Commonwealth Numbered Acts

PRIVACY AMENDMENT ACT 1990 No. 116, 1990 - SECT 13

13. Before Part IV of the Principal Act the following Part is inserted:

"PART IIIA - CREDIT REPORTING Certain credit reporting only to be undertaken
by corporations

"18C. (1) A person must not use an eligible communications service in the
course of carrying on a credit reporting business unless the person is a
corporation.

"(2) A person must not:

   (a)  in the course of trade or commerce:

        (i)    between Australia and places outside Australia; or

        (ii)   among the States; or

        (iii)  between a State and a Territory; or

        (iv)   among the Territories; or

   (b)  in the course of banking (other than State banking not extending
        beyond the limits of the State concerned); or

   (c)  in the course of insurance business (other than insurance business
        relating to State insurance not extending beyond the limits of the
        State concerned); or

   (d)  in a Territory; carry on a credit reporting business unless the person
        is a corporation.

"(3) A person must not act on a corporation's behalf in the course of carrying
on a credit reporting business unless the person is a corporation.

"(4) A person who knowingly or recklessly contravenes this section is guilty
of an offence punishable, on conviction, by a fine not exceeding $30,000.
Personal information not to be given to certain persons carrying on credit
reporting

"18D. (1) A person must not use an eligible communications service to give to
a person carrying on a credit reporting business personal information in
circumstances to which this section applies unless the last-mentioned person
is a corporation.

"(2) A person must not:

   (a)  in the course of trade or commerce:

        (i)    between Australia and places outside Australia; or

        (ii)   among the States; or

        (iii)  between a State and a Territory; or

        (iv)   among the Territories; or

   (b)  in the course of banking (other than State banking not extending
        beyond the limits of the State concerned); or

   (c)  in the course of insurance business (other than insurance business
        relating to State insurance not extending beyond the limits of the
        State concerned); or

   (d)  in a Territory; give to a person carrying on a credit reporting
        business personal information in circumstances to which this section
        applies unless the last-mentioned person is a corporation.

"(3) A corporation must not give to a person carrying on a credit reporting
business personal information in circumstances to which this section applies
unless the last-mentioned person is a corporation.

"(4) A person who knowingly or recklessly contravenes this section is guilty
of an offence punishable, on conviction, by a fine not exceeding $12,000.

"(5) For the purposes of this section, personal information is to be taken to
be given to a person in circumstances to which this section applies if the
person to whom the information is given is likely to use the information in
the course of carrying on a credit reporting business. Permitted contents of
credit information files

"18E. (1) A credit reporting agency must not include personal information in
an individual's credit information file unless:

   (a)  the inclusion of the information in the file is reasonably necessary
        in order to identify the individual; or

   (b)  the information is a record of:

        (i)    both:

                (A)  a credit provider having sought a credit report in
                     relation to an individual in connection with an
                     application for credit or commercial credit made by the
                     individual to the credit provider; and

                (B)  the amount of credit or commercial credit sought in the
                     application; or

   (ii) a mortgage insurer having sought a credit report in connection with
        the provision of insurance to a credit provider in respect of mortgage
        credit given by the credit provider to the individual; or

   (iii) a trade insurer having sought a credit report in connection with the
        provision of insurance to a credit provider in respect of commercial
        credit given by the credit provider to the individual or another
        person; or

   (iv) a credit provider having sought a credit report in connection with the
        individual having offered to act as guarantor in respect of a loan or
        an application for a loan; or

   (v)  a credit provider being a current credit provider in relation to the
        individual; or

   (vi) credit provided by a credit provider to an individual, being credit in
        respect of which:

                (A)  the individual is at least 60 days overdue in making a
                     payment, including a payment that is wholly or partly a
                     payment of interest; and

                (B)  the credit provider has taken steps to recover the whole
                     or any part of the amount of credit (including any
                     amounts of interest) outstanding; or

   (vii) a cheque, for an amount not less than $100, that:

                (A)  has been drawn by the individual; and

                (B)  has twice been presented and dishonoured; or

   (viii) court judgments made against the individual; or

   (ix) bankruptcy orders made against the individual; or

   (x)  the opinion of a credit provider that the individual has, in the
        circumstances specified, committed a serious credit infringement; or

   (c)  the information is included in a statement provided by the individual
        under subsection 18J (2) for inclusion in the file; or

   (d)  the information is included in a note included in the file under
        subsection 18F (4) or 18K (5).

