It is the intention of the Parliament that this Act is not to affect the operation of a law of a State or of a Territory that makes provision with respect to the collection, holding, use, correction or disclosure of personal information (including such a law relating to credit reporting or the use of information held in connection with credit reporting) and is capable of operating concurrently with this Act.

amount of credit has the meaning given by subsection 6M(2).

commercial credit means credit (other than consumer credit) that is applied for by, or provided to, a person.

commercial credit related purpose of a credit provider in relation to a person means the purpose of:

consumer credit means credit:

consumer credit liability information: if a credit provider provides consumer credit to an individual, the following information about the consumer credit is consumer credit liability information about the individual:

consumer credit related purpose of a credit provider in relation to an individual means the purpose of:

credit has the meaning given by subsections 6M(1) and (3).

credit card means any article of a kind commonly known as a credit card, charge card or any similar article intended for use in obtaining cash, goods or services by means of credit, and includes any article of a kind commonly issued by persons carrying on business to customers or prospective customers of those persons for use in obtaining goods or services from those persons by means of credit.

credit eligibility information about an individual means:

credit enhancement, in relation to credit, means:

credit guarantee purpose of a credit provider in relation to an individual means the purpose of assessing whether to accept the individual as a guarantor in relation to:

credit information has the meaning given by section 6N.

credit provider has the meaning given by sections 6G to 6K, and, for the purposes of sections 7 and 8 and Parts III, IIIB, IV and V, is taken to include a mortgage insurer and a trade insurer.

credit reporting body means:

that carries on a credit reporting business.

credit reporting business has the meaning given by section 6P.

credit reporting complaint means a complaint about an act or practice that, if established, would be an interference with the privacy of an individual because:

credit reporting information about an individual means credit information, or CRB derived information, about the individual.

credit worthiness of an individual means the individual’s:

guarantee includes an indemnity given against the default of a person in making a payment in relation to credit that has been applied for by, or provided to, the person.

licensee has the meaning given by the National Consumer Credit Protection Act 2009.

managing credit does not include the act of collecting overdue payments in relation to credit.

mortgage credit means consumer credit:

mortgage insurer means an organisation, or small business operator, that carries on a business or undertaking that involves providing insurance to credit providers in relation to mortgage credit provided by providers to other persons.

pending correction request in relation to credit information or CRB derived information means:

pending dispute in relation to credit information or CRB derived information means:

purchase, in relation to credit, includes the purchase of rights to receive payments relating to the credit.

residential property has the meaning given by section 204 of the National Credit Code (within the meaning of the National Consumer Credit Protection Act 2009).

respondent for a complaint made under section 23A means the credit reporting body or credit provider to which the complaint is made.

securitisation related purpose of a credit provider in relation to an individual is the purpose of:

serious credit infringement means:

trade insurer means an organisation, or small business operator, that carries on a business or undertaking that involves providing insurance to credit providers in relation to commercial credit provided by providers to other persons.

(10) For the purposes of this Act, a reference to family in the definition of consumer credit in subsection 6(1), and in sections 6D and 16, in relation to any individual is taken to include the following (without limitation):

(1) Each of the following is a credit provider:

Other credit providers

then the supplier is a credit provider but only in relation to the credit.

then the lessor is a credit provider but only in relation to the credit.

(4) An organisation or small business operator is a credit provider if subsection 6H(1), 6J(1) or 6K(1) provides that the organisation or operator is a credit provider.

is not a credit provider while acting in that capacity.

(6) Despite subsections (1) to (4) of this section, an organisation or small business operator is not a credit provider if it is included in a class of organisations or operators prescribed by the regulations.

(1) If an organisation or small business operator (the agent) is acting as an agent of a credit provider (the principal) in performing, on behalf of the principal, a task that is reasonably necessary:

then, while the agent is so acting, the agent is a credit provider.

(2) Subsection (1) does not apply if the principal is an organisation or small business operator that is a credit provider because of a previous application of that subsection.

(3) If subsection (1) applies in relation to credit that has been provided by the principal, the credit is taken, for the purposes of this Act, to have been provided by both the principal and the agent.

