a mortgage insurer; or

a trade insurer; or

a body corporate referred to in paragraph 21G(3)(b); or

a person referred to in paragraph 21G(3)(c); or

an entity or adviser referred to in paragraph 21N(2)(a).

agency means:

a Minister; or

a Department; or

a body (whether incorporated or not), or a tribunal, established or appointed for a public purpose by or under a Commonwealth law, not being:

an incorporated company, society or association; or

(ii) an organisation that is registered under the Fair Work (Registered Organisations) Act 2009 or a branch of such an organisation; or

(ca) a body (whether incorporated or not), or a tribunal, established for a public purpose by or under a law (other than a law providing for the incorporation of companies, societies or associations) of a State or Territory as in force in an external Territory, other than a body exempted by the Minister under subsection (5A); or

a body established or appointed by the Governor-General, or by a Minister, otherwise than by or under a Commonwealth law; or

a person holding or performing the duties of an office established by or under, or an appointment made under, a Commonwealth law, other than a person who, by virtue of holding that office, is the Secretary of a Department; or

(ea) a person holding or performing the duties of an office established by or under, or an appointment made under, a law of a State or Territory as in force in an external Territory, other than an office or appointment exempted by the Minister under subsection (5A); or

a person holding or performing the duties of an appointment, being an appointment made by the Governor-General, or by a Minister, otherwise than under a Commonwealth law; or

a federal court; or

the Australian Federal Police; or

a court of Norfolk Island; or

an eligible hearing service provider; or

(l) the service operator under the Healthcare Identifiers Act 2010.

alternative complaint body has the meaning given by subsection 50(1).

amount of credit has the meaning given by subsection 6M(2).

annual turnover of a business has the meaning given by section 6DA.

APP code has the meaning given by section 26C.

APP code developer means:

an APP entity; or

a group of APP entities; or

a body or association representing one or more APP entities.

APP complaint means a complaint about an act or practice that, if established, would be an interference with the privacy of an individual because it breached an Australian Privacy Principle.

APP entity means an agency or organisation.

APP privacy policy has the meaning given by Australian Privacy Principle 1.3.

at risk from an eligible data breach has the meaning given by section 26WE.

AUSTRAC means the Australian Transaction Reports and Analysis Centre continued in existence by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.

Australian law means:

an Act of the Commonwealth or of a State or Territory; or

regulations, or any other instrument, made under such an Act; or

any other law in force in the Jervis Bay Territory or an external Territory; or

a rule of common law or equity.

Australian link has the meaning given by subsections 5B(2) and (3).

Australian Privacy Principle has the meaning given by section 14.

authorised agent of a reporting entity means a person authorised to act on behalf of the reporting entity as mentioned in section 37 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.

bank means:

the Reserve Bank of Australia; or

(b) a body corporate that is an ADI (authorised deposit-taking institution) for the purposes of the Banking Act 1959; or

a person who carries on State banking within the meaning of paragraph 51(xiii) of the Constitution.

Bankruptcy Act means the Bankruptcy Act 1966.

ban period has the meaning given by subsection 20K(3).

Board of the ACC means the Board of the Australian Crime Commission established under section 7B of the Australian Crime Commission Act 2002.

breach:

in relation to an Australian Privacy Principle, has the meaning given by section 6A; and

in relation to a registered APP code, has the meaning given by section 6B; and

in relation to the registered CR code, has the meaning given by section 6BA.

child means an individual who has not reached 18 years.

Children’s Online Privacy Code: see section 26GC.

civil penalty provision has the same meaning as in the Regulatory Powers Act.

class member means any of the persons on whose behalf the complaint was lodged, but does not include a person who has withdrawn under section 38B.

code complaint means a complaint about an act or practice that, if established, would be an interference with the privacy of an individual because it breached a registered APP code.

Codes Register has the meaning given by subsection 26U(1).

collects: an entity collects personal information only if the entity collects the personal information for inclusion in a record or generally available publication.

commercial credit means credit (other than consumer credit) that is applied for by, or provided to, a person.

commercial credit related purpose of a credit provider in relation to a person means the purpose of:

assessing an application for commercial credit made by the person to the provider; or

collecting payments that are overdue in relation to commercial credit provided by the provider to the person.

Commissioner means the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010.

Commissioner of Police means the Commissioner of Police appointed under the Australian Federal Police Act 1979.

Commission of inquiry means:

(a) the Commission of inquiry within the meaning of the Quarantine Act 1908 (as in force immediately before its repeal); or

(b) a Commission of inquiry within the meaning of the Offshore Petroleum and Greenhouse Gas Storage Act 2006.

committee of management of an unincorporated association means a body (however described) that governs, manages or conducts the affairs of the association.

Commonwealth contract means a contract, to which the Commonwealth or an agency is or was a party, under which services are to be, or were to be, provided to an agency.

Commonwealth law means the following: an Act other than: (i) the Northern Territory (Self-Government) Act 1978; or an Act providing for the administration or government of an external Territory; or (iii) the Australian Capital Territory (Self-Government) Act 1988; an Ordinance of the Australian Capital Territory or of an external Territory; (c) a law continued in force by Norfolk Island Act 1979;section 16 or 16A of the an instrument (including rules, regulations or by-laws) made under: an Act to which paragraph (a) applies; or an Ordinance to which paragraph (b) applies; or a law to which paragraph (c) applies; any other legislation that applies as a law of the Commonwealth, other than legislation in so far as it is applied: by an Act referred to in subparagraph (a)(i) or (ii); or as a law of the Australian Capital Territory, to the extent that it operates as such a law.

an Act other than:

(i) the Northern Territory (Self-Government) Act 1978; or

an Act providing for the administration or government of an external Territory; or

(iii) the Australian Capital Territory (Self-Government) Act 1988;

an Ordinance of the Australian Capital Territory or of an external Territory;

(c) a law continued in force by Norfolk Island Act 1979;section 16 or 16A of the

an instrument (including rules, regulations or by-laws) made under:

an Act to which paragraph (a) applies; or

an Ordinance to which paragraph (b) applies; or

a law to which paragraph (c) applies;

any other legislation that applies as a law of the Commonwealth, other than legislation in so far as it is applied:

by an Act referred to in subparagraph (a)(i) or (ii); or

as a law of the Australian Capital Territory, to the extent that it operates as such a law.

Commonwealth officer means a person who holds office under, or is employed by, the Commonwealth, and includes: (a) a person appointed or engaged under the Public Service Act 1999; a person (other than a person referred to in paragraph (a)) permanently or temporarily employed by, or in the service of, an agency; a member of the Defence Force; and a member, staff member or special member of the Australian Federal Police; but does not include a person permanently or temporarily employed in the Australian Capital Territory Government Service or in the Public Service of the Northern Territory.

(a) a person appointed or engaged under the Public Service Act 1999;

a person (other than a person referred to in paragraph (a)) permanently or temporarily employed by, or in the service of, an agency;

a member of the Defence Force; and

a member, staff member or special member of the Australian Federal Police;

but does not include a person permanently or temporarily employed in the Australian Capital Territory Government Service or in the Public Service of the Northern Territory.

Commonwealth record has the same meaning as in the Archives Act 1983.

consent means express consent or implied consent.

consumer credit means credit: for which an application has been made by an individual to a credit provider, or that has been provided to an individual by a credit provider, in the course of the provider carrying on a business or undertaking as a credit provider; and that is intended to be used wholly or primarily: for personal, family or household purposes; or to acquire, maintain, renovate or improve residential property for investment purposes; or to refinance consumer credit that has been provided wholly or primarily to acquire, maintain, renovate or improve residential property for investment purposes. consumer credit liability information: if a credit provider provides consumer credit to an individual, the following information about the consumer credit is consumer credit liability information about the individual: the name of the provider; whether the provider is a licensee; the type of consumer credit; the day on which the consumer credit is entered into; the terms or conditions of the consumer credit: that relate to the repayment of the amount of credit; and that are prescribed by the regulations; the maximum amount of credit available under the consumer credit; the day on which the consumer credit is terminated or otherwise ceases to be in force. consumer credit related purpose of a credit provider in relation to an individual means the purpose of: assessing an application for consumer credit made by the individual to the provider; or collecting payments that are overdue in relation to consumer credit provided by the provider to the individual.

for which an application has been made by an individual to a credit provider, or that has been provided to an individual by a credit provider, in the course of the provider carrying on a business or undertaking as a credit provider; and

that is intended to be used wholly or primarily:

for personal, family or household purposes; or

to acquire, maintain, renovate or improve residential property for investment purposes; or

to refinance consumer credit that has been provided wholly or primarily to acquire, maintain, renovate or improve residential property for investment purposes.

consumer credit liability information: if a credit provider provides consumer credit to an individual, the following information about the consumer credit is consumer credit liability information about the individual:

the name of the provider;

whether the provider is a licensee;

the type of consumer credit;

the day on which the consumer credit is entered into;

the terms or conditions of the consumer credit:

that relate to the repayment of the amount of credit; and

that are prescribed by the regulations;

the maximum amount of credit available under the consumer credit;

the day on which the consumer credit is terminated or otherwise ceases to be in force.

consumer credit related purpose of a credit provider in relation to an individual means the purpose of:

assessing an application for consumer credit made by the individual to the provider; or

collecting payments that are overdue in relation to consumer credit provided by the provider to the individual.

consumer data rules has the same meaning as in the Competition and Consumer Act 2010.

contracted service provider, for a government contract, means:

an organisation that is or was a party to the government contract and that is or was responsible for the provision of services to an agency or a State or Territory authority under the government contract; or

a subcontractor for the government contract.

corporation means a body corporate that: is a foreign corporation; is a trading corporation formed within the limits of Australia or is a financial corporation so formed; or is incorporated in a Territory, other than the Northern Territory.

is a foreign corporation;

is a trading corporation formed within the limits of Australia or is a financial corporation so formed; or

is incorporated in a Territory, other than the Northern Territory.

court proceedings information about an individual means information about a judgement of an Australian court: that is made, or given, against the individual in proceedings (other than criminal proceedings); and that relates to any credit that has been provided to, or applied for by, the individual.

that is made, or given, against the individual in proceedings (other than criminal proceedings); and

that relates to any credit that has been provided to, or applied for by, the individual.

court/tribunal order means an order, direction or other instrument made by: a court; or a tribunal; or a judge (including a judge acting in a personal capacity) or a person acting as a judge; or a magistrate (including a magistrate acting in a personal capacity) or a person acting as a magistrate; or a member or an officer of a tribunal;

a court; or

a tribunal; or

a judge (including a judge acting in a personal capacity) or a person acting as a judge; or

a magistrate (including a magistrate acting in a personal capacity) or a person acting as a magistrate; or

a member or an officer of a tribunal;

and includes an order, direction or other instrument that is of an interim or interlocutory nature.

