Each licensee must supply certain information to eligible credit reporting bodies about all of the open credit accounts held with the licensee or with other members of the licensee’s corporate group.
Each licensee must then supply updated information to those credit reporting bodies on an ongoing basis.
Conditions may need to be met before the credit reporting bodies who are supplied with this information can further disclose this information to credit providers.
This Part applies in addition to the Privacy Act 1988.
133CN Meanings of eligible licensee and eligible credit reporting body
(1) A licensee is an eligible licensee, on 1 July 2021 or a later day, if on that day the licensee:
(a) is a large ADI, or is a body corporate of a kind prescribed by the regulations; and
(b) is a credit provider.
(2) A credit reporting body is an eligible credit reporting body for a licensee if:
(a) the following conditions are met:
(i) an agreement of the kind referred to in paragraph 20Q(2)(a) of the Privacy Act 1988 between the body and the licensee was in force on 2 November 2017;
(ii) the licensee is an eligible licensee on 1 July 2021; or
(b) the conditions (if any) prescribed by the regulations are met.
133CO Meaning of eligible credit account
(1) An eligible credit account is an account that:
(a) relates to the provision, or possible provision, of consumer credit (within the meaning of the Privacy Act 1988); and
(b) is held by one or more natural persons with a credit provider; and
(c) is not of a kind determined under subsection (2).
(2) ASIC may, by legislative instrument, determine one or more kinds of account for the purposes of paragraph (1)(c).
133CP Meaning of mandatory credit information
(1) Mandatory credit information, for eligible credit accounts held by natural persons with a credit provider, is personal information (other than sensitive information) for those accounts that is:
(a) identification information (within the meaning of the Privacy Act 1988) about the natural persons; or
(b) consumer credit liability information (within the meaning of the Privacy Act 1988) about the natural persons; or
(c) repayment history information (within the meaning of the Privacy Act 1988) about the natural persons; or
(d) financial hardship information about the natural persons; or
(e) default information (within the meaning of the Privacy Act 1988) about the natural persons; or
(f) payment information (within the meaning of the Privacy Act 1988) about the natural persons; or
(g) new arrangement information (within the meaning of the Privacy Act 1988) about the natural persons.
(2) Despite paragraph (1)(c), mandatory credit information does not include repayment history information (within the meaning of the Privacy Act 1988) that comes into existence more than 3 months before the first 1 July on which:
(a) if the credit provider is a member of a banking group—the head company of the group is an eligible licensee; or
(b) otherwise—the credit provider is an eligible licensee.
(3) Despite paragraph (1)(d), mandatory credit information does not include financial hardship information that comes into existence:
(a) before 1 July 2022; or
(b) more than 3 months before the first 1 July on which:
(i) if the credit provider is a member of a banking group—the head company of the group is an eligible licensee; or
(ii) otherwise—the credit provider is an eligible licensee.
Note: Paragraph (b) is included to deal with the case where the first 1 July is in 2023 or a later year.
(4) Despite paragraph (1)(e), mandatory credit information does not include default information (within the meaning of the Privacy Act 1988) that comes into existence before the first 1 July on which:
(a) if the credit provider is a member of a banking group—the head company of the group is an eligible licensee; or
(b) otherwise—the credit provider is an eligible licensee.
133CQ Meaning of supply requirements
(1) Information is supplied in accordance with the supply requirements if the supply is in accordance with:
(a) the registered CR code (within the meaning of the Privacy Act 1988); and
(b) any determination under subsection (2); and
(c) any technical standards approved under subsection (4).
(2) For one or more kinds of information to be supplied under this Part, ASIC may, by legislative instrument, determine particulars of the information that must be included in the supply.
(3) Despite subsection 14(2) of the Legislation Act 2003, a determination under subsection (2) may make provision in relation to a matter by applying, adopting or incorporating, with or without modification, any matter contained in any other instrument or writing as in force or existing from time to time.
(4) ASIC may, in writing, approve technical standards for supplying one or more kinds of information under this Part.
(5) If there is an inconsistency between:
(a) the registered CR code (within the meaning of the Privacy Act 1988); and
(b) a determination under subsection (2) or a technical standard approved under subsection (4);
the registered CR code prevails to the extent of the inconsistency.
Division 2—Supplying credit information to credit reporting bodies etc.
Subdivision A—Initial bulk supplies of credit information
133CR Requirement to supply
First bulk supply for at least 50% of total eligible credit accounts
(1) An eligible licensee must supply mandatory credit information for the accounts referred to in subsection (2) to each eligible credit reporting body (CRB) for the licensee:
(a) before the end of the later of the following periods:
(i) the 90‑day period starting on the first 1 July on which the licensee is an eligible licensee;
(ii) if subsection (5) applies—the 14‑day period starting on the cessation day referred to in that subsection; and
(b) in accordance with the supply requirements; and
(c) to the extent that the licensee is not prevented by the Privacy Act 1988 from doing so.
Civil penalty: 5,000 penalty units.
