National Consumer Credit Protection Amendment (Mandatory Credit Reporting and Other Measures) Act 2021

No. 5, 2021

An Act to amend the law relating to credit reporting, and for other purposes

Contents

1 Short title 1

2 Commencement 2

3 Schedules 2

Schedule 1—Main amendments 3

National Consumer Credit Protection Act 2009 3

Privacy Act 1988 26

Schedule 2—Financial hardship and other amendments 28

Part 1—Financial hardship amendments 28

Privacy Act 1988 28

Part 2—Related amendments 34

National Consumer Credit Protection Act 2009 34

National Consumer Credit Protection (Transitional and Consequential Provisions) Act 2009 35

Part 3—Other amendments 37

Privacy Act 1988 37

An Act to amend the law relating to credit reporting, and for other purposes

[Assented to 16 February 2021]

The Parliament of Australia enacts:

1 Short title

This Act is the National Consumer Credit Protection Amendment (Mandatory Credit Reporting and Other Measures) Act 2021.

2 Commencement 1

Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Commencement information	Commencement information	Commencement information
Column 1	Column 2	Column 3
Provisions	Commencement	Date/Details
1. Sections 1 to 3 and anything in this Act not elsewhere covered by this table	The day this Act receives the Royal Assent.	16 February 2021
2. Schedule 1	The day after this Act receives the Royal Assent.	17 February 2021
3. Schedule 2, Part 1	The later of: (a) the day after this Act receives the Royal Assent; and (b) 1 July 2022.	1 July 2022 (paragraph (b) applies)
4. Schedule 2, Part 2	Immediately after the commencement of the provisions covered by table item 3.	1 July 2022
5. Schedule 2, Part 3	The day after this Act receives the Royal Assent.	17 February 2021

Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

3 Schedules

Legislation that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms.

Main amendments

National Consumer Credit Protection Act 2009

1 Subsection 5(1)

Insert:

banking group means a relevant group of bodies corporate (within the meaning of the Banking Act 1959) that includes a body corporate covered by paragraph 133CN(1)(a) (about large ADIs).

credit information has the same meaning as in the Privacy Act 1988.

2 Subsection 5(1) (definition of credit provider)

Repeal the definition, substitute:

credit provider:

(a) when used in Privacy Act 1988; andPart 3-2CA—has the same meaning as in the

otherwise—has the same meaning as in section 204 of the National Credit Code, and includes a person who is a credit provider because of section 10 of this Act.

3 Subsection 5(1)

Insert:

credit reporting body has the same meaning as in the Privacy Act 1988.

declaration of contravention means a declaration made under section 166.

eligible credit account: see section 133CO.

eligible credit reporting body: see subsection 133CN(2).

eligible licensee: see subsection 133CN(1).

evidential burden, in relation to a matter, means the burden of adducing or pointing to evidence that suggests a reasonable possibility that the matter exists or does not exist.

head company, of a banking group, means the member of the group covered by paragraph 133CN(1)(a) (about large ADIs).

large ADI has the same meaning as in the Banking Act 1959.

mandatory credit information: see section 133CP.

Part 3-2CA body: see section 133CZF.

personal information has the same meaning as in the Privacy Act 1988.

sensitive information has the same meaning as in the Privacy Act 1988.

supply requirements: see section 133CQ.

4 After Part 3-2C

Insert:

133CM Guide to this Part

This Part has rules that apply to licensees that are large ADIs or are of a prescribed kind.

Each licensee must supply certain information to eligible credit reporting bodies about all of the open credit accounts held with the licensee or with other members of the licensee’s corporate group.

Each licensee must then supply updated information to those credit reporting bodies on an ongoing basis.

Conditions may need to be met before the credit reporting bodies who are supplied with this information can further disclose this information to credit providers.

This Part applies in addition to the Privacy Act 1988.

133CN Meanings of eligible licensee and eligible credit reporting body 1

(1) A licensee is an eligible licensee, on 1 July 2021 or a later day, if on that day the licensee:

is a large ADI, or is a body corporate of a kind prescribed by the regulations; and

is a credit provider.

(2) A credit reporting body is an eligible credit reporting body for a licensee if:

the following conditions are met:

(i) an agreement of the kind referred to in paragraph 20Q(2)(a) of the Privacy Act 1988 between the body and the licensee was in force on 2 November 2017;

the licensee is an eligible licensee on 1 July 2021; or

the conditions (if any) prescribed by the regulations are met.

133CO Meaning of eligible credit account 1

(1) An eligible credit account is an account that:

(a) relates to the provision, or possible provision, of consumer credit (within the meaning of the Privacy Act 1988); and

is held by one or more natural persons with a credit provider; and

is not of a kind determined under subsection (2).

ASIC may, by legislative instrument, determine one or more kinds of account for the purposes of paragraph (1)(c).

