Commonwealth of Australia Bills Commonwealth of Australia Bills[Index] [Search] [Download] [Related Items] [Help]
This is a Bill, not an Act. For current law, see the Acts databases.
2016-2017-2018
The Parliament of the
Commonwealth of Australia
HOUSE OF REPRESENTATIVES
Presented and read a first time
National Consumer Credit Protection
Amendment (Mandatory Comprehensive
Credit Reporting) Bill 2018
No. , 2018
(Treasury)
A Bill for an Act to provide for mandatory
comprehensive credit reporting, and for related
purposes
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
i
Contents
1
Short title ........................................................................................... 1
2
Commencement ................................................................................. 1
3
Schedules ........................................................................................... 2
Schedule 1--Amendments
3
National Consumer Credit Protection Act 2009
3
Privacy Act 1988
25
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
1
A Bill for an Act to provide for mandatory
1
comprehensive credit reporting, and for related
2
purposes
3
The Parliament of Australia enacts:
4
1 Short title
5
This Act is the National Consumer Credit Protection Amendment
6
(Mandatory Comprehensive Credit Reporting) Act 2018.
7
2 Commencement
8
(1) Each provision of this Act specified in column 1 of the table
9
commences, or is taken to have commenced, in accordance with
10
column 2 of the table. Any other statement in column 2 has effect
11
according to its terms.
12
2
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
1
Commencement information
Column 1
Column 2
Column 3
Provisions
Commencement
Date/Details
1. Sections 1 to 3
and anything in
this Act not
elsewhere covered
by this table
The day this Act receives the Royal Assent.
2. Schedule 1,
items 1 to 11
The day after this Act receives the Royal
Assent.
3. Schedule 1,
item 12
The later of:
(a) immediately after the commencement of
the provisions covered by table item 2;
and
(b) the commencement of Part 1 of
Schedule 1 to the Intelligence Services
Amendment (Establishment of the
Australian Signals Directorate) Act
2018.
However, the provisions do not commence
at all if the event mentioned in paragraph (b)
does not occur.
Note:
This table relates only to the provisions of this Act as originally
2
enacted. It will not be amended to deal with any later amendments of
3
this Act.
4
(2) Any information in column 3 of the table is not part of this Act.
5
Information may be inserted in this column, or information in it
6
may be edited, in any published version of this Act.
7
3 Schedules
8
Legislation that is specified in a Schedule to this Act is amended or
9
repealed as set out in the applicable items in the Schedule
10
concerned, and any other item in a Schedule to this Act has effect
11
according to its terms.
12
Amendments Schedule 1
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
3
Schedule 1--Amendments
1
2
National Consumer Credit Protection Act 2009
3
1 Subsection 5(1)
4
Insert:
5
banking group means a relevant group of bodies corporate (within
6
the meaning of the Banking Act 1959) that includes a body
7
corporate covered by paragraph 133CN(1)(a) (about large ADIs).
8
credit information has the same meaning as in the Privacy Act
9
1988.
10
2 Subsection 5(1) (definition of credit provider)
11
Repeal the definition, substitute:
12
credit provider:
13
(a) when used in Part 3-2CA--has the same meaning as in the
14
Privacy Act 1988; and
15
(b) otherwise--has the same meaning as in section 204 of the
16
National Credit Code, and includes a person who is a credit
17
provider because of section 10 of this Act.
18
3 Subsection 5(1)
19
Insert:
20
credit reporting body has the same meaning as in the Privacy Act
21
1988.
22
declaration of contravention means a declaration made under
23
section 166.
24
eligible credit account: see section 133CO.
25
eligible credit reporting body: see subsection 133CN(2).
26
eligible licensee: see subsection 133CN(1).
27
Schedule 1 Amendments
4
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
evidential burden, in relation to a matter, means the burden of
1
adducing or pointing to evidence that suggests a reasonable
2
possibility that the matter exists or does not exist.
3
head company, of a banking group, means the member of the
4
group covered by paragraph 133CN(1)(a) (about large ADIs).
5
large ADI has the same meaning as in the Banking Act 1959.
6
mandatory credit information: see section 133CP.
7
Part 3-2CA body: see section 133CZF.
8
pecuniary penalty order means an order made under section 167.
9
personal information has the same meaning as in the Privacy Act
10
1988.
11
sensitive information has the same meaning as in the Privacy Act
12
1988.
13
supply requirements: see section 133CQ.
14
4 After Part 3-2C
15
Insert:
16
Part 3-2CA--Licensees supplying credit
17
information to credit reporting bodies etc.
18
Division 1--Introduction
19
133CM Guide to this Part
20
This Part has rules that apply to licensees that are large ADIs or are
21
of a prescribed kind.
22
Each licensee must supply certain information to eligible credit
23
reporting bodies about all of the open credit accounts held with the
24
licensee or with other members of the licensee's corporate group.