CP derived information about an individual means any personal information (other than sensitive information) about the individual: that is derived from credit reporting information about the individual that was disclosed to a credit provider by a credit reporting body under Division 2 of Part IIIA; and that has any bearing on the individual’s credit worthiness; and that is used, has been used or could be used in establishing the individual’s eligibility for consumer credit.

that is derived from credit reporting information about the individual that was disclosed to a credit provider by a credit reporting body under Division 2 of Part IIIA; and

that has any bearing on the individual’s credit worthiness; and

that is used, has been used or could be used in establishing the individual’s eligibility for consumer credit.

CRB derived information about an individual means any personal information (other than sensitive information) about the individual: that is derived by a credit reporting body from credit information about the individual that is held by the body; and that has any bearing on the individual’s credit worthiness; and that is used, has been used or could be used in establishing the individual’s eligibility for consumer credit.

that is derived by a credit reporting body from credit information about the individual that is held by the body; and

that has any bearing on the individual’s credit worthiness; and

that is used, has been used or could be used in establishing the individual’s eligibility for consumer credit.

CR code has the meaning given by section 26N.

CR code developer means:

an entity that is subject to Part IIIA; or

a group of entities that are subject to Part IIIA; or

a body or association representing one or more entities that are subject to Part IIIA.

credit has the meaning given by subsections 6M(1) and (3).

credit card means any article of a kind commonly known as a credit card, charge card or any similar article intended for use in obtaining cash, goods or services by means of credit, and includes any article of a kind commonly issued by persons carrying on business to customers or prospective customers of those persons for use in obtaining goods or services from those persons by means of credit.

credit eligibility information about an individual means:

credit reporting information about the individual that was disclosed to a credit provider by a credit reporting body under Division 2 of Part IIIA; or

CP derived information about the individual.

credit enhancement, in relation to credit, means:

the process of insuring risk associated with purchasing or funding the credit by means of a securitisation arrangement; or

any other similar process related to purchasing or funding the credit by those means.

credit guarantee purpose of a credit provider in relation to an individual means the purpose of assessing whether to accept the individual as a guarantor in relation to:

credit provided by the provider to a person other than the individual; or

credit for which an application has been made to the provider by a person other than the individual.

credit information has the meaning given by section 6N.

credit provider has the meaning given by sections 6G to 6K, and, for the purposes of sections 7 and 8 and Parts III, IIIB, IV and V, is taken to include a mortgage insurer and a trade insurer.

credit reporting body means:

an organisation; or

an agency prescribed by the regulations;

that carries on a credit reporting business.

credit reporting business has the meaning given by section 6P.

credit reporting complaint means a complaint about an act or practice that, if established, would be an interference with the privacy of an individual because: it breached the registered CR code; or it breached a provision of Part IIIA.

it breached the registered CR code; or

it breached a provision of Part IIIA.

credit reporting information about an individual means credit information, or CRB derived information, about the individual.

credit worthiness of an individual means the individual’s: eligibility to be provided with consumer credit; or history in relation to consumer credit; or capacity to repay an amount of credit that relates to consumer credit.

eligibility to be provided with consumer credit; or

history in relation to consumer credit; or

capacity to repay an amount of credit that relates to consumer credit.

de facto partner of an individual has the meaning given by the Acts Interpretation Act 1901.

default information has the meaning given by section 6Q.

Defence Department means the Department of State that deals with defence and that is administered by the Minister administering section 1 of the Defence Act 1903.

Defence Force includes the Australian Defence Force Cadets.

de-identified: personal information is de-identified if the information is no longer about an identifiable individual or an individual who is reasonably identifiable.

Department means an Agency within the meaning of the Public Service Act 1999.

eligible data breach has the meaning given by Division 2 of Part IIIC.

eligible data breach declaration means a declaration under subsection 26X(1).

eligible hearing service provider means an entity (within the meaning of the Hearing Services Administration Act 1997): (a) that is, or has at any time been, engaged under Part 3 of the Hearing Services Administration Act 1997 to provide hearing services; and (b) that is not covered by paragraph (a), (b), (c), (d), (e), (f), (g) or (h) of the definition of agency.

(a) that is, or has at any time been, engaged under Part 3 of the Hearing Services Administration Act 1997 to provide hearing services; and

(b) that is not covered by paragraph (a), (b), (c), (d), (e), (f), (g) or (h) of the definition of agency.

employee record means a record of personal information relating to the employment of the employee. Examples of personal information relating to the employment of the employee are health information about the employee and personal information about all or any of the following: the engagement, training, disciplining or resignation of the employee; the termination of the employment of the employee; the terms and conditions of employment of the employee; the employee’s personal and emergency contact details; the employee’s performance or conduct; the employee’s hours of employment; the employee’s salary or wages; the employee’s membership of a professional or trade association; the employee’s trade union membership; the employee’s recreation, long service, sick, personal, maternity, paternity or other leave; the employee’s taxation, banking or superannuation affairs.

the engagement, training, disciplining or resignation of the employee;

the termination of the employment of the employee;

the terms and conditions of employment of the employee;

the employee’s personal and emergency contact details;

the employee’s performance or conduct;

the employee’s hours of employment;

the employee’s salary or wages;

the employee’s membership of a professional or trade association;

the employee’s trade union membership;

the employee’s recreation, long service, sick, personal, maternity, paternity or other leave;

the employee’s taxation, banking or superannuation affairs.

enforcement body means:

the Australian Federal Police; or

the National Anti-Corruption Commissioner; or

the Inspector of the National Anti-Corruption Commission; or

the ACC; or

Sport Integrity Australia; or

the Immigration Department; or

the Australian Prudential Regulation Authority; or

the Australian Securities and Investments Commission; or

the Office of the Director of Public Prosecutions, or a similar body established under a law of a State or Territory; or

another agency, to the extent that it is responsible for administering, or performing a function under, a law that imposes a penalty or sanction or a prescribed law; or

another agency, to the extent that it is responsible for administering a law relating to the protection of the public revenue; or

a police force or service of a State or a Territory; or

the New South Wales Crime Commission; or

the Independent Commission Against Corruption of New South Wales; or

the Law Enforcement Conduct Commission of New South Wales; or

the Independent Broad-based Anti-corruption Commission of Victoria; or

the Crime and Corruption Commission of Queensland; or

the Corruption and Crime Commission of Western Australia; or

the Independent Commission Against Corruption of South Australia; or

another prescribed authority or body that is established under a law of a State or Territory to conduct criminal investigations or inquiries; or

a State or Territory authority, to the extent that it is responsible for administering, or performing a function under, a law that imposes a penalty or sanction or a prescribed law; or

a State or Territory authority, to the extent that it is responsible for administering a law relating to the protection of the public revenue.

enforcement related activity means:

the prevention, detection, investigation, prosecution or punishment of:

criminal offences; or

breaches of a law imposing a penalty or sanction; or

the conduct of surveillance activities, intelligence gathering activities or monitoring activities; or

the conduct of protective or custodial activities; or

the enforcement of laws relating to the confiscation of the proceeds of crime; or

the protection of the public revenue; or

the prevention, detection, investigation or remedying of misconduct of a serious nature, or other conduct prescribed by the regulations; or

the preparation for, or conduct of, proceedings before any court or tribunal, or the implementation of court/tribunal orders.

entity means:

an agency; or

an organisation; or

a small business operator.

Federal Court means the Federal Court of Australia.

file number complaint means a complaint about an act or practice that, if established, would be an interference with the privacy of an individual: because it breached a rule issued under section 17; or because it involved an unauthorised requirement or request for disclosure of a tax file number.

because it breached a rule issued under section 17; or

because it involved an unauthorised requirement or request for disclosure of a tax file number.

financial corporation means a financial corporation within the meaning of paragraph 51(xx) of the Constitution.

financial hardship arrangement has the meaning given by subsection 6QA(1).

financial hardship information has the meaning given by subsection 6QA(4).

foreign corporation means a foreign corporation within the meaning of paragraph 51(xx) of the Constitution.

