by the provider to the individual; and (b) the provider has disclosed the opinion to a credit reporting agency; and (c) because of the provider having that opinion: (i) the terms or conditions of the original consumer credit that relate to the repayment of the amount of credit are varied; or (ii) the individual is provided with other consumer credit (the new consumer credit) by a credit provider that relates, wholly or in part, to that amount of credit; then new arrangement information about the individual is a statement that those terms or conditions of the original consumer credit have been varied, or that the individual has been provided with the new consumer credit.
185 Meaning of payment information If: (a) a credit provider has disclosed default information about an individual to a credit reporting agency; and (b) on a day after the default information was so disclosed, the amount of the overdue payment to which the information relates is paid; then payment information about the individual is a statement that the amount of the overdue payment has been paid on that day.
186 Meaning of personal insolvency information (1) Personal insolvency information about an individual is information: (a) that is entered or recorded in the National Personal Insolvency Index; and (b) that relates to: (i) a bankruptcy of the individual; or (ii) a debt agreement proposal given by the individual; or (iii) a debt agreement made by the individual; or Credit reporting EXPOSURE DRAFT Part B Other relevant provisions Division 2 Definitions relating to credit reporting Section (iv) a personal insolvency agreement executed by the individual; or (v) a direction given, or an order made, under section 50 of the Bankruptcy Act that relates to the property of the individual; or (vi) an authority signed under section 188 of that Act that relates to the property of the individual.
(2) Despite subparagraph (1)(b)(i), the personal insolvency information about the individual must not relate to: (a) the presentation of a creditor’s petition against the individual; or (b) an administration under Part XI of the Bankruptcy Act of the individual’s estate.

(3) An expression used in paragraph (1)(b) or (2)(a) that is also used in the Bankruptcy Act has the same meaning in that paragraph as it has in that Act.
187 Meaning of repayment history information (1) If a credit provider provides consumer credit to an individual, the following information about the consumer credit is repayment history information about the individual: (a) whether or not the individual has met an obligation to make a monthly payment that is due and payable in relation to the consumer credit; (b) the day on which the monthly payment is due and payable; (c) if the individual makes the monthly payment after the day on which the payment is due and payable—the day on which the individual makes that payment.
(2) The regulations may make provision in relation to: (a) whether or not an individual has met an obligation to make a monthly payment that is due and payable in relation to consumer credit; and (b) whether or not a payment is a monthly payment.
98 Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions relating to credit reporting Division 2 Section 188 Subdivision B—Credit provider 188 Meaning of credit provider General (1) Each of the following is a credit provider: (a) a bank; (b) an organisation or small business operator if: (i) the organisation or operator carries on a business or undertaking; and (ii) a substantial part of the business or undertaking is the provision of credit; (c) an organisation or small business operator: (i) that carries on a retail business; and (ii) that, in the course of the business, issues credit cards to individuals in connection with the sale of goods, or the supply of services, by the organisation or operator (as the case may be); (d) an agency, organisation or small business operator: (i) that carries on a business or undertaking that involves providing credit; and (ii) that is prescribed by the regulations.
Other credit providers (2) If: (a) an organisation or small business operator (the supplier) carries on a business or undertaking in the course of which the supplier provides credit in connection with the sale of goods, or the supply of services, by the supplier; and (b) the repayment, in full or in part, of the amount of credit is deferred for at least 7 days; and (c) the supplier is not a credit provider under subsection (1); then the supplier is a credit provider but only in relation to the credit.
(3) If: Credit reporting EXPOSURE DRAFT Part B Other relevant provisions Division 2 Definitions relating to credit reporting Section (a) an organisation or small business operator (the lessor) carries on a business or undertaking in the course of which the lessor provides credit in connection with the hiring, leasing or renting of goods; and (b) the credit is in force for at least 7 days; and (c) no amount, or an amount less than the value of the goods, is paid as a deposit for the return of the goods; and (d) the lessor is not a credit provider under subsection (1); then the lessor is a credit provider but only in relation to the credit.
(4) An organisation or small business operator is a credit provider if subsection 189(1), 190(1) or 191(1) provides that the organisation or operator is a credit provider.

Exclusions (5) Despite subsections (1) to (4) of this section, an organisation or small business operator acting in the capacity of: (a) a real estate agent; or (b) a general insurer (within the meaning of the Insurance Act 1973); or (c) an employer of an individual; is not a credit provider while acting in that capacity.
(6) Despite subsections (1) to (4) of this section, an organisation or small business operator is not a credit provider if it is included in a class of organisations or operators prescribed by the regulations.
189 Agents of credit providers (1) If an organisation or small business operator (the agent) is acting as an agent of a credit provider (the principal) in performing, on behalf of the principal, a task that is reasonably necessary: (a) in processing an application for credit made to the principal; or (b) in managing credit provided by the principal; then, while the agent is so acting, the agent is a credit provider.
100 Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions relating to credit reporting Division 2 Section 190 (2) Subsection (1) does not apply if the principal is an organisation or small business operator that is a credit provider because of a previous application of that subsection.
(3) If subsection (1) applies in relation to credit that has been provided by the principal, the credit is taken, for the purposes of this Act, to have been provided by both the principal and the agent.