25
Amendments Schedule 1
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
5
Each licensee must then supply updated information to those credit
1
reporting bodies on an ongoing basis.
2
Conditions may need to be met before the credit reporting bodies
3
who are supplied with this information can on-disclose this
4
information to credit providers.
5
This Part applies in addition to the Privacy Act 1988.
6
133CN Meanings of eligible licensee and eligible credit reporting body
7
(1) A licensee is an eligible licensee, on 1 July 2018 or a later day, if
8
on that day the licensee:
9
(a) is a large ADI, or is a body corporate of a kind prescribed by
10
the regulations; and
11
(b) is a credit provider.
12
(2) A credit reporting body is an eligible credit reporting body for a
13
licensee if:
14
(a) the following conditions are met:
15
(i) an agreement of the kind referred to in
16
paragraph 20Q(2)(a) of the Privacy Act 1988 between
17
the body and the licensee was in force on 2 November
18
2017;
19
(ii) the licensee is an eligible licensee on 1 July 2018; or
20
(b) the conditions (if any) prescribed by the regulations are met.
21
133CO Meaning of eligible credit account
22
An eligible credit account is an account that:
23
(a) relates to the provision, or possible provision, of consumer
24
credit (within the meaning of the Privacy Act 1988); and
25
(b) is held by one or more natural persons with a credit provider;
26
and
27
(c) is not of a kind prescribed by the regulations.
28
Schedule 1 Amendments
6
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
133CP Meaning of mandatory credit information
1
(1) Mandatory credit information, for eligible credit accounts held by
2
natural persons with a credit provider, is personal information
3
(other than sensitive information) for those accounts that is:
4
(a) identification information (within the meaning of the Privacy
5
Act 1988) about the natural persons; or
6
(b) consumer credit liability information (within the meaning of
7
the Privacy Act 1988) about the natural persons; or
8
(c) repayment history information (within the meaning of the
9
Privacy Act 1988) about the natural persons; or
10
(d) default information (within the meaning of the Privacy Act
11
1988) about the natural persons; or
12
(e) payment information (within the meaning of the Privacy Act
13
1988) about the natural persons; or
14
(f) new arrangement information (within the meaning of the
15
Privacy Act 1988) about the natural persons.
16
(2) Despite paragraph (1)(c), mandatory credit information does not
17
include repayment history information (within the meaning of the
18
Privacy Act 1988) that comes into existence more than 3 months
19
before the first 1 July on which:
20
(a) if the credit provider is a member of a banking group--the
21
head company of the group is an eligible licensee; or
22
(b) otherwise--the credit provider is an eligible licensee.
23
(3) Despite paragraph (1)(d), mandatory credit information does not
24
include default information (within the meaning of the Privacy Act
25
1988) that comes into existence before the first 1 July on which:
26
(a) if the credit provider is a member of a banking group--the
27
head company of the group is an eligible licensee; or
28
(b) otherwise--the credit provider is an eligible licensee.
29
133CQ Meaning of supply requirements
30
(1) Information is supplied in accordance with the supply
31
requirements if the supply is in accordance with:
32
(a) the registered CR code (within the meaning of the Privacy
33
Act 1988); and
34
Amendments Schedule 1
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
7
(b) any determination under subsection (2); and
1
(c) any technical standards approved under subsection (4).
2
(2) For one or more kinds of information to be supplied under this
3
Part, ASIC may, by legislative instrument, determine particulars of
4
the information that must be included in the supply.
5
(3) Despite subsection 14(2) of the Legislation Act 2003, a
6
determination under subsection (2) may make provision in relation
7
to a matter by applying, adopting or incorporating, with or without
8
modification, any matter contained in any other instrument or
9
writing as in force or existing from time to time.
10
(4) ASIC may, in writing, approve technical standards for supplying
11
one or more kinds of information under this Part.
12
(5) If there is an inconsistency between:
13
(a) the registered CR code (within the meaning of the Privacy
14
Act 1988); and
15
(b) a determination under subsection (2) or a technical standard
16
approved under subsection (4);
17
the registered CR code prevails to the extent of the inconsistency.
18
Division 2--Supplying credit information to credit
19
reporting bodies etc.
20
Subdivision A--Initial bulk supplies of credit information
21
133CR Requirement to supply
22
First bulk supply for at least 50% of total eligible credit accounts
23
(1) An eligible licensee must supply mandatory credit information for
24
the accounts referred to in subsection (2) to each eligible credit
25
reporting body (CRB) for the licensee:
26
(a) before the end of the later of the following periods:
27
(i) the 90-day period starting on the first 1 July on which
28
the licensee is an eligible licensee;
29
(ii) if subsection (5) applies--the 14-day period starting on
30
the cessation day referred to in that subsection; and
31
Schedule 1 Amendments
8
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
(b) in accordance with the supply requirements; and
1
(c) to the extent that the licensee is not prevented by the Privacy
2
Act 1988 from doing so.