Freedom of Information Act means the Freedom of Information Act 1982.

generally available publication means a magazine, book, article, newspaper or other publication that is, or will be, generally available to members of the public: whether or not it is published in print, electronically or in any other form; and whether or not it is available on the payment of a fee.

whether or not it is published in print, electronically or in any other form; and

whether or not it is available on the payment of a fee.

genetic relative of an individual (the first individual) means another individual who is related to the first individual by blood, including but not limited to a sibling, a parent or a descendant of the first individual.

government contract means a Commonwealth contract or a State contract.

government related identifier of an individual means an identifier of the individual that has been assigned by: an agency; or a State or Territory authority; or an agent of an agency, or a State or Territory authority, acting in its capacity as agent; or a contracted service provider for a Commonwealth contract, or a State contract, acting in its capacity as contracted service provider for that contract.

an agency; or

a State or Territory authority; or

an agent of an agency, or a State or Territory authority, acting in its capacity as agent; or

a contracted service provider for a Commonwealth contract, or a State contract, acting in its capacity as contracted service provider for that contract.

guarantee includes an indemnity given against the default of a person in making a payment in relation to credit that has been applied for by, or provided to, the person.

guidance related functions has the meaning given by subsection 28(1).

healthcare identifier has the meaning given by the Healthcare Identifiers Act 2010.

healthcare identifier offence means:

(a) an offence against Healthcare Identifiers Act 2010; orsection 26 of the

(b) an offence against Crimes Act 1914 that relates to an offence mentioned in paragraph (a) of this definition.section 6 of the

health information has the meaning given by section 6FA.

health service has the meaning given by section 6FB.

hearing services has the same meaning as in the Hearing Services Administration Act 1997.

holds: an entity holds personal information if the entity has possession or control of a record that contains the personal information.

identification information about an individual means:

the individual’s full name; or

an alias or previous name of the individual; or

the individual’s date of birth; or

the individual’s sex; or

the individual’s current or last known address, and 2 previous addresses (if any); or

the name of the individual’s current or last known employer; or

if the individual holds a driver’s licence—the individual’s driver’s licence number.

identifier of an individual means a number, letter or symbol, or a combination of any or all of those things, that is used to identify the individual or to verify the identity of the individual, but does not include: the individual’s name; or (b) the individual’s ABN (within the meaning of the A New Tax System (Australian Business Number) Act 1999); or anything else prescribed by the regulations.

the individual’s name; or

(b) the individual’s ABN (within the meaning of the A New Tax System (Australian Business Number) Act 1999); or

anything else prescribed by the regulations.

Immigration Department means the Department administered by the Minister administering the Migration Act 1958.

individual means a natural person.

information request has the meaning given by section 6R.

intelligence agency means:

the Australian Security Intelligence Organisation;

the Australian Secret Intelligence Service; or

the Australian Signals Directorate; or

the Office of National Intelligence.

interested party has the meaning given by subsections 20T(3) and 21V(3).

interference with the privacy of an individual has the meaning given by sections 13 to 13F.

licensee has the meaning given by the National Consumer Credit Protection Act 2009.

managing credit does not include the act of collecting overdue payments in relation to credit.

media organisation means an organisation whose activities consist of or include the collection, preparation for dissemination or dissemination of the following material for the purpose of making it available to the public: material having the character of news, current affairs, information or a documentary; material consisting of commentary or opinion on, or analysis of, news, current affairs, information or a documentary.

material having the character of news, current affairs, information or a documentary;

material consisting of commentary or opinion on, or analysis of, news, current affairs, information or a documentary.

medical research includes epidemiological research.

member of the staff of the Commissioner means a person referred to in section 23 of the Australian Information Commissioner Act 2010.

misconduct includes fraud, negligence, default, breach of trust, breach of duty, breach of discipline or any other misconduct in the course of duty.

monitoring related functions has the meaning given by subsections 28A(1) and (2).

mortgage credit means consumer credit: that is provided in connection with the acquisition, maintenance, renovation or improvement of real property; and in relation to which the real property is security. mortgage insurance purpose of a mortgage insurer in relation to an individual is the purpose of assessing: whether to provide insurance to, or the risk of providing insurance to, a credit provider in relation to mortgage credit: provided by the provider to the individual; or for which an application to the provider has been made by the individual; or the risk of the individual defaulting on mortgage credit in relation to which the insurer has provided insurance to a credit provider; or the risk of the individual being unable to meet a liability that might arise under a guarantee provided, or proposed to be provided, in relation to mortgage credit provided by a credit provider to another person.

that is provided in connection with the acquisition, maintenance, renovation or improvement of real property; and

in relation to which the real property is security.

mortgage insurance purpose of a mortgage insurer in relation to an individual is the purpose of assessing:

whether to provide insurance to, or the risk of providing insurance to, a credit provider in relation to mortgage credit:

provided by the provider to the individual; or

for which an application to the provider has been made by the individual; or

the risk of the individual defaulting on mortgage credit in relation to which the insurer has provided insurance to a credit provider; or

the risk of the individual being unable to meet a liability that might arise under a guarantee provided, or proposed to be provided, in relation to mortgage credit provided by a credit provider to another person.

mortgage insurer means an organisation, or small business operator, that carries on a business or undertaking that involves providing insurance to credit providers in relation to mortgage credit provided by providers to other persons.

National Credit Code has the same meaning as in the National Consumer Credit Protection Act 2009.

national emergency declaration has the same meaning as in the National Emergency Declaration Act 2020.

National Personal Insolvency Index has the meaning given by the Bankruptcy Act.

new arrangement information has the meaning given by section 6S.

non-participating credit provider means a credit provider to which all of the following apply: the credit provider has not disclosed credit reporting information or credit eligibility information about an individual to a credit reporting body or another credit provider; the credit provider is not likely to disclose credit reporting information or credit eligibility information about an individual to a credit reporting body or another credit provider; the credit provider has not collected credit reporting information or credit eligibility information about an individual from a credit reporting body or another credit provider.

the credit provider has not disclosed credit reporting information or credit eligibility information about an individual to a credit reporting body or another credit provider;

the credit provider is not likely to disclose credit reporting information or credit eligibility information about an individual to a credit reporting body or another credit provider;

the credit provider has not collected credit reporting information or credit eligibility information about an individual from a credit reporting body or another credit provider.

non-profit organisation means an organisation: that is a non-profit organisation; and that engages in activities for cultural, recreational, political, religious, philosophical, professional, trade or trade union purposes.

that is a non-profit organisation; and

that engages in activities for cultural, recreational, political, religious, philosophical, professional, trade or trade union purposes.

offence against this Act includes an offence against section 6 of the Crimes Act 1914, or section 11.1, 11.2, 11.2A, 11.4 or 11.5 of the Criminal Code, that relates to an offence against this Act.

Ombudsman means the Commonwealth Ombudsman.

organisation has the meaning given by section 6C.

overseas recipient, in relation to personal information, has the meaning given by Australian Privacy Principle 8.1.

payment information has the meaning given by section 6T.

pending correction request in relation to credit information or CRB derived information means:

a request made under subsection 20T(1) in relation to the information if a notice has not been given under subsection 20U(2) or (3) in relation to the request; or

a request made under subsection 21V(1) in relation to the information if:

the credit reporting body referred to in subsection 20V(3) has been consulted about the request under subsection 21V(3); and

a notice has not been given under subsection 21W(2) or (3) in relation to the request.

pending dispute in relation to credit information or CRB derived information means:

a complaint made under section 23A that relates to the information if a decision about the complaint has not been made under subsection 23B(4); or

a matter that relates to the information and that is still being dealt with by a recognised external dispute resolution scheme; or

a complaint made to the Commissioner under Part V that relates to the information and that is still being dealt with.

permitted CP disclosure has the meaning given by sections 21J to 21N.

permitted CP use has the meaning given by section 21H.

permitted CRB disclosure has the meaning given by section 20F.

permitted general situation has the meaning given by section 16A.

permitted health situation has the meaning given by section 16B.

personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable: whether the information or opinion is true or not; and whether the information or opinion is recorded in a material form or not.

whether the information or opinion is true or not; and

whether the information or opinion is recorded in a material form or not.

personal insolvency information has the meaning given by section 6U.

pre-screening assessment means an assessment made under paragraph 20G(2)(d).

principal executive, of an agency, has a meaning affected by section 37.

purchase includes the purchase of rights to receive payments relating to the credit.

recognised external dispute resolution scheme means an external dispute resolution scheme recognised under section 35A.

record includes:

a document; or

an electronic or other device;

but does not include:

a generally available publication; or

anything kept in a library, art gallery or museum for the purposes of reference, study or exhibition; or

(f) Commonwealth records as defined by subsection 3(1) of the Archives Act 1983 that are in the open access period for the purposes of that Act; or

(fa) records (as defined in the Archives Act 1983) in the care (as defined in that Act) of the National Archives of Australia in relation to which the Archives has entered into arrangements with a person other than a Commonwealth institution (as defined in that Act) providing for the extent to which the Archives or other persons are to have access to the records; or

(g) documents placed by or on behalf of a person (other than an agency) in the memorial collection within the meaning of the Australian War Memorial Act 1980; or

letters or other articles in the course of transmission by post.

registered APP code has the meaning given by section 26B.

registered CR code has the meaning given by section 26M.

registered political party means a political party registered under Part XI of the Commonwealth Electoral Act 1918.

regulated information of an affected information recipient means:

if the recipient is a mortgage insurer or trade insurer—personal information disclosed to the recipient under Division 2 or 3 of Part IIIA; or

if the recipient is a body corporate referred to in paragraph 21G(3)(b)—credit eligibility information disclosed to the recipient under that paragraph; or

if the recipient is a person referred to in paragraph 21G(3)(c)—credit eligibility information disclosed to the recipient under that paragraph; or

if the recipient is an entity or adviser referred to in paragraph 21N(2)(a)—credit eligibility information disclosed to the recipient under subsection 21N(2).

Regulatory Powers Act means the Regulatory Powers (Standard Provisions) Act 2014.

related body corporate: see subsection (8).

repayment history information has the meaning given by subsection 6V(1).

reporting entity has the same meaning as in the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.

representative complaint means a complaint where the persons on whose behalf the complaint was made include persons other than the complainant, but does not include a complaint that the Commissioner has determined should no longer be continued as a representative complaint.

residential property has the meaning given by section 204 of the National Credit Code.

respondent for a complaint made under section 23A means the credit reporting body or credit provider to which the complaint is made.

responsible person has the meaning given by section 6AA.

retention period has the meaning given by sections 20W and 20X.

