Section 20ZA — Privacy Act 1988: Dealing with information if an Australian law etc. requires it to be retained

(1) This section applies if a credit reporting body is not required: (a) to do a thing referred to in subsection 20V(2) to credit information because of subsection 20V(4); or (b) to do a thing referred to in subsection 20V(5) to CRB derived information because of subsection 20V(7); or (c) to destroy credit reporting information under subsection 20Y(2) because of subsection 20Y(3). Use or disclosure (2) The credit reporting body must not use or disclose the information under Subdivision D of this Division. Civil penalty: 2,000 penalty units. (3) However, the credit reporting body may use or disclose the information under this subsection if the use or disclosure of the information is required by or under an Australian law or a court/tribunal order. (4) If the credit reporting body uses or discloses the information under subsection (3), the body must make a written note of the use or disclosure. Civil penalty: 500 penalty units. Other requirements (5) Subdivision E of this Division (other than section 20Q) does not apply in relation to the use or disclosure of the information. Note: Section 20Q deals with the security of credit reporting information. (6) Subdivision F of this Division does not apply in relation to the information.