Section 20K — Privacy Act 1988: No use or disclosure of credit reporting information during a ban period

(1) If: (a) a credit reporting body holds credit reporting information about an individual; and (b) the individual believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud); and (c) the individual requests the body not to use or disclose the information under this Division; then, despite any other provision of this Division, the body must not use or disclose the information during the ban period for the information. Civil penalty: 2,000 penalty units. (2) Subsection (1) does not apply if: (a) the individual expressly consents, in writing, to the use or disclosure of the credit reporting information under this Division; or (b) the use or disclosure of the credit reporting information is required by or under an Australian law or a court/tribunal order. Ban period (3) The ban period for credit reporting information about an individual is the period that: (a) starts when the individual makes a request under paragraph (1)(c); and (b) ends: (i) 21 days after the day on which the request is made; or (ii) if the period is extended under subsection (4)—on the day after the extended period ends. (4) If: (a) there is a ban period for credit reporting information about an individual that is held by a credit reporting body; and (b) before the ban period ends, the individual requests the body to extend that period; and (c) the body believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud); the body must: (d) extend the ban period by such period as the body considers is reasonable in the circumstances; and (e) give the individual written notification of the extension. Civil penalty: 1,000 penalty units. (5) A ban period for credit reporting information may be extended more than once under subsection (4). No charge for request etc. (6) If an individual makes a request under paragraph (1)(c) or (4)(b), a credit reporting body must not charge the individual for the making of the request or to give effect to the request.