"(2) A credit reporting agency must not include in an individual's credit
information file personal information recording the individual's:

   (a)  political, social or religious beliefs or affiliations; or

   (b)  criminal record; or

   (c)  medical history or physical handicaps; or

   (d)  race, ethnic origins or national origins; or

   (e)  sexual preferences or practices; or

   (f)  lifestyle, character or reputation.

"(3) The Commissioner may determine, in writing, the kinds of information that
are, for the purposes of paragraph (1) (a), reasonably necessary to be
included in an individual's credit information file in order to identify the
individual.

"(4) Where the Commissioner so determines, information that is not of a kind
so determined is to be taken not to be information that is permitted to be
included in an individual's credit information file under paragraph (1) (a).

"(5) A determination is to be made by notice published in the Gazette.

"(6) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901.

"(7) A credit reporting agency must not open a credit information file in
relation to an individual unless it has information, concerning the
individual, to include in the file that is information of a kind referred to
in paragraph (1) (b).

"(8) A credit provider must not give to a credit reporting agency personal
information relating to an individual if:

   (a)  a credit reporting agency is prohibited, under subsection (1), from
        including the information in the individual's credit information file;
        or

   (b)  the credit provider does not have reasonable grounds for believing
        that the information is correct; or

   (c)  the credit provider did not, at the time of, or before, acquiring the
        information, inform the individual that the information might be
        disclosed to a credit reporting agency. Deletion of information from
        credit information files

"18F. (1) A credit reporting agency must delete from an individual's credit
information file maintained by the credit reporting agency any personal
information of a kind referred to in paragraph 18E (1) (b) within 1 month
after the end of the maximum permissible period for the keeping of personal
information of that kind.

"(2) For the purposes of subsection (1), the maximum permissible periods for
the keeping of personal information of the kind referred to in paragraph 18E
(1) (b) are as follows:

   (a)  in the case of information of a kind referred to in subparagraph (i),
        (ii), (iii) or (iv) of that paragraph - the period of 5 years
        commencing on the day on which the credit report concerned was sought;

   (b)  in the case of information of a kind referred to in subparagraph (v)
        of that paragraph - the period of 14 days commencing on the day on
        which the credit reporting agency is notified under subsection (5)
        that the credit provider concerned is no longer a current credit
        provider in relation to the individual concerned;

   (c)  in the case of information of a kind referred to in subparagraph (vi)
        of that paragraph - the period of 5 years commencing on the day on
        which the credit reporting agency was informed of the overdue payment
        concerned;

   (d)  in the case of information of a kind referred to in subparagraph (vii)
        of that paragraph - the period of 5 years commencing on the day on
        which the second dishonouring of the cheque occurred;

   (e)  in the case of information of a kind referred to in subparagraph
        (viii) of that paragraph - the period of 5 years commencing on the day
        on which the court judgment concerned was made;

   (f)  in the case of information of a kind referred to in subparagraph (ix)
        of that paragraph - the period of 7 years commencing on the day on
        which the bankruptcy order concerned was made;

   (g)  in the case of information of a kind referred to in subparagraph (x)
        of that paragraph - the period of 7 years commencing on the day on
        which the information was included in the credit information file
        concerned.

"(3) Where:

   (a)  a credit reporting agency has been given information that an
        individual is overdue in making a payment in respect of credit
        provided by a credit provider; and

   (b)  the individual ceases to be overdue in making the payment or contends
        that he or she is not overdue in making the payment; the credit
        provider must, as soon as practicable, inform the credit reporting
        agency that the individual has ceased to be overdue in making the
        payment, or contends that he or she is not overdue in making the
        payment, as the case may be.