(4) If subsection (1) applies in relation to credit for which an application has been made to the principal, the application is taken, for the purposes of this Act, to have been made to both the principal and the agent.

then, while the securitisation entity performs such a task, the securitisation entity is a credit provider.

(2) Subsection (1) does not apply if the original credit provider is an organisation or small business operator that is a credit provider because of a previous application of that subsection.

(3) If subsection (1) applies in relation to credit that has been provided by the original credit provider, the credit is taken, for the purposes of this Act, to have been provided by both the original credit provider and the securitisation entity.

(4) If subsection (1) applies in relation to credit for which an application has been made to the original credit provider, the application is taken, for the purposes of this Act, to have been made to both the original credit provider and the securitisation entity.

then the acquirer is a credit provider but only in relation to the credit.

(2) If subsection (1) of this section applies in relation to credit that has been provided by the original credit provider, the credit is taken, for the purposes of this Act, to have been provided by the acquirer.

(3) If subsection (1) of this section applies in relation to credit for which an application has been made to the original credit provider, the application is taken, for the purposes of this Act, to have been made to the acquirer.

(1) An access seeker in relation to credit reporting information, or credit eligibility information, about an individual is:

(1) Credit is a contract, arrangement or understanding under which:

(2) The amount of credit is the amount of the debt that is actually deferred, or that may be deferred, but does not include any fees or charges payable in connection with the deferral of the debt.

(3) Without limiting subsection (1), credit includes:

Credit information about an individual is personal information (other than sensitive information) that is:

(1) A credit reporting business is a business or undertaking that involves collecting, holding, using or disclosing personal information about individuals for the purpose of, or for purposes including the purpose of, providing an entity with information about the credit worthiness of an individual.

(2) Subsection (1) applies whether or not the information about the credit worthiness of an individual is:

(3) In determining whether a business or undertaking carried on by a credit provider is a credit reporting business, disregard the provision of information about the credit worthiness of an individual to a related body corporate by the provider.

(4) Despite subsection (1), a business or undertaking is not a credit reporting business if the business or undertaking is included in a class of businesses or undertakings prescribed by the regulations.

Consumer credit defaults

(1) Default information about an individual is information about a payment (including a payment that is wholly or partly a payment of interest) that the individual is overdue in making in relation to consumer credit that has been provided by a credit provider to the individual if:

(2) Default information about an individual is information about a payment that the individual is overdue in making as a guarantor under a guarantee given against any default by a person (the borrower) in repaying all or any of the debt deferred under consumer credit provided by a credit provider to the borrower if:

Credit provider

(1) A credit provider has made an information request in relation to an individual if the provider has sought information about the individual from a credit reporting body:

Consumer credit defaults

then new arrangement information about the individual is a statement that those terms or conditions of the original consumer credit have been varied, or that the individual has been provided with the new consumer credit.

Serious credit infringements

then new arrangement information about the individual is a statement that those terms or conditions of the original consumer credit have been varied, or that the individual has been provided with the new consumer credit.

(1) If a credit provider provides consumer credit to an individual, the following information about the consumer credit is repayment history information about the individual:

Credit reporting

In general, this Part deals with the privacy of information relating to credit reporting.

Divisions 2 and 3 contain rules that apply to credit reporting bodies and credit providers in relation to their handling of information relating to credit reporting.

Division 5 deals with complaints to credit reporting bodies or credit providers about acts or practices that may be a breach of certain provisions of this Part or the registered CR code.

Division 6 deals with entities that obtain credit reporting information or credit eligibility information by false pretence, or when they are not authorised to do so under this Part.

This Division sets out rules that apply to credit reporting bodies in relation to their handling of the following:

(1) This Division applies to a credit reporting body in relation to the following:

(2) The Australian Privacy Principles do not apply to a credit reporting body in relation to personal information that is:

Note: The Australian Privacy Principles apply to the credit reporting body in relation to other kinds of personal information.

(1) The object of this section is to ensure that credit reporting bodies manage credit reporting information in an open and transparent way.

