Commonwealth Consolidated Acts

PRIVACY ACT 1988 - SECT 21G

Prohibition on use or disclosure

  (1)   If a credit provider holds credit eligibility information about an individual, the provider must not use or disclose the information.

Civil penalty:   2,000 penalty units.

Permitted uses

  (2)   Subsection   (1) does not apply to the use of credit eligibility information about the individual if:

  (a)   the use is for a consumer credit related purpose of the credit provider in relation to the individual; or

  (b)   the use is a permitted CP use in relation to the individual; or

  (c)   both of the following apply:

  (i)   the credit provider believes on reasonable grounds that the individual has committed a serious credit infringement;

  (ii)   the provider uses the information in connection with the infringement; or

  (d)   the use is required or authorised by or under an Australian law (other than the consumer data rules) or a court/tribunal order; or

  (e)   the use is a use prescribed by the regulations.

Permitted disclosures

  (3)   Subsection   (1) does not apply to the disclosure of credit eligibility information about the individual if:

  (a)   the disclosure is a permitted CP disclosure in relation to the individual; or

  (b)   the disclosure is to a related body corporate of the credit provider; or

  (c)   the disclosure is to:

  (i)   a person for the purpose of processing an application for credit made to the credit provider; or

  (ii)   a person who manages credit provided by the credit provider for use in managing that credit; or

  (d)   both of the following apply:

  (i)   the credit provider believes on reasonable grounds that the individual has committed a serious credit infringement;

  (ii)   the provider discloses the information to another credit provider that has an Australian link, or to an enforcement body; or

  (e)   both of the following apply:

  (i)   the disclosure is for the purposes of a recognised external dispute resolution scheme;

  (ii)   a credit provider or credit reporting body is a member of or subject to the scheme; or

  (f)   the disclosure is required or authorised by or under an Australian law (other than the consumer data rules) or a court/tribunal order; or

  (g)   the disclosure is a disclosure prescribed by the regulations.

Note:   See section   21NA for additional rules about the disclosure of credit eligibility information under paragraph   (3)(b) or (c).

  (4)   However, if the credit eligibility information about the individual is, or was derived from, repayment history information or financial hardship information about the individual, the credit provider must not disclose the information under subsection   (3).

Civil penalty:   2,000 penalty units.

  (5)   Subsection   (4) does not apply if:

  (a)   the recipient of the credit eligibility information is another credit provider who is a licensee; or

  (b)   the disclosure is a permitted CP disclosure within the meaning of section   21L; or

  (c)   the credit provider discloses the credit eligibility information under paragraph   (3)(b), (c), (e) or (f); or

  (d)   the credit provider discloses the credit eligibility information under paragraph   (3)(d) to an enforcement body.

Written note of use or disclosure

  (6)   If a credit provider uses or discloses credit eligibility information under this section, the provider must make a written note of that use or disclosure.

Civil penalty:   500 penalty units.

Interaction with the Australian Privacy Principles

  (7)   If a credit provider is an APP entity, Australian Privacy Principles   6, 7 and 8 do not apply to the provider in relation to credit eligibility information.

  (8)   If:

  (a)   a credit provider is an APP entity; and

  (b)   the credit eligibility information is a government related identifier of the individual;

Australian Privacy Principle   9.2 does not apply to the provider in relation to the information.