Document ID: chunk:federal_register_of_legislation:F2024L01251:clause:2_5:p1
Version: federal_register_of_legislation:F2024L01251
Segment Type: clause
Provision Reference: sch 2 cl 5 (pt 1/3)
Character Range: 25060–28024

5  Practices, procedures and systems

Restrictions on the collection, use and disclosure of personal information
 (1) A credit reporting body must not:
 (a) collect personal information about an individual's activities in relation to consumer credit that is not credit information;
 (b) use personal information about an individual's activities in relation to consumer credit that is not credit information to derive CRB derived information; or
 (c) disclose personal information about an individual's activities in relation to consumer credit that is not credit information or credit reporting information
  unless subsections (3) or (4) apply to the information.
 (2) A credit provider must not disclose to a credit reporting body or another provider personal information about an individual's activities in relation to consumer credit that:
 (a) was disclosed to the provider by a credit reporting body and that is not credit reporting information; or
 (b) was derived (wholly or in part) from personal information about an individual's activities in relation to consumer credit that was disclosed to the provider by a credit reporting body and that is not credit reporting information
  unless subsection (4) applies to the information.
Note:  A credit provider includes an organisation or small business operators that is acting as an agent of a credit provider in some circumstances: see section 6H of the Act.
 (3) This subsection applies to personal information that:
 (a) is either credit ID information or capacity information; and
 (b) is collected at the same time as the credit information or credit reporting information.
 (4) This subsection applies to personal information that:
 (a) is either credit ID information or capacity information; and
 (b) is disclosed at the same time as the credit information or credit reporting information.

Restrictions on standardisation of consumer credit numbering conventions
 (5) A credit reporting body and a credit provider must not agree or implement procedures to standardise the provider's numbering conventions for consumer credit.

Practices, procedures and systems of credit providers
 (6) A credit provider must have reasonable practices, procedures and systems, given the size and complexity of its business, that are designed to cover obligations under Part IIIA of the Act, the Regulations and this CR code.
 (7) The practices, procedures and systems described in subsection (6) must require the credit provider to:
 (a) ensure it does not disclose information to a credit reporting body that it is prohibited from disclosing;
 (b) advise the relevant credit reporting body as soon as practicable if the provider becomes aware that it has disclosed information to the body that it is prohibited from disclosing;
 (c) ensure that it only discloses credit information that is accurate, up-to-date and complete;
 (d) if it identifies that credit information that it has disclosed to a credit reporting