3
Civil penalty:
2,000 penalty units.
4
(2) For the purposes of subsection (1), the accounts are at least 50% of
5
all of the eligible credit accounts held:
6
(a) on the first 1 July on which the licensee is an eligible
7
licensee; and
8
(b) with the licensee, or with a member of a banking group of
9
which the licensee is the head company.
10
The licensee may choose which eligible credit accounts make up
11
this 50%.
12
Bulk supply for remaining eligible credit accounts
13
(3) An eligible licensee must supply mandatory credit information for
14
the accounts referred to in subsection (4) to each eligible credit
15
reporting body (CRB) for the licensee:
16
(a) before the end of the latest of the following periods:
17
(i) the 90-day period starting on the second 1 July on which
18
the licensee is an eligible licensee;
19
(ii) if subsection (5) applies--the 14-day period starting on
20
the cessation day referred to in that subsection;
21
(iii) if, because paragraph 133CS(1)(b) is no longer satisfied,
22
subsection 133CS(1) ceases to provide the licensee with
23
an exception to this subsection for the CRB--the 14-day
24
period starting on the day that exception ceases to
25
apply; and
26
(b) in accordance with the supply requirements; and
27
(c) to the extent that the licensee is not prevented by the Privacy
28
Act 1988 from doing so.
29
Civil penalty:
2,000 penalty units.
30
(4) For the purposes of subsection (3), the accounts are all of the
31
eligible credit accounts held:
32
(a) on the second 1 July on which the licensee is an eligible
33
licensee; and
34
Amendments Schedule 1
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
9
(b) with the licensee, or with a member of a banking group of
1
which the licensee is the head company;
2
for which mandatory credit information was not supplied under
3
subsection (1) to the CRB.
4
Possible extension of time if credit reporting body later complies
5
with information security requirements before end of 90-day period
6
(5) For the purposes of subsection (1) or (3), this subsection applies if:
7
(a) the licensee reasonably believes that the CRB is not
8
complying with section 20Q of the Privacy Act 1988 on the
9
1 July referred to in that subsection; and
10
(b) the licensee complies with paragraphs 133CS(2)(a) and (b) in
11
relation to that belief; and
12
(c) the licensee ceases to hold that belief on a day (the cessation
13
day) before the end of the 90-day period starting on that
14
1 July.
15
Requirements apply whether the information is kept in or outside
16
this jurisdiction
17
(6) Subsection (1) or (3) applies whether the mandatory credit
18
information is kept in or outside this jurisdiction.
19
133CS Exception if credit reporting body not complying with
20
information security requirements
21
(1) Subsection 133CR(1) or (3) does not apply, and is taken never to
22
have applied, to a licensee for a credit reporting body if:
23
(a) the licensee reasonably believes that the body is not
24
complying with section 20Q of the Privacy Act 1988:
25
(i) on the 1 July referred to in that subsection; and
26
(ii) on the last day of the 90-day period starting on that
27
1 July; and
28
(b) in the case of subsection 133CR(3)--the licensee continues
29
to hold that belief after that 90-day period; and
30
(c) the licensee satisfies subsection (2) of this section.
31
Note 1:
Paragraph (b) means that, if the licensee ceases to hold that belief after
32
the 90-day period for the 1 July in subsection 133CR(3), this
33
Schedule 1 Amendments
10
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
exception will cease to apply and the supply requirement in
1
subsection 133CR(3) will apply.
2
Note 2:
A person who wishes to rely on this subsection bears an evidential
3
burden in relation to the matters in this subsection (see subsection (3)
4
of this section and subsection 13.3(3) of the Criminal Code).
5
(2) The licensee satisfies this subsection if:
6
(a) the licensee prepares a written notice:
7
(i) stating that the licensee reasonably believes that the
8
body is not complying with section 20Q of the Privacy
9
Act 1988 on that 1 July; and
10
(ii) setting out the licensee's reasons for that belief; and
11
(iii) stating that the body may try to convince the licensee
12
otherwise, but that in the case of subsection 133CR(1)
13
the body will need to do so before the end of the 90-day
14
period starting on that 1 July; and
15
(b) the licensee gives that notice to the credit reporting body, and
16
a copy to the Information Commissioner and ASIC, within 7
17
days after that 1 July; and
18
(c) the licensee prepares a written notice (the final notice):
19
(i) stating that the licensee reasonably believes that the
20
body is not complying with section 20Q of the Privacy
21
Act 1988 on the last day of that 90-day period; and
22
(ii) setting out the licensee's reasons for that belief; and
23
(d) the licensee gives the final notice to the body, and a copy to
24
the Information Commissioner and ASIC, within 7 days after
25
the last day of that 90-day period.
