Competition and Consumer Act 2010

This section applies if an SPF regulator gives a written request to a regulated entity for the entity to give the SPF regulator a report about a scam relating to, connected with, or using a regulated service of the entity.

The entity contravenes this subsection if the entity fails to give a report about the scam:

to the SPF regulator within the period, and in the manner and form, set out in the request; and

that contains the kinds of information set out in the request.

Subsection (2) is a civil penalty provision.

This means subsection (2) is a civil penalty provision of an SPF principle for the purposes of section 58FJ (about civil penalties).

For the purposes of (but without limiting) subsection (2), the SPF regulator’s request may:

provide that the report may be given via access to a specified data gateway, portal or website; and

ask that the report set out:

what loss or harm may have resulted from the scam, what disruptive actions the entity has taken and whether any of those actions have been reversed; and

what steps the entity is taking to disrupt similar scams, and to prevent loss or harm resulting from similar scams.

For more about the data gateways, portals or websites referred to in paragraph (a), see section 58BT.

The request may ask for the report to include SPF personal information. If so, the request must require the entity to de‑identify the information unless the SPF regulator reasonably believes that doing so would not achieve the object of this Part.

If:

a regulated entity gives a scam report to an SPF regulator under this section; and

another SPF regulator later requests a scam report under this section from the regulated entity about the same matters;

The SPF regulators can share the earlier scam report under Subdivision C of Division 5.