22Record keeping

22  Record keeping

Requirements to maintain records

 (1) A credit reporting body and a credit provider must maintain adequate records that evidence their compliance with Part IIIA of the Act, the Regulations and this CR Code.

 (2) Without limiting subsection (1), a credit reporting body and a credit provider must maintain records of:

 (a) where credit-related personal information is destroyed to meet obligations under Part IIIA of the Act, the Regulations and this CR Code (but only if this is possible);

 (b) in the case of a credit provider that receives credit eligibility information disclosed to it by another provider:

 (i) the date on which that information was disclosed;

 (ii) the provider who disclosed the information;

 (iii) a brief description of the type of information disclosed; and

 (iv) the evidence relied upon that the consent requirements have been met;

 (c) for each disclosure that a body or provider makes of credit reporting information or credit eligibility information (as applicable):

 (i) the date of the disclosure;

 (ii) a brief description of the type of information disclosed;

 (iii) the provider, affected information recipient or other person to whom the disclosure was made; and

 (iv) evidence that the disclosure was permitted under Part IIIA of the Act, the Regulations or this CR Code;

 (d) any consent provided by an individual for the purposes of Part IIIA of the Act, the Regulations or this CR Code;

 (e) in the case of a credit provider, any written notice given to an individual stating that a consumer credit application has been refused within 90 days of disclosure of credit reporting information in relation to that individual by a credit reporting body to the provider; and

 (f) correspondence and actions taken in relation to:

 (i) requests to establish or extend a ban period;

 (ii) requests for, or notifications of, corrections;

 (iii) complaints;

 (iv) pre-screening requests by a credit provider; and

 (v) monitoring and auditing of credit providers in accordance with Part IIIA of the Act, the Regulations and this CR Code.

Retention of records

 (3) Subject to subsection (4), a credit reporting body and a credit provider must retain records for a minimum period of 5 years from the date on which the record is made.

 (4) If a credit reporting body makes a record that includes information that the body is required to destroy at the end of the applicable retention period by Part IIIA of the Act, the Regulations or this CR Code, the record must be retained for the duration of that retention period only.