Credit Reporting Act, 2018
This section gives the Act its short title and says it starts on a date set by the Minister by statutory instrument.
- Jurisdiction
- Zambia
- Instrument
- Act or statute
- Citation
- Act 8 of 2018
- Version
- 31 Jul 2018
- Language
- en
- Official source
- View official record ↗
administrative decisions administrative law adverse action notification application rejection application scope board composition business naming certified copies collaboration company registration complaint handling complaints and appeals complaints handling complaints procedure compliance compliance deadlines compliance timing consent consumer credit information continuing offences credit information credit information accuracy credit information collection credit information disclosure +81 more
Statute overview
About this statute
This section gives the Act its short title and says it starts on a date set by the Minister by statutory instrument. This section defines key terms used in the Act, including access log, account, credit information, credit provider, and processing. This section says who the Act applies to: licensed credit reporting agencies, credit providers, data subjects, data providers, and anyone else the Bank designates. The Bank administers the Act and must licence, regulate, and supervise credit reporting agencies. The Bank must establish and maintain a register of credit reporting agencies.
Search within this statute
Search all stored provisions in this version.
Legal text
Provisions of Credit Reporting Act, 2018
Showing 65 of 65
Part
PART I
- 1
This section gives the Act its short title and says it starts on a date set by the Minister by statutory instrument.
1. This Act may be cited as the Credit Reporting Act, 2018, and shall come into operation on the date appointed by the Minister by statutory instrument. Short title and commencement - 2 Verify source ↗
Short title and commencement
This section defines key terms used in the Act, including access log, account, credit information, credit provider, and processing.
2. (1) In this Act, unless the context otherwise requires— Interpretation “ access log ” means a record of every access made to credit information held by a credit reporting agency; “ account ” means any account between a credit provider and a data subject that involves the provision of credit, and includes any new account created as a result of a scheme of arrangement involving one or more previous accounts; “ account general data ” includes— (a) (b) (c) (d) the identity of a credit provider; the account number; the capacity of the data subject, whether the subject is a borrower or a guarantor; the date when the account was opened and closed; 190 No. 8 of 2018] Credit Reporting (e) the type of credit facility and the currency in which that facility was provided; (f) the approved credit limit; (g) (h) the repayment period and terms of a credit facility; the status of the account; (i) the credit facility maturity date; (j) particulars for the identification of the asset used as security; (k) instalment amount payable; and (l) any other detail as may be prescribed; “ account repayment data ” includes— (a) (b) (c) (d) the amount last due; the total repayment made towards the previous credit facility; the outstanding balance on an account; and default data being— (i) amount past due and number of days past due; and (ii) date of settlement of amount past due; “ adverse action ” means any denial of credit cancellation or an unfavourable change in the terms and conditions of a transaction regarding a data subject based in whole or in part on information contained in a credit report; “ appeals tribunal ” means an ad hoc tribunal appointed and convened by the Minister as specified in section 49; “ appropriate authority ” means the Minister having responsibility for, or such public body having powers under, any other law over an incorporated or unincorporated entity and the management of credit information, and includes a public or statutory office, body or institution under the following laws: Cap. 107 Cap. 96 (a) (b) the Zambia Police Act; the Narcotic Drugs and Psychotropic Substances Act; Credit Reporting [No. 8 of 2018 191 (c) the Financial Intelligence Centre Act, 2010; (d) the Anti-Corruption Act, 2012; (e) the Prohibition and Prevention of Money Laundering Act, 2001; Act No 46 of 2010 Act No. 3 of 2012 Act No. 14 of 2001 (f) the Zambia Revenue Authority Act; Cap. 321 (g) the Information and CommunicationTechnologies Act, 2009; Act No. 15 of 2009 (h) the Banking and Financial Services Act, 2017; (i) the Companies Act, 2017; (j) the Corporate Insolvency Act, 2017; (k) the Standards Act, 2017; (l) the Compulsory Standards Act, 2017; and (m) the Competition and Consumer Protection Act, 2010; “ Bank ” means the Bank of Zambia established under the Constitution; “ beneficial owner ” has the meaning assigned to the words in the Companies Act, 2017; “ chief executive officer ” means the principal officer of a credit reporting agency, whether that person is or is not a director; “ company ” has the meaning assigned to the word in the Companies Act, 2017; “ constituent documents ” means the articles of association, incorporation form and share certificate; “ control ” has the meaning assigned to the word in the Companies Act, 2017; “ court ” means a court of competent jurisdiction; “ credit ” includes— Act No. 7 of 2017 Act No. 10 of 2017 Act No. 9 of 2017 Act No. 4 of 2017 Act No. 3 of 2017 Act No. 24 of 2010 Cap. 1 Act No. 10 of 2017 Act No. 10 of 2017 Act No. 10 of 2017 192 No. 8 of 2018] Credit Reporting (a) (b) (c) (d) (e) (f) a loan, an overdraft facility or other kind of credit provided by a credit provider to, and for the use of, a person; financing under a lease or hire purchase agreement; an advance, trade credit or other facility, in whatever form or by whatever name called, whereby the person to whom the benefit is given has access, directly or indirectly, to the funds or property of the person giving it; a guarantee or any security in relation to the obligations of a person; any hire purchase, leasing, factoring, debt trading and such similar dealings or transactions; or any other dealing or transaction as may be prescribed by the Minister, on the recommendation of the Bank; “ credit information ” means information relating to a data subject’s— (a) identification, full name and date of birth; (b) place of residence and previous places of residence; (c) marital status and spouse’s name; (d) place of employment and previous places of employment; (e) paying habits and outstanding debt obligations; (f) assets and inquiries made of credit history or information relating to a legal entity or business that would identify the legal entity or business information on incorporation; (g) tax, directors governance, outstanding debt obligations, assets or credit history; or (h) other business details; “ credit provider ” means a person who carries on a business involving the provision of credit, and includes— Credit Reporting [No. 8 of 2018 193 (a) (b) (c) (d) a financial service provider within the meaning of the Banking and Financial Services Act; a subsidiary of a financial service provider; Act No. 7 of 2017 a money lender licensed under the Money Lenders Act; Cap. 398 a person whose business, whether or not the person carries on any other business, is that of providing finance for the acquisition of goods by way of leasing or hire purchase; (e) a person who provides goods or services on credit; or (f) any other person as may be designated by the Bank; “ Credit Registry ” means the database established by the Bank under section 17; “ credit report ” means information relating to the financial obligations of a person, including the payment history of such obligations, guarantees, publicly available information and any other relevant data compiled by a credit reporting agency; “ credit reporting agency ” means a credit registry or company licensed in accordance with this Act, to collect credit reports and process information on the credit status of a data subject; “ data controller ” has the meaning assigned to the words in the Electronic Communications and Transactions Act, 2009; “ data provider ” means a person providing credit information to a credit reporting agency or credit provider; “ data system ” means any system automated or otherwise, which is used, in whole or in part, by a credit reporting agency for the processing of credit information, and includes any document and equipment forming part of the system; Act No. 21 of 2009 “ data subject ” has the meaning assigned to the words in the Electronic Communications and Transactions Act, 2009; “ licence ” means a licence granted in accordance with section Act No. 21 of 2009 9; “ personal information ” excludes information about a data subject on— 194 No. 8 of 2018] Credit Reporting (a) credit information; (b) (c) the data subject’s name, present and past addresses, taxpayer registration number or other numerical reference, cataloguing or reference scheme used for identification purposes; and any other relevant information about the data subject which is reasonably required for the purpose of this Act; “ processing ” means collecting, recording, holding, storing or transferring credit information or carrying out an operation or sets of operations on the credit information, including— (a) (b) (c) organisation, adaptation or alteration of credit information; retrieval, consultation on, or use of, credit information; or alignment, combination, correction, erasure or destruction of credit information; “ Register ” means the Register established and maintained in accordance with section 5; “ Registrar ” means the person appointed as Registrar of Banks and Financial Institutions in accordance with the Banking and Financial Services Act, 2017; “ regulatory statement ” has the meaning assigned to the words in the Banking and Financial Service Act, 2017; “ senior management officer ” includes the chief executive officer or any other officer as determined by the Bank; “ significant shareholder ” has the meaning assigned to the words in the Banking and Financial Services Act, 2017; “ subscriber ” means a person who has entered into a subscriber agreement with a credit reporting agency; and “ subscriber agreement ” means a written agreement providing a subscriber with access to credit information held by a credit reporting agency. Act No. 7 of 2017 Act No. 7 of 2017 Act No. 7 of 2017 Application of Act
Part
part on information contained in a credit report;
- 3 Verify source ↗
Application of the Act
This section says who the Act applies to: licensed credit reporting agencies, credit providers, data subjects, data providers, and anyone else the Bank designates.