(2) For the purposes of subsection (1), the accounts are at least 50% of all of the eligible credit accounts held:
(a) on the first 1 July on which the licensee is an eligible licensee; and
(b) with the licensee, or with a member of a banking group of which the licensee is the head company.
The licensee may choose which eligible credit accounts make up this 50%.
Bulk supply for remaining eligible credit accounts
(3) An eligible licensee must supply mandatory credit information for the accounts referred to in subsection (4) to each eligible credit reporting body (CRB) for the licensee:
(a) before the end of the latest of the following periods:
(i) the 90‑day period starting on the second 1 July on which the licensee is an eligible licensee;
(ii) if subsection (5) applies—the 14‑day period starting on the cessation day referred to in that subsection;
(iii) if, because paragraph 133CS(1)(b) is no longer satisfied, subsection 133CS(1) ceases to provide the licensee with an exception to this subsection for the CRB—the 14‑day period starting on the day that exception ceases to apply; and
(b) in accordance with the supply requirements; and
(c) to the extent that the licensee is not prevented by the Privacy Act 1988 from doing so.
Civil penalty: 5,000 penalty units.
(4) For the purposes of subsection (3), the accounts are all of the eligible credit accounts held:
(a) on the second 1 July on which the licensee is an eligible licensee; and
(b) with the licensee, or with a member of a banking group of which the licensee is the head company;
for which mandatory credit information was not supplied under subsection (1) to the CRB.
Possible extension of time if credit reporting body later complies with information security requirements before end of 90‑day period
(5) For the purposes of subsection (1) or (3), this subsection applies if:
(a) the licensee reasonably believes that the CRB is not complying with section 20Q of the Privacy Act 1988 on the 1 July referred to in that subsection; and
(b) the licensee complies with paragraphs 133CS(2)(a) and (b) in relation to that belief; and
(c) the licensee ceases to hold that belief on a day (the cessation day) before the end of the 90‑day period starting on that 1 July.
Requirements apply whether the information is kept in or outside this jurisdiction
(6) Subsection (1) or (3) applies whether the mandatory credit information is kept in or outside this jurisdiction.
133CS Exception if credit reporting body not complying with information security requirements
(1) Subsection 133CR(1) or (3) does not apply, and is taken never to have applied, to a licensee for a credit reporting body if:
(a) the licensee reasonably believes that the body is not complying with section 20Q of the Privacy Act 1988:
(i) on the 1 July referred to in that subsection; and
(ii) on the last day of the 90‑day period starting on that 1 July; and
(b) in the case of subsection 133CR(3)—the licensee continues to hold that belief after that 90‑day period; and
(c) the licensee satisfies subsection (2) of this section.
Note 1: Paragraph (b) means that, if the licensee ceases to hold that belief after the 90‑day period starting on the 1 July in subsection 133CR(3), this exception will cease to apply and the supply requirement in subsection 133CR(3) will apply.
Note 2: A person who wishes to rely on this subsection bears an evidential burden in relation to the matters in this subsection (see subsection (3) of this section and subsection 13.3(3) of the Criminal Code).
(2) The licensee satisfies this subsection if:
(a) the licensee prepares a written notice:
(i) stating that the licensee reasonably believes that the credit reporting body is not complying with section 20Q of the Privacy Act 1988 on that 1 July; and
(ii) setting out the licensee’s reasons for that belief; and
(iii) stating that the body may try to convince the licensee otherwise, but that in the case of subsection 133CR(1) the body will need to do so before the end of the 90‑day period starting on that 1 July; and
(b) the licensee gives that notice to the body, and a copy to the Information Commissioner and ASIC, within 7 days after that 1 July; and
(c) the licensee prepares a written notice (the final notice):
(i) stating that the licensee reasonably believes that the body is not complying with section 20Q of the Privacy Act 1988 on the last day of that 90‑day period; and
(ii) setting out the licensee’s reasons for that belief; and
(d) the licensee gives the final notice to the body, and a copy to the Information Commissioner and ASIC, within 7 days after the last day of that 90‑day period.
(3) A licensee who wishes to rely on subsection (1) in proceedings for a declaration of contravention or a pecuniary penalty order bears an evidential burden in relation to the matters in that subsection.
133CT Licensee must give notice if credit reporting body later complies with information security requirements
If:
(a) an eligible licensee reasonably believes that an eligible credit reporting body for the licensee is not complying with section 20Q of the Privacy Act 1988 on the first or second 1 July on which the licensee is an eligible licensee; and
(b) the licensee complies with paragraphs 133CS(2)(a) and (b) in relation to that belief; and
(c) the licensee ceases to hold that belief:
(i) in the case of subsection 133CR(1)—on a day during the 90‑day period starting on that first 1 July; or
(ii) in the case of subsection 133CR(3)—on any day after that second 1 July;
the licensee must:
(d) prepare a written notice:
(i) stating that the licensee has ceased to hold that belief; and
(ii) setting out the licensee’s reasons for ceasing to hold that belief; and
(e) give that notice to the body, and a copy to the Information Commissioner and ASIC, within 7 days after the day the licensee ceases to hold that belief.
