Section 20D — Privacy Act 1988 (Cth)

(1) If:

(a) a credit reporting body receives credit information about an individual; and

(b) the body did not solicit the information;

the body must, within a reasonable period after receiving the information, determine whether or not the body could have collected the information under section 20C if the body had solicited the information.

(2) The credit reporting body may use or disclose the credit information for the purposes of making the determination under subsection (1).

(3) If the credit reporting body determines that it could have collected the credit information, sections 20E to 20ZA apply in relation to the information as if the body had collected the information under section 20C.

(4) If the credit reporting body determines that it could not have collected the credit information, the body must, as soon as practicable, destroy the information.

Civil penalty: 1,000 penalty units.

(5) Subsection (4) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, to retain the credit information.

Related sections

• s 20A — Application of this Division and the Australian Privacy Principles to credit reporting bodies
• s 20B — Open and transparent management of credit reporting information
• s 20C — Collection of solicited credit information
• s 20E — Use or disclosure of credit reporting information
• s 20F — Permitted CRB disclosures in relation to individuals
• s 20G — Use or disclosure of credit reporting information for the purposes of direct marketing

Research how courts apply s 20D

BriefBridge searches Australian caselaw by meaning — every answer cited to the paragraph.