3. This Act applies to credit reporting agencies licensed under this Act, credit providers, data subjects, data providers and any other person designated by the Bank. Credit Reporting [No. 8 of 2018 195 PART II ADMINISTRATION
Part
PART II
- 4 Verify source ↗
Administration of Act
The Bank administers the Act and must licence, regulate, and supervise credit reporting agencies.
4. (1) The Act shall be administered by the Bank. Administration of Act (2) The Bank shall — (a) licence, regulate and supervise credit reporting agencies; (b) maintain proper standards of conduct and acceptable credit reporting practices; (c) take measures to protect the interests of data subjects; (d) protect the integrity of the credit reporting system; and (e) do any other things that are necessary or incidental to the performance of its functions as provided in this Act. PART III LICENSING OF CREDIT REPORTING AGENCIES
Part
PART III
- 5 Verify source ↗
Register of credit reporting agencies
The Bank must establish and maintain a register of credit reporting agencies.
5. (1) The Bank shall establish and maintain a Register of credit reporting agencies in which shall be entered— (a) particulars of a credit reporting agency; (b) notices of matters which are required, in accordance with this Act to be entered in the Register; and (c) such other matters as may be prescribed. (2) The Register may be established and maintained wholly or partly in electronic form. Register of credit reporting agencies - 6 Verify source ↗
Inspection of Register
The Register must be open to the public for inspection during normal working hours, but a prescribed fee must be paid.
6. (1) Subject to this Act, the Register shall, on payment of a prescribed fee, be open for inspection by the public during normal working hours. Inspection of Register (2) A copy of an entry in the Register or an extract from the Register certified by the Registrar, may be admitted in evidence without further proof and without production of the original copy. - 7 Verify source ↗
Operating credit reporting agency without licence
A person must not establish, maintain, assist in, or hold out as operating a credit reporting agency unless licensed under the Act.
7. (1) A person shall not— (a) establish, maintain or hold out as providing or maintaining a credit reporting agency, unless that person is licensed in accordance with this Act; or (b) assist in establishing or maintaining, or hold out as providing or maintaining, or carrying on a business as a Operating credit reporting agency without licence 196 No. 8 of 2018] Credit Reporting credit reporting agency that is not established and operated by a company licensed in accordance with this Act. (2) A person who contravenes this section commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both. Application for credit reporting licence - 8 Verify source ↗
Application for credit reporting licence
A company may apply to the Bank for a licence to establish and operate a credit reporting agency, and an applicant may withdraw the application before the licence is granted or rejected.
8. (1) A company may apply to the Bank for a licence to establish and operate a credit reporting agency in the prescribed manner and form on payment of a prescribed fee. (2) An applicant may withdraw an application for a licence, by notice in writing to the Bank at any time before the licence is granted or rejected. (3) The Bank shall, in considering an application for a licence, made in accordance with subsection (1), have regard to the— (a) capital resources of the applicant; (b) adequacy and integrity of the operational systems of the applicant; (c) prospects for the profitable operation of the business; (d) transparency of the legal, operational, managerial, governance and ownership structures; and (e) character and experience of the directors, shareholders, beneficial owners or persons proposing to be concerned in the management of the business. (4) This section does not apply to a Bank licenced under the Banking and Financial Services Act, 2017. - 9 Verify source ↗
Consideration and grant of credit reporting agency licence
The Bank must grant a credit reporting licence within 120 days if the applicant meets the Act’s requirements. The licence lets the holder carry out specified credit-reporting activities, and the agency must not act outside the licence terms.
9. (1) The Bank shall, where the applicant meets the requirements of this Act, within one hundred and twenty days of receipt of the application for a credit reporting licence as provided under section 8, grant the licence. (2) A licence granted under subsection (1) shall authorise the holder of the licence to— (a) obtain and receive credit information; (b) process, store, update, manage and disseminate information of data subjects in accordance with this Act; (c) compile and maintain files of information on data subjects from which credit reports shall be generated; Act No. 7 of 2017 Consideration and grant of credit reporting agency licence Credit Reporting [No. 8 of 2018 197 (d) develop a credit scoring system; (e) provide specialised literature relating to its activities; (f) carry out market and statistical research relating to matters set out in this Act; and (g) carry out any other activity as may be prescribed. (3) A credit reporting agency shall not provide or offer to provide services in breach of the terms and conditions of the licence. - 10 Verify source ↗
Validity of licence
A section 9 licence is subject to its attached terms and conditions, an annual prescribed fee, and compliance with the licence, the Act, and related regulations and rules.
10. (1) A licence granted under section 9 shall be subject to the terms and conditions attached to that licence. Validity of licence (2) A licence granted under section 9 shall be subject to the payment of an annual prescribed fee and to compliance, by the licensed credit reporting agency, with the conditions of the licence and this Act and regulations and rules made under this Act. - 11 Verify source ↗
Variation of licence
The Bank may vary a licence’s terms and conditions if a licensee applies.
