1 Name
This instrument is the National Consumer Credit Protection Amendment (Mandatory Credit Reporting) Regulations 2021.
2 Commencement
(1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.
| Commencement information |
| Column 1 | Column 2 | Column 3 |
| Provisions | Commencement | Date/Details |
| 1. The whole of this instrument | The day after this instrument is registered. | 28 May 2021 |
Note: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.
(2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.
3 Authority
This instrument is made under the National Consumer Credit Protection Act 2009.
4 Schedules
Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.
Schedule 1—Amendments
National Consumer Credit Protection Regulations 2010
1 In the appropriate position in Chapter 3
Insert:
Part 3.8—Licensees supplying credit information to credit reporting bodies etc.
28TA Ongoing supplies of mandatory credit information
(1) For the purposes of item 6 of the table in subsection 133CU(1) of the Act, an event of the kind specified in column 1 of an item in the following table, and information of the kind specified in column 2 for that kind of event, are prescribed.
| Prescribed events and information |
| Item | Column 1 | Column 2 |
| | Event | Information |
| 1 | Repayment history information (within the meaning of the Privacy Act 1988) comes into existence for an eligible credit account at a particular time (the event time), provided that: (a) mandatory credit information for the account has previously been supplied by the licensee to the credit reporting body under Division 2 of Part 3‑2CA of the Act; and (b) if the event time is during the period: (i) starting on the day after that supply; and (ii) ending on 30 June 2022; no arrangement of the kind covered by subregulation (2) is, or has been, in place in relation to the account during any part of that period that is before the event time; and (c) if: (i) the event time is after that period; and (ii) during any part of that period, one or more arrangements of the kind covered by subregulation (2) were in place in relation to the account; all of those arrangements have ceased to be in place before the event time | The repayment history information |
(2) This subregulation covers an arrangement, in relation to an eligible credit account, if:
(a) the arrangement is an agreement, undertaking or other kind of arrangement, whether formal or informal, whether express or implied and whether or not enforceable, or intended to be enforceable, by legal proceedings; and
(b) the arrangement is between:
(i) a holder of the account; and
(ii) the credit provider with whom the account is held;
in relation to the inability of the holder to meet the holder’s obligations relating to consumer credit (within the meaning of the Privacy Act 1988) relating to the account; and
(c) the arrangement affects the monthly payment obligations of the holder and is either:
(i) a permanent variation to the terms of the consumer credit; or
(ii) a temporary relief from or deferral of the holder’s obligations in relation to the consumer credit;
(whether the arrangement was entered into before or after this regulation commences).
28TB When protected information must not be on‑disclosed
(1) For the purposes of subsection 133CZA(2) of the Act, the following conditions are prescribed for a credit reporting body and a credit provider:
(a) the protected information (see subsection 133CZA(1) of the Act) was:
(i) supplied under Division 2 of Part 3‑2CA of the Act to the credit reporting body; or
(ii) derived from information that was supplied under that Division to the credit reporting body;
by another credit provider that was a signatory to the principles mentioned in subregulation (3) at the time of that supply;
(b) those principles have the effect of restricting the further disclosure of one or more kinds of information (the restricted kinds of information) making up the protected information.
(2) For the purposes of subsection 133CZA(2) of the Act, the restricted kinds of information (if any) are prescribed (see paragraph (b) of that subsection).
(3) For the purposes of paragraph (1)(a), the principles are those titled “Principles of Reciprocity and Data Exchange”, dated 6 January 2021 and published by the Australian Retail Credit Association, as amended from time to time.
Note: The Principles of Reciprocity and Data Exchange could in 2021 be viewed on the Australian Retail Credit Association website (http://www.arca.asn.au).
(4) For the purposes of paragraph (1)(b), if those principles would only restrict the credit reporting body if that body were a signatory to those principles, treat that body as if it were a signatory to those principles.
(5) Treat paragraph (1)(b) as ceasing to apply to a restriction if that restriction is subject to conditions and those conditions are met.
28TC Reports about initial bulk supplies of credit information—information to be given by licensee
Information to be included in statement given after the first bulk supply
(1) For the purposes of paragraph 133CZC(1)(a) of the Act, the following kinds of information are prescribed in relation to a statement that is required to be given by a licensee within 6 months after the 1 July referred to in subsection 133CR(1) of the Act:
(a) for each eligible credit reporting body to which the licensee must supply mandatory credit information under that subsection:
(i) the number of accounts held with the licensee for which mandatory credit information has been supplied to that body under that subsection; and
(ii) the number of accounts held with each member of a banking group of which the licensee is the head company for which mandatory credit information has been supplied to that body under that subsection; and
(iii) the number of accounts held with the licensee for which mandatory credit information has not been supplied to that body under that subsection; and
(iv) the number of accounts held with each member of a banking group of which the licensee is the head company for which mandatory credit information has not been supplied to that body under that subsection;
(b) for each account covered by paragraph (a)—the type of that account;
(c) for the accounts covered by subparagraph (a)(i) or (ii):
(i) the number of those accounts for which a correction under section 21U of the Privacy Act 1988 has been made during the 4‑month period (the 4‑month period) starting on that 1 July; and
(ii) the number of those accounts for which a request under section 21V of the Privacy Act 1988 has been made during the 4‑month period; and
(iii) the number of those accounts for which a correction has been made during the 4‑month period in response to a request covered by subparagraph (ii); and
(iv) the number of those accounts for which a complaint under subsection 23A(2) of the Privacy Act 1988 has been made during the 4‑month period.
