(1) Where, as a result of any data subject information contained in a credit report a credit provider —
(a) takes any adverse action against the data subject;
(b) denies credit to a data subject, in whole or in part; or
(c) changes the terms and conditions of an existing credit with adverse impact on a data subject,
the credit provider shall, within 30 days after taking the action and in writing, provide an adverse action notice to the data subject.
(2) An adverse action notice under subsection (1) shall inform the data subject of the following —
(a) the adverse action and the reasons for the action; and
(b) the name, address and phone number of the credit bureau that provided the data subject information; and
(c) the data subject's right —
(i) to dispute the data subject information with the credit bureau; and
(ii) if the data subject information is erroneous or outdated, to have the erroneous or outdated information corrected.
(3) A credit provider is deemed to have notified the data subject under subsection (1) if the credit provider sends the adverse action notice to the data subject's last known address by registered mail, certified mail or electronic means.
(4) Notwithstanding section 23(1)(c), a data subject is entitled to a copy of the credit report without cost to the data subject every time an adverse action is taken against the data subject by reason of negative information in a credit report.