26
(3) A licensee who wishes to rely on subsection (1) in proceedings for
27
a declaration of contravention or a pecuniary penalty order bears an
28
evidential burden in relation to the matters in that subsection.
29
133CT Licensee must give notice if credit reporting body later
30
complies with information security requirements
31
If:
32
(a) an eligible licensee reasonably believes that an eligible credit
33
reporting body for the licensee is not complying with
34
section 20Q of the Privacy Act 1988 on the first or second
35
1 July on which the licensee is an eligible licensee; and
36
Amendments Schedule 1
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
11
(b) the licensee complies with paragraphs 133CS(2)(a) and (b) in
1
relation to that belief; and
2
(c) the licensee ceases to hold that belief:
3
(i) in the case of subsection 133CR(1)--on a day during
4
the 90-day period starting on that first 1 July; or
5
(ii) in the case of subsection 133CR(3)--on any day after
6
that second 1 July;
7
the licensee must:
8
(d) prepare a written notice:
9
(i) stating that the licensee has ceased to hold that belief;
10
and
11
(ii) setting out the licensee's reasons for ceasing to hold that
12
belief; and
13
(e) give that notice to the body, and a copy to the Information
14
Commissioner and ASIC, within 7 days after the day the
15
licensee ceases to hold that belief.
16
Civil penalty:
2,000 penalty units.
17
Subdivision B--Ongoing supplies of credit information
18
133CU Requirement to supply
19
(1) If:
20
(a) a licensee has supplied a credit reporting body (the CRB)
21
with mandatory credit information under this Division; and
22
(b) on a later day (the trigger day):
23
(i) the conditions (if any) prescribed by the regulations are
24
not met for the licensee and the CRB; and
25
(ii) the licensee, or a member of a banking group of which
26
the licensee is the head company, would reasonably be
27
expected to have become aware that an event in an item
28
of the following table has happened; and
29
(iii) the licensee is still an eligible licensee; and
30
(iv) an agreement of the kind referred to in
31
paragraph 20Q(2)(a) of the Privacy Act 1988 is in force
32
between the CRB and a body referred to in
33
subparagraph (ii) of this paragraph;
34
Schedule 1 Amendments
12
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
the licensee must supply to the credit reporting body the
1
information referred to in that table item:
2
(c) before the end of the latest of the following periods:
3
(i) the 45-day period starting on the trigger day;
4
(ii) if subsection (2) applies--the 14-day period starting on
5
the cessation day referred to in that subsection;
6
(iii) if, because paragraph 133CV(1)(b) is no longer
7
satisfied, subsection 133CV(1) ceases to provide the
8
licensee with an exception to this subsection for the
9
CRB--the 14-day period starting on the day that
10
exception ceases to apply; and
11
(d) in accordance with the supply requirements; and
12
(e) to the extent that the licensee is not prevented by the Privacy
13
Act 1988 from doing so.
14
15
Ongoing supplies of mandatory credit information
Item
If this event happens:
This information must be
supplied:
1
the need to change any mandatory credit
information the licensee has supplied
under this Division to ensure that the
information is accurate, up to date and
complete
details of the changed
information
2
the payment of an overdue payment about
which default information (within the
meaning of the Privacy Act 1988) has
been supplied under this Division
payment information (within the
meaning of the Privacy Act
1988) relating to the payment
3
the opening (or reopening) of an eligible
credit account with the licensee, provided
this happens after the licensee has
supplied the CRB with mandatory credit
information under subsection 133CR(3)
mandatory credit information for
that account
4
an event:
(a) of a kind prescribed by the regulations;
and
(b) that relates to eligible credit accounts
or to the natural persons who hold
those accounts
information that:
(a) is, or relates to, mandatory
credit information; and
(b) is of a kind prescribed by the
regulations for that kind of
event
Amendments Schedule 1
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
13
Civil penalty:
2,000 penalty units.
1
(2) For the purposes of subsection (1), this subsection applies if:
2
(a) the licensee reasonably believes that the CRB is not
3
complying with section 20Q of the Privacy Act 1988 on the
4
trigger day; and
5
(b) the licensee complies with paragraphs 133CV(2)(a) and (b)
6
in relation to that belief; and
7
(c) the licensee ceases to hold that belief on a day (the cessation
8
day) before the end of the 45-day period starting on the
9
trigger day.
10
(3) Supplies under subsection (1) of information relating to multiple
11
events, or multiple trigger days, may be made together.
12
(4) Subsection (1) applies whether the information referred to in the
13
table is kept in or outside this jurisdiction.