(2) A credit reporting body must take such steps as are reasonable in the circumstances to implement practices, procedures and systems relating to the credit reporting business of the body that:

Policy about the management of credit reporting information

(3) A credit reporting body must have a clearly expressed and up to date policy about the management of credit reporting information by the body.

(4) Without limiting subsection (3), the policy of the credit reporting body must contain the following information:

(5) A credit reporting body must take such steps as are reasonable in the circumstances to make the policy available:

Note: A credit reporting body will usually make the policy available on the body’s website.

(6) If a person or body requests a copy, in a particular form, of the policy of a credit reporting body, the credit reporting body must take such steps as are reasonable in the circumstances to give the person or body a copy in that form.

(1) A credit reporting body must not collect credit information about an individual.

(2) Subsection (1) does not apply if the collection of the credit information is required or authorised by or under an Australian law or a court/tribunal order.

(6) Despite paragraph (4)(b), consumer credit liability information about the individual may relate to consumer credit that was entered into on a day before the individual turned 18, so long as the consumer credit was not terminated, or did not otherwise cease to be in force, on a day before the individual turned 18.

(7) A credit reporting body must collect credit information only by lawful and fair means.

Solicited credit information

(8) This section applies to the collection of credit information that is solicited by a credit reporting body.

(2) The credit reporting body may use or disclose the credit information for the purposes of making the determination under subsection (1).

(3) If the credit reporting body determines that it could have collected the credit information, sections 20E to 20ZA apply in relation to the information as if the body had collected the information under section 20C.

(4) If the credit reporting body determines that it could not have collected the credit information, the body must, as soon as practicable, destroy the information.

(5) Subsection (4) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, to retain the credit information.

(1) If a credit reporting body holds credit reporting information about an individual, the body must not use or disclose the information.

(2) Subsection (1) does not apply to the use of credit reporting information about the individual if:

(3) Subsection (1) does not apply to the disclosure of credit reporting information about the individual if:

(4) However, if the credit reporting information is, or was derived from, repayment history information about the individual, the credit reporting body must not disclose the information under paragraph (3)(a) or (f) unless the recipient of the information is:

(5) If a credit reporting body discloses credit reporting information under this section, the body must make a written note of that disclosure.

(6) This section does not apply to the use or disclosure of credit reporting information for the purposes of direct marketing.

Note: Section 20G deals with the use or disclosure of credit reporting information for the purposes of direct marketing.

(1) A disclosure by a credit reporting body of credit reporting information about an individual is a permitted CRB disclosure in relation to the individual if:

(1) If a credit reporting body holds credit reporting information about an individual, the body must not use or disclose the information for the purposes of direct marketing.

(2) Subsection (1) does not apply to the use by the credit reporting body of credit information about the individual for the purposes of direct marketing by, or on behalf of, a credit provider if:

(3) In assessing under paragraph (2)(d) whether or not the individual is eligible to receive the direct marketing communications of the credit provider, the credit reporting body must have regard to the eligibility requirements nominated by the provider.

(4) An assessment under paragraph (2)(d) is not credit reporting information about the individual.

(5) An individual may request a credit reporting body that holds credit information about the individual not to use the information under subsection (2).

(6) If the individual makes a request under subsection (5), the credit reporting body must not charge the individual for the making of the request or to give effect to the request.

(7) If a credit reporting body uses credit information under subsection (2), the body must make a written note of that use.

Use or disclosure by credit reporting bodies

(1) If a credit reporting body makes a pre screening assessment in relation to direct marketing by, or on behalf of, a credit provider, the body must not use or disclose the assessment.

(3) If the credit reporting body discloses the pre screening assessment under subsection (2), the body must make a written note of that disclosure.

(4) If the credit reporting body discloses the pre screening assessment under subsection (2), the recipient must not use or disclose the assessment.

(5) Subsection (4) does not apply if the recipient uses the pre screening assessment for the purposes of the direct marketing by, or on behalf of, the credit provider.

(2) If the entity is an APP entity but not a credit reporting body, Australian Privacy Principle 11.2 does not apply to the entity in relation to the pre screening assessment.

(3) The ban period for credit reporting information about an individual is the period that:

(5) A ban period for credit reporting information may be extended more than once under subsection (4).