Secretary means an Agency Head within the meaning of the Public Service Act 1999.

securitisation arrangement means an arrangement: involving the funding, or proposed funding, of: credit that has been, or is to be, provided by a credit provider; or the purchase of credit by a credit provider; by issuing instruments or entitlements to investors; and under which payments to investors in respect of such instruments or entitlements are principally derived, directly or indirectly, from such credit. securitisation related purpose of a credit provider in relation to an individual is the purpose of: assessing the risk in purchasing, by means of a securitisation arrangement, credit that has been provided to, or applied for by: the individual; or a person for whom the individual is, or is proposing to be, a guarantor; or assessing the risk in undertaking credit enhancement in relation to credit: that is, or is proposed to be, purchased or funded by means of a securitisation arrangement; and that has been provided to, or applied for by, the individual or a person for whom the individual is, or is proposing to be, a guarantor.

involving the funding, or proposed funding, of:

credit that has been, or is to be, provided by a credit provider; or

the purchase of credit by a credit provider;

by issuing instruments or entitlements to investors; and

under which payments to investors in respect of such instruments or entitlements are principally derived, directly or indirectly, from such credit.

securitisation related purpose of a credit provider in relation to an individual is the purpose of:

assessing the risk in purchasing, by means of a securitisation arrangement, credit that has been provided to, or applied for by:

the individual; or

a person for whom the individual is, or is proposing to be, a guarantor; or

assessing the risk in undertaking credit enhancement in relation to credit:

that is, or is proposed to be, purchased or funded by means of a securitisation arrangement; and

that has been provided to, or applied for by, the individual or a person for whom the individual is, or is proposing to be, a guarantor.

sensitive information means:

information or an opinion about an individual’s:

racial or ethnic origin; or

political opinions; or

membership of a political association; or

religious beliefs or affiliations; or

philosophical beliefs; or

membership of a professional or trade association; or

membership of a trade union; or

sexual orientation or practices; or

criminal record;

that is also personal information; or

health information about an individual; or

genetic information about an individual that is not otherwise health information; or

biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or

biometric templates.

serious credit infringement means:

an act done by an individual that involves fraudulently obtaining consumer credit, or attempting fraudulently to obtain consumer credit; or

an act done by an individual that involves fraudulently evading the individual’s obligations in relation to consumer credit, or attempting fraudulently to evade those obligations; or

an act done by an individual if:

a reasonable person would consider that the act indicates an intention, on the part of the individual, to no longer comply with the individual’s obligations in relation to consumer credit provided by a credit provider; and

the provider has, after taking such steps as are reasonable in the circumstances, been unable to contact the individual about the act; and

at least 6 months have passed since the provider last had contact with the individual.

small business has the meaning given by section 6D.

small business operator has the meaning given by section 6D.

solicits: an entity solicits personal information if the entity requests another entity to provide the personal information, or to provide a kind of information in which that personal information is included.

staff of the Ombudsman means the persons appointed or employed for the purposes of section 31 of the Ombudsman Act 1976.

State includes the Australian Capital Territory and the Northern Territory.

State contract means a contract, to which a State or Territory or State or Territory authority is or was a party, under which services are to be, or were to be, provided to a State or Territory authority.

State or Territory authority has the meaning given by section 6C.

subcontractor, for a government contract, means an organisation:

(a) that is or was a party to a contract (the subcontract):

(i) with a contracted service provider for the government contract (within the meaning of paragraph (a) of the definition of contracted service provider); or

with a subcontractor for the government contract (under a previous application of this definition); and

that is or was responsible under the subcontract for the provision of services to an agency or a State or Territory authority, or to a contracted service provider for the government contract, for the purposes (whether direct or indirect) of the government contract.

tax file number means a tax file number as defined in Part VA of the Income Tax Assessment Act 1936.

tax file number information means information, whether compiled lawfully or unlawfully, and whether recorded in a material form or not, that records the tax file number of a person in a manner connecting it with the person’s identity.

temporary APP code: see section 26GB.

temporary public interest determination means a determination made under section 80A.

trade insurance purpose of a trade insurer in relation to an individual is the purpose of assessing:

whether to provide insurance to, or the risk of providing insurance to, a credit provider in relation to commercial credit provided by the provider to the individual or another person; or

the risk of a person defaulting on commercial credit in relation to which the insurer has provided insurance to a credit provider.

trade insurer means an organisation, or small business operator, that carries on a business or undertaking that involves providing insurance to credit providers in relation to commercial credit provided by providers to other persons.

trading corporation means a trading corporation within the meaning of paragraph 51(xx) of the Constitution.

a prescribed office; or

(b) an office prescribed by regulations made for the purposes of subparagraph 4(3)(b)(i) of the Freedom of Information Act 1982; or

an office established by or under a Commonwealth law, or a law of a State or Territory that applies in an external Territory, for the purposes of an agency;

a judicial office or of an office of magistrate; or

an office of a member of a tribunal:

that is established by or under a Commonwealth law, or a law of a State or Territory that applies in an external Territory; and

that is prescribed by the regulations for the purposes of this subparagraph.

being both a file number complaint and an APP complaint; or

being both a file number complaint and a credit reporting complaint; or

being both a file number complaint and a code complaint; or

being both a code complaint and a credit reporting complaint; or

being both an APP complaint and a credit reporting complaint; or

being both an APP complaint and a code complaint.

a de facto partner of the individual;

(b) someone who is the child of the person, or of whom the person is the child, because of the definition of child in subsection (11);

anyone else who would be a member of the individual’s family if someone mentioned in paragraph (a) or (b) is taken to be a member of the individual’s family.

a parent of the individual; or

a child or sibling of the individual if the child or sibling is at least 18 years old; or

a spouse or de facto partner of the individual; or

a relative of the individual if the relative is:

at least 18 years old; and

a member of the individual’s household; or

a guardian of the individual; or

a person exercising an enduring power of attorney granted by the individual that is exercisable in relation to decisions about the individual’s health; or

a person who has an intimate personal relationship with the individual; or

a person nominated by the individual to be contacted in case of emergency.

an adopted child, stepchild, exnuptial child or foster child of the individual;

(b) someone who is a child of the individual within the meaning of the Family Law Act 1975.

parent: without limiting who is a parent of an individual for the purposes of subsection (1), someone is a parent of an individual if the individual is his or her child because of the definition of child in this subsection.

relative of an individual (the first individual) means a grandparent, grandchild, uncle, aunt, nephew or niece of the first individual and for this purpose, relationships to the first individual may also be traced to or through another individual who is: a de facto partner of the first individual; or (b) the child of the first individual because of the definition of child in this subsection. sibling of an individual includes: a half-brother, half-sister, adoptive brother, adoptive sister, step-brother, step-sister, foster-brother and foster-sister of the individual; and another individual if a relationship referred to in paragraph (a) can be traced through a parent of either or both of the individuals. stepchild: without limiting who is a stepchild of an individual, someone is a stepchild of an individual if he or she would be the individual’s stepchild except that the individual is not legally married to the individual’s de facto partner.

a de facto partner of the first individual; or

(b) the child of the first individual because of the definition of child in this subsection.

sibling of an individual includes:

a half-brother, half-sister, adoptive brother, adoptive sister, step-brother, step-sister, foster-brother and foster-sister of the individual; and

another individual if a relationship referred to in paragraph (a) can be traced through a parent of either or both of the individuals.

stepchild: without limiting who is a stepchild of an individual, someone is a stepchild of an individual if he or she would be the individual’s stepchild except that the individual is not legally married to the individual’s de facto partner.

the act is done, or the practice is engaged in:

by an organisation that is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract); and

for the purposes of meeting (directly or indirectly) an obligation under the contract; and

the act or practice is authorised by a provision of the contract that is inconsistent with the principle.

No breach—disclosure to the National Archives of Australia

the act is done, or the practice is engaged in, outside Australia and the external Territories; and

the act or practice is required by an applicable law of a foreign country.

Effect despite subsection (1)

the act is done, or the practice is engaged in:

by an organisation that is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract); and

for the purposes of meeting (directly or indirectly) an obligation under the contract; and

the act or practice is authorised by a provision of the contract that is inconsistent with the code.

No breach—disclosure to the National Archives of Australia

the act is done, or the practice is engaged in, outside Australia and the external Territories; and

the act or practice is required by an applicable law of a foreign country.

Effect despite subsection (1)

an individual; or

a body corporate; or

a partnership; or

any other unincorporated association; or

a trust;

that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State or Territory.

Legal person treated as different organisations in different capacities

a State or Territory Minister; or

a Department of State of a State or Territory; or

a body (whether incorporated or not), or a tribunal, established or appointed for a public purpose by or under a law of a State or Territory, other than:

an incorporated company, society or association; or

an association of employers or employees that is registered or recognised under a law of a State or Territory dealing with the resolution of industrial disputes; or

a body established or appointed, otherwise than by or under a law of a State or Territory, by:

a Governor of a State; or

the Australian Capital Territory Executive; or

the Administrator of the Northern Territory; or

a State or Territory Minister; or

a person holding or performing the duties of an office established by or under, or an appointment made under, a law of a State or Territory, other than the office of head of a State or Territory Department (however described); or

a person holding or performing the duties of an appointment made, otherwise than under a law of a State or Territory, by:

a Governor of a State; or

the Australian Capital Territory Executive; or

the Administrator of the Northern Territory; or

a State or Territory Minister; or

a State or Territory court.

Making regulations to stop instrumentalities being organisations

be satisfied that the State or Territory has requested that the instrumentality be prescribed for those purposes; and

consider:

whether treating the instrumentality as an organisation for the purposes of this Act adversely affects the government of the State or Territory; and

the desirability of regulating under this Act the collection, holding, use, correction and disclosure of personal information by the instrumentality; and

whether the law of the State or Territory regulates the collection, holding, use, correction and disclosure of personal information by the instrumentality to a standard that is at least equivalent to the standard that would otherwise apply to the instrumentality under this Act; and

consult the Commissioner about the matters mentioned in subparagraphs (b)(ii) and (iii).