11. The Bank may, on the application of a licensee, vary the terms and conditions of a licence as specified by the Bank. - 12 Verify source ↗
Rejection of application
The Bank must reject a credit reporting licence application within 120 days if any listed grounds apply, and if it rejects the application it must notify the applicant in writing and give reasons.
12. (1) The Bank shall , within one hundred and twenty days of receipt of an application for a credit reporting licence, reject an application by an applicant to operate a credit reporting agency if the— Variation of licence Rejection of application (a) activity or business to be carried out by the applicant contravenes any law; (b) applicant submits false information in relation to the application; (c) applicant fails to comply with the requirements of this Act; (d) past conduct of the applicant, or any officers, directors or representatives of the applicant will affect carrying on the business with honesty and integrity in accordance with this Act, or any term or condition of the licence; (e) applicant has made a false or misleading statement, with respect to any matter that the Bank considers material, in an application or in any of the information or material submitted to the Bank in support of an application; (f) applicant directly or indirectly holds a controlling interest or share in a debt collection agency or a regulated entity; or (g) the issuance of the licence is not in the public interest. 198 No. 8 of 2018] Credit Reporting Surrender of licence Transfer of licence Suspension or cancellation of licence (2) The Bank shall, where the Bank rejects an application for a licence, inform the applicant, in writing, and give reasons for the rejection. - 13 Verify source ↗
Surrender of licence
If a licensed credit reporting agency decides to stop operating, it must notify the Bank in writing and agree with the Bank on the terms for surrendering its licence. If the licence is surrendered under this rule, it is cancelled and the agency stops being entitled to any benefits.
13. (1) Where a licensed credit reporting agency decides to cease operations, it shall notify the Bank, in writing, and shall agree with the Bank the terms and conditions of the surrender of the licence, with particular reference to anything done or any benefit obtained under the licence. (2) Where a credit reporting agency surrenders its licence, in accordance with subsection (1), the licence shall be cancelled and the credit reporting agency shall cease to be entitled to any benefits. - 14 Verify source ↗
Transfer of licence
A licence cannot be transferred, except when there is an amalgamation or other corporate restructuring.
14. A licence shall not be transferable, except in the event of an amalgamation or other corporate restructuring. - 15 Verify source ↗
Suspension or cancellation of licence
The Bank may suspend or cancel a credit reporting agency’s licence for listed compliance or insolvency-related grounds, but must first notify the agency, give reasons, and allow up to 30 days to show cause.
15. (1) Subject to this Act, the Bank may suspend or cancel a licence if the licensed credit reporting agency— (a) obtained the licence by submission of false information or statement; (b) contravenes this Act, any other law or any terms and conditions of the licence; (c) fails to comply with a decision or guidelines made by the Bank; (d) enters into receivership or takes any action for the winding up or dissolution of the company; (e) enters into any scheme of arrangement, other than for purposes of amalgamation or corporate restructuring; or (f) is the subject of an order that is made by a court for its compulsory winding- up or dissolution. (2) The Bank shall, before suspending or cancelling a licence in accordance with subsection (1), notify the credit reporting agency, in writing, of such an intention and— (a) give the reasons for the intended suspension or cancellation; and (b) require the agency to show cause, within a period not exceeding thirty days, why the licence should not be suspended or cancelled. Credit Reporting [No. 8 of 2018 199 (3) The Bank shall not suspend or cancel a licence, as provided in this section if the credit reporting agency takes remedial measures, to the satisfaction of the Bank, within the period referred to in subsection (2). (4) The Bank shall, where the Bank suspends or cancels a licence, in accordance with this section, publish the suspension or cancellation, as the case may be, in the Gazette and a daily newspaper of general circulation in Zambia. - 16 Verify source ↗
Handling of credit information when licence cancelled
If a credit reporting agency’s licence is cancelled, it must hand over all credit information to the Bank within the time the Bank sets. The Bank may keep the information in the Credit Registry or send it to another credit reporting agency, and that agency must notify affected data subjects in writing.
16. (1) A credit reporting agency whose licence has been cancelled, in accordance with section 15, shall, within a period determined by the Bank, handover all credit information within its possession to the Bank. Handling of credit information when licence cancelled (2) The Bank may, on receipt of the credit information referred to in subsection (1)— (a) keep the information in the Credit Registry; or (b) hand over the information to another credit reporting agency, on the terms that the Bank may determine. (3) Where the Bank decides to hand over information to another credit reporting agency as provided under subsection (2) (b), that credit reporting agency shall notify, in writing, all data subjects whose information has been handed over to it. (4) An obligation in relation to a data subject and consent previously obtained from a data subject by a credit reporting agency whose licence has been cancelled, in accordance with section 15, shall pass to the credit reporting agency to which the information is handed over as provided under subsection (2) (b). (5) A person who contravenes subsection (1) commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both. 200 No. 8 of 2018] Credit Reporting PART IV CREDIT REGISTRY Establishment of Credit Registry Act No. 7 of 2017 Retention of information on Credit Registry
Part
PART IV
- 17 Verify source ↗
Establishment of Credit Registry
The Bank must run a Credit Registry, some credit providers must supply credit information to it, and the Bank sets who may access registry information and how.
17. (1) The Bank shall establish, maintain and operate a Credit Registry which shall be a database for credit information. (2) A credit provider regulated under the Banking and Financial Services Act, 2017 shall supply credit information to the Credit Registry. (3) The Bank may impose the obligation to supply credit information to the Credit Registry on other credit providers. (4) The Bank shall prescribe the category of persons who may access and the manner in which information from the Credit Registry may be accessed. (5) A person who contravenes this section commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both. - 18 Verify source ↗
Retention of information on Credit Registry
The Bank may keep Credit Registry information for at least 10 years, but some identified credit-application or credit-agreement information has shorter limits, and anonymised information may be kept indefinitely.
18. The Bank may retain information kept on the Credit Registry for at least ten years, except that— (a) in the case of credit information which identifies a data subject and relates to a credit application, for a period not exceeding six months; (b) in the case of credit information which identifies a data subject and relates to a credit agreement, for a period not exceeding five years; and (c) in case of anonymised information for an indefinite period. PART V MANAGEMENT OF CREDIT REPORTING AGENCY Beneficial interest and control of credit reporting agency Act No. 7 of 2017
Part
PART V
- 19 Verify source ↗
Beneficial interest and control of credit reporting agency
A person must not buy shares or a beneficial interest in a credit reporting agency without prior written approval from the Bank.
19. (1) A person shall not acquire shares or a beneficial interest in a credit reporting agency without the prior written approval of the Bank. (2) A person shall not acquire a beneficial interest in a credit reporting agency if that person is a credit provider regulated under the Banking and Financial Services Act, 2017 or that person’s significant shareholder. Credit Reporting [No. 8 of 2018 201 (3) A person who contravenes this section commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both. - 20 Verify source ↗
Owning of shares in another credit reporting agency
A person controlling a credit reporting agency must not own shares in another credit reporting agency or take/keep control of another agency without the Bank’s prior written approval. No person may hold shares as a nominee.
