Section 20M — Privacy Act 1988: Use or disclosure of credit reporting information that is de-identified

Use or disclosure (1) If: (a) a credit reporting body holds credit reporting information; and (b) the information (the de-identified information) is de-identified; the body must not use or disclose the de-identified information. (2) Subsection (1) does not apply to the use or disclosure of the de-identified information if: (a) the use or disclosure is for the purposes of conducting research in relation to credit; and (b) the credit reporting body complies with the rules made under subsection (3). Commissioner may make rules (3) The Commissioner may, by legislative instrument, make rules relating to the use or disclosure by a credit reporting body of de-identified information for the purposes of conducting research in relation to credit. (4) Without limiting subsection (3), the rules may relate to the following matters: (a) the kinds of de-identified information that may or may not be used or disclosed for the purposes of conducting the research; (b) whether or not the research is research in relation to credit; (c) the purposes of conducting the research; (d) consultation about the research; (e) how the research is conducted.