133CP Meaning of mandatory credit information 1

(1) Mandatory credit information, for eligible credit accounts held by natural persons with a credit provider, is personal information (other than sensitive information) for those accounts that is:

(a) identification information (within the meaning of the Privacy Act 1988) about the natural persons; or

(b) consumer credit liability information (within the meaning of the Privacy Act 1988) about the natural persons; or

(e) default information (within the meaning of the Privacy Act 1988) about the natural persons; or

(f) payment information (within the meaning of the Privacy Act 1988) about the natural persons; or

(g) new arrangement information (within the meaning of the Privacy Act 1988) about the natural persons.

(2) Despite paragraph (1)(c), mandatory credit information does not include repayment history information (within the meaning of the Privacy Act 1988) that comes into existence more than 3 months before the first 1 July on which:

if the credit provider is a member of a banking group—the head company of the group is an eligible licensee; or

otherwise—the credit provider is an eligible licensee.

(4) Despite paragraph (1)(e), mandatory credit information does not include default information (within the meaning of the Privacy Act 1988) that comes into existence before the first 1 July on which:

if the credit provider is a member of a banking group—the head company of the group is an eligible licensee; or

otherwise—the credit provider is an eligible licensee.

133CQ Meaning of supply requirements 1

(1) Information is supplied in accordance with the supply requirements if the supply is in accordance with:

(a) the registered CR code (within the meaning of the Privacy Act 1988); and

any determination under subsection (2); and

any technical standards approved under subsection (4).

For one or more kinds of information to be supplied under this Part, ASIC may, by legislative instrument, determine particulars of the information that must be included in the supply.

(3) Despite subsection 14(2) of the Legislation Act 2003, a determination under subsection (2) may make provision in relation to a matter by applying, adopting or incorporating, with or without modification, any matter contained in any other instrument or writing as in force or existing from time to time.

ASIC may, in writing, approve technical standards for supplying one or more kinds of information under this Part.

If there is an inconsistency between:

(a) the registered CR code (within the meaning of the Privacy Act 1988); and

a determination under subsection (2) or a technical standard approved under subsection (4);

the registered CR code prevails to the extent of the inconsistency.

Subdivision A—Initial bulk supplies of credit information

133CR Requirement to supply

First bulk supply for at least 50% of total eligible credit accounts

Civil penalty: 5,000 penalty units.

The licensee may choose which eligible credit accounts make up this 50%.

Bulk supply for remaining eligible credit accounts

Civil penalty: 5,000 penalty units.

for which mandatory credit information was not supplied under subsection (1) to the CRB.

Possible extension of time if credit reporting body later complies with information security requirements before end of 90-day period

Requirements apply whether the information is kept in or outside this jurisdiction

(1) An eligible licensee must supply mandatory credit information for the accounts referred to in subsection (2) to each eligible credit reporting body (CRB) for the licensee:

before the end of the later of the following periods:

the 90-day period starting on the first 1 July on which the licensee is an eligible licensee;

if subsection (5) applies—the 14-day period starting on the cessation day referred to in that subsection; and

in accordance with the supply requirements; and

For the purposes of subsection (1), the accounts are at least 50% of all of the eligible credit accounts held:

on the first 1 July on which the licensee is an eligible licensee; and

with the licensee, or with a member of a banking group of which the licensee is the head company.

(3) An eligible licensee must supply mandatory credit information for the accounts referred to in subsection (4) to each eligible credit reporting body (CRB) for the licensee:

before the end of the latest of the following periods:

the 90-day period starting on the second 1 July on which the licensee is an eligible licensee;

if subsection (5) applies—the 14-day period starting on the cessation day referred to in that subsection;

iii

if, because paragraph 133CS(1)(b) is no longer satisfied, subsection 133CS(1) ceases to provide the licensee with an exception to this subsection for the CRB—the 14-day period starting on the day that exception ceases to apply; and

in accordance with the supply requirements; and

For the purposes of subsection (3), the accounts are all of the eligible credit accounts held:

on the second 1 July on which the licensee is an eligible licensee; and

with the licensee, or with a member of a banking group of which the licensee is the head company;

For the purposes of subsection (1) or (3), this subsection applies if:

(a) the licensee reasonably believes that the CRB is not complying with Privacy Act 1988 on the 1 July referred to in that subsection; andsection 20Q of the

the licensee complies with paragraphs 133CS(2)(a) and (b) in relation to that belief; and

(c) the licensee ceases to hold that belief on a day (the cessation day) before the end of the 90-day period starting on that 1 July.

Subsection (1) or (3) applies whether the mandatory credit information is kept in or outside this jurisdiction.

133CS Exception if credit reporting body not complying with information security requirements 1

Subsection 133CR(1) or (3) does not apply, and is taken never to have applied, to a licensee for a credit reporting body if:

(a) the licensee reasonably believes that the body is not complying with Privacy Act 1988:section 20Q of the

on the 1 July referred to in that subsection; and

on the last day of the 90-day period starting on that 1 July; and

in the case of subsection 133CR(3)—the licensee continues to hold that belief after that 90-day period; and

the licensee satisfies subsection (2) of this section.

