Bill 12 2023 - Credit Reporting Bill 2023

[11th September 2023] Credit Reporting 1 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL CREDIT REPORTING BILL, 2023 (Bill No. 12 of 2023) EXPLANATORY STATEMENT The object of this Bill is to provide for the establishment, operation, regulation and oversight of the Credit Information System with the objective of ensuring the safe, reliable and efficient processing of information. The Bill provides for the functions and duties of the Central Bank in relation to its responsibilities, and the rights and responsibilities of data providers, data users and data subjects. Dated this 31st day of August, 2023. NAADIR HASSAN MINISTER OF FINANCE, NATIONAL PLANNING AND TRADE ——————— [11th September 2023] Credit Reporting 2 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL CREDIT REPORTING BILL, 2023 (Bill No. 12 of 2023) ARRANGEMENT OF SECTIONS PART I - PRELIMINARY Sections 1. Short title and commencement 2. Interpretation 3. Exemption from application PART II - ADMINISTRATION OF THE ACT 4. Establishment of the CIS 5. Operation of the CIS 6. Functions of the Central Bank 7. Powers of the Central Bank 8. Cooperation with authorities in Seychelles PART III - DATA PROVIDERS 9. Categories of data providers 10. Submission of data by data provider 11. Duty to inform data subjects 12. Duty to obtain consent PART IV - DATA SUBJECTS AND DATA MANAGEMENT 13. Right to access own information 14. Access to credit reports 15. Access reports 16. Data access 17. Restriction of data 18. Purpose of access 19. Data quality 20. Validity of information 21. Accuracy of information 22. Data security [11th September 2023] Credit Reporting 3 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL 23. Data protection 24. System downtime or outage 25. Data processing and usage 26. Data confidentiality 27. Data submission 28. Data validation 29. Data retention 30. Archive 31. Disputes and complaints 32. Examination PART V - INFRINGEMENTS, REMEDIAL MEASURES AND PENALTIES 33. Offences 34. Enforcement action 35. Right to submit written representations and oral submissions 36. Publication and sharing of information PART VI - MISCELLANEOUS 37. Protection of action taken in good faith 38. Regulations 39. Amendment of Cap 26 SCHEDULES [11th September 2023] Credit Reporting 4 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL CREDIT REPORTING BILL, 2023 (Bill No. 12 of 2023) A BILL FOR AN ACT TO PROVIDE FOR THE ESTABLISHMENT, OPERATION, REGULATION AND OVERSIGHT OF THE CREDIT INFORMATION SYSTEM WITH THE OBJECTIVE OF ENSURING THE SAFE, RELIABLE AND EFFICIENT PROCESSING OF INFORMATION, TO PROVIDE FOR THE FUNCTIONS AND DUTIES OF THE CENTRAL BANK IN RELATION TO ITS RESPONSIBILITIES UNDER THIS ACT, TO PROVIDE FOR THE RIGHTS AND RESPONSIBILITIES OF DATA PROVIDERS, DATA USERS AND DATA SUBJECTS, AND FOR OTHER CONNECTED OR INCIDENTAL MATTERS. ENACTED by the President and the National Assembly. Short title and commencement 1. This Act may be cited as the Credit Reporting Act, 2023 and shall come into operation on such date as the Minister may, by notice in the Gazette appoint, and different dates may be appointed for different provisions of this Act. [11th September 2023] Credit Reporting 5 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL Interpretation 2. In this Act, unless the context otherwise requires — “Central Bank” means the Central Bank of Seychelles established under section 3 of the Central Bank of Seychelles Act (Cap.26); “CIS” means the Credit Information System established under section 4; “CIS Operator” means a person designated and permitted by the Central Bank to access the CIS to conduct operational activities; “consent” means a data subject's freely informed and specific written agreement to the collection, processing and disclosure of the subject's data; “credit history” means the record of a data subject's payment behaviour over a period of time made in accordance with section 29; “credit report” means a report issued by the CIS containing the recorded credit history of a data subject; “credit scoring” means a method of evaluating the probability of a prospective borrower to fulfill its financial obligations associated with a facility, by considering both positive and negative data; “customer credit portal” means an online platform accessible to a data subject to access the data subject's information contained within the CIS, and lodge any dispute in accordance with section 31; “data provider” means an entity that is required to supply information to the CIS in a structured manner; “data subject” means a natural or legal person who — [11th September 2023] Credit Reporting 6 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (a) applies for credit; (b) is a guarantor; or (c) signs a service or product agreement that involves a payment, and whose data is collected, processed and disclosed to data users in the CIS; “data user” means an entity having authorised access and use in respect of information contained in the CIS; “facility” means an arrangement or means by which a debt is incurred by a data subject, including declaration of bankruptcy by a court; “guarantor” means a person who gives his or her immovable property or offers his or her guarantee as security for the repayment of a credit facility by a borrower; “interbank market participants” comprises the Central Bank, banks licensed under the Financial Institutions Act, 2004 and credit unions established under the Credit Union Act, 2009; “legal person” means any entity other than a natural person that can establish a customer relationship with a financial institution and that is capable of suing and being sued in a court