National Consumer Credit Protection Act 2009

Subsection 133CU(1) does not apply, and is taken never to have applied, to a licensee for a credit reporting body if:

the licensee reasonably believes that the body is not complying with section 20Q of the Privacy Act 1988:

on the trigger day referred to in that subsection; and

on the last day of the 45‑day period starting on the trigger day; and

the licensee continues to hold that belief after that 45‑day period; and

the licensee satisfies subsection (2) of this section.

Paragraph (b) means that, if the licensee ceases to hold that belief after that 45‑day period, this exception will cease to apply and the supply requirement in subsection 133CU(1) will apply.

A person who wishes to rely on this subsection bears an evidential burden in relation to the matters in this subsection (see subsection (3) of this section and subsection 13.3(3) of the Criminal Code).

The licensee satisfies this subsection if:

the licensee prepares a written notice:

stating that the licensee reasonably believes that the body is not complying with section 20Q of the Privacy Act 1988 on the trigger day; and

setting out the licensee’s reasons for that belief; and

stating that the body may try to convince the licensee otherwise; and

the licensee gives that notice to the body, and a copy to the Information Commissioner and ASIC, within 7 days after the trigger day; and

the licensee prepares a written notice (the final notice):

stating that the licensee reasonably believes that the body is not complying with section 20Q of the Privacy Act 1988 on the last day of that 45‑day period; and

setting out the licensee’s reasons for that belief; and

the licensee gives the final notice to the body, and a copy to the Information Commissioner and ASIC, within 7 days after the last day of that 45‑day period.

A licensee who wishes to rely on subsection (1) in proceedings for a declaration of contravention or a pecuniary penalty order bears an evidential burden in relation to the matters in that subsection.

Subsection 21U(2) of the Privacy Act 1988 does not require a licensee to give a credit reporting body notice of a correction of certain information if:

subsection (1) of this section is providing the licensee with an exception from a requirement under subsection 133CU(1) of this Act; and

that requirement is to supply the corrected information to the body;