Section 21S — Privacy Act 1988 (Cth)

(1) If a credit provider holds credit eligibility information, the provider must take such steps as are reasonable in the circumstances to protect the information:

(a) from misuse, interference and loss; and

(b) from unauthorised access, modification or disclosure.

(2) If:

(a) a credit provider holds credit eligibility information about an individual; and

(b) the provider no longer needs the information for any purpose for which the information may be used or disclosed by the provider under this Division; and

(c) the provider is not required by or under an Australian law, or a court/tribunal order, to retain the information;

the provider must take such steps as are reasonable in the circumstances to destroy the information or to ensure that the information is de‑identified.

Civil penalty: 1,000 penalty units.

(3) If a credit provider is an APP entity, Australian Privacy Principle 11 does not apply to the provider in relation to credit eligibility information.

Related sections

• s 21P — Notification of a refusal of an application for consumer credit
• s 21Q — Quality of credit eligibility information
• s 21R — False or misleading credit information or credit eligibility information
• s 21T — Access to credit eligibility information
• s 21U — Correction of credit information or credit eligibility information
• s 21V — Individual may request the correction of credit information etc.

Research how courts apply s 21S

BriefBridge searches Australian caselaw by meaning — every answer cited to the paragraph.