17Protections for victims of fraud

17  Protections for victims of fraud

 (1) This section is made for the purposes of section 20K of the Act.

Note:  Section 20K of the Act allows individuals to request a ‘ban period’ if they believe on reasonable grounds that they have been, or are likely to be, a victim of fraud. Credit reporting information relating to an individual may not generally be used or disclosed when a ban period is in effect. A credit ban may be extended where the credit reporting body has reasonable grounds to believe that the relevant individual has been, or is likely to be, a victim of fraud.

Ban notification services

 (2) On or after 1 October 2025, a credit reporting body:

 (a) must operate a ban notification service for individuals in relation to whose credit reporting information a ban period is in effect;

 (b) may require an individual, before they can receive notifications as part of the ban notification service, to expressly consent in writing to the use of their credit reporting information for the provision of notifications; and

Note: If a credit ban is in place, a credit reporting body may not use or disclose the individual’s credit reporting information without the individual’s express written consent (or unless required by or under an Australian law or court/tribunal order): see subsections 20K(1) and (2) of the Privacy Act.

 (c) may:

 (i) collect contact information from individuals to facilitate the provision of notifications as part of the ban notification service; and

 (ii) provide, with the individual’s consent, those contact details to another body in the circumstances described in subparagraph (3)(b)(iv) below for the purpose of that body operating a ban notification service.

Steps credit reporting bodies must take when a consumer requests a ban period

 (3) Where an individual believes on reasonable grounds that they have been, or are likely to be, a victim of fraud and the individual requests a credit reporting body not to use or disclose their credit reporting information, the body must immediately:

 (a) include on the credit reporting information held in relation to the individual a notation about the individual’s request and retain the notation for the duration of the ban period; and

 (b) explain to the individual:

 (i) the effect and duration of the ban period, including that the individual may not be able to access credit during the ban period; and

 (ii) that they may request a ban notification service (if such a service is offered by the body); and

 (iii) that they may request a ban period with other credit reporting bodies; and

 (iv) that the individual can consent to the credit reporting body (the first body) notifying the credit reporting bodies nominated by the individual (each a notified body) that the individual has requested that the notified bodies not use or disclose the individual’s credit reporting information (an additional ban period request) and, if relevant, provide a ban notification service.