Civil penalty: 5,000 penalty units.
Subdivision B—Ongoing supplies of credit information
133CU Requirement to supply
(1) If:
(a) a licensee has supplied a credit reporting body (the CRB) with mandatory credit information under this Division; and
(b) on a later day (the trigger day):
(i) the conditions (if any) prescribed by the regulations are not met for the licensee and the CRB; and
(ii) the licensee, or a member of a banking group of which the licensee is the head company, would reasonably be expected to have become aware that an event in an item of the following table has happened; and
(iii) the licensee is still an eligible licensee; and
(iv) an agreement of the kind referred to in paragraph 20Q(2)(a) of the Privacy Act 1988 is in force between the CRB and a body referred to in subparagraph (ii) of this paragraph;
the licensee must supply to the CRB the information referred to in that table item:
(c) before the end of the latest of the following periods:
(i) the 45‑day period starting on the trigger day;
(ii) if subsection (2) applies—the 14‑day period starting on the cessation day referred to in that subsection;
(iii) if, because paragraph 133CV(1)(b) is no longer satisfied, subsection 133CV(1) ceases to provide the licensee with an exception to this subsection for the CRB—the 14‑day period starting on the day that exception ceases to apply;
(iv) if the trigger day happens because of table item 3 and is before the licensee supplies the CRB with mandatory credit information under subsection 133CR(3)—the 90‑day period starting on the trigger day; and
(d) in accordance with the supply requirements; and
(e) to the extent that the licensee is not prevented by the Privacy Act 1988 from doing so.
Ongoing supplies of mandatory credit information
Item If this event happens: This information must be supplied:
1 the need to correct any mandatory credit information the licensee has supplied under this Division to ensure that, having regard to a purpose for which the information is held by:(a) the licensee; or(b) a member of a banking group of which the licensee is the head company;the information is accurate, up‑to‑date, complete, relevant and not misleading details of the corrected information
2 the payment of an overdue payment about which default information (within the meaning of the Privacy Act 1988) has been supplied under this Division payment information (within the meaning of the Privacy Act 1988) relating to the payment
3 the opening of an eligible credit account with:(a) the licensee; or(b) a member of a banking group of which the licensee is the head company;provided this happens after the second 1 July on which the licensee is an eligible licensee mandatory credit information for that account
4 financial hardship information comes into existence for an eligible credit account on or after the later of:(a) 1 July 2022; and(b) the day after the first day mandatory credit information for the account is supplied by the licensee to the CRB under this Division the financial hardship information
5 default information (within the meaning of the Privacy Act 1988) comes into existence for an eligible credit account for which mandatory credit information has previously been supplied by the licensee to the CRB under this Division the default information
6 an event:(a) of a kind prescribed by the regulations; and(b) that relates to eligible credit accounts or to the natural persons who hold those accounts information that:(a) is, or relates to, mandatory credit information; and(b) is of a kind prescribed by the regulations for that kind of event
Civil penalty: 5,000 penalty units.
(2) For the purposes of subparagraph (1)(c)(ii), this subsection applies if:
(a) the licensee reasonably believes that the CRB is not complying with section 20Q of the Privacy Act 1988 on the trigger day; and
(b) the licensee complies with paragraphs 133CV(2)(a) and (b) in relation to that belief; and
(c) the licensee ceases to hold that belief on a day (the cessation day) before the end of the 45‑day period starting on the trigger day.
(3) Supplies under subsection (1) of information relating to multiple events, or multiple trigger days, may be made together.
(4) Subsection (1) applies whether the information referred to in the table is kept in or outside this jurisdiction.
(5) Regulations made for the purposes of subparagraph (1)(b)(i) may make provision in relation to a matter by applying, adopting or incorporating, with or without modification, any matter contained in any other instrument or writing as in force or existing from time to time.
(6) Subsection (5) has effect despite subsection 14(2) of the Legislation Act 2003.
133CV Exception if credit reporting body not complying with information security requirements
(1) Subsection 133CU(1) does not apply, and is taken never to have applied, to a licensee for a credit reporting body if:
(a) the licensee reasonably believes that the body is not complying with section 20Q of the Privacy Act 1988:
(i) on the trigger day referred to in that subsection; and
(ii) on the last day of the 45‑day period starting on the trigger day; and
(b) the licensee continues to hold that belief after that 45‑day period; and
(c) the licensee satisfies subsection (2) of this section.
Note 1: Paragraph (b) means that, if the licensee ceases to hold that belief after that 45‑day period, this exception will cease to apply and the supply requirement in subsection 133CU(1) will apply.
Note 2: A person who wishes to rely on this subsection bears an evidential burden in relation to the matters in this subsection (see subsection (3) of this section and subsection 13.3(3) of the Criminal Code).
(2) The licensee satisfies this subsection if:
(a) the licensee prepares a written notice:
(i) stating that the licensee reasonably believes that the body is not complying with section 20Q of the Privacy Act 1988 on the trigger day; and