14
(5) Regulations made for the purposes of subparagraph (1)(b)(i) may
15
make provision in relation to a matter by applying, adopting or
16
incorporating, with or without modification, any matter contained
17
in any other instrument or writing as in force or existing from time
18
to time.
19
(6) Subsection (5) has effect despite subsection 14(2) of the
20
Legislation Act 2003.
21
133CV Exception if credit reporting body not complying with
22
information security requirements
23
(1) Subsection 133CU(1) does not apply, and is taken never to have
24
applied, to a licensee for a credit reporting body if:
25
(a) the licensee reasonably believes that the body is not
26
complying with section 20Q of the Privacy Act 1988:
27
(i) on the trigger day referred to in that subsection; and
28
(ii) on the last day of the 45-day period starting on the
29
trigger day; and
30
(b) the licensee continues to hold that belief after that 45-day
31
period; and
32
(c) the licensee satisfies subsection (2) of this section.
33
Schedule 1 Amendments
14
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
Note 1:
Paragraph (b) means that, if the licensee ceases to hold that belief after
1
that 45-day period, this exception will cease to apply and the supply
2
requirement in subsection 133CU(1) will apply.
3
Note 2:
A person who wishes to rely on this subsection bears an evidential
4
burden in relation to the matters in this subsection (see subsection (3)
5
of this section and subsection 13.3(3) of the Criminal Code).
6
(2) The licensee satisfies this subsection if:
7
(a) the licensee prepares a written notice:
8
(i) stating that the licensee reasonably believes that the
9
body is not complying with section 20Q of the Privacy
10
Act 1988 on the trigger day; and
11
(ii) setting out the licensee's reasons for that belief; and
12
(iii) stating that the body may try to convince the licensee
13
otherwise; and
14
(b) the licensee gives that notice to the credit reporting body, and
15
a copy to the Information Commissioner and ASIC, within 7
16
days after the trigger day; and
17
(c) the licensee prepares a written notice (the final notice):
18
(i) stating that the licensee reasonably believes that the
19
body is not complying with section 20Q of the Privacy
20
Act 1988 on the last day of that 45-day period; and
21
(ii) setting out the licensee's reasons for that belief; and
22
(d) the licensee gives the final notice to the body, and a copy to
23
the Information Commissioner and ASIC, within 7 days after
24
the last day of that 45-day period.
25
(3) A licensee who wishes to rely on subsection (1) in proceedings for
26
a declaration of contravention or a pecuniary penalty order bears an
27
evidential burden in relation to the matters in that subsection.
28
(4) Subsection 21U(2) of the Privacy Act 1988 does not require a
29
licensee to give a credit reporting body notice of a correction of
30
certain information if:
31
(a) subsection (1) of this section is providing the licensee with an
32
exception from a requirement under subsection 133CU(1) of
33
this Act; and
34
(b) that requirement is to supply the corrected information to the
35
credit reporting body;
36
Amendments Schedule 1
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
15
unless the reason under subsection 21U(1) of the Privacy Act 1988
1
for the correction is that the information is inaccurate, and it was
2
inaccurate when earlier supplied to the credit reporting body under
3
this Division.
4
133CW Licensee must give notice if credit reporting body later
5
complies with information security requirements
6
If:
7
(a) an eligible licensee reasonably believes that an eligible credit
8
reporting body for the licensee is not complying with
9
section 20Q of the Privacy Act 1988 on the trigger day
10
referred to in subsection 133CU(1); and
11
(b) the licensee complies with paragraphs 133CV(2)(a) and (b)
12
in relation to that belief; and
13
(c) the licensee ceases to hold that belief on any day after the
14
trigger day;
15
the licensee must:
16
(d) prepare a written notice:
17
(i) stating that the licensee has ceased to hold that belief;
18
and
19
(ii) setting out the licensee's reasons for ceasing to hold that
20
belief; and
21
(e) give that notice to the body, and a copy to the Information
22
Commissioner and ASIC, within 7 days after the day the
23
licensee ceased to hold that belief.
24
Civil penalty:
2,000 penalty units.
25
Subdivision C--Offences
26
133CX Offence relating to initial bulk supplies
27
(1) A person commits an offence if:
28
(a) the person is subject to a requirement under
29
subsection 133CR(1) or (3); and
30
(b) the person engages in conduct; and
31
(c) the conduct contravenes the requirement.
32
Schedule 1 Amendments
16
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
Criminal penalty:
100 penalty units.
1
(2) Section 14.1 of the Criminal Code does not apply to an offence
2
against subsection (1).
3
Note:
For an exception to an offence against subsection (1), see
4
subsection 133CS(1). A defendant bears an evidential burden in
5
relation to the matters in subsection 133CS(1) (see subsection 13.3(3)
6
of the Criminal Code).
7
133CY Offence relating to ongoing supplies
8
(1) A person commits an offence if:
9
(a) the person is subject to a requirement under
10
subsection 133CU(1); and
11
(b) the person engages in conduct; and
12
(c) the conduct contravenes the requirement.