20. (1) A person who controls a credit reporting agency shall not own any share in another credit reporting agency, or acquire and maintain control over another agency, without the prior written approval of the Bank. (2) A person shall not hold shares in a credit reporting agency as a nominee. (3) A person who contravenes this section commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both. - 21 Verify source ↗
Appointment of board of directors
A credit reporting agency must have a board with a majority of non-executive directors, and board appointments need the Bank’s prior written approval.
21. (1) A credit reporting agency shall have a board of directors with a majority of its members being non-executive. (2) A person shall not be appointed as a member of the board of directors of a credit reporting agency without the prior written approval of the Bank. Owning of shares in another credit reporting agency Appointment of board of directors (3) A person shall not be appointed as a member of the board of directors of a credit reporting agency if the person is a member of a board of a credit provider regulated under the Banking and Financial Services Act, 2017 or another credit reporting agency. Act No. 7 of 2017 (4) Where a director of the board or a member of the senior management of a credit reporting agency ceases to hold office, the credit reporting agency shall, within fourteen days of such cessation, notify the Bank, in writing, of the cessation and reasons for the cessation. - 22 Verify source ↗
Disqualification for appointment as director or senior manager
A person cannot be appointed as a director or senior manager if they fail any listed fitness, age, capacity, bankruptcy, conduct, suspension, insolvency, or misconduct conditions.
22. (1) A person shall not qualify for appointment as a director of the board or a senior management officer if that person— (a) is not a fit and proper person as prescribed by the Bank; (b) is below the age of twenty one years; (c) is incapable of discharging the functions of a director of a board or senior management office; (d) is an undischarged bankrupt; Disqualification for appointment as director or senior manager 202 No. 8 of 2018] Credit Reporting Act No. 9 of 2017 (e) has been convicted of an offence involving fraud, forgery or uttering a false document; (f) is serving a suspension or has been removed from office as specified in this Act; (g) has an adverse listing with any credit reporting agency, been a director of the board or senior management officer of a company which has been adjudged insolvent in accordance with the Corporate Insolvency Act, 2017 entered into a composition with creditors, gone into liquidation, or has entered into any arrangement with creditors or taken any other action with similar effect in Zambia or elsewhere; or (h) has been removed from an office of trust due to misconduct, abuse of office or corruption. (2) The Bank may direct a credit reporting agency to suspend, remove or take any other action against a member of a board of directors or senior management in order to enforce the provision of this Act. (3) A person who contravenes subsection (1), commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both. PART VI SUPERVISION AND REGULATION OF CREDIT REPORTING AGENCIES Collection of information on data subject
Part
PART VI
- 23 Verify source ↗
Collection of information on data subject
A credit reporting agency may collect credit information only for a purpose directly related to an activity authorised under its licence, and the collection does not require the data subject’s consent.
23. (1) A credit reporting agency shall not collect credit information on a data subject unless the information is collected for a purpose directly related to an activity authorised under the licence. (2) The collection of credit information, referred to in subsection (1), shall not require the consent of the data subject. (3) A person who contravenes subsection (1) commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both. - 24 Verify source ↗
Disclosure of credit information
A credit reporting agency generally may not disclose credit information unless a stated condition applies, and it must not require consent to disclose adverse credit information.
24. (1) A credit reporting agency shall not disclose credit information to a person unless— Disclosure of credit information Credit Reporting [No. 8 of 2018 203 (a) with the written consent of the data subject; (b) the disclosure is in accordance with any other law or an order of a court; (c) the Bank, in carrying out its functions in accordance with this Act, orders the disclosure of such information; or (d) the disclosure is intended to safeguard the integrity of a credit market. (2) A credit reporting agency shall not require consent from a data subject to disclose credit information where the credit information relating to the data subject is adverse. (3) A person who contravenes subsection (1) commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both. - 25 Verify source ↗
Security of credit information
A credit reporting agency must protect credit information from unauthorised access and other security risks, especially when processing that information.
25. (1) A credit reporting agency shall take appropriate measures to safeguard credit information against unauthorised access. Security of credit information (2) A credit reporting agency shall, when processing credit information, put measures in place to protect credit information from loss, misuse, unauthorised access, unauthorised disclosure, alteration, erasure or destruction by— (a) developing written policies and procedures to be followed by credit information processors, its employees, agents and contractors; (b) imposing access authentication controls; (c) providing information and training to its employees so as to ensure compliance with policies, procedures and controls; (d) ensuring that a subscriber agreement, in a prescribed form, is entered into with the subscriber, before information is disclosed to the subscriber; (e) taking appropriate action where a security breach is identified; (f) periodically reviewing policies, procedures and controls; (g) maintaining an access log in a prescribed form; and (h) any other measures as may be necessary to secure the information. 204 No. 8 of 2018] Credit Reporting (3) Where processing of credit information is carried out by a data controller, the credit reporting agency shall ensure that the credit information processor— (a) provides sufficient guarantees with regard to technical and organisational security measures to be put in place when processing credit information; and (b) takes reasonable steps to ensure compliance with measures referred to in paragraph (a). (4) Where processing of credit information is carried out by a credit information processor, the credit reporting agency shall remain liable in the event of loss, misuse, unauthorised access, unauthorised disclosure, alteration, erasure or destruction of credit information. (5) A person who contravenes subsection (1) commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both. - 26 Verify source ↗
Retention period of credit information by credit reporting agency
A credit reporting agency must keep a data subject’s credit information in its database for at least 10 years from certain events.
26. A credit reporting agency shall retain credit information on a data subject, maintained on its database, for a period of at least ten years from— (a) final loan repayment; (b) a credit being written off; (c) a declaration of bankruptcy; or (d) discharge from bankruptcy. Retention period of credit information by credit reporting agency Credibility of credit information - 27 Verify source ↗
Credibility of credit information
A credit reporting agency must make sure credit information is accurate, complete, relevant, up to date, and not misleading before sharing it, and must take reasonable steps to avoid incorrect matching when comparing credit information.
27. (1) A credit reporting agency shall, before disseminating credit information, take necessary steps to ensure that the credit information is accurate, complete, relevant, up to date and not misleading to the users of the information. (2) A credit reporting agency shall, when undertaking a comparison of credit information within its possession with any other credit information, for the purpose of producing or verifying information on a data subject, take reasonable steps to avoid incorrect matching of such information. Credit report - 28 Verify source ↗
Credit report
The Bank may set the form and content of credit reports, and a credit reporting agency may provide a credit report only for listed purposes or recipients.
