(1) A credit bureau may not knowingly provide to any person any information from the credit files of a data subject except for a permissible purpose specified in subsection (2).
(2) A credit bureau may, with the consent of a data subject, provide to a subscriber a credit report or value added product in respect of the data subject, on the basis of information contained in the credit file of the data subject for —
(a) the consideration of —
(i) an application for credit; or
(ii) an offer to act as a guarantor of an application for credit;
(b) use in connection with —
(i) the purchase or collection of a debt of a data subject;
(ii) the entering into or renewal of a tenancy agreement with a data subject; or
(iii) the underwriting of insurance involving a data subject;
(c) use relating to the pre-employment check of a data subject for a position that entails significant financial responsibilities;
(d) periodic portfolio monitoring and risk assessment purposes, collection and skip tracing; or
(e) any other permissible purpose as may be provided by Regulations.
(3) Where a person requires, from a credit bureau, data subject information for any permissible purpose under this Act —
(a) the person shall —
(i) submit sufficient information to the credit bureau to enable the credit bureau to confirm and validate the identity of the data subject and the identity of the person requesting the information;
(ii) submit evidence of data subject consent;
(iii) agree to properly dispose of data subject information so that the data subject information cannot reasonably be read or reconstructed; and
(iv) demonstrate adequate level of security and control in its systems to ensure that data received by it is protected;
(b) the credit bureau shall, before releasing the information required —
(i) confirm that the consent of the data subject is obtained;
(ii) confirm and validate the identity of both the data subject and the person requiring the information; and
(iii) ensure that the integrity of the information provided is not altered during the transmission of the data subject information.
(4) A person who obtains data subject information under this section shall ensure that the information is used only for the purpose for which it was obtained.
(5) A credit bureau may provide a data subject with a copy of the data's subject's own credit report, provided it confirms and validates the identity of the data subject prior to disclosing this information.
(6) A credit bureau commits an offence if the credit bureau wilfully discloses data subject information in contravention of the provisions of this section and is liable, on summary conviction, to a fine not less than $10 000 but not exceeding $100 000.