Commonwealth Consolidated Acts Commonwealth Consolidated ActsProhibition on disclosure
(1) A credit provider must not disclose credit information about an individual to a credit reporting body (whether or not the body's credit reporting business is carried on in Australia).
Civil penalty: 2,000 penalty units.
Permitted disclosure
(2) Subsection (1) does not apply to the disclosure of credit information about the individual if:
(a) the credit provider:
(i) is a member of or subject to a recognised external dispute resolution scheme or is prescribed by the regulations; and
(ii) knows, or believes on reasonable grounds, that the individual is at least 18 years old; and
(b) the credit reporting body is:
(i) an agency; or
(ii) an organisation that has an Australian link; and
(c) the information meets the requirements of subsection (3).
Note: Section 21F limits the disclosure of credit information if there is a ban period for the information.
(3) Credit information about an individual meets the requirements of this subsection if:
(a) the information does not relate to an act, omission, matter or thing that occurred or existed before the individual turned 18; and
(b) if the information relates to consumer credit or commercial credit--the credit is or has been provided, or applied for, in Australia; and
(c) if the information is repayment history information or financial hardship information about the individual:
(i) the credit provider is a licensee or is prescribed by the regulations; and
(ii) the consumer credit to which the information relates is consumer credit in relation to which the provider also discloses, or a credit provider has previously disclosed, consumer credit liability information about the individual to the credit reporting body; and
(iii) the provider complies with any requirements relating to the disclosure of the information that are prescribed by the regulations; and
(d) if the information is default information about the individual:
(i) the credit provider has given the individual a notice in writing stating that the provider intends to disclose the information to the credit reporting body; and
(ii) at least 14 days have passed since the giving of the notice.
(4) Paragraph (3)(a) does not apply to identification information about the individual.
(5) Despite paragraph (3)(a), consumer credit liability information about the individual may relate to consumer credit that was entered into on a day before the individual turned 18, so long as the consumer credit was not terminated, or did not otherwise cease to be in force, on a day before the individual turned 18.
Written note of disclosure
(6) If a credit provider discloses credit information under this section, the provider must make a written note of that disclosure.
Civil penalty: 500 penalty units.
Interaction with the Australian Privacy Principles
(7) If a credit provider is an APP entity, Australian Privacy Principles 6 and 8 do not apply to the disclosure by the provider of credit information to a credit reporting body.