14Permitted CRB disclosures

14  Permitted CRB disclosures 

 (1) This section is made for the purposes of sections 20E, 20F and 21G of the Act.

Note: Section 20E of the Act contains restrictions about when a credit reporting body may disclose credit reporting information. Bodies may disclose credit reporting information to credit providers, mortgage insurers and/or trade insurers in the circumstances set out in section 20F of the Act, many of which relate to the provider or insurer requesting the information for specific purposes. Section 21G of the Act puts in place a similar framework restriction how providers may disclose credit eligibility information

 (2) Before a credit reporting body discloses credit reporting information to a credit provider, mortgage insurer or trade insurer, the body must have taken reasonable steps to ensure that the provider or insurer has been notified of the requirements of Part IIIA of the Act, the Regulations and this CR Code about limitations on use and disclosure of credit reporting information.

 (3) Subsections (4) and (5) apply where:

 (a) in response to a request:

 (i) a credit reporting body discloses credit reporting information to a credit provider, mortgage insurer or trade insurer; or

 (ii) a credit provider discloses credit eligibility information to an entity to which a permitted CP disclosure may be made; and

 (b) the credit reporting body, credit provider, mortgage insurer or trade insurer (as applicable) subsequently becomes aware that the credit reporting information or credit eligibility information was about an individual other than the individual that was the subject of the request.

 (4) The recipient of the information described in subsection (3) must:

 (a) advise the disclosing credit reporting body or credit provider of the mistake as to identity, unless it was the disclosing body or provider that identified the mistake);

 (b) destroy the disclosed information; and

Note: Section 1A has information about obligations to destroy information

 (c) take reasonable steps to ensure that any derived information that is based on the disclosed information is not disclosed or used for the purpose of assessing the credit worthiness of the individual to whom the information relates

 (5) The credit reporting body or credit provider that disclosed the information described in subsection (3) must:

 (a) advise the recipient of the information of the mistake as to identity (unless it was the recipient of the information that identified the mistake); and

 (b) take reasonable steps to review its disclosure practices, procedures and systems so that similar mistakes are minimised in the future.