First bulk supply for at least 50% of total eligible credit accounts
(1) An eligible licensee must supply mandatory credit information for the accounts referred to in subsection (2) to each eligible credit reporting body ( CRB ) for the licensee:
(a) before the end of the later of the following periods:
(i) the 90 - day period starting on the first 1 July on which the licensee is an eligible licensee;
(ii) if subsection (5) applies--the 14 - day period starting on the cessation day referred to in that subsection; and
(b) in accordance with the supply requirements; and
(c) to the extent that the licensee is not prevented by the Privacy Act 1988 from doing so.
Civil penalty: 5,000 penalty units.
(2) For the purposes of subsection (1), the accounts are at least 50% of all of the eligible credit accounts held:
(a) on the first 1 July on which the licensee is an eligible licensee; and
(b) with the licensee, or with a member of a banking group of which the licensee is the head company.
The licensee may choose which eligible credit accounts make up this 50%.
Bulk supply for remaining eligible credit accounts
(3) An eligible licensee must supply mandatory credit information for the accounts referred to in subsection (4) to each eligible credit reporting body ( CRB ) for the licensee:
(a) before the end of the latest of the following periods:
(i) the 90 - day period starting on the second 1 July on which the licensee is an eligible licensee;
(ii) if subsection (5) applies--the 14 - day period starting on the cessation day referred to in that subsection;
(iii) if, because paragraph 133CS(1)(b) is no longer satisfied, subsection 133CS(1) ceases to provide the licensee with an exception to this subsection for the CRB--the 14 - day period starting on the day that exception ceases to apply; and
(b) in accordance with the supply requirements; and
(c) to the extent that the licensee is not prevented by the Privacy Act 1988 from doing so.
Civil penalty: 5,000 penalty units.
(4) For the purposes of subsection (3), the accounts are all of the eligible credit accounts held:
(a) on the second 1 July on which the licensee is an eligible licensee; and
(b) with the licensee, or with a member of a banking group of which the licensee is the head company;
for which mandatory credit information was not supplied under subsection (1) to the CRB.
Possible extension of time if credit reporting body later complies with information security requirements before end of 90 - day period
(5) For the purposes of subsection (1) or (3), this subsection applies if:
(a) the licensee reasonably believes that the CRB is not complying with section 20Q of the Privacy Act 1988 on the 1 July referred to in that subsection; and
(b) the licensee complies with paragraphs 133CS(2)(a) and (b) in relation to that belief; and
(c) the licensee ceases to hold that belief on a day (the cessation day ) before the end of the 90 - day period starting on that 1 July.
Requirements apply whether the information is kept in or outside this jurisdiction
(6) Subsection (1) or (3) applies whether the mandatory credit information is kept in or outside this jurisdiction.