(6) If an individual makes a request under paragraph (1)(c) or (4)(b), a credit reporting body must not charge the individual for the making of the request or to give effect to the request.

(3) The Commissioner may, by legislative instrument, make rules relating to the use or disclosure by a credit reporting body of de identified information for the purposes of conducting research in relation to credit.

(1) A credit reporting body must take such steps as are reasonable in the circumstances to ensure that the credit information the body collects is accurate, up to date and complete.

(2) A credit reporting body must take such steps as are reasonable in the circumstances to ensure that the credit reporting information the body uses or discloses is, having regard to the purpose of the use or disclosure, accurate, up to date, complete and relevant.

(3) Without limiting subsections (1) and (2), a credit reporting body must:

(1) A credit reporting body commits an offence if:

(2) A credit reporting body must not use or disclose credit reporting information under this Division (other than subsections 20D(2) and 20T(4)) if the information is false or misleading in a material particular.

(1) If a credit reporting body holds credit reporting information, the body must take such steps as are reasonable in the circumstances to protect the information:

(2) Without limiting subsection (1), a credit reporting body must:

(1) If a credit reporting body holds credit reporting information about an individual, the body must, on request by an access seeker in relation to the information, give the access seeker access to the information.

(2) Despite subsection (1), the credit reporting body is not required to give the access seeker access to the credit reporting information to the extent that:

(3) The credit reporting body must respond to the request within a reasonable period, but not longer than 10 days, after the request is made.

(4) If the credit reporting body gives access to the credit reporting information, the access must be given in the manner set out in the registered CR code.

(5) If a request under subsection (1) in relation to the individual has not been made to the credit reporting body in the previous 12 months, the body must not charge the access seeker for the making of the request or for giving access to the information.

(6) If subsection (5) does not apply, any charge by the credit reporting body for giving access to the information must not be excessive and must not apply to the making of the request.

(7) If the credit reporting body refuses to give access to the information because of subsection (2), the body must give the access seeker a written notice that:

(1) An individual may request a credit reporting body to correct personal information about the individual if:

(2) If the credit reporting body is satisfied that the personal information is inaccurate, out of date, incomplete, irrelevant or misleading, the body must take such steps (if any) as are reasonable in the circumstances to correct the information within:

(3) If the credit reporting body considers that the body cannot be satisfied of the matter referred to in subsection (2) in relation to the personal information without consulting either or both of the following (the interested party):

(5) The credit reporting body must not charge the individual for the making of the request or for correcting the information.

(1) This section applies if an individual requests a credit reporting body to correct personal information under subsection 20T(1).

(2) If the credit reporting body corrects the personal information under subsection 20T(2), the body must, within a reasonable period:

(3) If the credit reporting body does not correct the personal information under subsection 20T(2), the body must, within a reasonable period, give the individual written notice that:

(4) Paragraph (2)(c) does not apply if it is impracticable for the credit reporting body to give the notice under that paragraph.

(5) Subsection (2) or (3) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, not to give the notice under that subsection.

Note: There is no retention period for identification information or credit information of a kind referred to in paragraph 6N(k).

Destruction etc. of credit information

(2) The credit reporting body must destroy the credit information, or ensure that the information is de identified, within 1 month after the retention period for the information ends.

(3) Despite subsection (2), the credit reporting body must neither destroy the credit information nor ensure that the information is de identified, if immediately before the retention period ends:

(4) Subsection (2) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, to retain the credit information.

(5) The credit reporting body must destroy any CRB derived information about the individual that was derived from the credit information, or ensure that the CRB derived information is de identified:

at the same time that the body does that thing to that credit information; or

(6) Despite subsection (5), the credit reporting body must neither destroy the CRB derived information nor ensure that the information is de identified, if immediately before the retention period ends:

(7) Subsection (5) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, to retain the CRB derived information.

The following table sets out the retention period for credit information:

Destruction of credit reporting information

(2) The credit reporting body must:

(3) Subsection (2) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, to retain the credit reporting information.

(5) Subsection (4) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, not to give the notification.

