Commonwealth Consolidated Acts Commonwealth Consolidated ActsProhibition on use or disclosure
(1) If a credit reporting body holds credit reporting information about an individual, the body must not use or disclose the information.
Civil penalty: 2,000 penalty units.
Permitted uses
(2) Subsection (1) does not apply to the use of credit reporting information about the individual if:
(a) the credit reporting body uses the information in the course of carrying on the body's credit reporting business; or
(b) the use is required or authorised by or under an Australian law (other than the consumer data rules) or a court/tribunal order; or
(c) the use is a use prescribed by the regulations.
Permitted disclosures
(3) Subsection (1) does not apply to the disclosure of credit reporting information about the individual if:
(a) the disclosure is a permitted CRB disclosure in relation to the individual; or
(b) the disclosure is to another credit reporting body that has an Australian link; or
(c) both of the following apply:
(i) the disclosure is for the purposes of a recognised external dispute resolution scheme;
(ii) a credit reporting body or credit provider is a member of or subject to the scheme; or
(d) both of the following apply:
(i) the disclosure is to an enforcement body;
(ii) the credit reporting body is satisfied that the body, or another enforcement body, believes on reasonable grounds that the individual has committed a serious credit infringement; or
(e) the disclosure is required or authorised by or under an Australian law (other than the consumer data rules) or a court/tribunal order; or
(f) the disclosure is a disclosure prescribed by the regulations.
(4) However, if the credit reporting information is, or was derived from, repayment history information or financial hardship information about the individual, the credit reporting body must not disclose the information under paragraph (3)(a) or (f) unless the recipient of the information is:
(a) a credit provider who is a licensee or is prescribed by the regulations; or
(b) a mortgage insurer.
Civil penalty: 2,000 penalty units.
(4A) Despite subsection (3), if the credit reporting information is, or was derived from, financial hardship information about the individual, the credit reporting body must not disclose the information under paragraph (3)(a) or (f) to a credit provider or mortgage insurer if the provider or insurer requested the information for the purpose of:
(a) in the case of a credit provider:
(i) collecting payments that are overdue in relation to consumer credit provided by the provider to the individual; or
(ii) collecting payments that are overdue in relation to commercial credit provided by the provider to a person; or
(iii) assessing whether to accept the individual as a guarantor in relation to credit for which an application has been made to the provider by a person other than the individual; or
(b) in the case of a mortgage insurer--assessing the risk of the individual defaulting on mortgage credit in relation to which the insurer has provided insurance to a credit provider.
Civil penalty: 2,000 penalty units.
(5) If a credit reporting body discloses credit reporting information under this section, the body must make a written note of that disclosure.
Civil penalty: 500 penalty units.
Note: Other Acts may provide that the note must not be made (see for example the Australian Crime Commission Act 2002 and the National Anti - Corruption Commission Act 2022 ).
No use or disclosure for the purposes of direct marketing
(6) This section does not apply to the use or disclosure of credit reporting information for the purposes of direct marketing.
Note: Section 20G deals with the use or disclosure of credit reporting information for the purposes of direct marketing.
No disclosure of financial hardship information as part of credit score
(7) Subsection (3) does not apply to the disclosure of CRB derived information which contains or takes the form of a credit score where the credit information from which the credit score is derived includes financial hardship information.