Document ID: chunk:federal_register_of_legislation:F2024L01251:clause:2_23:p1
Version: federal_register_of_legislation:F2024L01251
Segment Type: clause
Provision Reference: sch 2 cl 23 (pt 1/6)
Character Range: 125300–128258

23  Credit reporting system integrity
 (1) This section is made for the purposes of sections 20N and 20Q of the Act.
Note 1: Section 20N of the Act requires credit reporting bodies to take reasonable steps to ensure the information they collect is accurate, up‑to‑date and complete, and that the information they use and disclose accurate, up‑to‑date, complete and relevant (having regard to the purpose of the use or disclosure). Bodies must also enter into agreements with credit providers requiring them to ensure the information they disclose is accurate, up-to-date and complete, and also to obtain independent audits to determine whether those agreements are being complied with.
Note 2: Section 20Q of the Act requires credit reporting bodies to take reasonable steps to protect credit reporting information from misuse, interference and loss, unauthorised access, modification or disclosure. Bodies must also enter into agreements with credit providers requiring them to protect information in this way, and also to obtain independent audits to determine whether those agreements are being complied with.

Programs for monitoring credit providers' compliance with the Act
 (2) To ensure that credit reporting bodies tailor the frequency and extent of the audits required by sections 20N and 20Q of the Act to the credit providers that present the greatest risk of non-compliance, a body must establish a documented, risk-based program to monitor providers' compliance with their obligations under Part IIIA of the Act (incorporated in their agreements with the body) to ensure:
 (a) that credit information that the provider discloses to the body is accurate, up-to-date and complete; and
 (b) that credit reporting information that the body discloses to the provider is protected by the provider from misuse, interference and loss and from unauthorised access, modification or disclosure; and
 (c) that the provider takes the steps in relation to requests to correct credit-related personal information required by Part IIIA of the Act, the Regulations and this CR Code.
 (3) The program established by a credit reporting body under subsection (2) must:
 (a) identify and evaluate indicators of risk of non-compliance by credit providers with the obligations referred to in subsection (2); and
 (b) assess the risk posed by providers of significant non-compliance with those obligations using those risk indicators and the information available to the body including correction requests and complaints; and
 (c) use a reasonable range of monitoring techniques to validate and update those risk assessments from time to time; and
 (d) include a program for auditing providers to assess compliance with the obligations referred to in subsection (2).
Note: Credit reporting bodies have obligations to ensure that audits of credit providers are conducted in relation to the quality and security of credit reporting information: see subsections 20N(3)(b)