State does not include Territory

carries on one or more small businesses; and

does not carry on a business that is not a small business.

Entities that are not small business operators

carries on a business that has had an annual turnover of more than $3,000,000 for a financial year that has ended after the later of the following:

the time he, she or it started to carry on the business;

the commencement of this section; or

provides a health service to another individual and holds any health information except in an employee record; or

discloses personal information about another individual to anyone else for a benefit, service or advantage; or

provides a benefit, service or advantage to collect personal information about another individual from anyone else; or

is a contracted service provider for a Commonwealth contract (whether or not a party to the contract); or

is a credit reporting body.

Private affairs of small business operators who are individuals

otherwise than in the course of a business he or she carries on; and

only for the purposes of, or in connection with, his or her personal, family or household affairs.

Non-business affairs of other small business operators

with the consent of the other individual; or

as required or authorised by or under legislation.

Collection with consent or under legislation

collects personal information about another individual from someone else:

with the consent of the other individual; or

as required or authorised by or under legislation; and

provides a benefit, service or advantage to be allowed to collect the information.

Related bodies corporate

the proceeds of sales of goods and/or services;

commission income;

repair and service income;

rent, leasing and hiring income;

government bounties and subsidies;

interest, royalties and dividends;

other operating income.

(a) the Anti-Money Laundering and Counter-Terrorism Financing Act 2006; or

regulations or AML/CTF Rules under that Act;

as if the small business operator were an organisation.

Small business operator that is a protected action ballot agent under the Fair Work Act 2009

is personal information; but

is not CDR data (within the meaning of that Act);

as if the small business operator were an organisation.

Regulations treating a small business operator as an organisation

be satisfied that it is desirable in the public interest to regulate under this Act the small business operator, act or practice; and

consult the Commissioner about the desirability of regulating under this Act the matters described in paragraph (a).

the name or names under which the operator carries on business; and

(b) the operator’s ABN, if the operator has one under the A New Tax System (Australian Business Number) Act 1999.

be satisfied that the relevant State or Territory has requested that the authority or instrumentality be prescribed for those purposes; and

consult the Commissioner about the desirability of regulating under this Act the collection, holding, use, correction and disclosure of personal information by the authority or instrumentality.

to assess, maintain or improve the individual’s health; or

where the individual’s health cannot be maintained or improved—to manage the individual’s health; or

to diagnose the individual’s illness, disability or injury; or

to treat the individual’s illness, disability or injury or suspected illness, disability or injury; or

to record the individual’s health for the purposes of assessing, maintaining, improving or managing the individual’s health.

a reference in this section to an individual’s health includes the individual’s physical or psychological health; and

(b) an activity mentioned in subsection (1) or (2) that takes place in the course of providing aged care, palliative care or care for a person with a disability is a health service.

a bank;

an organisation or small business operator if:

the organisation or operator carries on a business or undertaking; and

a substantial part of the business or undertaking is the provision of credit;

an organisation or small business operator:

that carries on a retail business; and

that, in the course of the business, issues credit cards to individuals in connection with the sale of goods, or the supply of services, by the organisation or operator (as the case may be);

an agency, organisation or small business operator:

that carries on a business or undertaking that involves providing credit; and

that is prescribed by the regulations.

Other credit providers

(a) an organisation or small business operator (the supplier) carries on a business or undertaking in the course of which the supplier provides credit in connection with the sale of goods, or the supply of services, by the supplier; and

the repayment, in full or in part, of the amount of credit is deferred for at least 7 days; and

the supplier is not a credit provider under subsection (1);

then the supplier is a credit provider but only in relation to the credit.

(a) an organisation or small business operator (the lessor) carries on a business or undertaking in the course of which the lessor provides credit in connection with the hiring, leasing or renting of goods; and

the credit is in force for at least 7 days; and

no amount, or an amount less than the value of the goods, is paid as a deposit for the return of the goods; and

the lessor is not a credit provider under subsection (1);

then the lessor is a credit provider but only in relation to the credit.

a real estate agent; or

(b) a general insurer (within the meaning of the Insurance Act 1973); or

an employer of an individual;

is not a credit provider while acting in that capacity.

in processing an application for credit made to the principal; or

in managing credit provided by the principal;

then, while the agent is so acting, the agent is a credit provider.

(a) an organisation or small business operator (the securitisation entity) carries on a business that is involved in either or both of the following:

a securitisation arrangement;

managing credit that is the subject of a securitisation arrangement; and

the securitisation entity performs a task that is reasonably necessary for:

purchasing, funding or managing, or processing an application for, credit by means of a securitisation arrangement; or

undertaking credit enhancement in relation to credit; and

(c) the credit has been provided by, or is credit for which an application has been made to, a credit provider (the original credit provider);

then, while the securitisation entity performs such a task, the securitisation entity is a credit provider.

(a) an organisation or small business operator (the acquirer) acquires, whether by assignment, subrogation or any other means, the rights of a credit provider (the original credit provider) in relation to the repayment of an amount of credit; and

the acquirer is not a credit provider under subsection 6G(1);

then the acquirer is a credit provider but only in relation to the credit.

the individual; or

a person:

who is assisting the individual to deal with a credit reporting body or credit provider; and

who is authorised, in writing, by the individual to make a request in relation to the information under subsection 20R(1) or 21T(1).

a credit provider; or

a mortgage insurer; or

a trade insurer; or

a person who is prevented from being a credit provider by subsection 6G(5) or (6).

payment of a debt owed by one person to another person is deferred; or

one person incurs a debt to another person and defers the payment of the debt.

a hire-purchase agreement; and

a contract, arrangement or understanding of a kind referred to in that subsection that is for the hire, lease or rental of goods, or for the supply of services, other than a contract, arrangement or understanding under which:

full payment is made before, or at the same time as, the goods or services are provided; and

in the case of goods—an amount greater than, or equal to, the value of the goods is paid as a deposit for the return of the goods.

provided for profit or reward; or

provided, or intended to be provided, for the purposes of assessing an application for consumer credit.

the individual is at least 60 days overdue in making the payment; and

the provider has given a written notice to the individual informing the individual of the overdue payment and requesting that the individual pay the amount of the overdue payment; and

the provider is not prevented by a statute of limitations from recovering the amount of the overdue payment; and

the amount of the overdue payment is equal to or more than:

$150; or

such higher amount as is prescribed by the regulations.

Guarantor defaults

the provider has given the individual written notice of the borrower’s default that gave rise to the individual’s obligation to make the overdue payment; and

the notice requests that the individual pay the amount of the overdue payment; and

at least 60 days have passed since the day on which the notice was given; and

in addition to giving the notice, the provider has taken other steps to recover the amount of the overdue payment from the individual; and

the provider is not prevented by a statute of limitations from recovering the amount of the overdue payment.

a credit provider provides consumer credit to an individual; and

the National Credit Code applies to the provision of the credit; and

the individual is or will be unable to meet the individual’s obligations in relation to the consumer credit; and

as a result of the inability, an arrangement covered by subsection (3) affecting the monthly payment obligations of the individual is made between the credit provider and the individual which is either:

a permanent variation to the terms of the consumer credit; or

a temporary relief from or deferral of the individual’s obligations in relation to the consumer credit;

then the arrangement is a financial hardship arrangement.

defer or reduce required monthly payments for a temporary period; or

accept interest-only payments for a temporary period; or

extend the term of a loan to reduce monthly payments.

Financial hardship information

for an arrangement referred to in subparagraph (1)(d)(i) (about permanent variations)—information, relating only to the first monthly payment affected by the arrangement, that indicates that the monthly payment is the first monthly payment affected by a financial hardship arrangement of that kind;

for an arrangement referred to in subparagraph (1)(d)(ii) (about temporary relief or deferral of obligations)—information, relating to each monthly payment affected by the arrangement, that indicates that the monthly payment was affected by a financial hardship arrangement of that kind.

the individual met the obligation to make the monthly payment, as affected by the arrangement; and

the amount paid was equal to, or greater than, the amount the individual would have been obliged to pay apart from the arrangement.

in connection with an application for consumer credit made by the individual to the provider; or

in connection with an application for commercial credit made by a person to the provider; or

for a credit guarantee purpose of the provider in relation to the individual; or

for a securitisation related purpose of the provider in relation to the individual.

Mortgage insurer

the insurer has sought information about the individual from a credit reporting body; and

the information was sought in connection with the provision of insurance to a credit provider in relation to mortgage credit provided by the provider to:

the individual; or

a person for whom the individual is, or is proposing to be, a guarantor.

Trade insurer

the insurer has sought information about the individual from a credit reporting body; and

the information was sought in connection with the provision of insurance to a credit provider in relation to commercial credit provided by the provider to the individual or another person.

a credit provider has disclosed default information about an individual to a credit reporting body; and

(b) the default information relates to a payment that the individual is overdue in making in relation to consumer credit (the original consumer credit) that has been provided by the provider to the individual; and

because of the individual being so overdue:

the terms or conditions of the original consumer credit that relate to the repayment of the amount of credit are varied; or

(ii) the individual is provided with other consumer credit (the new consumer credit) by a credit provider that relates, wholly or in part, to that amount of credit;

then new arrangement information about the individual is a statement that those terms or conditions of the original consumer credit have been varied, or that the individual has been provided with the new consumer credit.

