1AObligations to destroy information

1A  Obligations to destroy information

Obligations on credit reporting bodies

 (1) Subject to subsection (2), an obligation on a credit reporting body to destroy credit information or credit reporting information requires the body to ensure it irretrievably destroys the information.

 (2) Where it is not possible for a credit reporting body to irretrievably destroy credit-related personal information held in electronic format, the body must take steps to put the information beyond use.

 (3) For the purposes of subsection (2), information is beyond use if the credit reporting body:

 (a) irretrievably omits the relevant information from the databases that it utilises for the purposes of making disclosures permitted under Part IIIA of the Act; and

 (b) is not able to use, and will not attempt to use, the information, including for the purposes of deriving CRB derived information; and

 (c) is not able to disclose, and will not attempt to disclose, the information; and

 (d) surrounds the information with appropriate technical and organisational security; and

 (e) commits to irretrievably destroy the information if, or when, this becomes possible.

Obligations on credit providers

 (4) Subject to subsection (5), an obligation on a credit provider to destroy credit reporting information or credit eligibility information requires the provider to take reasonable steps to ensure it irretrievably destroys the information.

 (5) Where it is not possible for a credit provider to irretrievably destroy credit-related personal information held in electronic format, the provider must take steps to put the information beyond use.

 (6) For the purposes of subsection (5), information is beyond use if the credit provider:

 (a) is not able to use, and will not attempt to use, the information, including for the purposes of deriving CP derived information; and

 (b) is not able to disclose, and will not attempt to disclose, the information; and

 (c) surrounds the information with appropriate technical and organisational security; and

 (d) commits to irretrievably destroy the information if, or when, this becomes possible.