(1) This section applies if a credit reporting body holds credit reporting information about an individual and either:

(2) The credit reporting body must, as soon as practicable, notify in writing the Commissioner of the matter referred to in paragraph (1)(a) or (b) of this section.

(3) The credit reporting body must not use or disclose the information under Subdivision D of this Division.

(4) However, the credit reporting body may use or disclose the information under this subsection if:

(5) If the credit reporting body uses or discloses the information under subsection (4), the body must make a written note of the use or disclosure.

(6) The Commissioner may, by legislative instrument, direct the credit reporting body to destroy the information, or ensure that the information is de identified, by a specified day.

(7) If the Commissioner gives a direction under subsection (6) to the credit reporting body, the body must comply with the direction.

(8) To avoid doubt, section 20M applies in relation to credit reporting information that is de identified as a result of the credit reporting body complying with the direction.

(1) This section applies if a credit reporting body is not required:

(2) The credit reporting body must not use or disclose the information under Subdivision D of this Division.

(3) However, the credit reporting body may use or disclose the information under this subsection if the use or disclosure of the information is required by or under an Australian law or a court/tribunal order.

(4) If the credit reporting body uses or discloses the information under subsection (3), the body must make a written note of the use or disclosure.

Note: Section 20Q deals with the security of credit reporting information.

This Division sets out rules that apply to credit providers in relation to their handling of the following:

If a credit provider is an APP entity, the rules apply in relation to that information in addition to, or instead of, any relevant Australian Privacy Principles.

(1) This Division applies to a credit provider in relation to the following:

(2) If the credit provider is an APP entity, this Division may apply to the provider in relation to information referred to in subsection (1) in addition to, or instead of, the Australian Privacy Principles.

(1) The object of this section is to ensure that credit providers manage credit information and credit eligibility information in an open and transparent way.

(2) A credit provider must take such steps as are reasonable in the circumstances to implement practices, procedures and systems relating to the provider’s functions or activities as a credit provider that:

Policy about the management of credit information etc.

(3) A credit provider must have a clearly expressed and up to date policy about the management of credit information and credit eligibility information by the provider.

(4) Without limiting subsection (3), the policy of the credit provider must contain the following information:

(5) A credit provider must take such steps as are reasonable in the circumstances to make the policy available:

Note: A credit provider will usually make the policy available on the provider’s website.

(6) If a person or body requests a copy, in a particular form, of the policy of a credit provider, the provider must take such steps as are reasonable in the circumstances to give the person or body a copy in that form.

(7) If a credit provider is an APP entity, Australian Privacy Principles 1.3 and 1.4 do not apply to the provider in relation to credit information or credit eligibility information.

(1) At or before the time a credit provider collects personal information about an individual that the provider is likely to disclose to a credit reporting body, the provider must:

(2) If a credit provider is an APP entity, subsection (1) applies to the provider in relation to personal information in addition to Australian Privacy Principle 5.

(3) If a credit provider is an APP entity, then the matters for the purposes of Australian Privacy Principle 5.1 include the following matters to the extent that the personal information referred to in that principle is credit information or credit eligibility information:

(1) A credit provider must not disclose credit information about an individual to a credit reporting body (whether or not the body’s credit reporting business is carried on in Australia).

(2) Subsection (1) does not apply to the disclosure of credit information about the individual if:

Note: Section 21F limits the disclosure of credit information if there is a ban period for the information.

(3) Credit information about an individual meets the requirements of this subsection if:

(5) Despite paragraph (3)(a), consumer credit liability information about the individual may relate to consumer credit that was entered into on a day before the individual turned 18, so long as the consumer credit was not terminated, or did not otherwise cease to be in force, on a day before the individual turned 18.

(6) If a credit provider discloses credit information under this section, the provider must make a written note of that disclosure.

(7) If a credit provider is an APP entity, Australian Privacy Principles 6 and 8 do not apply to the disclosure by the provider of credit information to a credit reporting body.

(2) If the credit provider holds credit information about the individual that relates to the consumer credit, the provider must not, despite sections 21D and 21E, disclose the information to a credit reporting body.