Serious credit infringements

(a) a credit provider is of the opinion that an individual has committed a serious credit infringement in relation to consumer credit (the original consumer credit) provided by the provider to the individual; and

the provider has disclosed the opinion to a credit reporting body; and

because of the provider having that opinion:

the terms or conditions of the original consumer credit that relate to the repayment of the amount of credit are varied; or

(ii) the individual is provided with other consumer credit (the new consumer credit) by a credit provider that relates, wholly or in part, to that amount of credit;

then new arrangement information about the individual is a statement that those terms or conditions of the original consumer credit have been varied, or that the individual has been provided with the new consumer credit.

that is entered or recorded in the National Personal Insolvency Index; and

that relates to:

a bankruptcy of the individual; or

a debt agreement proposal given by the individual; or

a debt agreement made by the individual; or

a personal insolvency agreement executed by the individual; or

a direction given, or an order made, under section 50 of the Bankruptcy Act that relates to the property of the individual; or

an authority signed under section 188 of that Act that relates to the property of the individual.

the presentation of a creditor’s petition against the individual; or

an administration under Part XI of the Bankruptcy Act of the individual’s estate.

whether or not the individual has met an obligation to make a monthly payment that is due and payable in relation to the consumer credit;

the day on which the monthly payment is due and payable;

if the individual makes the monthly payment after the day on which the payment is due and payable—the day on which the individual makes that payment.

a monthly payment is taken to have been due and payable on the day on which it would have been due and payable apart from the arrangement; and

the individual is taken to have met the obligation to make the monthly payment; and

the obligation to make the monthly payment is taken to be affected by the arrangement.

whether or not an individual has met an obligation to make a monthly payment that is due and payable in relation to consumer credit; and

whether or not a payment is a monthly payment.

an act done, or a practice engaged in, as the case may be, by an agency (other than an eligible hearing service provider), a file number recipient, a credit reporting body or a credit provider other than:

(i) an agency specified in any of the following provisions of the Freedom of Information Act 1982:

(A) Schedule 1;

(B) Division 1 of Part I of Schedule 2;

(C) Division 1 of Part II of Schedule 2; or

a federal court; or

a court of Norfolk Island; or

a Minister; or

the National Anti-Corruption Commissioner; or

the Inspector of the National Anti-Corruption Commission; or

the ACC; or

a Royal Commission; or

a Commission of inquiry; or

(b) an act done, or a practice engaged in, as the case may be, by a federal court or by an agency specified in Schedule 1 to the Freedom of Information Act 1982, being an act done, or a practice engaged in, in respect of a matter of an administrative nature; or

an act done, or a practice engaged in, as the case may be, by a court of Norfolk Island, being an act done, or a practice engaged in, in respect of a matter of an administrative nature; or

(c) an act done, or a practice engaged in, as the case may be, by an agency specified in Freedom of Information Act 1982, other than an act done, or a practice engaged in, in relation to a record in relation to which the agency is exempt from the operation of that Act; orDivision 1 of Part II of Schedule 2 to the

(ca) an act done, or a practice engaged in, as the case may be, by a part of the Defence Department specified in Freedom of Information Act 1982, other than an act done, or a practice engaged in, in relation to the activities of that part of the Department; orDivision 2 of Part I of Schedule 2 to the

(cc) an act done, or a practice engaged in, as the case may be, by an eligible hearing service provider in connection with the provision of hearing services under an agreement made under Part 3 of the Hearing Services Administration Act 1997; or

an act done, or a practice engaged in, as the case may be, by a Minister in relation to the affairs of an agency (other than an eligible hearing service provider), not being an act done, or a practice engaged in, in relation to an existing record; or

an act done, or a practice engaged in, as the case may be, by a Minister in relation to a record that is in the Minister’s possession in his or her capacity as a Minister and relates to the affairs of an agency (other than an eligible hearing service provider); or

(ec) an act done, or a practice engaged in, as the case may be, by a Minister in relation to the affairs of an eligible hearing service provider, being affairs in connection with the provision of hearing services under an agreement made under Part 3 of the Hearing Services Administration Act 1997; or

(ed) an act done, or a practice engaged in, as the case may be, by a Minister in relation to a record that is in the Minister’s possession in his or her capacity as a Minister and relates to the affairs of an eligible hearing service provider, being affairs in connection with the provision of hearing services under an agreement made under Part 3 of the Hearing Services Administration Act 1997; or

an act done, or a practice engaged in, by an organisation, other than an exempt act or exempt practice (see sections 7B and 7C);

but does not include a reference to an act done, or a practice engaged in, in relation to a record that has originated with, or has been received from:

an intelligence agency;

the Defence Intelligence Organisation or the Australian Geospatial-Intelligence Organisation; or

(ga) the National Anti-Corruption Commissioner or another staff member of the NACC (within the meaning of the National Anti-Corruption Commission Act 2022); or

(gb) the Inspector of the National Anti-Corruption Commission or a person assisting the Inspector (within the meaning of the National Anti-Corruption Commission Act 2022); or

the ACC or the Board of the ACC.

the Australian Security Intelligence Organisation; or

the Australian Secret Intelligence Service; or

the Australian Signals Directorate.

an intelligence agency;

the Defence Intelligence Organisation or the Australian Geospatial-Intelligence Organisation; or

the ACC or the Board of the ACC.

doing an act in accordance with a practice; or

refusing or failing to do an act.

the act or practice were an act done, or practice engaged in, by an organisation; and

the agency mentioned in that subsection were the organisation.

(a) are done or engaged in by an agency specified in Freedom of Information Act 1982 in relation to documents in respect of its commercial activities or the commercial activities of another entity; andDivision 1 of Part II of Schedule 2 to the

relate to those commercial activities.

the organisation is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract); and

the organisation would be a small business operator if it were not a contracted service provider for a Commonwealth contract; and

the act is done, or the practice is engaged in, otherwise than for the purposes of meeting (directly or indirectly) an obligation under a Commonwealth contract for which the organisation is the contracted service provider.

Employee records

a current or former employment relationship between the employer and the individual; and

an employee record held by the organisation and relating to the individual.

Journalism

by the organisation in the course of journalism; and

at a time when the organisation is publicly committed to observe standards that:

deal with privacy in the context of the activities of a media organisation (whether or not the standards also deal with other matters); and

have been published in writing by the organisation or a person or body representing a class of media organisations.

Organisation acting under State contract

the organisation is a contracted service provider for a State contract (whether or not the organisation is a party to the contract); and

the act is done, or the practice is engaged in for the purposes of meeting (directly or indirectly) an obligation under the contract.

an election under an electoral law; or

a referendum under a law of the Commonwealth or a law of a State or Territory; or

the participation by the political representative in another aspect of the political process.

Contractors for political representatives etc.

for the purposes of meeting an obligation under a contract between the contractor and a registered political party or a political representative described in subsection (1); and

for any purpose in connection with one or more of the following:

an election under an electoral law;

a referendum under a law of the Commonwealth or a law of a State or Territory;

the participation in another aspect of the political process by the registered political party or political representative;

facilitating acts or practices of the registered political party or political representative for a purpose mentioned in subparagraph (i), (ii) or (iii) of this paragraph.

Subcontractors for organisations covered by subsection (1) etc.

for the purposes of meeting an obligation under a contract between the subcontractor and a contractor described in subsection (2); and

for a purpose described in paragraph (2)(b).

Volunteers for registered political parties

an election under an electoral law;

a referendum under a law of the Commonwealth or a law of a State or Territory;

the participation in another aspect of the political process by the registered political party;

facilitating acts or practices of the registered political party for a purpose mentioned in paragraph (a), (b) or (c).

Effect of subsection (4) on other operation of Act

the Parliament of the Commonwealth; or

a State Parliament; or

the legislature of a Territory.

an act done or practice engaged in by, or information disclosed to, a person employed by, or in the service of, an agency, organisation, file number recipient, credit reporting body or credit provider in the performance of the duties of the person’s employment shall be treated as having been done or engaged in by, or disclosed to, the agency, organisation, recipient, credit reporting body or credit provider;

an act done or practice engaged in by, or information disclosed to, a person on behalf of, or for the purposes of the activities of, an unincorporated body, being a board, council, committee, sub-committee or other body established by or under a Commonwealth law, or a law of a State or Territory that applies in an external Territory, for the purpose of assisting, or performing functions in connection with, an agency or organisation, shall be treated as having been done or engaged in by, or disclosed to, the agency or organisation; and

an act done or practice engaged in by, or information disclosed to, a member, staff member or special member of the Australian Federal Police in the performance of his or her duties as such a member, staff member or special member shall be treated as having been done or engaged in by, or disclosed to, the Australian Federal Police.

an act done or a practice engaged in by a person, in relation to a record, is to be treated, under subsection (1), as having been done or engaged in by an agency; and

that agency does not hold that record;

that act or practice shall be treated as the act or the practice of the agency that holds that record.

an act done or practice engaged in by a partner is taken to have been done or engaged in by the organisation; and

a communication (including a complaint, notice, request or disclosure of information) made to a partner is taken to have been made to the organisation.

an act done or practice engaged in by a member of the committee of management of the association is taken to have been done or engaged in by the organisation; and

a communication (including a complaint, notice, request or disclosure of information) made to a member of the committee of management of the association is taken to have been made to the organisation.

an act done or practice engaged in by a trustee is taken to have been done or engaged in by the organisation; and

a communication (including a complaint, notice or request or disclosure of information) made to a trustee is taken to have been made to the organisation.

(a) a record of personal information (not being a record relating to the administration of the National Archives of Australia) is in the care (within the meaning of the Archives Act 1983) of the National Archives of Australia; or

a record of personal information (not being a record relating to the administration of the Australian War Memorial) is in the custody of the Australian War Memorial;

the agency by or on behalf of which the record was placed in that care or custody or, if that agency no longer exists, the agency to whose functions the contents of the record are most closely related, shall be regarded, for the purposes of this Act, to be the agency that holds that record.

in the course of the person’s employment in the service of or by a person or body other than an agency;

in the course of the person’s employment in the service of or by an agency other than the Australian Federal Police; or

as a member, staff member or special member of the Australian Federal Police in the performance of his or her duties as such a member, staff member or special member;

then, for the purposes of this Act, the file number recipient in relation to that record shall be taken to be:

if paragraph (a) applies—the person’s employer;

if paragraph (b) applies—the agency first referred to in that paragraph; and

if paragraph (c) applies—the Australian Federal Police.

an agency;

an organisation;

a small business operator;

a body politic.

the International Covenant on Civil and Political Rights done at New York on 16 December 1966 ([1980] ATS 23), and in particular Articles 17 and 24(1) of the Covenant;

Article 16 of the Convention on the Rights of the Child done at New York on 20 November 1989 ([1991] ATS 4).

between Australia and places outside Australia; or

among the States; or

within a Territory, between a State and a Territory or between 2 Territories.

banking (other than State banking not extending beyond the limits of the State concerned); or

insurance (other than State insurance not extending beyond the limits of the State concerned).

the act or practice breaches an Australian Privacy Principle in relation to personal information about the individual; or

the act or practice breaches a registered APP code that binds the entity in relation to personal information about the individual.

