Section 20H — Privacy Act 1988: Use or disclosure of pre-screening assessments

Use or disclosure by credit reporting bodies (1) If a credit reporting body makes a pre-screening assessment in relation to direct marketing by, or on behalf of, a credit provider, the body must not use or disclose the assessment. Civil penalty: 2,000 penalty units. (2) Subsection (1) does not apply if: (a) the credit reporting body discloses the pre-screening assessment for the purposes of the direct marketing by, or on behalf of, the credit provider; and (b) the recipient of the assessment is an entity (other than the provider) that has an Australian link. (3) If the credit reporting body discloses the pre-screening assessment under subsection (2), the body must make a written note of that disclosure. Civil penalty: 500 penalty units. Use or disclosure by recipients (4) If the credit reporting body discloses the pre-screening assessment under subsection (2), the recipient must not use or disclose the assessment. Civil penalty: 1,000 penalty units. (5) Subsection (4) does not apply if the recipient uses the pre-screening assessment for the purposes of the direct marketing by, or on behalf of, the credit provider. (6) If the recipient uses the pre-screening assessment under subsection (5), the recipient must make a written note of that use. Civil penalty: 500 penalty units. Interaction with the Australian Privacy Principles (7) If the recipient is an APP entity, Australian Privacy Principles 6, 7 and 8 do not apply to the recipient in relation to a pre-screening assessment.