of law; “Minister” means the Minister responsible for finance; “negative data” means adverse information relating to a data subject including defaults, arrears, bankruptcies and other non- compliance to contractual or legal obligations; “personal data” means any information that can be used to identify a person, including name, identification number and address; [11th September 2023] Credit Reporting 7 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL “positive data” means favourable information relating to a data subject on contractual or legally compliant behaviour; “regulatory authority” means an authority or a public body which exercises any functions of prudential, technical or economic regulation on the basis of statutory powers; and “Seychelles Revenue Commission” means the Seychelles Revenue Commission established under section 3 of the Seychelles Revenue Commission Act, 2009. “signature” means a written, and often stylized depiction of someone's name, or other mark that a person writes on documents as a proof of identity and intent. Exemption from application 3. This Act does not apply to — (a) any funds provided by the Central Bank in its capacity as lender of last resort, for resolution or financial stability purposes made in line with written law; (b) instruments issued by the Central Bank for liquidity management; (c) borrowing between interbank market participants, the Development Bank of Seychelles established under the Development Bank of Seychelles Decree (Cap 63), and the Housing Finance Company Limited; or (d) Government financing. PART II - ADMINISTRATION OF THE ACT Establishment of CIS 4. The Central Bank shall establish and operate the CIS to collect, store and process facility information on the data subjects from the data providers. [11th September 2023] Credit Reporting 8 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL Operation of CIS 5.(1) No person shall establish or operate a credit information system. (2) A person who contravenes subsection (1) commits an offence and shall be liable on conviction to a fine not exceeding level 5 on the standard scale or to imprisonment not exceeding 2 years or both. Functions of the Central Bank 6.(1) The Central Bank shall administer and enforce this Act. (2) Without prejudice to subsection (1), the Central Bank shall — (a) operate the CIS for the purposes of collection, processing and dissemination of facility information of data subjects in the form of credit reports and other services including statistical reports; (b) have oversight of the CIS for the purpose of ensuring its safety, security, efficient and effective operation; (c) regulate the data users and data providers in respect of CIS related activities; (d) manage disputes and complaints in accordance with this Act; (e) provide information to data subjects in respect of their rights, and the responsibilities of data users and data providers under this Act; (f) consult any person, organisation or institution with regard to any matter under this Act; (g) perform such other functions as may be necessary to ensure the effective implementation and administration of this Act. [11th September 2023] Credit Reporting 9 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL Powers of the Central Bank 7.(1) The Central Bank shall have powers to do things necessary or expedient for, or in connection with the performance of its functions under this Act. (2) Without prejudice to the generality of subsection (1), the powers of the Central Bank shall include the power to — (a) access and process data in the CIS; (b) grant access to the CIS to qualified persons for the purpose of maintenance, support and other technical work as may be required for the proper functioning of the CIS; (c) appoint such agents, experts or consultants and procure goods or services as may be necessary for the performance of its functions; (d) amend data within the CIS to rectify system issues; (e) impose and collect such fees as may be prescribed under this Act; (f) manage access to the CIS and establish procedures and rules for persons accessing the CIS; (g) establish operating procedures and data validation processes in relation to the CIS; (h) perform onsite and offsite examination of data providers and data users to determine and assess their compliance with this Act; (i) coordinate and cooperate with other authorities within the scope of this Act; (j) conduct education and advocacy programmes in relation to the functions of the CIS; [11th September 2023] Credit Reporting 10 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (k) issue regulations, directions and guidelines as may be necessary for the implementation of this Act; (l) do all such other things as the Central Bank deems fit to allow for the performance of its functions under this Act or which may be incidental to or consequential upon the performance of those functions. Cooperation with authorities in Seychelles 8. The Central Bank may share or disclose information resulting from inspections or through its supervision of the CIS with a relevant local regulatory authority or law enforcement agency if the Central Bank has the reasonable belief that such sharing or disclosure is necessary for the prevention or detection of criminal offences. PART III - DATA PROVIDERS Categories of data providers 9.(1) The Categories of data providers which are required to submit data to the CIS shall be as specified in the First Schedule. (2) Data providers shall submit data as required under the relevant category following the issuance of regulations, except data under Category 1 which shall be provided upon the coming into operation of this Act. (3) The Central Bank may issue regulations, guidelines and rules to provide for the requirements on data submission, quality, usage and any other related matters for each category of data provider. Submission of data by data provider 10.