13
Criminal penalty:
100 penalty units.
14
(2) Section 14.1 of the Criminal Code does not apply to an offence
15
against subsection (1).
16
Note:
For an exception to an offence against subsection (1), see
17
subsection 133CV(1). A defendant bears an evidential burden in
18
relation to the matters in subsection 133CV(1) (see subsection 13.3(3)
19
of the Criminal Code).
20
133CZ Offence relating to giving notice if credit reporting body
21
later complies with information security requirements
22
A person commits an offence if:
23
(a) the person is subject to a requirement under section 133CT or
24
133CW; and
25
(b) the person engages in conduct; and
26
(c) the conduct contravenes the requirement.
27
Criminal penalty:
100 penalty units.
28
Amendments Schedule 1
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
17
Division 3--Conditions on credit reporting bodies
1
on-disclosing credit information
2
133CZA On-disclosing information supplied under Division 2 etc.
3
(1) This section applies to a credit reporting body in relation to the
4
following information (the protected information):
5
(a) any information that the credit reporting body is supplied
6
under Division 2;
7
(b) any CRB derived information (within the meaning of the
8
Privacy Act 1988) that is derived from information that the
9
credit reporting body is supplied under Division 2.
10
When protected information must not be disclosed
11
(2) If the conditions prescribed by the regulations are met for the credit
12
reporting body and a credit provider, the credit reporting body
13
must not disclose to the credit provider so much of the protected
14
information as:
15
(a) is prescribed by the regulations; or
16
(b) is of a kind or kinds prescribed by the regulations.
17
Civil penalty:
2,000 penalty units.
18
When protected information must be disclosed
19
(3) If the conditions prescribed by the regulations are met for the credit
20
reporting body and a credit provider, the credit reporting body
21
must disclose to the credit provider so much of the protected
22
information as:
23
(a) the regulations require to be disclosed; or
24
(b) is of a kind or kinds prescribed by the regulations;
25
and which the Privacy Act 1988 does not prevent the credit
26
reporting body from disclosing.
27
Civil penalty:
2,000 penalty units.
28
(4) If the credit reporting body is required under subsection (3) to
29
disclose information, the credit reporting body must make the
30
Schedule 1 Amendments
18
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
disclosure by the time, and in accordance with the requirements,
1
prescribed by the regulations.
2
Civil penalty:
2,000 penalty units.
3
Incorporation of other instruments
4
(5) Regulations made for the purposes of subsection (2), (3) or (4) may
5
make provision in relation to a matter by applying, adopting or
6
incorporating, with or without modification, any matter contained
7
in any other instrument or writing as in force or existing from time
8
to time.
9
(6) Subsection (5) has effect despite subsection 14(2) of the
10
Legislation Act 2003.
11
Matters regulations may deal with
12
(7) Without limiting subsection (2), (3) or (4), a matter prescribed for
13
the purposes of that subsection may depend on a person or body
14
being satisfied of one or more specified matters.
15
133CZB Offence
16
A person commits an offence if:
17
(a) the person is subject to a requirement under
18
subsection 133CZA(2), (3) or (4); and
19
(b) the person engages in conduct; and
20
(c) the conduct contravenes the requirement.
21
Criminal penalty:
100 penalty units.
22
Division 4--Reporting to the Minister
23
133CZC Reports about initial bulk supplies of credit information
24
(1) A licensee who is required under subsection 133CR(1) or (3) to
25
supply mandatory credit information must arrange:
26
(a) for the preparation of a written statement containing
27
information of the kinds prescribed by the regulations
28
relating to:
29
Amendments Schedule 1
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
19
(i) the mandatory credit information; or
1
(ii) the eligible credit accounts to which the mandatory
2
credit information relates; and
3
(b) for a person appointed under section 133CZD to audit that
4
statement and prepare a written report of the audit; and
5
(c) for that statement and audit report to be given to the Minister
6
within 6 months after the 1 July referred to in that subsection.
7
Civil penalty:
2,000 penalty units.
8
(2) A credit reporting body to whom mandatory credit information is
9
required under subsection 133CR(1) or (3) to be supplied must
10
arrange:
11
(a) for the preparation of a written statement containing
12
information of the kinds prescribed by the regulations
13
relating to:
14
(i) the mandatory credit information; or
15
(ii) the eligible credit accounts to which the mandatory
16
credit information relates; and
17
(b) for a person appointed under section 133CZD to audit that
18
statement and prepare a written report of the audit; and
19
(c) for that statement and audit report to be given to the Minister
20
within 6 months after the 1 July referred to in that subsection.
21
Civil penalty:
2,000 penalty units.