"(4) On being informed that the individual is no longer overdue in making the
payment, or that the individual contends that he or she is not overdue in
making the payment, the credit reporting agency must include in the
individual's credit information file a note to that effect.

"(5) Where a credit provider ceases to be a current credit provider in
relation to an individual, the credit provider must, as soon as practicable,
notify that fact to any credit reporting agency that was previously informed
that the credit provider was a current credit provider in relation to the
individual. Accuracy and security of credit information files and credit
reports

"18G. A credit reporting agency in possession or control of a credit
information file, or a credit provider or credit reporting agency in
possession or control of a credit report, must:

   (a)  take reasonable steps to ensure that personal information contained in
        the file or report is accurate, up-to-date, complete and not
        misleading; and

   (b)  ensure that the file or report is protected, by such security
        safeguards as are reasonable in the circumstances, against loss,
        against unauthorised access, use, modification or disclosure, and
        against other misuse; and

   (c)  if it is necessary for the file or report to be given to a person in
        connection with the provision of a service to the credit reporting
        agency or credit provider, ensure that everything reasonably within
        the power of the credit reporting agency or credit provider is done to
        prevent unauthorised use or disclosure of personal information
        contained in the file or report. Access to credit information files
        and credit reports

"18H. (1) A credit reporting agency in possession or control of an
individual's credit information file must take reasonable steps to ensure that
the individual can obtain access to that file.

"(2) A credit provider, or a credit reporting agency, in possession or control
of a credit report containing personal information concerning an individual
must take all reasonable steps to ensure that the individual can obtain access
to that report. Alteration of credit information files and credit reports

"18J. (1) A credit reporting agency in possession or control of a credit
information file, or a credit provider or credit reporting agency in
possession or control of a credit report, must take reasonable steps, by way
of making appropriate corrections, deletions and additions, to ensure that the
personal information contained in the file or report is accurate, up-to-date,
complete and not misleading.

"(2) Where:

   (a)  a credit reporting agency in possession or control of a credit
        information file, or a credit provider or credit reporting agency in
        possession or control of a credit report, does not amend personal
        information contained in that file or report, by making a correction,
        deletion or addition, in accordance with a request by the individual
        concerned; and

   (b)  the individual requests the credit reporting agency or credit provider
        to include in that file or report a statement provided by the
        individual of the correction, deletion or addition sought; the credit
        reporting agency or credit provider must take reasonable steps to
        include the statement in the file or report within 30 days after being
        requested to do so.

"(3) Where the credit reporting agency or credit provider considers a
statement included pursuant to subsection 18J (2) to be of undue length in the
circumstances, the credit reporting agency or credit provider may refer the
statement to the Commissioner for such reduction as is considered appropriate
and, if the statement is altered, the statement as altered is to be included
in the file or report. Limits on disclosure of personal information by credit
reporting agencies

"18K. (1) A credit reporting agency in possession or control of an
individual's credit information file must not disclose personal information
contained in the file to a person, body or agency (other than the individual)
unless:

   (a)  the information is contained in a credit report given to a credit
        provider who requested the report for the purpose of assessing an
        application for credit made by the individual to the credit provider;
        or

   (b)  the information is contained in a credit report given to a credit
        provider who requested the report for the purpose of assessing an
        application for commercial credit made by a person to the credit
        provider, and the individual to whom the report relates has
        specifically agreed, in writing, to the report being given to the
        credit provider for that purpose; or

   (c)  the information is contained in a credit report given to a credit
        provider who requested the report for the purpose of assessing whether
        to accept the individual as a guarantor in respect of:

   (i)  a loan provided by the credit provider to a person other than the
        individual; or