Credit reporting

the act or practice breaches a provision of Part IIIA in relation to personal information about the individual; or

the act or practice breaches the registered CR code in relation to personal information about the individual and the code binds the entity.

Contracted service providers

the act or practice relates to personal information about the individual; and

the organisation is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract); and

the act or practice does not breach:

an Australian Privacy Principle; or

a registered APP code that binds the organisation;

in relation to the personal information because of a provision of the contract that is inconsistent with the principle or code; and

the act is done, or the practice is engaged in, in a manner contrary to, or inconsistent with, that provision.

Tax file numbers

it is an act or practice of a file number recipient and the act or practice breaches a rule issued under section 17 in relation to tax file number information that relates to the individual; or

the act or practice involves an unauthorised requirement or request for disclosure of the tax file number of the individual.

Notification of eligible data breaches etc.

(a) constitutes a breach of Part 2 of the Data-matching Program (Assistance and Tax) Act 1990 or the rules issued under section 12 of that Act; or

(b) constitutes a breach of the rules issued under National Health Act 1953.section 135AA of the

the collection of personal information (other than sensitive information) about the individual by the body corporate from a related body corporate;

the disclosure of personal information (other than sensitive information) about the individual by the body corporate to a related body corporate.

a body corporate uses personal information it has collected from a related body corporate; and

the use breaches Australian Privacy Principle 6 (noting that the collecting body’s primary purpose of collection will be taken to be the same as that of the related body).

a related body corporate that is not an organisation; or

a related body corporate whose disclosure of the information to the body corporate is an exempt act or exempt practice for the purposes of paragraph 7(1)(ee); or

a related body corporate whose disclosure of the information to the body corporate is not an interference with privacy because of section 13D.

Relationship with subsection 13(3)

(a) an organisation (the new partnership) that is a partnership forms at the same time as, or immediately after, the dissolution of another partnership (the old partnership); and

at least one person who was a partner in the old partnership is a partner in the new partnership; and

the new partnership carries on a business that is the same as, or similar to, a business carried on by the old partnership; and

the new partnership holds, immediately after its formation, personal information about an individual that the old partnership held immediately before its dissolution;

neither the disclosure (if any) by the old partnership, nor the collection (if any) by the new partnership, of the information that was necessary for the new partnership to hold the information immediately after its formation constitutes an interference with the privacy of the individual.

Effect of subsection (1)

the entity does an act, or engages in a practice, that is an interference with the privacy of an individual; and

the interference with privacy is serious.

the particular kind or kinds of information involved in the interference with privacy;

the sensitivity of the personal information of the individual;

the consequences, or potential consequences, of the interference with privacy for the individual;

the number of individuals affected by the interference with privacy;

whether the individual affected by the interference with privacy is a child or person experiencing vulnerability;

whether the act was done, or the practice engaged in, repeatedly or continuously;

whether the contravening entity failed to take steps to implement practices, procedures and systems to comply with their obligations in relation to privacy in a way that contributed to the interference with privacy;

any other relevant matter.

Maximum pecuniary penalty

$50,000,000;

if the court can determine the value of the benefit that the body corporate, and any related body corporate, have obtained directly or indirectly and that is reasonably attributable to the conduct constituting the contravention—3 times the value of that benefit;

(c) if the court cannot determine the value of that benefit—30% of the adjusted turnover of the body corporate during the breach turnover period for the contravention.

supplies made from any of those bodies corporate to any other of those bodies corporate; or

supplies that are input taxed; or

(c) supplies that are not for consideration (and are not taxable supplies under A New Tax System (Goods and Services Tax) Act 1999); orsection 72-5 of the

supplies that are not made in connection with an enterprise that the body corporate carries on; or

supplies that are not connected with the indirect tax zone.

the period of 12 months ending at the end of the month in which the contravention ceased, or proceedings in relation to the contravention were instituted (whichever is earlier);

the period:

starting at the beginning of the month in which the contravention occurred or began occurring; and

ending at the same time as the period determined under paragraph (a).

the entity does an act, or engages in a practice; and

the act or practice breaches any of the following Australian Privacy Principles:

Australian Privacy Principle 1.3 (requirement to have APP privacy policy);

Australian Privacy Principle 1.4 (contents of APP privacy policy);

Australian Privacy Principle 2.1 (individuals may choose not to identify themselves in dealing with entities);

Australian Privacy Principle 6.5 (written notice of certain uses or disclosures);

Australian Privacy Principle 7.2(c) or 7.3(c) (simple means for individuals to opt out of direct marketing communications);

Australian Privacy Principle 7.3(d) (requirement to draw attention to ability to opt out of direct marketing communications);

Australian Privacy Principle 7.7(a) (giving effect to request in reasonable period);

Australian Privacy Principle 7.7(b) (notification of source of information);

Australian Privacy Principle 13.5 (dealing with requests);

any other Australian Privacy Principle prescribed by the regulations.

Civil penalty provision for non-compliant eligible data breach statement

the entity prepares a statement under section 26WK (eligible data breaches); and

the statement does not comply with subsection 26WK(3).

Civil penalty provisions

the entity is an entity of a kind specified in an item in column 1 of the table; and

the item in column 2 of the table applies to the information or identifier; and

such conditions as are specified in the item in column 3 of the table are satisfied.

the information is necessary to provide a health service to the individual; and

either:

the collection is required or authorised by or under an Australian law (other than this Act); or

the information is collected in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the organisation.

(a) it is necessary for the organisation to collect the family, social or medical history of an individual (the patient) to provide a health service to the patient; and

the health information about the third party is part of the family, social or medical history necessary for the organisation to provide the health service to the patient; and

the health information is collected by the organisation from the patient or, if the patient is physically or legally incapable of giving the information, a responsible person for the patient.

Collection—research etc.

the collection is necessary for any of the following purposes:

research relevant to public health or public safety;

the compilation or analysis of statistics relevant to public health or public safety;

the management, funding or monitoring of a health service; and

that purpose cannot be served by the collection of information about the individual that is de-identified information; and

it is impracticable for the organisation to obtain the individual’s consent to the collection; and

any of the following apply:

the collection is required by or under an Australian law (other than this Act);

the information is collected in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the organisation;

the information is collected in accordance with guidelines approved under section 95A for the purposes of this subparagraph.

Use or disclosure—research etc.

the use or disclosure is necessary for research, or the compilation or analysis of statistics, relevant to public health or public safety; and

it is impracticable for the organisation to obtain the individual’s consent to the use or disclosure; and

the use or disclosure is conducted in accordance with guidelines approved under section 95A for the purposes of this paragraph; and

in the case of disclosure—the organisation reasonably believes that the recipient of the information will not disclose the information, or personal information derived from that information.

Use or disclosure—genetic information

the organisation has obtained the information in the course of providing a health service to the first individual; and

the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of another individual who is a genetic relative of the first individual; and

the use or disclosure is conducted in accordance with guidelines approved under section 95AA; and

in the case of disclosure—the recipient of the information is a genetic relative of the first individual.

Disclosure—responsible person for an individual

the organisation provides a health service to the individual; and

the recipient of the information is a responsible person for the individual; and

the individual:

is physically or legally incapable of giving consent to the disclosure; or

physically cannot communicate consent to the disclosure; and

(d) another individual (the carer) providing the health service for the organisation is satisfied that either:

the disclosure is necessary to provide appropriate care or treatment of the individual; or

the disclosure is made for compassionate reasons; and

the disclosure is not contrary to any wish:

expressed by the individual before the individual became unable to give or communicate consent; and

of which the carer is aware, or of which the carer could reasonably be expected to be aware; and

the disclosure is limited to the extent reasonable and necessary for a purpose mentioned in paragraph (d).

an APP entity discloses personal information about an individual to an overseas recipient; and

Australian Privacy Principle 8.1 applies to the disclosure of the information; and

the Australian Privacy Principles do not apply, under this Act, to an act done, or a practice engaged in, by the overseas recipient in relation to the information; and

the overseas recipient does an act, or engages in a practice, in relation to the information that would be a breach of the Australian Privacy Principles (other than Australian Privacy Principle 1) if those Australian Privacy Principles so applied to that act or practice.

to have been done, or engaged in, by the APP entity; and

to be a breach of those Australian Privacy Principles by the APP entity.

credit reporting information;

CP derived information;

credit reporting information that is de-identified;

a pre-screening assessment.

credit reporting information; or

CP derived information; or

a pre-screening assessment.

Subdivision B—Consideration of information privacy

will ensure that the body complies with this Division and the registered CR code; and

will enable the body to deal with inquiries or complaints from individuals about the body’s compliance with this Division or the registered CR code.

Policy about the management of credit reporting information

the kinds of credit information that the body collects and how the body collects that information;

the kinds of credit reporting information that the body holds and how the body holds that information;

the kinds of personal information that the body usually derives from credit information that the body holds;

the purposes for which the body collects, holds, uses and discloses credit reporting information;

information about the effect of section 20G (which deals with direct marketing) and how the individual may make a request under subsection (5) of that section;

how an individual may access credit reporting information about the individual that is held by the body and seek the correction of such information;

information about the effect of section 20T (which deals with individuals requesting the correction of credit information etc.);

how an individual may complain about a failure of the body to comply with this Division or the registered CR code and how the body will deal with such a complaint.