(3) Subsection (2) does not apply if the credit provider has taken such steps as are reasonable in the circumstances to verify the identity of the individual.

(1) If a credit provider holds credit eligibility information about an individual, the provider must not use or disclose the information.

(2) Subsection (1) does not apply to the use of credit eligibility information about the individual if:

(3) Subsection (1) does not apply to the disclosure of credit eligibility information about the individual if:

Note: See section 21NA for additional rules about the disclosure of credit eligibility information under paragraph (3)(b) or (c).

(4) However, if the credit eligibility information about the individual is, or was derived from, repayment history information about the individual, the credit provider must not disclose the information under subsection (3).

(6) If a credit provider uses or discloses credit eligibility information under this section, the provider must make a written note of that use or disclosure.

(7) If a credit provider is an APP entity, Australian Privacy Principles 6, 7 and 8 do not apply to the provider in relation to credit eligibility information.

A use by a credit provider of credit eligibility information about an individual is a permitted CP use in relation to the individual if:

(1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

Agents of credit providers

(3) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

(4) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

Mortgage credit secured by the same real property

(5) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

(1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

(3) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

(4) The consent of the individual under subparagraph (3)(c)(i) must be given in writing unless the application for the credit was not made in writing.

A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if the disclosure is to a mortgage insurer that has an Australian link for:

(1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

Note: See section 21NA for additional rules about the disclosure of credit eligibility information under this subsection.

Mortgage credit assistance schemes

(1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

Assignment of debts owed to credit providers etc.

(2) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

(3) This subsection applies to the credit eligibility information if the recipient proposes to use the information:

Related bodies corporate and credit managers etc.

(1) Before a credit provider discloses credit eligibility information under paragraph 21G(3)(b) or (c) to a related body corporate, or person, that does not have an Australian link, the provider must take such steps as are reasonable in the circumstances to ensure that the body or person does not breach the following provisions (the relevant provisions) in relation to the information:

(3) Before a credit provider discloses credit eligibility information under subsection 21M(1) to a person or body that does not have an Australian link, the provider must take such steps as are reasonable in the circumstances to ensure that the person or body does not breach the Australian Privacy Principles (other than Australian Privacy Principle 1) in relation to the information.

(2) The credit provider must, within a reasonable period after refusing the application, give the individual a written notice that:

(1) A credit provider must take such steps (if any) as are reasonable in the circumstances to ensure that the credit eligibility information the provider collects is accurate, up to date and complete.

(2) A credit provider must take such steps (if any) as are reasonable in the circumstances to ensure that the credit eligibility information the provider uses or discloses is, having regard to the purpose of the use or disclosure, accurate, up to date, complete and relevant.

(3) If a credit provider is an APP entity, Australian Privacy Principle 10 does not apply to the provider in relation to credit eligibility information.

(1) A credit provider commits an offence if:

(2) A credit provider commits an offence if:

(3) A credit provider must not disclose credit information under section 21D if the information is false or misleading in a material particular.

(4) A credit provider must not use or disclose credit eligibility information under this Division if the information is false or misleading in a material particular.

(1) If a credit provider holds credit eligibility information, the provider must take such steps as are reasonable in the circumstances to protect the information:

(3) If a credit provider is an APP entity, Australian Privacy Principle 11 does not apply to the provider in relation to credit eligibility information.

(1) If a credit provider holds credit eligibility information about an individual, the provider must, on request by an access seeker in relation to the information, give the access seeker access to the information.

(2) Despite subsection (1), the credit provider is not required to give the access seeker access to the credit eligibility information to the extent that:

(3) The credit provider must respond to the request within a reasonable period after the request is made.

(4) If the credit provider gives access to the credit eligibility information, the access must be given in the manner set out in the registered CR code.

(5) If the credit provider is an agency, the provider must not charge the access seeker for the making of the request or for giving access to the information.

(6) If a credit provider is an organisation or small business operator, any charge by the provider for giving access to the information must not be excessive and must not apply to the making of the request.

(8) If a credit provider is an APP entity, Australian Privacy Principle 12 does not apply to the provider in relation to credit eligibility information.