(1) Data submitted by a data provider to the CIS shall only include such information as is necessary to — (a) obtain a complete and valid identification of a data subject; (b) evaluate the creditworthiness of a data subject; and [11th September 2023] Credit Reporting 11 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (c) build the credit history of a data subject. (2) A data provider shall submit information to the CIS in respect of a data subject in accordance with the Second Schedule. (3) A data provider shall submit information to the CIS of month end information as specified by the Central Bank. (4) A data provider which fails to provide information to the CIS as required under subsections (1), (2) and (3) shall be liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of the day during which the contravention continues. (5) Data submitted by a data provider relating to gender, age and nationality of a data subject shall not be processed for the sole purpose of determining a person's creditworthiness and shall be used for statistical purposes by the Central Bank. Duty to inform data subjects 11.(1) A data provider shall provide the following information verbally and in writing to a data subject prior to submission of the subject's data to the CIS — (a) the manner in which its information may be used and processed; (b) the data users which may access their information; (c) the name of the institution operating the CIS; and (d) the procedures which allow the data subject to exercise its rights of access and verification in relation to its own data. (2) A data provider which fails to provide information to a data subject under subsection (1) is liable to an administrative penalty not exceeding SCR100,000. [11th September 2023] Credit Reporting 12 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (3) Subsection (1) shall not apply to — (a) the Judiciary of Seychelles prior to the submission of a data subject's declaration of bankruptcy by the Court; and (b) the Seychelles Revenue Commission prior to the submission of information pertaining to a data subject's failure to pay taxes. Duty to obtain consent 12.(1) Subject to subsection (2), prior to accessing a data subject's information from the CIS, a data provider shall — (a) conduct and record appropriate identity verification of the data subject; and (b) record the data subject's consent in accordance with the form specified in the Third Schedule. (2) A data provider shall not require the consent of the data subject to access information which the data provider had submitted to the CIS under Regulation 6 of the Central Bank of Seychelles (Credit Information System) Regulations, 2012 (S.I. 10 of 2012) as a participating institution. (3) Upon request by the Central Bank, a data provider shall provide evidence of consent made by a data subject to submit its data to the CIS. (4) A data provider who fails to obtain and record the consent of a data subject in accordance with subsection (1), commits an offence and is liable upon conviction to a fine of Level 5 on the Standard Scale. (5) A data provider who fails to provide evidence of a data subject's consent to the Central Bank commits an offence and is liable upon conviction to or a fine of Level 5 on the Standard Scale. (6) Section 12 shall not apply to the Seychelles Revenue Commission when accessing a data subject's information from the CIS to [11th September 2023] Credit Reporting 13 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL assess the suitability of a compromise agreement with the data subject, in line with section 22 of the Revenue Administration Act (Cap 308). PART IV - DATA SUBJECTS Right to access own information 13. A data subject has the right to access and verify their information stored in the CIS through the CIS customer credit portal, or by request to a data user, in accordance with section 14. Access to credit reports 14.(1) A data subject may, once registered by the Central Bank in the required form and manner, access the CIS customer credit portal and have unlimited and free access to the data subject's credit report. (2) A data user shall, within two working days, upon request by its data subject, provide the data subject's credit report — (a) at no fee for credit reports which are requested twice in a calendar year; and (b) at a fee as specified in the Fourth Schedule for any additional reports requested during the calendar year. (3) A data user who contravenes subsection (2) is liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of a day during which the contravention continues. Access reports 15. The CIS Operator shall provide within two working days, upon request by a data subject, an access report of the names of data users who have accessed their information and the report shall be provided — (a) at no fee for a report requested once in a calendar year; and [11th September 2023] Credit Reporting 14 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (b) at a fee as specified in the Fourth Schedule, for any additional reports requested during the calendar year. Data access 16. The Central Bank may prescribe the procedures and rules for access to the CIS by data providers, data users, data subjects and other persons provided for under this Act. Restriction of access 17. Access to the information contained in the CIS shall be restricted to the entities and conditions specified under section 26. Purpose of access 18.