   (ii) a loan for which an application has been made by a person other than
        the individual to the credit provider; and the first-mentioned
        individual has specifically agreed, in writing, to the report being
        given to the credit provider for that purpose; or

   (d)  the information is contained in a credit report given to a mortgage
        insurer for the purpose of assessing:

   (i)  whether to provide insurance to, or the risk of providing insurance
        to, a credit provider in respect of mortgage credit given by the
        credit provider to the individual; or

   (ii) the risk of the individual defaulting on mortgage credit in respect of
        which the mortgage insurer has provided insurance to a credit
        provider; or

   (e)  the information is contained in a credit report given to a trade
        insurer for the purpose of assessing:

   (i)  whether to provide insurance to, or the risk of providing insurance
        to, a credit provider in respect of commercial credit given by the
        credit provider to the individual or another person; or

   (ii) the risk of a person defaulting on commercial credit in respect of
        which the trade insurer has provided insurance to a credit provider;
        and the individual to whom the report relates has specifically agreed,
        in writing, to the report being given to the trade insurer for that
        purpose; or

   (f)  the credit reporting agency has, at least 30 days before the
        disclosure, received information of a kind referred to in subparagraph
        18E (1) (b) (vi), and the information is contained in a credit report
        given to a credit provider referred to in the credit information file
        as a credit provider who is a current credit provider in relation to
        the individual; or

   (g)  the information is contained in a credit report given to a credit
        provider who requested the report for the purpose of the collection of
        payments that are overdue in respect of credit provided to the
        individual by the credit provider; or

   (h)  the information is contained in a credit report given to a credit
        provider who requested the report for the purpose of the collection of
        payments that are overdue in respect of commercial credit provided to
        a person by the credit provider, and:

   (i)  the individual to whom the report relates has specifically agreed, in
        writing, to the report being given to the credit provider for that
        purpose; or

   (ii) that individual had specifically agreed, in writing, to a credit
        report relating to the individual being given to the credit provider
        for the purpose of the credit provider assessing the application that
        the first-mentioned person made to the credit provider for the
        provision of the commercial credit concerned; or

   (iii) the credit provider provided the commercial credit concerned before
        the commencement of this section; or

   (j)  the information is contained in a credit report given to another
        credit reporting agency; or

   (k)  the information is contained in a record in which the only personal
        information relating to individuals is publicly available information;
        or

   (m)  the disclosure is required or authorised by or under law; or

   (n)  the credit reporting agency is satisfied that a credit provider or law
        enforcement authority believes on reasonable grounds that the
        individual has committed a serious credit infringement and the
        information is given to that credit provider or law enforcement
        authority or to any other credit provider or law enforcement
        authority.

"(2) A credit reporting agency must not disclose personal information
contained in an individual's credit information file, or in any other record
containing information derived from the file, that is in the possession or
control of the credit reporting agency if the file or other record contains
personal information that the credit reporting agency would be:

   (a)  prohibited from including in an individual's credit information file
        under section 18E; or

   (b)  required to delete from such a file under section 18F.

"(3) Subsection (2) does not prohibit the credit reporting agency from
disclosing personal information that it would be prohibited from including in
an individual's credit information file under section 18E if:

   (a)  the credit reporting agency included the information in a credit
        information file or other record before the commencement of this
        section; and

   (b)  the information is information of a kind that the Commissioner has
        determined, in writing, to be information that the credit reporting
        agency may disclose without contravening that subsection.

"(4) A credit reporting agency that knowingly or recklessly contravenes
subsection (1) or (2) is guilty of an offence punishable, on conviction, by a
fine not exceeding $150,000.

"(5) Where a credit reporting agency discloses personal information contained
in an individual's credit information file, it must include in the file a note
of that disclosure.

"(6) A credit reporting agency must not include in a credit report given to a
credit provider under paragraph (1) (a) any information relating to an
individual's commercial activities.

"(7) A determination under paragraph (3) (b) is to be made by notice published
in the Gazette.

