Commonwealth Consolidated Acts

[Index] [Table] [Search] [Search this Act] [Notes] [Noteup] [Previous] [Next] [Download] [Help]

PRIVACY ACT 1988 - SECT 18K

Limits on disclosure of personal information by credit reporting agencies

             (1)  A credit reporting agency in possession or control of an individual's credit information file must not disclose personal information contained in the file to a person, body or agency (other than the individual) unless:

                     (a)  the information is contained in a credit report given to a credit provider who requested the report for the purpose of assessing an application for credit made by the individual to the credit provider; or

                    (ab)  the information:

                              (i)  is contained in a credit report given to a person who is a credit provider because of the application of subsection 11B(4B); and

                             (ii)  the person requested the report for the purpose of assessing the risk in purchasing a loan by means of a securitisation arrangement, being a loan given to or applied for by:

                                        (A)  the individual; or

                                        (B)  a person in relation to whom the individual is, or is proposing to be, a guarantor; or

                    (ac)  the information:

                              (i)  is contained in a credit report given to a person who is a credit provider because of the application of subsection 11B(4B); and

                             (ii)  the person requested the report for the purpose of assessing the risk in undertaking credit enhancement of a loan that is, or is proposed to be, purchased or funded by means of a securitisation arrangement, being a loan given to or applied for by:

                                        (A)  the individual; or

                                        (B)  a person in relation to whom the individual is, or is proposing to be, a guarantor; or

                     (b)  the information is contained in a credit report given to a credit provider who requested the report for the purpose of assessing an application for commercial credit made by a person to the credit provider, and the individual to whom the report relates has specifically agreed to the report being given to the credit provider for that purpose; or

                     (c)  the information is contained in a credit report given to a credit provider who requested the report for the purpose of assessing whether to accept the individual as a guarantor in respect of:

                              (i)  a loan provided by the credit provider to a person other than the individual; or

                             (ii)  a loan for which an application has been made by a person other than the individual to the credit provider;

                            and the first‑mentioned individual has specifically agreed, in writing, to the report being given to the credit provider for that purpose; or

                     (d)  the information is contained in a credit report given to a mortgage insurer for the purpose of assessing:

                              (i)  whether to provide insurance to, or the risk of providing insurance to, a credit provider in respect of mortgage credit given by the credit provider to the individual; or

                             (ii)  the risk of the individual defaulting on mortgage credit in respect of which the mortgage insurer has provided insurance to a credit provider; or

                            (iii)  the risk of the individual being unable to meet a liability that might arise under a guarantee entered into, or proposed to be entered into, in respect of mortgage credit given by a credit provider to another person; or

                     (e)  the information is contained in a credit report given to a trade insurer for the purpose of assessing:

                              (i)  whether to provide insurance to, or the risk of providing insurance to, a credit provider in respect of commercial credit given by the credit provider to the individual or another person; or

                             (ii)  the risk of a person defaulting on commercial credit in respect of which the trade insurer has provided insurance to a credit provider;

                            and the individual to whom the report relates has specifically agreed, in writing, to the report being given to the trade insurer for that purpose; or

                      (f)  the credit reporting agency has, at least 30 days before the disclosure, received information of a kind referred to in subparagraph 18E(1)(b)(vi), and the information is contained in a credit report given to a credit provider referred to in the credit information file as a credit provider who is a current credit provider in relation to the individual; or

                     (g)  the information is contained in a credit report given to a credit provider who requested the report for the purpose of the collection of payments that are overdue in respect of credit provided to the individual by the credit provider; or

                     (h)  the information is contained in a credit report given to a credit provider who requested the report for the purpose of the collection of payments that are overdue in respect of commercial credit provided to a person by the credit provider, and:

                              (i)  the individual to whom the report relates has specifically agreed, in writing, to the report being given to the credit provider for that purpose; or

                             (ii)  that individual had specifically agreed, in writing, to a credit report relating to the individual being given to the credit provider for the purpose of the credit provider assessing the application that the first‑mentioned person made to the credit provider for the provision of the commercial credit concerned; or

                            (iii)  the credit provider provided the commercial credit concerned before the commencement of this section; or

                      (j)  the information is contained in a credit report given to another credit reporting agency; or

                     (k)  the information is contained in a record in which the only personal information relating to individuals is publicly available information; or

                    (m)  the disclosure is required or authorised by or under law; or

                     (n)  the credit reporting agency is satisfied that a credit provider or law enforcement authority believes on reasonable grounds that the individual has committed a serious credit infringement and the information is given to that credit provider or law enforcement authority or to any other credit provider or law enforcement authority.

          (1A)  For the purposes of paragraph (1)(b), the individual's agreement to the report being given to the credit provider must be in writing unless:

                     (a)  the report is requested for the purpose of assessing an application for commercial credit that was at first instance made orally; and

                     (b)  the application has not yet been made in writing.

             (2)  A credit reporting agency must not disclose personal information contained in an individual's credit information file, or in any other record containing information derived from the file, that is in the possession or control of the credit reporting agency if the file or other record contains personal information that the credit reporting agency would be:

                     (a)  prohibited from including in an individual's credit information file under section 18E; or

                     (b)  required to delete from such a file under section 18F.

             (3)  Subsection (2) does not prohibit the credit reporting agency from disclosing personal information that it would be prohibited from including in an individual's credit information file under section 18E if:

                     (a)  the credit reporting agency included the information in a credit information file or other record before the commencement of this section; and

                     (b)  the information is information of a kind that the Commissioner has determined, in writing, to be information that the credit reporting agency may disclose without contravening that subsection.

             (4)  A credit reporting agency that intentionally contravenes subsection (1) or (2) is guilty of an offence punishable, on conviction, by a fine not exceeding $150,000.

             (5)  Where a credit reporting agency discloses personal information contained in an individual's credit information file, it must include in the file a note of that disclosure.

Note:          A credit reporting agency must not include a note about the disclosure of information in a file if a notation has been made on a summons, or a notice, relating to the disclosure of the information and the notation has not been cancelled (see section 29A of the Australian Crime Commission Act 2002 and section 91 of the Law Enforcement Integrity Commissioner Act 2006 ).

             (6)  A credit reporting agency must not include in a credit report given to a credit provider under paragraph (1)(a) any information relating to an individual's commercial activities (other than information that the credit reporting agency is permitted under section 18E to include in the individual's credit information file).

             (7)  A determination under paragraph (3)(b) is to be made by notice published in the Gazette .

             (8)  A notice so published is a disallowable instrument for the purposes of section 46A of the Acts Interpretation Act 1901 .



[Index] [Table] [Search] [Search this Act] [Notes] [Noteup] [Previous] [Next] [Download] [Help]