28. (1) The Bank may, by Gazette notice, prescribe the form and content of a credit report. (2) Subject to section 29, a credit reporting agency shall only provide a credit report — Credit Reporting [No. 8 of 2018 205 (a) to a person who intends to use the information— (i) in connection with the extension of credit to a data subject or the purchase or collection of a debt of a data subject; (ii) in connection with entering into, or renewing of, a tenancy agreement involving a data subject; (iii) for employment purposes of a data subject; (iv) in connection with the underwriting of insurance involving a data subject; (v) to determine the eligibility of a data subject in accordance with any other written law; (vi) in connection with a credit transaction involving the data subject not covered by subparagraphs (i) to (v); or (vii) for purposes of updating information in a credit report previously provided by a credit reporting agency; (b) to a law enforcement officer for purposes of conducting an investigation; (c) in response to a court order; (d) in accordance with written instructions from the data subject to whom the information relates; (e) in response to an order made by the Bank as provided in this Act; or (f) for purposes that the Bank may prescribe. (3) Despite subsection (1), a credit reporting agency may provide information identifying a data subject, limited to the data subject’s name, address, former addresses and former places of employment to— (a) a Government agency; (b) law enforcement officer in the course of the officer’s duty; or (c) an appropriate authority. 206 No. 8 of 2018] Credit Reporting Information to be excluded from credit report - 29 Verify source ↗
30. Accuracy of data maintained by credit information provider
A credit reporting agency must not include certain kinds of information in a credit report, subject to listed source, reliability, age, writing, and storage conditions.
29. A credit reporting agency shall not include, any of the following in a credit report: (a) any information unless the name and address of the source of the information is recorded or retained in its database and can be readily ascertained by the data subject; (b) any information not based on the most reliable evidence reasonably available; (c) on the bankruptcy of a data subject which is more than ten years from the date on which the data subject was discharged, unless the data subject has been bankrupt more than once; (d) relating to a court judgment, against a data subject, which is more than two years from the date such judgment was rendered, unless the judgment creditor or the creditor’s agent, confirms that the judgment amount remains unpaid, and such confirmation is on record; (e) regarding a debt, three years after the final payment of such debt or if no payment is made, five years after a data subject incurred such debt; (f) regarding an administrative fine, three years after payment of such fine or if no payment is made, five years after the fine was incurred; (g) any information given orally unless the content of the oral report is reduced into writing; (h) regarding the state of health, race, creed, colour, ancestry, ethnic origin, religion, or political affiliation of a data subject; (i) criminal record, except for financial fraud and other similar offences; or (j) information which is not stored in a form capable of being reproduced in accordance with this Act. - 30 Verify source ↗
Accuracy of data maintained by credit information provider
Data providers must take reasonable steps to keep credit-reporting data accurate and complete, and correct and notify the agency within 30 days if they find an error. Credit reporting agencies must correct notified data within 5 days and keep records of challenged information.
30. (1) A data provider shall take reasonable steps to ensure the accuracy and completeness of data provided to a credit reporting agency. Accuracy of data maintained by credit information provider Credit Reporting [No. 8 of 2018 207 (2) Where a data provider discovers any inaccuracy or incompleteness in the data provided to a credit reporting agency, it shall, within thirty days, correct the data and inform a credit reporting agency of the inaccuracy or incompleteness of the data and the correction made to such data. (3) A credit reporting agency informed by a data provider, as provided in subsection (2), shall, within five days of being informed, make the necessary correction to such data. (4) Every credit reporting agency shall maintain, in a prescribed manner and form, a record of information that has been challenged by a data subject. - 31 Verify source ↗
Bank’s order on inaccurate, incomplete or outdated information
The Bank may order a credit reporting agency to fix, remove, stop using, or notify people about inaccurate, incomplete, outdated, or non-compliant information.
31. Where the Bank finds that the information contained in a database of a credit reporting agency is inaccurate, incomplete, outdated or does not comply with this Act, the Bank may make an order— (a) directing the credit reporting agency to amend or delete the information; (b) restricting or prohibiting the credit reporting agency from using the information; or (c) directing the credit reporting agency to provide notice of any amendment, deletion, restriction or prohibition specified in paragraph (a) or (b) to a person who has received a credit report. - 32 Verify source ↗
33. Destruction of documents
The Bank may inspect a credit reporting agency’s records and documents, and an inspector may require production and access for the inspection. A person who, without reasonable excuse, does not comply with a request under this section commits an offence and may be fined up to 100,000 penalty units, imprisoned for up to one year, or both.
32. (1) The Bank may inspect a credit reporting agency’s records or documents relating to the business, including the inspection of the bank accounts and financial transactions of a credit reporting agency for the purposes of ascertaining compliance with this Act, or the terms and conditions of a licence. (2) The Bank may appoint a person to exercise the powers of the Bank specified in subsection (1). (3) A person appointed to conduct an inspection may— (a) enter the premises of a credit reporting agency; (b) require a credit reporting agency or any person who may be in possession of any record or document, referred to in subsection (1), to produce it for the purposes of the inspection; Bank’s order on inaccurate, incomplete or outdated information Inspections 208 No. 8 of 2018] Credit Reporting (c) make inquiries of any other person who may be reasonably believed to have information relating to any record or document, referred to in subsection (1), concerning a transaction or activity which was undertaken in the course of, or which may affect, the business conducted by a credit reporting agency; and (d) inspect and make copies of, or take extracts from, and where necessary, take possession of, the documents referred to in subsection (1). (4) A credit reporting agency shall afford an inspector access to any record or document for purposes of an inspection and produce, to the inspector, a record or document that the inspector may require. (5) A person who, without reasonable excuse, fails to comply with a request made in accordance with this section, commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units, or to imprisonment for a term not exceeding one year, or to both. - 33 Verify source ↗
Destruction of documents
A person must not destroy, falsify, conceal, or dispose of documents relevant to an inspection or investigation, or cause or allow that to happen, if they know or ought to know the document is relevant.
33. A person who destroys, falsifies, conceals or disposes of, or causes or permits the destruction, falsification, concealment or disposal of, any document, which the person knows or ought to know is relevant to an inspection or investigation provided for in this Part, commits an offence and shall be liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both. Destruction of documents Supervisory action - 34 Verify source ↗
Supervisory action
The Bank may take supervisory action against a credit reporting agency if it fails to comply, obstructs an inspection or investigation, breaches data-safety or other law requirements, or is unlikely to keep operating normally.
34. (1) The Bank may take supervisory action against a credit reporting agency where a credit reporting agency— (a) fails to comply with an order or directive of the Bank made in accordance with this Act; (b) refuses to permit an inspection or obstructs an investigation provided for in this Act; (c) is found to be undertaking its business in a manner which compromises the safety of data and is in breach of any other law; or (d) is unable or is unlikely to continue its operations in the ordinary course of business. Credit Reporting [No. 8 of 2018 209 (2) The supervisory action the Bank may take, as provided in subsection (1), without prejudice to any other course of action or penalties provided for in this Act, includes— (a) taking possession of the credit reporting agency; (b) appointing a suitably qualified person to manage the affairs of the credit reporting agency, for such a period as the Bank considers necessary; (c) removing or suspending, from office, any director of the board, senior management officer or other employee of the credit reporting agency, and requiring the credit reporting agency to reconstitute its board of directors within a period the Bank may specify; (d) varying the authorised activities under licence of the credit reporting agency; (e) suspending the licence of the credit reporting agency for a period not exceeding six months; (f) cancelling the licence of the credit reporting agency; or (g) imposing any other sanction as the Bank may consider appropriate. PART VII CONSUMER RIGHTS AND PROTECTION
Part
PART VII
- 35 Verify source ↗
Complaints procedure
A credit reporting agency must have a written complaints procedure, assign a customer service officer for it, and keep complaints records for at least two years unless the Bank specifies a longer period.