22
(3) For the purposes of subsection (1) or (2), disregard section 133CS
23
when working out whether a person is required under
24
subsection 133CR(1) or (3) to supply mandatory credit information
25
to another person.
26
133CZD Auditors
27
(1) ASIC may, by writing, appoint as auditors for the purposes of this
28
Division:
29
(a) one or more suitably qualified persons; or
30
(b) the members of one or more classes of suitably qualified
31
persons.
32
Schedule 1 Amendments
20
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
(2) The reasonable fees and expenses of an auditor for preparing an
1
audit report under this Division are payable by the person required
2
to arrange for the preparation of the statement to which the audit
3
report relates.
4
(3) The auditor may recover those fees by action against that person.
5
133CZE Offence
6
A person commits an offence if:
7
(a) the person is subject to a requirement under
8
subsection 133CZC(1) or (2); and
9
(b) the person engages in conduct; and
10
(c) the conduct contravenes the requirement.
11
Criminal penalty:
100 penalty units.
12
Division 5--Assisting ASIC
13
133CZF Meaning of Part 3-2CA body
14
A Part 3-2CA body is a person that is or has been:
15
(a) an eligible licensee; or
16
(b) an eligible credit reporting body for a licensee.
17
133CZG Obligation to provide a statement or obtain an audit report
18
if directed by ASIC
19
Notice to Part 3-2CA body to provide a statement
20
(1) ASIC may give a Part 3-2CA body a written notice directing the
21
body to lodge with ASIC a written statement containing specified
22
information about whether the body, or another Part 3-2CA body,
23
is complying with this Part (other than Division 4).
24
(2) Notices under subsection (1):
25
(a) may be given at any time; and
26
(b) may be given to one or more particular Part 3-2CA bodies, or
27
to each Part 3-2CA body in one or more classes of
28
Part 3-2CA bodies, or to all Part 3-2CA bodies; and
29
Amendments Schedule 1
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
21
(c) may require all the same information, or may contain
1
differences as to the information they require; and
2
(d) may require a statement containing information to be given
3
on a periodic basis, or each time a particular event or
4
circumstance occurs, without ASIC having to give a further
5
written notice.
6
Notice to Part 3-2CA body to obtain an audit report
7
(3) ASIC may also give a Part 3-2CA body a written notice directing
8
the body to obtain an audit report prepared:
9
(a) by a suitably qualified person specified in the notice; and
10
(b) on a statement, or on each statement in a class of statements,
11
under subsection (1); and
12
(c) before the statement is given to ASIC.
13
(4) A notice under subsection (3) is not a legislative instrument.
14
Notice must specify day by which Part 3-2CA body must comply
15
(5) A notice given under this section must specify the day by which
16
the Part 3-2CA body must comply with the notice (which must be a
17
reasonable period after the notice is given). ASIC may extend the
18
day by giving a written notice to the Part 3-2CA body.
19
Requirement to comply with notice
20
(6) The Part 3-2CA body must comply with a notice given under this
21
section within the time specified in the notice.
22
Civil penalty:
2,000 penalty units.
23
Offence
24
(7) A person commits an offence if:
25
(a) the person is subject to a requirement under subsection (6);
26
and
27
(b) the person engages in conduct; and
28
(c) the conduct contravenes the requirement.
29
Criminal penalty:
25 penalty units, or 6 months imprisonment,
30
or both.
31
Schedule 1 Amendments
22
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
133CZH Obligation to give ASIC information required by the
1
regulations
2
Regulations may require Part 3-2CA body to give information
3
(1) The regulations may require:
4
(a) a Part 3-2CA body; or
5
(b) each Part 3-2CA body in a class of Part 3-2CA bodies;
6
to give ASIC specified information about whether the body, or
7
another Part 3-2CA body, is complying with this Part (other than
8
Division 4).
9
Requirement to comply with regulations
10
(2) If regulations under subsection (1) require a Part 3-2CA body to
11
give ASIC information, the body must give ASIC that information.
12
Civil penalty:
2,000 penalty units.
13
Offence
14
(3) A person commits an offence if:
15
(a) the person is subject to a requirement to give ASIC
16
information under subsection (2); and
17
(b) the person engages in conduct; and
18
(c) the conduct contravenes the requirement.
19
Criminal penalty:
25 penalty units, or 6 months imprisonment,
20
or both.
21
133CZI Obligation to provide ASIC with assistance if reasonably
22
requested
23
Requirement to provide assistance
24
(1) If ASIC, or a person authorised by ASIC, reasonably requests
25
assistance from a Part 3-2CA body (the assisting body) about
26
whether:
27
(a) the assisting body; or
28
(b) another Part 3-2CA body;
29
Amendments Schedule 1
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
23
is complying with this Part (other than Division 4), the assisting
1
body must give ASIC or the authorised person the requested
2
assistance.