Note 1: Paragraph (b) means that, if the licensee ceases to hold that belief after the 90-day period starting on the 1 July in subsection 133CR(3), this exception will cease to apply and the supply requirement in subsection 133CR(3) will apply.

Note 2: A person who wishes to rely on this subsection bears an evidential burden in relation to the matters in this subsection (see subsection (3) of this section and subsection 13.3(3) of the Criminal Code).

The licensee satisfies this subsection if:

the licensee prepares a written notice:

(i) stating that the licensee reasonably believes that the credit reporting body is not complying with Privacy Act 1988 on that 1 July; andsection 20Q of the

setting out the licensee’s reasons for that belief; and

iii

stating that the body may try to convince the licensee otherwise, but that in the case of subsection 133CR(1) the body will need to do so before the end of the 90-day period starting on that 1 July; and

the licensee gives that notice to the body, and a copy to the Information Commissioner and ASIC, within 7 days after that 1 July; and

(i) stating that the licensee reasonably believes that the body is not complying with Privacy Act 1988 on the last day of that 90-day period; andsection 20Q of the

setting out the licensee’s reasons for that belief; and

the licensee gives the final notice to the body, and a copy to the Information Commissioner and ASIC, within 7 days after the last day of that 90-day period.

A licensee who wishes to rely on subsection (1) in proceedings for a declaration of contravention or a pecuniary penalty order bears an evidential burden in relation to the matters in that subsection.

133CT Licensee must give notice if credit reporting body later complies with information security requirements

If:

the licensee must:

Civil penalty: 5,000 penalty units.

Subdivision B—Ongoing supplies of credit information

(a) an eligible licensee reasonably believes that an eligible credit reporting body for the licensee is not complying with Privacy Act 1988 on the first or second 1 July on which the licensee is an eligible licensee; andsection 20Q of the

the licensee complies with paragraphs 133CS(2)(a) and (b) in relation to that belief; and

the licensee ceases to hold that belief:

in the case of subsection 133CR(1)—on a day during the 90-day period starting on that first 1 July; or

in the case of subsection 133CR(3)—on any day after that second 1 July;

prepare a written notice:

stating that the licensee has ceased to hold that belief; and

setting out the licensee’s reasons for ceasing to hold that belief; and

give that notice to the body, and a copy to the Information Commissioner and ASIC, within 7 days after the day the licensee ceases to hold that belief.

133CU Requirement to supply 1

If:

(a) a licensee has supplied a credit reporting body (the CRB) with mandatory credit information under this Division; and

(b) on a later day (the trigger day):

the conditions (if any) prescribed by the regulations are not met for the licensee and the CRB; and

the licensee, or a member of a banking group of which the licensee is the head company, would reasonably be expected to have become aware that an event in an item of the following table has happened; and

iii

the licensee is still an eligible licensee; and

(iv) an agreement of the kind referred to in paragraph 20Q(2)(a) of the Privacy Act 1988 is in force between the CRB and a body referred to in subparagraph (ii) of this paragraph;

the licensee must supply to the CRB the information referred to in that table item:

Civil penalty: 5,000 penalty units.

before the end of the latest of the following periods:

the 45-day period starting on the trigger day;

if subsection (2) applies—the 14-day period starting on the cessation day referred to in that subsection;

iii

if, because paragraph 133CV(1)(b) is no longer satisfied, subsection 133CV(1) ceases to provide the licensee with an exception to this subsection for the CRB—the 14-day period starting on the day that exception ceases to apply;

if the trigger day happens because of table item 3 and is before the licensee supplies the CRB with mandatory credit information under subsection 133CR(3)—the 90-day period starting on the trigger day; and

in accordance with the supply requirements; and

(e) to the extent that the licensee is not prevented by the Privacy Act 1988 from doing so.

For the purposes of subparagraph (1)(c)(ii), this subsection applies if:

(a) the licensee reasonably believes that the CRB is not complying with Privacy Act 1988 on the trigger day; andsection 20Q of the

the licensee complies with paragraphs 133CV(2)(a) and (b) in relation to that belief; and

(c) the licensee ceases to hold that belief on a day (the cessation day) before the end of the 45-day period starting on the trigger day.

Supplies under subsection (1) of information relating to multiple events, or multiple trigger days, may be made together.

Subsection (1) applies whether the information referred to in the table is kept in or outside this jurisdiction.

Regulations made for the purposes of subparagraph (1)(b)(i) may make provision in relation to a matter by applying, adopting or incorporating, with or without modification, any matter contained in any other instrument or writing as in force or existing from time to time.

(6) Subsection (5) has effect despite subsection 14(2) of the Legislation Act 2003.

133CV Exception if credit reporting body not complying with information security requirements 1

Subsection 133CU(1) does not apply, and is taken never to have applied, to a licensee for a credit reporting body if:

(a) the licensee reasonably believes that the body is not complying with Privacy Act 1988:section 20Q of the

on the trigger day referred to in that subsection; and

on the last day of the 45-day period starting on the trigger day; and

the licensee continues to hold that belief after that 45-day period; and

the licensee satisfies subsection (2) of this section.

