35AReporting entities may disclose certain personal information to credit reporting bodies for identity verification purposes

#### 35A Reporting entities may disclose certain personal information to credit reporting bodies for identity verification purposes (1) A reporting entity may, to assist in verifying the identity of an individual for the purposes of this Act, the regulations or the AML/CTF Rules: (a) disclose any or all of the following personal information to a credit reporting body for the purposes of making a request referred to in paragraph (b): (i) the individual’s name; (ii) the individual’s residential address; (iii) the individual’s date of birth; and (b) request the credit reporting body to provide an assessment of whether the personal information so disclosed matches (in whole or part) personal information held by the credit reporting body. (2) A reporting entity must not make a verification request in relation to an individual unless, before making the request: (a) the individual was given information about: (i) the reasons for making the request; and (ii) the personal information about the individual that may be disclosed to the credit reporting body; and (iii) the fact that the reporting entity may request the credit reporting body to provide an assessment of whether the personal information matches (in whole or part) personal information held by the credit reporting body; and (iv) the fact that the credit reporting body may prepare and provide to the reporting entity such an assessment; and (v) the fact that the credit reporting body may use the personal information about the individual, and personal information held by the body that is the names, residential addresses and dates of birth of other individuals, for the purpose of preparing such an assessment; and (b) the individual expressly agreed to the making of the request and the disclosure of the personal information; and (c) an alternative means of verifying the identity of the individual was made available to the individual. (3) A disclosure of personal information under paragraph (1)(a) is taken to be authorised by this Act for the purposes of paragraph 6.2(b) of Australian Privacy Principle 6.