(1) If an entity has possession or control of a pre-screening assessment, the entity must destroy the assessment if:
(a) the entity no longer needs the assessment for any purpose for which it may be used or disclosed under section 20H; and
(b) the entity is not required by or under an Australian law, or a court/tribunal order, to retain the assessment.
Civil penalty: 1,000 penalty units.
(2) If the entity is an APP entity but not a credit reporting body, Australian Privacy Principle 11.2 does not apply to the entity in relation to the pre-screening assessment.