Section 20D — Privacy Act 1988: Dealing with unsolicited credit information

(1) If: (a) a credit reporting body receives credit information about an individual; and (b) the body did not solicit the information; the body must, within a reasonable period after receiving the information, determine whether or not the body could have collected the information under section 20C if the body had solicited the information. (2) The credit reporting body may use or disclose the credit information for the purposes of making the determination under subsection (1). (3) If the credit reporting body determines that it could have collected the credit information, sections 20E to 20ZA apply in relation to the information as if the body had collected the information under section 20C. (4) If the credit reporting body determines that it could not have collected the credit information, the body must, as soon as practicable, destroy the information. Civil penalty: 1,000 penalty units. (5) Subsection (4) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, to retain the credit information.