(4) If a credit provider is an APP entity, Australian Privacy Principle 13:

(1) An individual may request a credit provider to correct personal information about the individual if:

(2) If the credit provider is satisfied that the personal information is inaccurate, out of date, incomplete, irrelevant or misleading, the provider must take such steps (if any) as are reasonable in the circumstances to correct the information within:

(3) If the credit provider considers that the provider cannot be satisfied of the matter referred to in subsection (2) in relation to the personal information without consulting either or both of the following (the interested party):

(5) The credit provider must not charge the individual for the making of the request or for correcting the information.

(6) If a credit provider is an APP entity, Australian Privacy Principle 13:

(1) This section applies if an individual requests a credit provider to correct personal information under subsection 21V(1).

(2) If the credit provider corrects personal information about the individual under subsection 21V(2), the provider must, within a reasonable period:

(3) If the credit provider does not correct the personal information under subsection 21V(2), the provider must, within a reasonable period, give the individual written notice that:

(4) Paragraph (2)(c) does not apply if it is impracticable for the credit provider to give the notice under that paragraph.

(5) Subsection (2) or (3) does not apply if the credit provider is required by or under an Australian law, or a court/tribunal order, not to give the notice under that subsection.

(2) Subsection (1) does not apply to the use or disclosure of the information by the body corporate if the body would be permitted to use or disclose the information under section 21G if the body were the credit provider.

This Division deals with complaints about credit reporting bodies or credit providers.

Individuals may complain to credit reporting bodies or credit providers about acts or practices that may be a breach of certain provisions of this Part or the registered CR code.

(1) An individual may complain to a credit reporting body about an act or practice engaged in by the body that may be a breach of either of the following provisions in relation to the individual:

(2) An individual may complain to a credit provider about an act or practice engaged in by the provider that may be a breach of either of the following provisions in relation to the individual:

(5) The credit reporting body or credit provider must not charge the individual for the making of the complaint or for dealing with the complaint.

(2) If the respondent for the complaint considers that it is necessary to consult a credit reporting body or credit provider about the complaint, the respondent must consult the body or provider.

(1) This section applies if an individual makes a complaint under section 23A about an act or practice that may breach section 20S or 21U (which deal with the correction of personal information by credit reporting bodies and credit providers).

(3) An entity must not obtain credit reporting information from a credit reporting body if the entity is not:

(4) An entity must not obtain, by false pretence, credit reporting information from a credit reporting body.

(3) An entity must not obtain credit eligibility information from a credit provider if the entity is not:

(4) An entity must not obtain, by false pretence, credit eligibility information from a credit provider.

Division 3 deals with a code of practice about credit reporting, called a CR code. CR code developers or the Commissioner may develop a CR code, which:

(1) A CR code is a written code of practice about credit reporting.

Credit reporting and tax file number information

(3) Where, after an investigation of an act or practice of an agency, file number recipient, credit reporting body or credit provider that is an interference with the privacy of an individual under subsection 13(1), (2) or (4), the Commissioner is required by virtue of paragraph (1)(b) of this section to report to the Minister about the act or practice, the Commissioner:

(4) Where, at the end of 60 days after a copy of a report about an act or practice of an agency, file number recipient, credit reporting body or credit provider was served under subsection (3), the Commissioner:

and shall serve a copy of the report on the Minister (if any) responsible for the agency, recipient, credit reporting body or credit provider.

(1) Where, in the course of an investigation under section 40, the Commissioner forms the opinion that a tax file number offence, a healthcare identifier offence, an AML/CTF verification offence or a credit reporting offence may have been committed, the Commissioner shall:

credit reporting offence means:

(1) Subject to subsection (3), for the purposes of the performance by the Commissioner of his or her functions under this Act, a person authorised by the Commissioner in writing for the purposes of this section may, at any reasonable time of the day, enter premises occupied by an agency, an organisation, a file number recipient, a credit reporting body or a credit provider and inspect any documents that are kept at those premises and that are relevant to the performance of those functions, other than documents in respect of which the Attorney General has furnished a certificate under subsection 70(1) or (2).