21CAdditional notification requirements for the collection of personal information etc.

#### 21C Additional notification requirements for the collection of personal information etc. (1) At or before the time a credit provider collects personal information about an individual that the provider is likely to disclose to a credit reporting body, the provider must: (a) notify the individual of the following matters: (i) the name and contact details of the body; (ii) any other matter specified in the registered CR code; or (b) otherwise ensure that the individual is aware of those matters. (2) If a credit provider is an APP entity, subsection (1) applies to the provider in relation to personal information in addition to Australian Privacy Principle 5. (3) If a credit provider is an APP entity, then the matters for the purposes of Australian Privacy Principle 5.1 include the following matters to the extent that the personal information referred to in that principle is credit information or credit eligibility information: (a) that the policy (the credit reporting policy) of the provider that is referred to in subsection 21B(3) contains information about how an individual may access the credit eligibility information about the individual that is held by the provider; (b) that the credit reporting policy of the provider contains information about how an individual may seek the correction of credit information or credit eligibility information about the individual that is held by the provider; (c) that the credit reporting policy of the provider contains information about how an individual may complain about a failure of the provider to comply with this Division or the registered CR code if it binds the provider; (d) that the credit reporting policy of the provider contains information about how the provider will deal with such a complaint; (e) whether the provider is likely to disclose credit information or credit eligibility information to entities that do not have an Australian link; (f) if the provider is likely to disclose credit information or credit eligibility information to such entities—the countries in which those entities are likely to be located if it is practicable to specify those countries in the credit reporting policy.