"(8) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901. Limits on use by credit
providers of personal information contained in credit reports etc.

"18L. (1) A credit provider that is or has been in possession or control of a
credit report must not use the report or any personal information derived from
the report for any purpose other than assessing an application for credit made
to the credit provider by the individual concerned unless:

   (a)  the report was obtained under paragraph 18K (1) (b) and the credit
        provider uses the report or information for the purpose of assessing
        an application for commercial credit made by the individual to the
        credit provider; or

   (b)  the report was obtained under paragraph 18K (1) (c) and the credit
        provider uses the report or information for the purpose of assessing
        whether to accept the individual as a guarantor in respect of:

   (i)  a loan provided by the credit provider to a person other than the
        individual; or

   (ii) a loan for which an application has been made by a person other than
        the individual to the credit provider; or

   (c)  the report was obtained under paragraph 18K (1) (f) and the credit
        provider uses the information for the purpose of assisting the
        individual to avoid defaulting on his or her credit obligations; or

   (d)  the credit provider uses the report or information for the purpose of
        the collection of payments that are overdue in respect of credit
        provided to the individual by the credit provider; or

   (e)  use of the report or information for that other purpose is required or
        authorised by or under law; or

   (f)  the credit provider believes on reasonable grounds that the individual
        has committed a serious credit infringement, and the report or
        information is used in connection with that infringement.

"(2) A credit provider that knowingly or recklessly contravenes subsection (1)
is guilty of an offence punishable, on conviction, by a fine not exceeding
$150,000.

"(3) A credit provider that is or has been in possession or control of a
credit report must not:

   (a)  use the report unless all personal information concerning individuals
        that is not information of a kind referred to in subsection 18E (1)
        has been deleted from the report; or

   (b)  use any personal information derived from the report if the
        information is not information of a kind referred to in subsection 18E
        (1).

"(4) Where a credit provider has received a credit report for the purpose of
assessing an application for credit made to the credit provider by an
individual, the credit provider must not, in assessing the application, use
information that:

   (a)  concerns the individual's commercial activities or commercial credit
        worthiness; and

   (b)  was obtained from a person or body carrying on a business or
        undertaking involving the provision of information about the
        commercial credit worthiness of persons; unless the individual has
        specifically agreed, in writing, to the information being obtained by
        the credit provider for that purpose.

"(5) References in subsection (3) to information that is not information of a
kind referred to in subsection 18E (1) do not include references to
information the disclosure of which is taken, because of the application of
subsection 18K (3), not to be in contravention of subsection 18K (2).

"(6) The Commissioner may determine, in writing, the manner in which
information of a kind referred to in subsection (4) may, under that
subsection, be used (including the manner in which an individual's agreement
may be obtained for the purposes of that subsection).

"(7) A determination is to be made by notice published in the Gazette.

"(8) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901. Information to be given if an
individual's application for credit is refused

"18M. Where a credit provider refuses an application by an individual for
credit and the refusal is based wholly or partly on information derived from a
credit report given by a credit reporting agency to the credit provider for
the purpose of assessing the application, the credit provider must give the
individual a written notice:

   (a)  stating:

        (i)    that the application has been refused; and

        (ii)   that the refusal was based wholly or partly, as the case
               requires, on information derived from a credit report given by
               a credit reporting agency; and

        (iii)  the name and address of the credit reporting agency; and

   (b)  informing the individual of the individual's right under this Act to
        obtain access to the individual's credit information file maintained
        by the credit reporting agency. Limits on disclosure by credit
        providers of personal information contained in reports relating to
        credit worthiness etc.