Note 1: Paragraph (b) means that, if the licensee ceases to hold that belief after that 45-day period, this exception will cease to apply and the supply requirement in subsection 133CU(1) will apply.

unless the reason under subsection 21U(1) of the Privacy Act 1988 for the correction is that the information is inaccurate, and it was inaccurate when earlier supplied to the body under this Division.

The licensee satisfies this subsection if:

the licensee prepares a written notice:

(i) stating that the licensee reasonably believes that the body is not complying with Privacy Act 1988 on the trigger day; andsection 20Q of the

setting out the licensee’s reasons for that belief; and

iii

stating that the body may try to convince the licensee otherwise; and

the licensee gives that notice to the body, and a copy to the Information Commissioner and ASIC, within 7 days after the trigger day; and

(i) stating that the licensee reasonably believes that the body is not complying with Privacy Act 1988 on the last day of that 45-day period; andsection 20Q of the

setting out the licensee’s reasons for that belief; and

the licensee gives the final notice to the body, and a copy to the Information Commissioner and ASIC, within 7 days after the last day of that 45-day period.

(4) Subsection 21U(2) of the Privacy Act 1988 does not require a licensee to give a credit reporting body notice of a correction of certain information if:

subsection (1) of this section is providing the licensee with an exception from a requirement under subsection 133CU(1) of this Act; and

that requirement is to supply the corrected information to the body;

133CW Licensee must give notice if credit reporting body later complies with information security requirements

If:

the licensee must:

Civil penalty: 5,000 penalty units.

Subdivision C—Offences

(a) an eligible licensee reasonably believes that an eligible credit reporting body for the licensee is not complying with Privacy Act 1988 on the trigger day referred to in subsection 133CU(1); andsection 20Q of the

the licensee complies with paragraphs 133CV(2)(a) and (b) in relation to that belief; and

the licensee ceases to hold that belief on any day after the trigger day;

prepare a written notice:

stating that the licensee has ceased to hold that belief; and

setting out the licensee’s reasons for ceasing to hold that belief; and

give that notice to the body, and a copy to the Information Commissioner and ASIC, within 7 days after the day the licensee ceased to hold that belief.

133CX Offence relating to initial bulk supplies 1

A person commits an offence if:

the person is subject to a requirement under subsection 133CR(1) or (3); and

the person engages in conduct; and

the conduct contravenes the requirement.

Criminal penalty: 100 penalty units.

Note: For an exception to an offence against subsection (1), see subsection 133CS(1). A defendant bears an evidential burden in relation to the matters in subsection 133CS(1) (see subsection 13.3(3) of the Criminal Code).

(2) Section 14.1 of the Criminal Code does not apply to an offence against subsection (1).

133CY Offence relating to ongoing supplies 1

A person commits an offence if:

the person is subject to a requirement under subsection 133CU(1); and

the person engages in conduct; and

the conduct contravenes the requirement.

Criminal penalty: 100 penalty units.

Note: For an exception to an offence against subsection (1), see subsection 133CV(1). A defendant bears an evidential burden in relation to the matters in subsection 133CV(1) (see subsection 13.3(3) of the Criminal Code).

(2) Section 14.1 of the Criminal Code does not apply to an offence against subsection (1).

133CZ Offence relating to giving notice if credit reporting body later complies with information security requirements

A person commits an offence if:

Criminal penalty: 100 penalty units.

the person is subject to a requirement under section 133CT or 133CW; and

the person engages in conduct; and

the conduct contravenes the requirement.

133CZA On-disclosing information supplied under Division 2 etc. 1

(1) This section applies to a credit reporting body in relation to the following information (the protected information):

any information that the credit reporting body is supplied under Division 2;

(b) any CRB derived information (within the meaning of the Privacy Act 1988) that is derived from information that the credit reporting body is supplied under Division 2.

When protected information must not be disclosed

Civil penalty: 5,000 penalty units.

When protected information must be disclosed

and which the Privacy Act 1988 does not prevent the credit reporting body from disclosing.

Civil penalty: 5,000 penalty units.

Incorporation of other instruments

Matters regulations may deal with

If the conditions prescribed by the regulations are met for the credit reporting body and a credit provider, the credit reporting body must not disclose to the credit provider so much of the protected information as:

is prescribed by the regulations; or

is of a kind or kinds prescribed by the regulations.

If the conditions prescribed by the regulations are met for the credit reporting body and a credit provider, the credit reporting body must disclose to the credit provider so much of the protected information as:

the regulations require to be disclosed; or

is of a kind or kinds prescribed by the regulations;

If the credit reporting body is required under subsection (3) to disclose information, the credit reporting body must make the disclosure by the time, and in accordance with the requirements, prescribed by the regulations.

Regulations made for the purposes of subsection (2), (3) or (4) may make provision in relation to a matter by applying, adopting or incorporating, with or without modification, any matter contained in any other instrument or writing as in force or existing from time to time.

(6) Subsection (5) has effect despite subsection 14(2) of the Legislation Act 2003.