(1) A data user shall have access to the information contained in the CIS for the following purposes — (a) to assess the credit worthiness of a data subject; (b) to enable the data user to make informed decisions regarding the provision of credit, goods or services; and (c) as authorised by the data subject in writing. (2) A person who knowingly or willfully accesses or obtains information from the CIS without lawful authority or under false pretense commits an offence and is liable upon conviction to imprisonment not exceeding 2 years or to a fine of Level 6 on the Standard Scale. Data quality 19.(1) The Central Bank shall safeguard the accuracy of data stored in the CIS by — (a) acquiring and implementing the necessary technology, protocols and procedures in relation to the operations and functioning of the CIS; [11th September 2023] Credit Reporting 15 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (b) developing validation rules and tools ensuring adequate data quality in the CIS; and (c) conducting periodic audits of the CIS by officers of the Central Bank or by a qualified third party. Validity of information 20. Information contained within the CIS shall be considered valid unless it has been flagged as a result of the information being — (a) disputed in accordance with section 31; (b) the subject of mediation or arbitration; or (c) the subject of proceedings before a Court. Accuracy of information 21.(1) A data provider shall submit to the CIS accurate and up to date information in accordance with the provisions of this Act. (2) A data provider shall take reasonable measures to verify the accuracy of a data subject's information and identity prior to submission to the CIS. (3) A data provider which furnishes inaccurate information to the CIS is liable to an administrative penalty not exceeding SCR100,000 and an additional penalty of SCR2,500 for each day or part of a day during which the contravention continues. (4) A person who knowingly submits inaccurate information to the CIS commits an offence and is liable on conviction to a fine of Level 6 on the Standard Scale or to imprisonment not exceeding 2 years or both. Data security 22.(1) The Central Bank shall take reasonable measures to maintain the integrity of the CIS database, network technology and infrastructure. [11th September 2023] Credit Reporting 16 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (2) The Central Bank may issue regulations, instructions or guidelines related to specific security measures in the CIS to data providers and data users. Data protection 23.(1) A data provider shall ensure that its data subjects' information is protected from unauthorised access, use, modification or disclosure. (2) A data provider shall implement data recovery and disaster plans, which shall be submitted to the Central Bank upon request. (3) A data provider which fails to implement or submit data recovery and disaster plans to the Central Bank in accordance with subsection (2), is liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of a day during which the contravention continues. System downtime or outage 24.(1) The Central Bank shall not be liable for any loss or damage resulting from downtime or system outage of the CIS. (2) The Central Bank shall, through the local media as soon as is practicable, advise stakeholders and the public of any downtime or system outage of the CIS. Data processing and usage 25.(1) Data processed by the CIS shall be limited to the following activities — (a) evaluating the creditworthiness of a data subject by a data user; (b) allowing a data user to make an informed decision regarding the provision of credit, goods and services subject to deferred payment to a data subject; and [11th September 2023] Credit Reporting 17 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (c) monitoring and analysis of credit trends by the Central Bank which are relevant to the Central Bank's mandate, including those pertaining to price and financial stability. (2) A person who receives, uses, compiles and processes information from the CIS for a purpose other than that which has been provided for under this Act commits an offence and is liable on conviction to a fine of Level 5 on the Standard Scale or to imprisonment not exceeding 2 years or both. Data confidentiality 26.(1) Information contained within the CIS is confidential and may only be disclosed — (a) to a data subject in relation to the data subject's own data; (b) to the Central Bank in accordance with the provisions of this Act; (c) to a third party as authorised by a power of attorney by the data subject concerned; (d) to a legal heir or legatee of a deceased data subject; (e) to the executor of a data subject's estate; (f) to a local regulatory authority or law enforcement agency in accordance with written law; (g) in accordance with a Court order; or (h) to a data user in accordance with the First Schedule. (2) A person who fails to comply with subsection (1), commits an offence and is liable on conviction to a fine of level 5 on the standard scale or imprisonment not exceeding 2 years or both. [11th September 2023] Credit Reporting 18 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (3) A person selling or offering to sell data from the CIS commits an offence and is liable on conviction to a fine of level 6 on the standard scale or imprisonment not exceeding 3 years or both. Data submission 27.