Document ID: chunk:federal_register_of_legislation:F2024L00888:body:0:p1
Version: federal_register_of_legislation:F2024L00888
Segment Type: other
Provision Reference: 
Character Range: 0–3154

Privacy (Credit Related Research) Rule 2024
I, Carly Kind, Privacy Commissioner, make this Rule under section 20M(3) of the Privacy Act 1988.

Dated: 9 July 2024

[Signed]

Carly Kind
Australian Privacy Commissioner

Part 1 — Preliminary
   1          Name of Rule
   This Rule is the Privacy (Credit Related Research) Rule 2024.

   2          Commencement
   This Rule commences on the day it is registered on the Federal Register of Legislation.

   3          Purpose
   This Rule applies for the purposes of section 20M of the Privacy Act which prohibits a credit reporting body from using or disclosing de-identified credit reporting information (s 20M(1)).  Sections 20M(2)–(3) provide that this prohibition does not apply if the use or disclosure is for the purpose of conducting research in relation to credit and the credit reporting body complies with rules made by the Commissioner by legislative instrument.

   4               Definitions
    (1)    Unless this Rule states otherwise, any word or expression used in this Rule which is defined in the Privacy Act, has the same meaning as in that Act.
    (2)    In this Rule:
        Aggregated results means the results of de-identified credit reporting information research analysis which does not include the individual elements of the de-identified credit reporting information and cannot readily be disaggregated to extract or re-identify that de-identified credit reporting information
        De-identified information means credit reporting information that is no longer about an identifiable individual or an individual who is reasonably identifiable
        Privacy Act means the Privacy Act 1988
        Rule means the Privacy (Credit Related Research) Rule 2024
   Note: The following expressions are defined in Section 6(1) of the Privacy Act: Australian law; Australian link; Commissioner; court/tribunal order; credit; credit reporting body; credit reporting information; entity; personal information

   5          Schedules
   Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

Part 2 — Operational provisions
   6          Conducting research in relation to credit
   A credit reporting body may use or disclose credit reporting information if:
       (a)    the credit reporting information has been de-identified,
       (b)    the use and/or disclosure of the credit reporting information is for the purpose of conducting research in relation to credit, and
       (c)    the purpose for conducting the research in relation to credit is a permitted purpose as described in section 7 of this Rule.

   7          Permitted purposes of conducting research
   A credit reporting body may only use or disclose de-identified information for the purposes of conducting research in relation to credit for:
       (a)    the assessment or management of current, and development of new, credit services, or
       (b)    developing methodologies to combat fraud, anti-money laundering,