Without limiting subsection (2), (3) or (4), a matter prescribed for the purposes of that subsection may depend on a person or body being satisfied of one or more specified matters.

133CZB Offence

A person commits an offence if:

Criminal penalty: 100 penalty units.

the person is subject to a requirement under subsection 133CZA(2), (3) or (4); and

the person engages in conduct; and

the conduct contravenes the requirement.

133CZC Reports about initial bulk supplies of credit information 1

A licensee who is required under subsection 133CR(1) or (3) to supply mandatory credit information must arrange:

for the preparation of a written statement containing information of the kinds prescribed by the regulations relating to:

the mandatory credit information; or

the eligible credit accounts to which the mandatory credit information relates; and

for a person appointed under section 133CZD to audit that statement and prepare a written report of the audit; and

for that statement and audit report to be given to the Minister within 6 months after the 1 July referred to in that subsection.

Civil penalty: 5,000 penalty units.

A credit reporting body to whom mandatory credit information is required under subsection 133CR(1) or (3) to be supplied must arrange:

for the preparation of a written statement containing information of the kinds prescribed by the regulations relating to:

the mandatory credit information; or

the eligible credit accounts to which the mandatory credit information relates; and

for a person appointed under section 133CZD to audit that statement and prepare a written report of the audit; and

for that statement and audit report to be given to the Minister within 6 months after the 1 July referred to in that subsection.

For the purposes of subsection (1) or (2), disregard section 133CS when working out whether a person is required under subsection 133CR(1) or (3) to supply mandatory credit information to another person.

133CZD Auditors 1

ASIC may, in writing, appoint as auditors for the purposes of this Division:

one or more suitably qualified persons; or

the members of one or more classes of suitably qualified persons.

The reasonable fees and expenses of an auditor for preparing an audit report under this Division are payable by the person required to arrange for the preparation of the statement to which the audit report relates.

The auditor may recover those fees by action against that person.

133CZE Offence

A person commits an offence if:

Criminal penalty: 100 penalty units.

the person is subject to a requirement under subsection 133CZC(1) or (2); and

the person engages in conduct; and

the conduct contravenes the requirement.

133CZF Meaning of Part 3-2CA body

A Part 3-2CA body is a person that is or has been:

an eligible licensee; or

an eligible credit reporting body for a licensee.

133CZG Obligation to provide a statement or obtain an audit report if directed by ASIC

Notice to Part 3-2CA body to provide a statement

Notice to Part 3-2CA body to obtain an audit report

Notice must specify day by which Part 3-2CA body must comply

Requirement to comply with notice

Civil penalty: 5,000 penalty units.

Offence

Criminal penalty: 6 months imprisonment.

ASIC may give a Part 3-2CA body a written notice directing the body to lodge with ASIC a written statement containing specified information about whether the body, or another Part 3-2CA body, is complying with this Part (other than Division 4).

Notices under subsection (1):

may be given at any time; and

may be given to one or more particular Part 3-2CA bodies, or to each Part 3-2CA body in one or more classes of Part 3-2CA bodies, or to all Part 3-2CA bodies; and

may require all the same information, or may contain differences as to the information they require; and

may require a statement containing information to be given on a periodic basis, or each time a particular event or circumstance occurs, without ASIC having to give a further written notice.

ASIC may also give a Part 3-2CA body a written notice directing the body to obtain an audit report prepared:

by a suitably qualified person specified in the notice; and

on a statement, or on each statement in a class of statements, under subsection (1); and

before the statement is given to ASIC.

A notice under subsection (3) is not a legislative instrument.

A notice given under this section must specify the day by which the Part 3-2CA body must comply with the notice (which must be a reasonable period after the notice is given). ASIC may extend the day by giving a written notice to the Part 3-2CA body.

The Part 3-2CA body must comply with a notice given under this section within the time specified in the notice.

A person commits an offence if:

the person is subject to a requirement under subsection (6); and

the person engages in conduct; and

the conduct contravenes the requirement.

133CZH Obligation to give ASIC information required by the regulations

Regulations may require Part 3-2CA body to give information

to give ASIC specified information about whether the body, or another Part 3-2CA body, is complying with this Part (other than Division 4).

Requirement to comply with regulations

Civil penalty: 5,000 penalty units.

Offence

Criminal penalty: 6 months imprisonment.

The regulations may require:

a Part 3-2CA body; or

each Part 3-2CA body in a class of Part 3-2CA bodies;

If regulations under subsection (1) require a Part 3-2CA body to give ASIC information, the body must give ASIC that information.

A person commits an offence if:

the person is subject to a requirement to give ASIC information under subsection (2); and

the person engages in conduct; and

the conduct contravenes the requirement.

133CZI Obligation to provide ASIC with assistance if reasonably requested

Requirement to provide assistance

is complying with this Part (other than Division 4), the assisting body must give ASIC or the authorised person the requested assistance.

Civil penalty: 5,000 penalty units.

Offence

Criminal penalty: 6 months imprisonment.