"18N. (1) A credit provider that is or has been in possession or control of a
report must not disclose the report or any personal information derived from
the report to another person for any purpose unless:

   (a)  the report or information is disclosed to a credit reporting agency
        for the purpose of being used:

   (i)  to create a credit information file in relation to the individual
        concerned; or

   (ii) to include information in a credit information file, maintained by the
        credit reporting agency, in relation to the individual concerned; or

   (b)  the individual concerned has specifically agreed, in writing, to the
        disclosure of the report or information to another credit provider for
        the particular purpose; or

   (c)  the report (not being a credit report) or information:

   (i)  is disclosed to a person or body carrying on a business or undertaking
        that involves the collection of debts on behalf of others; and

   (ii) is disclosed for the purpose of the collection of payments that are
        overdue in respect of credit provided to the individual concerned by
        the credit provider; and

   (iii) does not contain or include any personal information derived from a
        credit report, other than:

                (A)  information of a kind referred to in paragraph 18E (1)
                     (a); and

                (B)  information of a kind referred to in subparagraph 18E (1)
                     (b) (vi), not being information that relates to an
                     overdue payment in respect of which a note to the effect
                     that the individual is no longer overdue in making the
                     payment has been included, under subsection 18F (4), in
                     the credit information file from which the credit report
                     was prepared; or

   (d)  where the credit provider is a corporation - the report or information
        is disclosed to a corporation that is related to the credit provider;
        or

   (e)  the report or information is disclosed to a corporation (including the
        professional legal advisers or professional financial advisers of that
        corporation) that proposes to use the report or information:

   (i)  in the process of considering whether to:

                (A)  accept an assignment of a debt owed to the credit
                     provider; or

                (B)  accept a debt owed to the credit provider as security for
                     a loan to the credit provider; or

                (C)  purchase an interest in the credit provider (including,
                     in a case where the credit provider is a corporation, a
                     corporation that is related to the credit provider); or

   (ii) in connection with exercising rights arising from any acceptance or
        purchase of a kind referred to in subparagraph (i); or

   (f)  the report or information is disclosed to a person who manages loans
        made by the credit provider, for use in managing those loans; or

   (g)  disclosure of the report or information to that other person for the
        particular purpose is required or authorised by or under law; or

   (h)  the credit provider believes on reasonable grounds that the individual
        concerned has committed a serious credit infringement and the report
        or information is given to another credit provider or a law
        enforcement authority.

"(2) A credit provider that knowingly or recklessly contravenes subsection (1)
is guilty of an offence punishable, on conviction, by a fine not exceeding
$150,000.

"(3) A credit provider that is or has been in possession or control of a
credit report, or a report containing personal information derived from a
credit report, must not:

   (a)  disclose the report to another person unless all personal information
        concerning individuals that is not information of a kind referred to
        in subsection 18E (1) has been deleted from the report; or

   (b)  disclose to another person any personal information derived from the
        report if the information is not information of a kind referred to in
        subsection 18E (1).

"(4) References in subsection (3) to information that is not information of a
kind referred to in subsection 18E (1) do not include references to
information the disclosure of which is taken, because of the application of
subsection 18K (3), not to be in contravention of subsection 18K (2).

"(5) The Commissioner may determine, in writing, the manner in which a report
or personal information derived from a report may, under subsection (1), be
disclosed (including the manner in which an individual's agreement may be
obtained for the purposes of paragraph (1) (b)).

"(6) Where the Commissioner so determines, a report or information that is
disclosed in a manner contrary to the determination is to be taken, except for
the purposes of subsection (2), to have been disclosed contrary to subsection
(1).

"(7) A determination is to be made by notice published in the Gazette.

"(8) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901.

"(9) In this section, unless the contrary intention appears: 'report' means:

   (a)  a credit report; or

   (b)  subject to subsection (10), any other record or information, whether
        in a written, oral or other form, that has any bearing on an
        individual's credit worthiness, credit standing, credit history or
        credit capacity; but does not include a credit report or any other
        record or information in which the only personal information relating
        to individuals is publicly available information.

