Section 24Privacy Act 1988 (Cth)

Obtaining credit reporting information from a credit reporting body

Offences

(1) An entity commits an offence if:

(a) the entity obtains credit reporting information; and

(b) the information is obtained from a credit reporting body; and

(c) the entity is not:

(i) an entity to which the body is permitted to disclose the information under Division 2 of this Part; or

(ii) an access seeker for the information.

Penalty: 200 penalty units.

(2) An entity commits an offence if:

(a) the entity obtains credit reporting information; and

(b) the information is obtained from a credit reporting body; and

(c) the information is obtained by false pretence.

Penalty: 200 penalty units.

Civil penalties

(3) An entity must not obtain credit reporting information from a credit reporting body if the entity is not:

(a) an entity to which the body is permitted to disclose the information under Division 2 of this Part; or

(b) an access seeker for the information.

Civil penalty: 2,000 penalty units.

(4) An entity must not obtain, by false pretence, credit reporting information from a credit reporting body.

Civil penalty: 2,000 penalty units.

Sourced from the Federal Register of Legislation at 17 May 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au. Verify the current text against the official source before relying on it.

Related sections

Research how courts apply s 24

BriefBridge searches Australian caselaw by meaning — every answer cited to the paragraph.

Try BriefBridge free