Section 20Z — Privacy Act 1988: Dealing with information if there is a pending correction request etc.

(1) This section applies if a credit reporting body holds credit reporting information about an individual and either: (a) subsection 20V(3) applies in relation to the information; or (b) subsection 20V(6) applies in relation to the information. Notification of Commissioner (2) The credit reporting body must, as soon as practicable, notify in writing the Commissioner of the matter referred to in paragraph (1)(a) or (b) of this section. Civil penalty: 1,000 penalty units. Use or disclosure (3) The credit reporting body must not use or disclose the information under Subdivision D of this Division. Civil penalty: 2,000 penalty units. (4) However, the credit reporting body may use or disclose the information under this subsection if: (a) the use or disclosure is for the purposes of the pending correction request, or pending dispute, in relation to the information; or (b) the use or disclosure of the information is required by or under an Australian law or a court/tribunal order. (5) If the credit reporting body uses or discloses the information under subsection (4), the body must make a written note of the use or disclosure. Civil penalty: 500 penalty units. Direction to destroy information etc. (6) The Commissioner may, by legislative instrument, direct the credit reporting body to destroy the information, or ensure that the information is de-identified, by a specified day. (7) If the Commissioner gives a direction under subsection (6) to the credit reporting body, the body must comply with the direction. Civil penalty: 1,000 penalty units. (8) To avoid doubt, section 20M applies in relation to credit reporting information that is de-identified as a result of the credit reporting body complying with the direction.