"(10) For the purposes of the application of this section to a credit provider
that is not a corporation, a record or information (other than a credit
report) is not taken to be a report for the purposes of this section unless it
is being or has been prepared by or for a corporation. Limits on use or
disclosure by mortgage insurers or trade insurers of personal information
contained in credit reports

"18P. (1) A mortgage insurer that is or has been in possession or control of a
credit report must not use the report or any personal information derived from
the report for any purpose other than assessing:

   (a)  whether to provide insurance to, or the risk of providing insurance
        to, a credit provider in respect of mortgage credit given by the
        credit provider to the individual concerned; or

   (b)  the risk of the individual concerned defaulting on mortgage credit in
        respect of which the mortgage insurer has provided insurance to a
        credit provider; unless use of the report or information for that
        other purpose is required or authorised by or under law.

"(2) A trade insurer that is or has been in possession or control of a credit
report must not use the report or any personal information derived from the
report for any purpose other than assessing:

   (a)  whether to provide insurance to, or the risk of providing insurance
        to, a credit provider in respect of commercial credit given by the
        credit provider to another person; or

   (b)  the risk of a person defaulting on commercial credit in respect of
        which the trade insurer has provided insurance to a credit provider;
        unless use of the report or information for that other purpose is
        required or authorised by or under law.

"(3) A mortgage insurer or trade insurer that is or has been in possession or
control of a credit report must not:

   (a)  use the report unless all personal information concerning individuals
        that is not information of a kind referred to in subsection 18E (1)
        has been deleted from the report; or

   (b)  use any personal information derived from the report if the
        information is not information of a kind referred to in subsection 18E
        (1).

"(4) References in subsection (3) to information that is not information of a
kind referred to in subsection 18E (1) do not include references to
information the disclosure of which is taken, because of the application of
subsection 18K (3), not to be in contravention of subsection 18K (2).

"(5) A mortgage insurer or trade insurer that is or has been in possession or
control of a credit report must not disclose the report or any personal
information derived from the report to another person for any purpose unless
disclosure of the report or information to that other person for that purpose
is required or authorised by or under law.

"(6) A mortgage insurer or trade insurer that knowingly or recklessly
contravenes subsection (1), (2) or (5) is guilty of an offence punishable, on
conviction, by a fine not exceeding $150,000. Limits on use or disclosure by
certain persons of personal information obtained from credit providers

"18Q. (1) A corporation that has obtained a report or information under
paragraph 18N (1) (d) must not:

   (a)  use the report or information, or any personal information derived
        from the report or information, otherwise than for a purpose for
        which, or in circumstances under which, a credit provider would be
        permitted under section 18L to use the report or information; or

   (b)  disclose the report or information, or any personal information
        derived from the report or information, to another person otherwise
        than for a purpose for which, or in circumstances under which, a
        credit provider would be permitted under section 18N to disclose the
        report or information to another person.

"(2) A corporation that has obtained a report or information under paragraph
18N (1) (e) must not use the report or information, or any personal
information derived from the report or information, for any purpose other
than:

   (a)  for use in the process of considering whether to:

   (i)  accept an assignment of a debt owed to the credit provider from whom
        the report or information was obtained; or

   (ii) accept a debt owed to the credit provider as security for a loan to
        the credit provider; or

   (iii) purchase an interest in the credit provider (including, where the
        credit provider is a corporation, a corporation that is related to the
        credit provider); or

   (b)  for use in connection with exercising rights arising from any
        acceptance or purchase of a kind referred to in paragraph (a).

"(3) A professional legal adviser or professional financial adviser of a
corporation who has obtained a report or information under paragraph 18N (1)
(e) must not use the report or information, or any personal information
derived from the report or information, for any purpose other than use by the
person, in his or her capacity as such a professional legal or financial
adviser, in connection with advising the corporation:

   (a)  whether to accept an assignment of a debt owed to the credit provider
        from whom the report or information was obtained; or

   (b)  whether to accept a debt owed to the credit provider as a security for
        a loan to the credit provider; or

   (c)  whether to purchase an interest in the credit provider (including, in
        a case where the credit provider is a corporation, a corporation that
        is related to the credit provider);

   (d)  in connection with exercising rights arising from any acceptance or
        purchase of a kind referred to in paragraph (a), (b) or (c); unless
        use of the report or information, or the information so derived, is
        required or authorised by or under law.