3
Civil penalty:
2,000 penalty units.
4
(2) If the request is in writing, it is not a legislative instrument.
5
Offence
6
(3) A person commits an offence if:
7
(a) the person is subject to a requirement to give ASIC or an
8
authorised person assistance under subsection (1); and
9
(b) the person engages in conduct; and
10
(c) the conduct contravenes the requirement.
11
Criminal penalty:
25 penalty units, or 6 months imprisonment,
12
or both.
13
133CZJ Extended application of Division 4 of Part 2-5
14
(1) Division 4 of Part 2-5 also applies in relation to an audit report
15
required under subsection 133CZG(3) as if the substitutions in the
16
following table, and the modification in subsection (2) of this
17
section, were made.
18
19
Substitutions to be made
Item
For a reference in Division 4 of
Part 2-5 to:
substitute a reference to:
1
licensee
Part 3-2CA body
2
subsection 49(3)
subsection 133CZG(3)
3
financial records or other credit books
records
(2) For the purposes of subsection (1), assume that paragraphs
20
104(2)(a) and (b) were replaced with the following:
21
"(a) constitutes or may constitute a contravention of Part 3-2CA
22
(other than Division 4); or".
23
Schedule 1 Amendments
24
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
Division 6--Miscellaneous
1
133CZK This Part does not limit the Privacy Act 1988
2
Subject to subsection 133CV(4), this Part does not limit the
3
operation of the Privacy Act 1988.
4
133CZL Review of the operation of this Part
5
(1) The Minister must cause an independent review to be conducted of
6
the operation of this Part.
7
(2) The persons who conduct the review must complete it, and give the
8
Minister a written report of the review, before 1 January 2022.
9
(3) The Minister must cause copies of the report to be tabled in each
10
House of the Parliament within 15 sitting days of that House after
11
the report is given to the Minister.
12
133CZM Alternative constitutional basis
13
Without limiting its effect apart from this section, this Part also has
14
the effect it would have if:
15
(a) each reference to an eligible licensee were expressly confined
16
to an eligible licensee that is a corporation to which
17
paragraph 51(xx) of the Constitution applies; and
18
(b) each reference to an eligible credit reporting body were
19
expressly confined to an eligible credit reporting body that is
20
a corporation to which paragraph 51(xx) of the Constitution
21
applies.
22
5 At the end of paragraph 265(2)(c)
23
Add:
24
(iii) is of a provision of Part 3-2CA (about mandatory
25
comprehensive credit reporting); or
26
6 Section 266 (at the end of the heading)
27
Add "or credit reporting".
28
Amendments Schedule 1
No. , 2018
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
25
7 Section 266
1
Before "ASIC may give", insert "(1)".
2
8 At the end of section 266
3
Add:
4
(2) ASIC may give to:
5
(a) a Part 3-2CA body that is, or has been, subject to a
6
requirement under Part 3-2CA (other than Division 4), either
7
alone or together with any other person or persons; or
8
(b) a representative, banker, lawyer or auditor of a person
9
referred to in paragraph (a);
10
a written notice requiring the production to a specified ASIC
11
member or ASIC staff member, at a specified place and time, of
12
specified books relating to:
13
(c) information, or a statement, to which that requirement
14
relates; or
15
(d) the character or financial situation of, or a business carried on
16
by, a person who is, or has been, subject to that requirement.
17
Note 1:
Part 3-2CA is about mandatory comprehensive credit reporting.
18
Note 2:
Failure to comply with a requirement made under this subsection is an
19
offence (see section 290).
20
9 Paragraph 267(1)(b)
21
After "paragraph 266(1)(d) or (e)", insert "or (2)(c) or (d)".
22
10 Paragraph 307(1)(b)
23
After "paragraph 266(1)(d) or (e)", insert "or (2)(c) or (d)".
24
Privacy Act 1988
25
11 At the end of section 20Q
26
Add:
27
(3) Without limiting subsection (1), if a credit reporting body holds
28
credit reporting information, the body must store the information:
29
(a) in Australia or an external Territory; or
30
(b) using a service that:
31
Schedule 1 Amendments
26
National Consumer Credit Protection Amendment (Mandatory
Comprehensive Credit Reporting) Bill 2018
No. , 2018
(i) is listed by the Australian Signals Directorate of the
1
Defence Department as a Certified Cloud Service under
2
the program known as the Information Security
3
Registered Assessors Program; or
4
(ii) meets the conditions specified in the registered CR
5
code.
6
12 Subparagraph 20Q(3)(b)(i)
7
Omit "of the Defence Department".
8
Note:
This item amends the subsection being added by item 11. This item will only commence
9
if Part 1 of Schedule 1 to the Intelligence Services Amendment (Establishment of the
10
Australian Signals Directorate) Act 2018 commences.
11