(1) A data provider shall submit identification and facility information to the CIS in respect of a data subject in accordance with the Second Schedule to this Act. (2) A data provider which fails to provide the requisite information in the CIS in accordance with subsection (1) is liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of a day during which the contravention continues. (3) A person who, with intent to deceive, makes false entries or fails to enter material items in the CIS, commits an offence and is liable on conviction to a fine of Level 6 on the Standard Scale or to imprisonment not exceeding 3 years or both. Data validation 28.(1) Data submitted to the CIS by a data provider shall be validated by the CIS prior to the data upload to the CIS database. (2) A data provider shall be informed of errors identified by the CIS following the data validation process provided for under subsection (1), and the data provider shall, within the timeframe directed by the Central Bank, correct and submit the correct data to the CIS. (3) A data provider who fails, refuses or delays to correct and submit information in accordance with subsection (2) shall be liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of a day during which the contravention continues. Data retention 29.(1) Information reflecting the last 24 months of repayment or non- repayment of active facilities shall be available to the data subjects and data users. [11th September 2023] Credit Reporting 19 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (2) Positive data collected in the CIS shall be available to the data users for a period of 5 years from the date of full repayment of a facility. (3) Negative data collected in the CIS shall be available to the data users for a period of 5 years as from — (a) the date of a data subject's full repayment of outstanding balances; (b) the date the debt is written off, settled whether by compromise or through a decision of a court releasing the data subject from liability, or otherwise liquidated; or (c) the date of a data subject's discharge from bankruptcy. Archive 30.(1) The Central Bank shall maintain an archive to store all data collected in the CIS for a period of 25 years from the date at which the data is no longer available to data users, and after which the data shall be erased from the archive. (2) A request to access information stored within the archive shall be managed by the Central Bank. (3) Access to information in the archive shall be limited — (a) to a data subject in relation to the data subject's own information; (b) to the CBS and data provider if relevant to a dispute submitted under section 31; (c) as provided for by a Court order; and (d) to a local regulatory authority or law enforcement agency in accordance with written law. [11th September 2023] Credit Reporting 20 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (4) The Central Bank may access and process information, in statistical format, contained within the archive to assist the Central Bank in the formulation of its policies to support financial stability, financial inclusion and monetary policy objectives. Disputes and complaints 31.(1) Where a data subject believes that the data subject's information contained within the CIS is inaccurate, the data subject shall either submit a dispute directly to the data provider or lodge a dispute through the CIS customer credit portal. (2) A data provider shall, within five working days of receipt of a dispute, — (a) amend the information contained within the CIS where it is found that the information contested is erroneous, and inform the data subject and the CIS operator of the amendment in writing; or (b) inform the data subject and the CIS operator in writing where the information contested is correct according to its records. (3) A data provider which fails to respond to a dispute in accordance with subsection (2) is liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of a day during which the contravention continues. (4) A data subject, being dissatisfied with the outcome of the data subject's dispute in accordance with subsection 2, may submit a complaint to the Central Bank. (5) A data provider which is the subject of, or has information relevant to a complaint shall promptly cooperate with the Central Bank in its efforts to resolve the complaint by providing all relevant documents, information and communication to the Central Bank. [11th September 2023] Credit Reporting 21 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (6) A data provider which fails to comply with subsection (5) is liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of a day during which the contravention continues. Examination 32.(1) The Central Bank may carry out an examination of a data provider or data user where the Central Bank determines it is necessary or desirable to ascertain whether they are complying with the provisions of this Act. (2) In conducting an examination under subsection (1), the Central Bank shall have the powers to — (a) access any premises reasonably believed to be premises at which a data provider or data user is carrying on its business; (b) inspect relevant documentation or information, and examine those documents or information where they are located or where data is processed; (c) obtain a copy of any documents or information in a form that can be taken away and is visible and legible; and (d) inspect equipment, systems or premises used to store or process data, documents or information, and request the running, processing or managing of any such systems. (3) An examination under subsection (1) shall be conducted by officers of the Central Bank or persons authorised by the Central Bank during business hours. (4) The Central Bank and any person authorised under this section to examine a data provider or data user shall be subject to the confidentiality provisions of this Act and section 11 of the Central