(4) If subsection (1) applies in relation to credit for which an application has been made to the principal, the application is taken, for the purposes of this Act, to have been made to both the principal and the agent.

190 Securitisation arrangements etc.
(1) If: (a) an organisation or small business operator (the securitisation entity) carries on a business that is involved in either or both of the following: (i) a securitisation arrangement; (ii) managing credit that is the subject of a securitisation arrangement; and (b) the securitisation entity performs a task that is reasonably necessary for: (i) purchasing, funding or managing, or processing an application for, credit by means of a securitisation arrangement; or (ii) undertaking credit enhancement in relation to credit; and (c) the credit has been provided by, or is credit for which an application has been made to, a credit provider (the original credit provider); then, while the securitisation entity performs such a task, the securitisation entity is a credit provider.
(2) Subsection (1) does not apply if the original credit provider is an organisation or small business operator that is a credit provider because of a previous application of that subsection.
Credit reporting 101 EXPOSURE DRAFT Part B Other relevant provisions Division 2 Definitions relating to credit reporting Section 191 (3) If subsection (1) applies in relation to credit that has been provided by the original credit provider, the credit is taken, for the purposes of this Act, to have been provided by both the original credit provider and the securitisation entity.
(4) If subsection (1) applies in relation to credit for which an application has been made to the original credit provider, the application is taken, for the purposes of this Act, to have been made to both the original credit provider and the securitisation entity.
191 Acquisition of the rights of a credit provider (1) If: (a) an organisation or small business operator (the acquirer) acquires, whether by assignment, subrogation or any other means, the rights of a credit provider (the original credit provider) in relation to the repayment of an amount of credit; and (b) the acquirer is not a credit provider under subsection 188(1); then the acquirer is a credit provider but only in relation to the credit.
(2) If subsection (1) of this section applies in relation to credit that has been provided by the original credit provider, the credit is taken, for the purposes of this Act, to have been provided by the acquirer.

(3) If subsection (1) of this section applies in relation to credit for which an application has been made to the original credit provider, the application is taken, for the purposes of this Act, to have been made to the acquirer.
Subdivision C—Other definitions 192 Meaning of access seeker (1) An access seeker in relation to credit reporting information, or credit eligibility information, about an individual is: (a) the individual; or (b) a person: 102 Credit reporting EXPOSURE DRAFT Other relevant provisions Part B Definitions relating to credit reporting Division 2 Section 193 (i) who is assisting the individual to deal with a credit reporting agency or credit provider; and (ii) who is authorised, in writing, by the individual to make a request in relation to the information under subsection 119(1) or 146(1).
(2) An individual must not authorise a person under subparagraph (1)(b)(ii) if the person is: (a) a credit provider; or (b) a mortgage insurer; or (c) a trade insurer; or (d) a person who is prevented from being a credit provider by subsection 188(5) or (6).
193 Meaning of credit and amount of credit (1) Credit is a contract, arrangement or understanding under which: (a) payment of a debt owed by one person to another person is deferred; or (b) one person incurs a debt to another person and defers the payment of the debt.

(2) The amount of credit is the amount of the debt that is actually deferred, or that may be deferred, but does not include any fees or charges payable in connection with the deferral of the debt.
(3) Without limiting subsection (1), credit includes: (a) a hire-purchase agreement; and (b) a contract, arrangement or understanding of a kind referred to in that subsection that is for the hire, lease or rental of goods, or for the supply of services, other than a contract, arrangement or understanding under which: (i) full payment is made before, or at the same time as, the goods or services are provided; and (ii) in the case of goods—an amount greater than, or equal to, the value of the goods is paid as a deposit for the return of the goods.
Credit reporting 103 EXPOSURE DRAFT Part B Other relevant provisions Division 2 Definitions relating to credit reporting Section 194 194 Meaning of credit reporting business (1) A credit reporting business is a business or undertaking: (a) that is carried on in Australia; and (b) that involves collecting, holding, using or disclosing personal information about individuals for the purpose of, or for purposes including the purpose of, providing an entity with information about the credit worthiness of an individual.
(2) Subsection (1) applies whether or not the information about the credit worthiness of an individual is: (a) provided for profit or reward; or (b) provided, or intended to be provided, for the purposes of assessing an application for consumer credit.

(3) In determining whether a business or undertaking carried on by a credit provider is a credit reporting business, disregard the provision of information about the credit worthiness of an individual to a related body corporate by the provider.
(4) Despite subsection (1), a business or undertaking is not a credit reporting business if the business or undertaking is included in a class of businesses or undertakings prescribed by the regulations.

195 Meaning of recognised external dispute resolution scheme (1) A credit reporting agency is a member of a recognised external dispute resolution scheme if the agency is a member of one or more external dispute resolution schemes that is, or are, recognised by the Information Commissioner under this Act.
(2) A credit provider is a member of a recognised external dispute resolution scheme if the provider is a member of one or more external dispute resolution schemes that is, or are, recognised by the Information Commissioner under this Act.

1 26 27 28 104 Credit reporting