(1) If ASIC, or a person authorised by ASIC, reasonably requests assistance from a assisting body) about whether:Part 3-2CA body (the

the assisting body; or

another Part 3-2CA body;

If the request is in writing, it is not a legislative instrument.

A person commits an offence if:

the person is subject to a requirement to give ASIC or an authorised person assistance under subsection (1); and

the person engages in conduct; and

the conduct contravenes the requirement.

133CZJ Extended application of Division 4 of Part 2-5 1

Division 4 of Part 2-5 also applies in relation to an audit report required under subsection 133CZG(3) as if the substitutions in the following table, and the modification in subsection (2) of this section, were made.

For the purposes of subsection (1), assume that paragraphs 104(2)(a) and (b) were replaced with the following:

“(a) constitutes or may constitute a contravention of Part 3-2CA (other than Division 4); or”.

133CZK This Part does not limit the Privacy Act 1988

Subject to subsection 133CV(4), this Part does not limit the operation of the Privacy Act 1988.

133CZL Review of the operation of this Part 1

The Minister must cause an independent review to be conducted of the operation of this Part.

The persons who conduct the review must complete it, and give the Minister a written report of the review, before 1 October 2024.

The Minister must cause copies of the report to be tabled in each House of the Parliament within 15 sitting days of that House after the report is given to the Minister.

133CZM Main constitutional basis

The main constitutional basis for this Part is set out in Part 1-3.

133CZN Other constitutional bases 1

Independently of section 133CZM, this Part also has effect as provided by subsections (2), (3), (4) and (5).

Other constitutional bases—eligible licensees

the carrying on of the business of banking, other than State banking (within the meaning of paragraph 51(xiii) of the Constitution) not extending beyond the limits of the State concerned.

Other constitutional bases—credit reporting bodies

the carrying on of the business of banking, other than State banking (within the meaning of paragraph 51(xiii) of the Constitution) not extending beyond the limits of the State concerned.

This Part also has the effect it would have if a reference in it to an eligible licensee were expressly confined to an eligible licensee that is a corporation to which paragraph 51(xx) of the Constitution applies.

This Part also has the effect it would have if a reference in it to an eligible licensee were expressly confined to an eligible licensee acting:

in the course of; or

in relation to;

Division 3, subsection 133CZC(2) and Division 5 also have the effect they would have if a reference in them to a credit reporting body were expressly confined to a credit reporting body that is a corporation to which paragraph 51(xx) of the Constitution applies.

Division 3, subsection 133CZC(2) and Division 5 also have the effect they would have if a reference in them to a credit reporting body were expressly confined to a credit reporting body acting:

in the course of; or

in relation to;

5 At the end of paragraph 265(2)(c)

Add:

iii

is of a provision of Part 3-2CA (about mandatory comprehensive credit reporting); or

6 Section 266 (at the end of the heading)

Add “or credit reporting”.

7 Section 266

Before “ASIC may give”, insert “(1)”.

8 At the end of section 266

Add:

a written notice requiring the production to a specified ASIC member or ASIC staff member, at a specified place and time, of specified books relating to:

Note 1: Part 3-2CA is about mandatory comprehensive credit reporting.

Note 2: Failure to comply with a requirement made under this subsection is an offence (see section 290).

ASIC may give to:

a Part 3-2CA body that is, or has been, subject to a requirement under Part 3-2CA (other than Division 4), either alone or together with any other person or persons; or

a representative, banker, lawyer or auditor of a person referred to in paragraph (a);

information, or a statement, to which that requirement relates; or

the character or financial situation of, or a business carried on by, a person who is, or has been, subject to that requirement.

9 Paragraph 267(1)(b)

After “paragraph 266(1)(d) or (e)”, insert “or (2)(c) or (d)”.

10 Paragraph 307(1)(b)

After “paragraph 266(1)(d) or (e)”, insert “or (2)(c) or (d)”.

Privacy Act 1988

11 At the end of section 20Q

Add:

Note: Requirements prescribed for paragraph (b) apply wherever the information is stored.

Without limiting subsection (1), if a credit reporting body holds credit reporting information, the body must store the information:

either:

in Australia or an external Territory; or

in accordance with any security requirements prescribed by the regulations for storing the information outside of Australia and the external Territories; and

in accordance with any security requirements prescribed by the regulations.

Financial hardship and other amendments

Privacy Act 1988

1 Subsection 6(1)

Insert:

financial hardship arrangement has the meaning given by subsection 6QA(1).

financial hardship information has the meaning given by subsection 6QA(4).

National Credit Code has the same meaning as in the National Consumer Credit Protection Act 2009.

2 Subsection 6(1) (definition of residential property)

Omit “(within the meaning of the National Consumer Credit Protection Act 2009)”.

3 After paragraph 6N(c)

Insert:

financial hardship information about the individual; or

4 After section 6Q

Insert:

6QA Meanings of financial hardship arrangement and financial hardship information

Financial hardship arrangement

then the arrangement is a financial hardship arrangement.

Note: Financial hardship arrangements affect repayment history information: see subsection 6V(1A).