Availability of policy etc.

free of charge; and

in such form as is appropriate.

the credit reporting body collects the credit information about the individual from a credit provider who is permitted under section 21D to disclose the information to the body; and

the body collects the information in the course of carrying on a credit reporting business; and

if the information is identification information about the individual—the body also collects from the provider, or already holds, credit information of another kind about the individual.

the credit reporting body:

collects the credit information about the individual from an entity (other than a credit provider) in the course of carrying on a credit reporting business; and

knows, or believes on reasonable grounds, that the individual is at least 18 years old; and

the information does not relate to an act, omission, matter or thing that occurred or existed before the individual turned 18; and

if the information relates to consumer credit or commercial credit—the credit is or has been provided, or applied for, in Australia; and

if the information is identification information about the individual—the body also collects from the entity, or already holds, credit information of another kind about the individual; and

if the information is repayment history information or financial hardship information about the individual—the body collects the information from another credit reporting body that has an Australian link.

a credit reporting body receives credit information about an individual; and

the body did not solicit the information;

the body must, within a reasonable period after receiving the information, determine whether or not the body could have collected the information under section 20C if the body had solicited the information.

the credit reporting body uses the information in the course of carrying on the body’s credit reporting business; or

the use is required or authorised by or under an Australian law (other than the consumer data rules) or a court/tribunal order; or

the use is a use prescribed by the regulations.

Permitted disclosures

the disclosure is a permitted CRB disclosure in relation to the individual; or

the disclosure is to another credit reporting body that has an Australian link; or

both of the following apply:

the disclosure is for the purposes of a recognised external dispute resolution scheme;

a credit reporting body or credit provider is a member of or subject to the scheme; or

both of the following apply:

the disclosure is to an enforcement body;

the credit reporting body is satisfied that the body, or another enforcement body, believes on reasonable grounds that the individual has committed a serious credit infringement; or

the disclosure is required or authorised by or under an Australian law (other than the consumer data rules) or a court/tribunal order; or

the disclosure is a disclosure prescribed by the regulations.

a credit provider who is a licensee or is prescribed by the regulations; or

a mortgage insurer.

in the case of a credit provider:

collecting payments that are overdue in relation to consumer credit provided by the provider to the individual; or

collecting payments that are overdue in relation to commercial credit provided by the provider to a person; or

assessing whether to accept the individual as a guarantor in relation to credit for which an application has been made to the provider by a person other than the individual; or

in the case of a mortgage insurer—assessing the risk of the individual defaulting on mortgage credit in relation to which the insurer has provided insurance to a credit provider.

the disclosure is to an entity that is specified in an item of the table and that has an Australian link; and

such conditions as are specified for the item are satisfied.

the credit provider referred to in that item requests the information for the purpose of assessing an application for commercial credit made by a person to the provider; and

the application has not been made in writing.

the provider has an Australian link and is a licensee; and

the direct marketing is about consumer credit that the provider provides in Australia; and

the information is not consumer credit liability information, repayment history information, or financial hardship information about the individual; and

the body uses the information to assess whether or not the individual is eligible to receive the direct marketing communications of the credit provider; and

the individual has not made a request under subsection (5); and

the body complies with any requirements that are set out in the registered CR code.

the credit reporting body discloses the pre-screening assessment for the purposes of the direct marketing by, or on behalf of, the credit provider; and

the recipient of the assessment is an entity (other than the provider) that has an Australian link.

the entity no longer needs the assessment for any purpose for which it may be used or disclosed under section 20H; and

the entity is not required by or under an Australian law, or a court/tribunal order, to retain the assessment.

a credit reporting body holds credit reporting information about an individual; and

the individual believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud); and

the individual requests the body not to use or disclose the information under this Division;

then, despite any other provision of this Division, the body must not use or disclose the information during the ban period for the information.

the individual expressly consents, in writing, to the use or disclosure of the credit reporting information under this Division; or

the use or disclosure of the credit reporting information is required by or under an Australian law or a court/tribunal order.

Ban period

starts when the individual makes a request under paragraph (1)(c); and

ends:

21 days after the day on which the request is made; or

if the period is extended under subsection (4)—on the day after the extended period ends.

there is a ban period for credit reporting information about an individual that is held by a credit reporting body; and

before the ban period ends, the individual requests the body to extend that period; and

the body believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud);

the body must:

extend the ban period by such period as the body considers is reasonable in the circumstances; and

give the individual written notification of the extension.

a credit reporting body holds credit reporting information about an individual; and

the information is a government related identifier of the individual;

the body must not adopt the government related identifier as its own identifier of the individual.

a credit reporting body holds credit reporting information; and

(b) the information (the de-identified information) is de-identified;

the body must not use or disclose the de-identified information.

the use or disclosure is for the purposes of conducting research in relation to credit; and

the credit reporting body complies with the rules made under subsection (3).

Commissioner may make rules

the kinds of de-identified information that may or may not be used or disclosed for the purposes of conducting the research;

whether or not the research is research in relation to credit;

the purposes of conducting the research;

consultation about the research;

how the research is conducted.

Subdivision E—Integrity of credit reporting information

enter into agreements with credit providers that require the providers to ensure that credit information that they disclose to the body under section 21D is accurate, up-to-date and complete; and

ensure that regular audits are conducted by an independent person to determine whether those agreements are being complied with; and

identify and deal with suspected breaches of those agreements.

the body uses or discloses credit reporting information under this Division (other than subsections 20D(2) and 20T(4)); and

the information is false or misleading in a material particular.

Civil penalty

from misuse, interference and loss; and

from unauthorised access, modification or disclosure.

enter into agreements with credit providers that require the providers to protect credit reporting information that is disclosed to them under this Division:

from misuse, interference and loss; and

from unauthorised access, modification or disclosure; and

ensure that regular audits are conducted by an independent person to determine whether those agreements are being complied with; and

identify and deal with suspected breaches of those agreements.

either:

in Australia or an external Territory; or

in accordance with any security requirements prescribed by the regulations for storing the information outside of Australia and the external Territories; and

in accordance with any security requirements prescribed by the regulations.

Subdivision F—Access to, and correction of, information

the information; and

(b) if the body is a corporation to which paragraph 51(xx) of the Constitution applies, and the credit reporting business of the body involves deriving CRB derived information about individuals in the form of a rating (a credit rating) of the individuals on a credit score scale or range—the information referred to in subsection (1A).

the credit rating of the individual, as derived by the body after the request is made; and

information that identifies the particular credit information that is held by the body and from which the credit rating was derived; and

information about the relative weighting of the credit information described in paragraph (b) in deriving the credit rating; and

information about what the other ratings on the scale or range are, and how the individual’s credit rating relates to those other ratings.

Exceptions to access

giving access would be unlawful; or

denying access is required or authorised by or under an Australian law or a court/tribunal order; or

giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or

for information referred to in subsection (1A)—the credit information about the individual that is held by the body is insufficient for the body to be able to derive the credit rating of the individual in the ordinary course of its credit reporting business within the period referred to in subsection (3).

Dealing with requests for access

sets out the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and

states that, if the access seeker is not satisfied with the response to the request, the access seeker may:

access a recognised external dispute resolution scheme of which the body is a member; or

make a complaint to the Commissioner under Part V.

a credit reporting body holds credit reporting information about an individual; and

the body is satisfied that, having regard to a purpose for which the information is held by the body, the information is inaccurate, out-of-date, incomplete, irrelevant or misleading;

the body must take such steps (if any) as are reasonable in the circumstances to correct the information to ensure that, having regard to the purpose for which it is held, the information is accurate, up-to-date, complete, relevant and not misleading.

the credit reporting body corrects credit reporting information under subsection (1); and

the body has previously disclosed the information under this Division (other than subsections 20D(2) and 20T(4));

the body must, within a reasonable period, give each recipient of the information written notice of the correction.

it is impracticable for the credit reporting body to give the notice under that subsection; or

the credit reporting body is required by or under an Australian law, or a court/tribunal order, not to give the notice under that subsection.

the personal information is:

credit information about the individual; or

CRB derived information about the individual; or

CP derived information about the individual; and

the body holds at least one kind of the personal information referred to in paragraph (a).

Correction

the period of 30 days that starts on the day on which the request is made; or

such longer period as the individual has agreed to in writing.

Consultation

another credit reporting body that holds or held the information and that has an Australian link;

a credit provider that holds or held the information and that has an Australian link;

the body must consult that interested party, or those interested parties, about the individual’s request.

give the individual written notice of the correction; and

if the body consulted an interested party under subsection 20T(3) about the individual’s request—give the party written notice of the correction; and

if the correction relates to information that the body has previously disclosed under this Division (other than subsections 20D(2) and 20T(4))—give each recipient of the information written notice of the correction.

states that the correction has not been made; and

sets out the body’s reasons for not correcting the information (including evidence substantiating the correctness of the information); and

states that, if the individual is not satisfied with the response to the request, the individual may:

access a recognised external dispute resolution scheme of which the body is a member; or

make a complaint to the Commissioner under Part V.

Exceptions

a credit reporting body holds credit information about an individual; and

the retention period for the information ends.

Destruction etc. of credit information

there is a pending correction request in relation to the information; or

there is a pending dispute in relation to the information.

if:

the CRB derived information was derived from 2 or more kinds of credit information; and

the body is required to do a thing referred to in subsection (2) to one of those kinds of credit information;

at the same time that the body does that thing to that credit information; or

otherwise—at the same time that the body is required to do a thing referred to in subsection (2) to the credit information from which the CRB derived information was derived.

there is a pending correction request in relation to the information; or

there is a pending dispute in relation to the information.