35. A credit reporting agency shall— (a) establish and make available, in writing, the procedure for dealing with complaints made by a person to the credit reporting agency; (b) designate a person to be a customer service officer implementing and administering the responsible for procedure referred to in paragraph (a); and (c) establish and maintain, for two years, or such longer period as the Bank may specify, a record stating the complaints received, when and how they were dealt with or disposed of. Complaints procedure 210 No. 8 of 2018] Credit Reporting Credit provider to provide information to data subject Access to credit information maintained by credit reporting agency - 36 Verify source ↗
Credit provider to provide information to data subject
A credit provider must give a data subject certain credit-information details and explain how the data subject can access or correct records.
36. (1) A credit provider shall provide the following information to a data subject: (a) the contact details of credit reporting agencies that collect, process and disseminate credit information to third parties relating to the credit worthiness of a data subject; and (b) the data subject’s right to check the data subject’s own credit history and to correct erroneous information. (2) A credit provider shall provide to a data subject, detailed information on how to access or correct data maintained by the credit provider. - 37 Verify source ↗
Access to credit information maintained by credit reporting agency
A data subject can get a credit report and related credit information from a credit reporting agency, and the agency must respond within set time limits unless a listed refusal ground applies.
37. (1) A data subject has the right to receive a copy of all credit information maintained by a credit reporting agency relating to the data subject’s own credit history, in the form of a credit report, which shall include— (a) a list of users that have accessed the data subject’s information in the last six months; (b) detailed information on the description of any codes used in the report, so as to enable the data subject understand the report; and (c) the source of the information. (2) A request, made in accordance with subsection (1), shall be accompanied by a certified copy of a national registration card or passport. (3) Subject to subsection (2), a credit reporting agency shall, within seven days of receiving a request, made in accordance with subsection (1), provide the data subject with information requested. (4) A data subject shall have the right to obtain, free of charge, within five days of making a request, a credit report from the credit reporting agency— (a) at least once a year upon a request being made; (b) after an investigation conducted in accordance with section 40; and (c) within thirty days of receiving an adverse action notice referred to in section 38. Credit Reporting [No. 8 of 2018 211 (5) A credit reporting agency may refuse to grant a request, made in accordance with subsection (1), if the credit reporting agency— (a) is not supplied with the information it requires to locate the credit information to which the request relates; (b) cannot comply without disclosing credit information relating to another data subject, unless— (i) the other data subject has consented to the disclosure; or (ii) it is reasonable, in all circumstances, to comply without the consent of the other data subject; or (c) would, by complying— (i) violate a court order; or (ii) disclose confidential commercial information. (6) Where the credit reporting agency refuses to grant a request, as provided in subsection (5), it shall, not later than thirty days of its refusal, inform the data subject, in writing, and give a reason for the refusal. - 38 Verify source ↗
Notification of adverse action
A credit provider must notify a data subject within 30 days after taking adverse action based on a credit report. After notice, the data subject may request the credit reporting agency’s contact details within 30 days.
38. (1) Where a credit provider takes adverse action against a data subject based, in whole or in part, on a credit report obtained from a credit reporting agency, it shall, within thirty days of taking such action, notify the affected data subject. Notification of adverse action (2) Where a data subject is notified, in accordance with subsection (1), the data subject may, within thirty days of receiving such notification, request for contact details of the credit reporting agency which prepared the credit report. - 39 Verify source ↗
Right to challenge credit information
A data subject may challenge credit information in writing if it is thought to be inaccurate, incomplete, or outdated. The credit reporting agency and credit provider must investigate and notify others within set time limits.
39. (1) A data subject shall have the right to challenge a credit reporting agency, in writing, on the information contained in a credit report, where a data subject is of the opinion that the information is inaccurate, incomplete or outdated. Right to challenge credit information (2) Where a credit reporting agency is notified of a challenge, in accordance with subsection (1), the credit reporting agency shall— (a) within five days of receiving the notice, send to a credit provider a notice accompanied by an endorsed copy of a credit report, specifying the challenged information; and 212 No. 8 of 2018] Credit Reporting (b) where the inaccuracy or incompleteness of the information is attributed to a credit reporting agency, conduct an investigation within fourteen days of receiving the notification. (4) Where a credit provider receives a notice, referred to in subsection (3) (a), the credit provider shall, within thirty days of receiving the notice, conduct an investigation into the challenged information and give the credit reporting agency a written report advising whether the challenged information is to be deleted, corrected or maintained, as the case may be. (5) Where a credit provider fails to respond to the notice, within the period specified in subsection (4), the credit reporting agency shall remove the challenged information from its database and shall inform the Bank of its action. (6) Where a credit reporting agency receives a report, referred to in subsection (4), it shall, within five days of receiving the report, notify— (a) the data subject of the findings of the report; and (b) any subscriber who has, in the last twelve months, obtained a credit report from the credit reporting agency containing the inaccurate, incomplete or outdated information. (7) Where information that has been challenged is corrected, the credit reporting agency shall provide the data subject with a free copy of the credit report that has been corrected. PART VIII COMPLAINT AND INVESTIGATION Initiation of investigation
Part
PART VIII
- 40 Verify source ↗
Initiation of investigation
The Bank may investigate complaints on its own initiative or when it receives a complaint from certain complainants, including anonymous complainants.
40. (1) The Bank may investigate a complaint— (a) on the Bank’s own initiative; or (b) on receipt of a complaint made by a complainant— (i) acting in the complainant’s own interest; (ii) that is an association acting in the interest of its members; (iii) who is a person acting on behalf of a complainant; (iv) who is a person acting on behalf, and in the interest, of a group or class of persons; or (v) who is making a complaint anonymously. Credit Reporting [No. 8 of 2018 213 Refusal to investigate or discontinue a complaint (2) A complaint, made as provided in subsection (1), shall be in the prescribed manner and form. (3) Subsection (2) shall not apply to a complaint made by a person specified in subsection (1) (b) (v). - 41 Verify source ↗
Refusal to investigate or discontinue a complaint
The Bank may refuse or stop investigating a complaint in listed cases, must not investigate late complaints unless an exception applies, and must notify the complainant in writing within 14 days with reasons if it decides not to investigate or stops an investigation.