Examples: An arrangement might involve a credit provider agreeing to:

Financial hardship information

Note: Paragraph (b) may apply even if, under the arrangement, the individual is not required to make a payment for a month: see subsection 6V(1B).

If:

a credit provider provides consumer credit to an individual; and

the National Credit Code applies to the provision of the credit; and

the individual is or will be unable to meet the individual’s obligations in relation to the consumer credit; and

as a result of the inability, an arrangement covered by subsection (3) affecting the monthly payment obligations of the individual is made between the credit provider and the individual which is either:

a permanent variation to the terms of the consumer credit; or

a temporary relief from or deferral of the individual’s obligations in relation to the consumer credit;

For the purposes of this section, it does not matter whether the arrangement was initiated by the credit provider or the individual.

This subsection covers any kind of agreement, arrangement or understanding, whether formal or informal, whether express or implied and whether or not enforceable, or intended to be enforceable, by legal proceedings.

defer or reduce required monthly payments for a temporary period; or

accept interest-only payments for a temporary period; or

extend the term of a loan to reduce monthly payments.

(4) If subsection 6V(1A) (about financial hardship arrangements) applies in determining repayment history information about an individual, then the following information is financial hardship information about the individual:

for an arrangement referred to in subparagraph (1)(d)(i) (about permanent variations)—information, relating only to the first monthly payment affected by the arrangement, that indicates that the monthly payment is the first monthly payment affected by a financial hardship arrangement of that kind;

for an arrangement referred to in subparagraph (1)(d)(ii) (about temporary relief or deferral of obligations)—information, relating to each monthly payment affected by the arrangement, that indicates that the monthly payment was affected by a financial hardship arrangement of that kind.

Paragraph (4)(b) does not apply in relation to a monthly payment under a financial hardship arrangement if:

the individual met the obligation to make the monthly payment, as affected by the arrangement; and

the amount paid was equal to, or greater than, the amount the individual would have been obliged to pay apart from the arrangement.

5 After subsection 6V(1)

Insert:

Note: In this case, there may be financial hardship information: see subsections 6QA(4) and (5).

If an obligation of the individual to make a monthly payment is, or is taken by subsection (1B) to be, affected by a financial hardship arrangement, then repayment history information is to be determined by reference to that obligation as so affected.

If, under a financial hardship arrangement, an individual is not required to make a monthly payment for a month, then, for the purposes of subsections (1) and (1A) and section 6QA:

a monthly payment is taken to have been due and payable on the day on which it would have been due and payable apart from the arrangement; and

the individual is taken to have met the obligation to make the monthly payment; and

the obligation to make the monthly payment is taken to be affected by the arrangement.

6 Paragraph 20C(4)(e)

After “repayment history information”, insert “or financial hardship information”.

7 Subsection 20E(4)

After “repayment history information”, insert “or financial hardship information”.

7A After subsection 20E(4)

Insert:

Civil penalty: 2,000 penalty units.

Despite subsection (3), if the credit reporting information is, or was derived from, financial hardship information about the individual, the credit reporting body must not disclose the information under paragraph (3)(a) or (f) to a credit provider or mortgage insurer if the provider or insurer requested the information for the purpose of:

in the case of a credit provider:

collecting payments that are overdue in relation to consumer credit provided by the provider to the individual; or

collecting payments that are overdue in relation to commercial credit provided by the provider to a person; or

iii

assessing whether to accept the individual as a guarantor in relation to credit for which an application has been made to the provider by a person other than the individual; or

in the case of a mortgage insurer—assessing the risk of the individual defaulting on mortgage credit in relation to which the insurer has provided insurance to a credit provider.

8 At the end of section 20E

Add:

No disclosure of financial hardship information as part of credit score

Subsection (3) does not apply to the disclosure of CRB derived information which contains or takes the form of a credit score where the credit information from which the credit score is derived includes financial hardship information.

9 Paragraph 20G(2)(c)

Omit “or repayment history information,”, substitute “repayment history information, or financial hardship information”.

10 Section 20W (after table item 2)

Insert:

11 Paragraph 21D(3)(c)

After “repayment history information”, insert “or financial hardship information”.

12 After section 21E

Insert:

21EA Financial hardship information must be disclosed

If:

the credit provider must, at the same time, disclose the financial hardship information to the credit reporting body.

Civil penalty: 500 penalty units.

a credit provider discloses to a credit reporting body repayment history information about an individual in relation to a monthly payment under section 21D; and

financial hardship information about that individual exists in relation to that monthly payment;

13 Subsection 21G(4)

After “repayment history information”, insert “or financial hardship information”.

14 Application

The amendments made by this Part apply in relation to arrangements made on or after the commencement of this Part, regardless of whether the consumer credit was applied for before, on or after that commencement.

National Consumer Credit Protection Act 2009

15 Subsection 5(1)

Insert:

financial hardship information has the same meaning as in the Privacy Act 1988.

16 After paragraph 133CP(1)(c)

Insert:

financial hardship information about the natural persons; or

17 After subsection 133CP(2)

Insert:

Note: Paragraph (b) is included to deal with the case where the first 1 July is in 2023 or a later year.

