28TBWhen protected information must not be on‑disclosed

#### 28TB When protected information must not be on‑disclosed (1) For the purposes of subsection 133CZA(2) of the Act, the following conditions are prescribed for a credit reporting body and a credit provider: (a) the protected information (see subsection 133CZA(1) of the Act) was: (i) supplied under Division 2 of Part 3‑2CA of the Act to the credit reporting body; or (ii) derived from information that was supplied under that Division to the credit reporting body; by another credit provider that was a signatory to the principles mentioned in subregulation (3) at the time of that supply; (b) those principles have the effect of restricting the further disclosure of one or more kinds of information (the restricted kinds of information) making up the protected information. (2) For the purposes of subsection 133CZA(2) of the Act, the restricted kinds of information (if any) are prescribed (see paragraph (b) of that subsection). (3) For the purposes of paragraph (1)(a), the principles are those titled “Principles of Reciprocity and Data Exchange”, dated 6 January 2021 and published by the Australian Retail Credit Association, as amended from time to time. > Note: The Principles of Reciprocity and Data Exchange could in 2021 be viewed on the Australian Retail Credit Association website (http://www.arca.asn.au). (4) For the purposes of paragraph (1)(b), if those principles would only restrict the credit reporting body if that body were a signatory to those principles, treat that body as if it were a signatory to those principles. (5) Treat paragraph (1)(b) as ceasing to apply to a restriction if that restriction is subject to conditions and those conditions are met.