41. (1) The Bank may refuse to investigate a complaint or, having commenced an investigation, discontinue the investigation if the— (a) complaint is frivolous, vexatious or not made in good faith; (b) complainant does not have sufficient interest in the action complained of, except that this paragraph shall not apply to a complaint made by a person specified in section 40 (1) (b) (v); (c) complainant has a right of appeal, review or remedy that has not been exhausted; (d) conduct or involvement to which the complaint relates is or has been the subject of an investigation or other action by any other appropriate authority under any other law; or (e) complaint has been withdrawn. (2) The Bank shall not investigate a complaint unless the complaint is made within a period of two years from the date on which the complainant exhausted the complainant’s rights under section 35. (3) Despite subsection (1) (c), the Bank may investigate a complaint where the Bank is satisfied that the complainant has been prevented from exercising the complainant’s rights as specified. (4) The Bank may, in exceptional circumstances, investigate a complaint received outside the period, referred to in subsection (2), except that the Bank shall not investigate a complaint made in contravention of the Law Reform (Limitation of Actions, etc.) Act. Cap. 72 (5) The Bank shall, where it decides not to conduct an investigation or discontinue an investigation, inform the complainant, in writing, within fourteen days of its decision and give reasons for the decision. - 42 Verify source ↗
Continuation of investigation where complaint withdrawn
The Bank may continue an investigation started by a complaint even if the complainant withdraws it, if the Bank thinks doing so is in the public interest.
42. Where the Bank is of the opinion that it is in public interest to do so, it may continue an investigation initiated by a complaint despite the withdrawal by the complainant of the complaint. Continuation of investigation where complaint withdrawn 214 No. 8 of 2018] Credit Reporting Referral of matter - 43 Verify source ↗
Referral of matter
The Bank may refer a matter to an appropriate authority at any stage of investigating or dealing with the matter under the Act.
43. The Bank may, at any stage of investigating or dealing with a matter as provided in this Act, refer the matter to an appropriate authority. Collaboration on investigation - 44 Verify source ↗
Collaboration on investigation
The Bank may work with an appropriate authority during an investigation by continuing its own investigation, referring the matter, requesting a report, or joining for a joint report.
44. The Bank may, where it commences an investigation or is investigating a matter and the matter is being dealt with by an appropriate authority— (a) continue to investigate or decide on the matter and share its findings with the appropriate authority concerned; (b) refer the matter to the appropriate authority concerned and request a report on the matter, once the matter has been finalised; or (c) join the appropriate authority investigating the matter and produce a joint report. Enforcement notice - 45 Verify source ↗
Enforcement notice
The Bank must issue an enforcement notice to a credit reporting agency after an investigation if it thinks the investigated action breaches the law or needs further steps.
45. (1) The Bank shall issue an enforcement notice directing a credit reporting agency to carry out such steps as the Bank considers appropriate, within a specified period where, after undertaking an investigation under this Act, the Bank is of the opinion— (a) that the action which was the subject matter of the investigation is contrary to this Act or any other law, based wholly or partly on a mistake of law or fact; (b) that — (i) the matter should be given further consideration; (ii) an omission should be rectified; (iii) a decision should be cancelled, reversed or varied; (iv) the practice on which the act, omission, decision or recommendation was based should be altered; (v) reasons should have been given for the decision; or (vi) any other steps should be taken. (2) Where, on the specified expiry of the period, referred to in an enforcement notice, a credit reporting agency fails to comply with the enforcement notice without reasonable cause, the Bank shall make a decision to give effect to the steps specified in the enforcement notice. Credit Reporting [No. 8 of 2018 215 - 46 Verify source ↗
Variation or cancellation of enforcement notice
The Bank may vary or cancel an enforcement notice, and if it does so it must immediately notify the concerned credit reporting agency in writing and give reasons.
46. (1) The Bank may, on its own initiative or on an application of a credit reporting agency, vary or cancel an enforcement notice issued in accordance with section 45. (2) Where the Bank varies or cancels an enforcement notice, as provided in subsection (1), the Bank shall immediately notify the concerned credit reporting agency, in writing, stating the reasons for the variation or cancellation. Variation or cancellation of enforcement notice PART IX REPRESENTATION AND APPEALS PROCESS
Part
PART IX
- 47 Verify source ↗
Reason for decision and right to be heard
When the Bank makes a decision under this Act, it must tell the person affected the reasons in writing.
47. Where the Bank makes a decision, in accordance with thisAct, the Bank shall, by notice in writing inform the person affected by the decision of the reasons for the decision. - 48 Verify source ↗
Right to appeal
A person aggrieved by a Bank decision may notify the Minister that they intend to appeal, within seven days of receiving the notice and reasons for the decision.
48. A person who is aggrieved by a decision of the Bank may, within seven days of receipt of the notice and reasons for the decision of the Bank, notify the Minister, in the prescribed manner and form, of the intention to appeal against the decision. - 49 Verify source ↗
Appointment and convening of appeals tribunal
The Minister must appoint and convene an ad hoc appeals tribunal within 7 days after receiving a notice under section 48.
49. The Minister shall, within seven days after receipt of a notice made under section 48, appoint and convene an ad hoc appeals tribunal consisting of a chairperson who is an advocate of the High Court of not less than seven years standing and two other persons having qualifications and experience relating to the matter which is the subject of the appeal. - 50 Verify source ↗
Tribunal Rules
The Chief Justice must prescribe procedure rules for an ad hoc tribunal under this Act.
50. The Chief Justice shall prescribe rules of procedure for an ad hoc tribunal convened under this Act. Reason for decision and right to be heard Right to appeal Appointment and convening of appeals tribunal Tribunal Rules PART X GENERAL PROVISIONS
Part
PART X
- 51 Verify source ↗
Access to documents
A person may request to review or copy documents lodged with the Bank, and the Bank may set access procedures, terms, and fees.
51. (1) Subject to this section, a person may, on request, review or copy any document lodged with the Bank in terms of this Act. Access to documents (2) The Bank may, by rules, specify procedures for making requests for access, as provided in subsection (1), and the terms and fees to be paid for such access. (3) The Bank may refuse to authorise a document to be reviewed or copied, in whole or part, where it is satisfied that information in the document is— (a) confidential to the person lodging the document and has a real commercial value to the person that would be seriously and unreasonably prejudiced if the information were to be made generally available; or 216 No. 8 of 2018] Credit Reporting (b) personal information about a person and it is in the public interest that the information should not be generally available. Continuing acts or offences - 52 Verify source ↗
Continuing acts or offences
A person can commit a separate offence for each day a failure or refusal continues, and a convicted person is liable to an administrative penalty prescribed by the Bank.
52. (1) A person commits a separate offence for each day on which a failure or refusal continues where in accordance with this Act— Restriction on use of name indicating credit reporting business (a) an act is required to be done within a particular period or before a particular time and the obligation to do the act continues after the period has ended or the time has passed; or (b) failure or refusal to comply with the provision is an offence and such failure continues. (2) A person convicted of an offence under subsection (1) is liable to an administrative penalty prescribed by the Bank for each day on which the failure or refusal continues. - 53 Verify source ↗
Restriction on use of name indicating credit reporting business
Companies and persons must not use or misrepresent names or licences suggesting they operate credit reporting business unless licensed, and registration authorities must not register names that would breach this rule.