(3) Despite paragraph (1)(d), mandatory credit information does not include financial hardship information that comes into existence:

before 1 July 2022; or

more than 3 months before the first 1 July on which:

if the credit provider is a member of a banking group—the head company of the group is an eligible licensee; or

otherwise—the credit provider is an eligible licensee.

18 Subsection 133CU(1) (after table item 3)

Insert:

19 Before subsection 67(1) of the National Credit Code

Insert:

Changes merely because financial hardship information exists

merely because financial hardship information (within the meaning of the Privacy Act 1988) about the debtor exists.

Credit contracts continue for any credit previously provided

A provision of a continuing credit contract has no effect to the extent that a credit provider purports to rely on the provision to:

refuse to provide any further credit to the debtor; or

reduce the debtor’s credit limit;

20 Before subsection 67(2) of the National Credit Code

Insert:

Giving notice of decision not to provide further credit or of decision to reduce credit limit

21 Before subsection 67(4) of the National Credit Code

Insert:

Credit limits may only be increased at request or with consent

National Consumer Credit Protection (Transitional and Consequential Provisions) Act 2009

22 In the appropriate position

Insert:

Schedule 9—Application provisions for the National Consumer Credit Protection Amendment (Mandatory Credit Reporting and Other Measures) Act 2021

23 Application

The amendments of the National Credit Code made by Part 2 of Schedule 2 to the National Consumer Credit Protection Amendment (Mandatory Credit Reporting and Other Measures) Act 2021 apply in relation to credit contracts entered into before, on or after the commencement of that Part.

Privacy Act 1988

24 Subsection 6(1)

Insert:

non-participating credit provider means a credit provider to which all of the following apply:

the credit provider has not disclosed credit reporting information or credit eligibility information about an individual to a credit reporting body or another credit provider;

the credit provider is not likely to disclose credit reporting information or credit eligibility information about an individual to a credit reporting body or another credit provider;

the credit provider has not collected credit reporting information or credit eligibility information about an individual from a credit reporting body or another credit provider.

25 Subparagraph 20E(3)(c)(ii)

After “member of”, insert “or subject to”.

25A Subsection 20R(1)

Repeal the subsection, substitute:

Access

If a credit reporting body holds credit reporting information about an individual, the body must, on request by an access seeker in relation to the information, give the access seeker access to:

the information; and

(b) if the body is a corporation to which paragraph 51(xx) of the Constitution applies, and the credit reporting business of the body involves deriving CRB derived information about individuals in the form of a rating (a credit rating) of the individuals on a credit score scale or range—the information referred to in subsection (1A).

The information is:

the credit rating of the individual, as derived by the body after the request is made; and

information that identifies the particular credit information that is held by the body and from which the credit rating was derived; and

information about the relative weighting of the credit information described in paragraph (b) in deriving the credit rating; and

information about what the other ratings on the scale or range are, and how the individual’s credit rating relates to those other ratings.

25B At the end of subsection 20R(2)

Add:

; or (d) for information referred to in subsection (1A)—the credit information about the individual that is held by the body is insufficient for the body to be able to derive the credit rating of the individual in the ordinary course of its credit reporting business within the period referred to in subsection (3).

25C Subsection 20R(5)

Omit “12 months”, substitute “3 months”.

26 At the end of section 21B

Add:

Exemption for certain non-participating credit providers

This section does not apply to a non-participating credit provider.

27 Subparagraph 21D(2)(a)(i)

After “member of”, insert “or subject to”.

28 Subparagraph 21G(3)(e)(ii)

After “member of”, insert “or subject to”.

29 Subparagraph 21T(7)(b)(i)

After “member”, insert “or to which it is subject”.

30 At the end of section 21U

Add:

Exemption for certain non-participating credit providers

This section does not apply to a non-participating credit provider.

31 At the end of section 21V

Add:

Exemption for certain non-participating credit providers

This section does not apply to a non-participating credit provider.

32 Subparagraph 21W(3)(c)(i)

After “member”, insert “or to which it is subject”.

33 Subparagraph 23B(4)(b)(i)

After “member”, insert “or to which it is subject”.

34 At the end of Part IIIA

Add:

25B Review of operation of this Part 1

The Minister must cause an independent review to be conducted of the operation of this Part.

The persons who conduct the review must complete it, and give the Minister a written report of the review, before 1 October 2024.

The Minister must cause a copy of the report to be tabled in each House of the Parliament within 15 sitting days of that House after the report is given to the Minister.

35 Application 1

The amendments made by this Part, apart from items 25A, 25B, 25C and 34, apply in relation to consumer credit applied for, or provided, after the commencement of this Part.

(2) The amendments made by items 25A, 25B and 25C apply to requests made under subsection 20R(1) of the Privacy Act 1988 on or after the commencement of this Part.

[Minister’s second reading speech made in—

House of Representatives on 5 December 2019

Senate on 5 February 2020]

(251/19)