Bank of Seychelles Act in respect of information acquired in the course of performing functions under this section and may require — [11th September 2023] Credit Reporting 22 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL (a) a director, officer, employee or agent of a data provider to furnish such information as deemed necessary for the purpose of the examination; or (b) any such director, officer, employee or agent to produce for inspection any books, records or other documents in their possession containing or likely to contain any such information. (5) A director, officer, employee or agent of a data provider or data user who impedes, prevents or obstructs an examination under this section commits an offence and is liable upon conviction to imprisonment not exceeding 2 years or to a fine of Level 5 on the Standard Scale. PART V - INFRINGEMENTS, REMEDIAL MEASURES AND PENALTIES Offences 33.(1) The Central Bank may impose penalties on data providers and data users if they — (a) contravene provisions relating to the supply of accurate, timely and up-to-date data; (b) fail to collaborate with the Central Bank during an examination; (c) fail to obtain or prove a data subject's consent prior to accessing the CIS; (d) fail to disclose information as lawfully requested by a data subject; or (e) do not adopt adequate security or consumer protection measures. Enforcement action 34.(1) Where a data provider or data user fails to comply with any of the provisions of this Act or any regulations, directives, rules, or guidelines [11th September 2023] Credit Reporting 23 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL made under this Act, the Central Bank may, in addition to a penalty under this Act, take one or more of the following enforcement actions against the data provider or data user — (a) issue a written warning; (b) issue written orders to cease and desist from such non- compliance and to undertake remedial action; (c) issue written orders to perform such acts as are necessary to comply with the Act, regulations, directions or guidelines; (d) impose administrative penalties, not exceeding SCR1,000 per day for each day or part of a day that the act constituting the non-compliance continues; or (e) restrict, suspend or revoke access to the CIS temporarily or permanently. (2) The enforcement actions specified under this section shall be determined in particular cases by the Central Bank and shall be applied following consideration of — (a) the nature, duration, gravity and extent of the contravention; (b) any loss or damage suffered as a result of the contravention; (c) the monetary gain derived from the contravention; (d) whether the person has previously been found in contravention of similar or different provisions of this Act; and (e) the impact of the contravention on the functioning of the CIS. [11th September 2023] Credit Reporting 24 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL Right to submit written representation and oral submissions 35.(1) The Central Bank shall give an opportunity to a data provider or data user to submit a written representation and oral submissions on a matter before the Central Bank within the timeframe specified in writing before imposing a penalty or taking any enforcement action under section 34. (2) Notwithstanding subsection (1), the Central Bank may immediately restrict or suspend a data provider or data user's access to the CIS where the Central Bank is of the reasonable belief that such action is necessary to safeguard the integrity of the CIS. (3) Where a data provider or data subject's access to the CIS has been restricted or suspended in accordance with subsection (2), the Central Bank shall give an opportunity to the data provider or data subject to submit a written representation and oral submissions within the timeframe specified in writing as to why their access should be restored. Publication and sharing of information 36. The Central Bank may publish in a daily newspaper or other media or share with local regulatory authorities, law enforcement agencies or international bodies the following — (a) all general or individual measures adopted under this Act, including enforcement measures, imposition of penalties and its redress decisions; and (b) information extracted from the CIS in a statistical format for educational or information purposes. PART VI - MISCELLANEOUS Protection of action taken in good faith 37. An employee or agent of the Central Bank shall not be liable for damages for anything done or omitted to be done in good faith in the discharge or purported discharge of their functions under this Act. [11th September 2023] Credit Reporting 25 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL Regulations 38.(1) The Central Bank may, for the purpose of granting effect to the principles and provisions in this Act make regulations with regard to any matter required by this Act. (2) Without prejudice to the generality of subsection (1), regulations may provide for — (a) fees and services relating to the CIS; (b) credit scoring; (c) categorisation of data providers; (d) access and submission of data to the CIS; (e) technological security measures for use or access of the CIS; (f) amendment of Schedules; and (g) the efficient implementation, administration and enforcement of this Act. Consequential amendment of (Cap 26) and savings 39.