Information to be included in statement given after the second bulk supply
(2) For the purposes of paragraph 133CZC(1)(a) of the Act, the following kinds of information are prescribed in relation to a statement that is required to be given by a licensee within 6 months after the 1 July referred to in subsection 133CR(3) of the Act:
(a) for each eligible credit reporting body to which the licensee must supply mandatory credit information under that subsection:
(i) the number of accounts held with the licensee for which mandatory credit information has been supplied to that body under that subsection; and
(ii) the number of accounts held with each member of a banking group of which the licensee is the head company for which mandatory credit information has been supplied to that body under that subsection;
(b) for each account covered by paragraph (a)—the type of that account;
(c) for the accounts covered by paragraph (a):
(i) the number of those accounts for which a correction under section 21U of the Privacy Act 1988 has been made during the 4‑month period (the 4‑month period) starting on that 1 July; and
(ii) the number of those accounts for which a request under section 21V of the Privacy Act 1988 has been made during the 4‑month period; and
(iii) the number of those accounts for which a correction has been made during the 4‑month period in response to a request covered by subparagraph (ii); and
(iv) the number of those accounts for which a complaint under subsection 23A(2) of the Privacy Act 1988 has been made during the 4‑month period.
28TD Reports about initial bulk supplies of credit information—information to be given by credit reporting body
Information to be included in statement given after the first bulk supply
(1) For the purposes of paragraph 133CZC(2)(a) of the Act, the following kinds of information are prescribed in relation to a statement that is required to be given by a credit reporting body within 6 months after the 1 July referred to in subsection 133CR(1) of the Act:
(a) for each licensee required to supply mandatory credit information to the credit reporting body under that subsection—the number of accounts for which such information has been supplied by the licensee to the body under that subsection;
(b) the number of disclosures of the body’s protected information made by or on behalf of the body to one or more credit providers during the 4‑month period (the 4‑month period) starting on that 1 July;
(c) for the accounts covered by paragraph (a):
(i) the number of those accounts for which a correction under section 20S of the Privacy Act 1988 has been made during the 4‑month period; and
(ii) the number of those accounts for which a request under section 20T of the Privacy Act 1988 has been made during the 4‑month period; and
(iii) the number of those accounts for which a correction has been made during the 4‑month period in response to a request covered by subparagraph (ii); and
(iv) the number of those accounts for which a complaint under subsection 23A(1) of the Privacy Act 1988 has been made during the 4‑month period.
Information to be included in statement given after the second bulk supply
(2) For the purposes of paragraph 133CZC(2)(a) of the Act, the following kinds of information are prescribed in relation to a statement that is required to be given by a credit reporting body within 6 months after the 1 July referred to in subsection 133CR(3) of the Act:
(a) for each licensee required to supply mandatory credit information to the credit reporting body under that subsection—the number of accounts for which such information has been supplied by the licensee to the body under that subsection;
(b) the number of disclosures of the body’s protected information made by or on behalf of the body to one or more credit providers during the 4‑month period (the 4‑month period) starting on that 1 July;
(c) for the accounts covered by paragraph (a):
(i) the number of those accounts for which a correction under section 20S of the Privacy Act 1988 has been made during the 4‑month period; and
(ii) the number of those accounts for which a request under section 20T of the Privacy Act 1988 has been made during the 4‑month period; and
(iii) the number of those accounts for which a correction has been made during the 4‑month period in response to a request covered by subparagraph (ii); and
(iv) the number of those accounts for which a complaint under subsection 23A(1) of the Privacy Act 1988 has been made during the 4‑month period.
Meaning of protected information
(3) In this regulation:
protected information, of a credit reporting body, means:
(a) any information that the credit reporting body is supplied under Division 2 of Part 3‑2CA of the Act; or
(b) any CRB derived information (within the meaning of the Privacy Act 1988) that is derived from the information referred to in paragraph (a).
2 After paragraph 38(2)(i)
Insert:
(ia) subsections 133CR(1) and (3);
(ib) section 133CT;
(ic) subsection 133CU(1);
(id) section 133CW;
(ie) subsections 133CZA(2), (3) and (4);
(if) subsections 133CZC(1) and (2);
(ig) subsection 133CZG(6);
(ih) subsection 133CZH(2);
(ii) subsection 133CZI(1);