"(4) A person who has obtained a report or information under paragraph 18N (1)
(f) must not use the report or information, or any personal information
derived from the report or information, for any purpose other than use by the
person in managing loans made by the credit provider from whom the person
obtained the report or information, unless use of the report or information,
or the information so derived, for that other purpose is required or
authorised by or under law.

"(5) A person who has obtained a report or information under paragraph 18N (1)
(e) or (f) must not disclose the report or information, or any personal
information derived from the report or information, to another person unless
disclosure of the report or information, or the information so derived, is
required or authorised by or under law.

"(6) A person who has obtained a report or information under paragraph 18N (1)
(d), (e) or (f) must not:

   (a)  use the report or information unless all personal information
        concerning individuals that is not information of a kind referred to
        in subsection 18E (1) has been deleted from the report or information;
        or

   (b)  use any personal information derived from the report or information if
        the personal information so derived is not information of a kind
        referred to in subsection 18E (1).

"(7) References in subsection (6) to information that is not information of a
kind referred to in subsection 18E (1) do not include references to
information the disclosure of which is taken, because of the application of
subsection 18K (3), not to be in contravention of subsection 18K (2).

"(8) In spite of anything in this section to the contrary, this section does
not impose any obligations on a person in relation to a report or information
obtained under paragraph 18N (1) (e) or (f), or in relation to any personal
information derived from such a report or information, unless:

   (a)  the person is a corporation; or

   (b)  the credit provider from whom the person obtained the report or
        information is a corporation.

"(9) A person who knowingly or recklessly contravenes subsection (1), (2),
(3), (4) or (5) is guilty of an offence punishable, on conviction, by a fine
not exceeding $30,000. False or misleading credit reports

"18R. (1) A credit reporting agency or credit provider must not give to any
other person or body (whether or not the other person or body is a credit
reporting agency or credit provider) a credit report that contains false or
misleading information.

"(2) A credit reporting agency or credit provider that knowingly or recklessly
contravenes subsection (1) is guilty of an offence punishable, on conviction,
by a fine not exceeding $75,000. Unauthorised access to credit information
files or credit reports

"18S. (1) A person must not obtain access to an individual's credit
information file in the possession or control of a credit reporting agency
unless the access is authorised by this Act.

"(2) A person must not obtain access to a credit report in the possession or
control of a credit provider or credit reporting agency unless:

   (a)  the person is given the report in accordance with this Act; or

   (b)  the access is otherwise authorised by this Act.

"(3) A person who knowingly or recklessly contravenes this section is guilty
of an offence punishable, on conviction, by a fine not exceeding $30,000.
Obtaining access to credit information files or credit reports by false
pretences

"18T. (1) A person must not, by a false pretence, obtain access to an
individual's credit information file in the possession or control of a credit
reporting agency.
Penalty: $30,000.

"(2) A person must not, by a false pretence, obtain access to a credit report
in the possession or control of a credit provider or credit reporting agency.
Penalty: $30,000. Application of section 4B of Crimes Act

"18U. Subsection 4B (3) of the Crimes Act 1914 does not apply in relation to
an offence against subsection 18K (4), 18L (2), 18N (2) or 18R (2) or section
18P. Application of this Part

"18V. (1) Subject to this section, this Part applies in relation to any credit
information file, any credit report or any report of a kind referred to in
section 18N, in existence on or after the commencement of this section,
whether or not it was in existence before that commencement.

"(2) Paragraph 18E (8) (c) does not apply in relation to information acquired
by a credit provider before the commencement of this section.

"(3) Section 18F applies in relation to personal information that was,
immediately before the commencement of this section, contained in an
individual's credit information file as if the references to the days
mentioned in the paragraphs of subsection 18F (2) were all references to the
day on which this section commenced.".