(1) The Central Bank of Seychelles Act (Cap 26) is amended — (a) in section 2 by repealing the definition of “Credit Information System”; and (b) by repealing section 32A. (2) Notwithstanding the repeal under subsection (1) (b), any statutory instrument made under the repealed section shall remain in operation as if made under this Act until it is repealed in accordance with this Act. (3) The Central Bank may amend, vary or repeal such statutory instruments. [11th September 2023] Credit Reporting 26 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL FIRST SCHEDULE Sections 9(1) and 26 (1) (g) Category of Data Providers Data Data Users Category 1 Credit facilities Categories 1, 2, 3, Commercial banks, including 4, 5, 6 and 8 upon Development Bank of consumer loan, their designation Seychelles, credit unions, credit card, as a data provider. Housing Finance Company overdraft and Ltd employee loans Category 2 Government, public Employee loans enterprises and the Central Bank Category 3 Entities providing hire Hire purchase, purchase, credit sales or credit sales, financial leasing facilities financial leasing facilities Category 4 Credit facilities Insurance Companies Category 5 Telecommunication and Telecommunicatio utility companies n and Utility bills Category 6 Seychelles Revenue Tax Payments Commission Category 7 Judiciary Bankruptcy Category 8 Employee loans Private Enterprises [11th September 2023] Credit Reporting 27 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL SECOND SCHEDULE Section 10(2) Content of the submission of data subject's information by a data provider Identification Information Facility Information Natural Name Person Date of birth Number of active and Gender inactive facilities Nationality Facilitator or issuing National Identification Number institution (NIN) for Seychellois citizen Facility type Passport Number for non- Date approved Seychellois citizen Start / End Date Customer Identification number Currency allocated by data provider Amounts Address Instalment Details Classification Employment Status Past Due Details Employer Sector Status Income Purpose of Financing Vital Status Interest Rate Contact Details Security Details Company Name as reflected on Certificate of Incorporation for companies Registered business name (where applicable) Business registration number Customer identification number allocated by data provider Registered address Taxpayer Identification Number (where applicable) Nature of business Names of directors Legal Form Economic Sector Entity Status Entity Size Contact Details [11th September 2023] Credit Reporting 28 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL Other Entity Registered name (Partnership, Registration number Association, Customer identification Sole Traders, number allocated by data and NGO) provider Registered address Taxpayer Identification Number (where applicable) Type of entity Names of Partners and Board Members (where applicable) Legal Form Economic Sector Entity Status Entity Size Contact Details THIRD SCHEDULE Section 12(1) Consent of data subject (Natural Person) Purpose I …………………………………………. (NIN / Passport Number …………………………) provide consent to (name of data requestor) for the retrieval of my information contained within the Credit Information System (CIS), as established by the Credit Reporting Act, for the following purpose(s) - (cid:42) to be used as part of an application for a (facility type), and its management; (cid:42) for personal use [11th September 2023] Credit Reporting 29 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL Submission, access and use of data I consent to information relating to the facility being procured from the abovementioned entity to be submitted to the CIS and consent that this information may be accessed, processed and used by persons authorised in accordance with the Credit Reporting Act. Signature: ……………………. In the absence of a signature, insert finger print in the box below or produce valid photo identification. Witnessed by [Name] of [Name of entity]. Signature: Date: ________________ Consent of data subject (Company/Other Entity) Purpose I/We …………………………………………. (NIN/Passport Number …………………………) ………………………………………………. (NIN/Passport Number …………………………) ………………………………………………. (NIN/Passport Number …………………………) ………………………………………………. (NIN/Passport Number …………………………) ………………………………………………. (NIN/Passport Number …………………………) [11th September 2023] Credit Reporting 30 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL provide consent to (name of data requestor) for the retrieval of information pertaining to (insert name of entity) contained within the Credit Information System (CIS), as established by the Credit Reporting Act, for the following purpose(s) - (cid:42) to be used as part of an application for a (facility type), and its management; (cid:42) for business use Submission, access and use of data I/We consent to information relating to the facility being procured from the abovementioned entity to be submitted to the CIS and consent that this information may be accessed, processed and used by persons authorised in accordance with the Credit Reporting Act. Where consent is being provided for and on behalf of an entity, I confirm that I am authorised to consent and sign on behalf of (insert name of entity). Signature(s): ……………………. ……………………. …………………..... ……………………. ……………………. In the absence of a signature, insert finger print(s) in the box below or produce valid photo identification. Witnessed by [Name] of [Name of entity]. Signature: Date: [11th September 2023] Credit Reporting 31 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE BILL FOURTH SCHEDULE Sections 14(2)(b) and 15(b) Report fees 1. Any additional credit report requested by a SCR25.00 data subject from a data user during the calendar year 2. Any additional access report requested by a SCR50.00 data subject from the CIS Operator during the calendar year 3. Credit report requested by a data user from SCR25.00 the CIS