PRIVACY ACT 1988
- SECT 18L
Limits on use by credit providers of personal information
contained in credit reports etc.

(1)

A credit provider that is or has been in possession or control of a credit report must not use the report or any personal information derived from the report for any purpose other than assessing an application for credit made to the credit provider by the individual concerned unless:

(aa) the report was obtained under paragraph 18K(1)(a) or (ab) and the credit provider uses the report or information for the purpose of assessing the risk in purchasing a loan by means of a securitisation arrangement, being a loan given to or applied for by:
(i) the individual; or
(ii) a person in relation to whom the individual is, or is proposing to be, a guarantor; or
(ab) the report was obtained under paragraph 18K(1)(a) or (ac) and the credit provider uses the report or information for the purpose of assessing the risk in undertaking credit enhancement of a loan that is, or is proposed to be, purchased or funded by means of a securitisation arrangement, being a loan given to or applied for by:
(i) the individual; or
(ii) a person in relation to whom the individual is, or is proposing to be, a guarantor; or
(a) the report was obtained under paragraph 18K(1)(b) and the credit provider uses the report or information for the purpose of assessing an application for commercial credit made by a person to the credit provider; or
(b) the report was obtained under paragraph 18K(1)(c) and the credit provider uses the report or information for the purpose of assessing whether to accept the individual as a guarantor in respect of:
(i) a loan provided by the credit provider to a person other than the individual; or
(ii) a loan for which an application has been made by a person other than the individual to the credit provider; or
(ba) the report was obtained under paragraph 18K(1)(a), (b) or (c) and the credit provider uses the report or information for the internal management purposes of the credit provider, being purposes directly related to the provision or management of loans by the credit provider; or
(c) the report was obtained under paragraph 18K(1)(f) and the credit provider uses the information for the purpose of assisting the individual to avoid defaulting on his or her credit obligations; or
(d) the credit provider uses the report or information for the purpose of the collection of payments that are overdue in respect of credit provided to the individual by the credit provider; or
(da) the report was obtained under paragraph 18K(1)(h) and the credit provider uses the report or information for the purpose of the collection of payments that are overdue in respect of commercial credit provided to a person by the credit provider; or
(e) use of the report or information for that other purpose is required or authorised by or under law; or
(f) the credit provider believes on reasonable grounds that the individual has committed a serious credit infringement, and the report or information is used in connection with that infringement.

(2)

A credit provider that intentionally contravenes subsection (1) is guilty of an offence punishable, on conviction, by a fine not exceeding $150,000.

(3)

A credit provider that is or has been in possession or control of a credit report must not:

(a) use the report unless all personal information concerning individuals that is not information of a kind referred to in subsection 18E(1) has been deleted from the report; or
(b) use any personal information derived from the report if the information is not information of a kind referred to in subsection 18E(1).

(4)

Where a credit provider has received a credit report for the purpose of assessing an application for credit made to the credit provider by an individual, the credit provider must not, in assessing the application, use information that:

(a) concerns the individual's commercial activities or commercial credit worthiness; and
(b) was obtained from a person or body carrying on a business or undertaking involving the provision of information about the commercial credit worthiness of persons;

unless the individual has specifically agreed to the information being obtained by the credit provider for that purpose.

(4A)

For the purposes of subsection (4), the individual's agreement to the information being obtained by the credit provider must be in writing unless:

(a) the information is obtained for the purpose of assessing an application for credit that was at first instance made orally; and
(b) the application has not yet been made in writing.

(5)

References in subsection (3) to information that is not information of a kind referred to in subsection 18E(1) do not include references to information the disclosure of which is taken, because of the application of subsection 18K(3), not to be in contravention of subsection 18K(2).

(6)

The Commissioner may determine, in writing, the manner in which information of a kind referred to in subsection (4) may, under that subsection, be used (including the manner in which an individual's agreement may be obtained for the purposes of that subsection).

(7)

A determination is to be made by notice published in the Gazette.

(8)

A notice so published is a disallowable instrument for the purposes of section 46A of the Acts Interpretation Act 1901.