53. (1) Subject to subsection (2), a company carrying on a business, unless the company is licensed as a credit reporting agency, shall not use any name which indicates or may reasonably be understood to indicate, whether in English or another language, that the business is being operated by a credit reporting agency or that it is carrying on credit reporting business. (2) A person shall not falsely represent to the public or any member of the public that the person — (a) holds a licence to conduct any credit reporting business or provides credit reporting services; or (b) is licensed to conduct a credit reporting business of any kind. (3) Any person acting contrary to this section commits an offence and shall be liable, on conviction, to a fine not exceeding five hundred thousand penalty units or to imprisonment for a term not exceeding five years, or to both. (4) Subsection (1) shall not prohibit the use of that kind of name by a company or other entity incorporated or otherwise established outside Zambia and which has no permanent place of business in Zambia for the purposes of soliciting business or advertising its business in Zambia. (5) An authority which, in accordance with any other law, is responsible for the registration of companies or business names shall not register a company or a name of a business that would be in contravention of subsection (1). Credit Reporting [No. 8 of 2018 217 - 54 Verify source ↗
Validity of certain acts
Transactions made in breach of the Act are generally not invalid just because of that breach, and a credit reporting agency does not need to pass a resolution to exercise a power under the Act, subject to its articles of association.
54. (1) A transaction entered into, in contravention of this Act, shall not be void or ineffective by reason only of the contravention, and shall not be voidable by a person to whom this Act applies unless the Court orders otherwise. Validity of certain acts (2) Subject to a credit reporting agency’s articles of association, it shall not be necessary for a credit reporting agency to pass a resolution in order to exercise any power conferred by this Act. - 55 Verify source ↗
Power to summon senior management officer, directors and
The Bank may summon certain credit reporting agency officials, directors, or shareholders for examination, and summoned persons must appear and answer honestly.
55. (1) Where the Bank considers that a senior management officer, director of the board or shareholder, past or present, of a credit reporting agency, has any information relating to the operations of the credit reporting agency which the Bank considers necessary for the performance of its supervisory functions, the Bank may, in the prescribed manner, summon that officer, director of the board or shareholder, for an examination. Power to summon senior management officer, directors and shareholders (2) A person commits an offence if that person, when summoned by the Bank, in accordance with subsection (1)— (a) fails without reasonable excuse to appear before the Bank for the examination; (b) withholds information; or (c) provides information which is false in any material particular. (3) A person who commits an offence under subsection (2) is liable, on conviction, to a fine not exceeding two hundred thousand penalty units or imprisonment for a term not exceeding two years, or to both. - 56 Verify source ↗
Submission of information and documents to Bank
Credit reporting agencies and related persons must provide information or documents to the Bank when required, and documents must be properly signed.
56. (1) Where, in the exercise of any of its powers, performance of its functions or the discharge of its duties as provided in this Act, or in accordance with any other law, the Bank requires any information from a credit reporting agency or any other person engaged in the provision of credit reporting services, a company affiliated, associated, holding or subsidiary company or any person who controls a credit reporting agency, on any matter relating to the affairs or business of the credit reporting agency, person or company, the credit reporting agency, person or company, shall submit the information to the Bank. (2) A credit reporting agency required to furnish or supply a document to the Bank shall ensure that the document is signed by the chief executive officer of the credit reporting agency or by the person holding the office or offices as required by a prescribed form. Submission of information and documents to Bank 218 No. 8 of 2018] Credit Reporting (3) At the request of a credit reporting agency or other interested person, the Bank may extend a period within which a credit reporting agency is obliged to furnish any document or information as provided in this Act. Publication of information - 57 Verify source ↗
Publication of information
The Bank may publish information or data furnished under the Act if it considers publication necessary or appropriate, but it must not reveal certain customer-affairs information unless lawfully required. A person who issues or helps issue a false document commits an offence and can be fined or imprisoned.
57. (1) Where the Bank considers a publication to be necessary or appropriate, the Bank may publish, in whole or in part, any information or data furnished in accordance with this Act. (2) The Bank shall not reveal to a person information regarding the affairs of a customer of a data controller that was obtained in the performance of the Bank’s functions, as provided in this Act, unless lawfully required to do so. (3) A person who issues or takes part in the issuance of a document, referred to in this Act, which is false in any material particular, commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both. - 58 Verify source ↗
59. Exemptions
Bank officers, agents, and other employees are protected from liability for good-faith acts done while carrying out powers or functions under the Act.
58. An act, matter or thing done by a senior management officer, agent or other employee of the Bank, in the exercise or performance, in good faith, of any power or function, in accordance with this Act, shall not give rise to any action, claim, liability, suit or demand against the officer, employee or agent concerned. - 59 Verify source ↗
Exemptions
The Bank may exempt a credit reporting agency from provisions of the Act, and may vary or revoke that exemption.
59. The Bank may, on the terms and conditions that the Bank may determine, exempt a credit reporting agency from any of the provisions of this Act and may, in like manner, provide for the variation or revocation of any exemption granted. - 60 Verify source ↗
Penalty for offences where no specific penalty provided
If someone commits an offence under the Act and no specific penalty is provided, they may be fined up to 100,000 penalty units, imprisoned for up to one year, or both, on conviction.
60. A person who commits an offence, in contravention of this Act, for which no penalty is specifically provided, is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both. - 61 Verify source ↗
Offence by principal officer or shareholder of body corporate or
A director, manager, or shareholder may also commit the offence if a body corporate or unincorporated body commits an offence with that person’s knowledge, consent, or connivance.
61. Where an offence under this Act is committed by a body corporate or unincorporated body, with the knowledge, consent or connivance of the director, manager or shareholder, that director, manager or shareholder of the body corporate or unincorporated body commits an offence and is liable, on conviction, to the penalty or term of imprisonment specified for the offence. - 62 Verify source ↗
Administrative penalties
The Bank may compound an offence and impose an administrative penalty, and may recover unpaid penalties through court action.
62. (1) Where the Bank is satisfied, after due investigation, or where a person admits that the person has committed an offence Immunity of senior management officer, agent or employee of Bank Exemptions Penalty for offences where no specific penalty provided Offence by principal officer or shareholder of body corporate or unincorporated body Administrative penalties Credit Reporting [No. 8 of 2018 219 in accordance with this Act or regulations or rules made in accordance with this Act, the Bank may compound the offence and impose such an administrative penalty as may be prescribed. (2) Where a person, on whom an administrative penalty is imposed, in accordance with this section, fails to pay the penalty within the time ordered by the Bank, the Bank may, recover the penalty by action in a court. - 63 Verify source ↗
Regulatory statements
The Bank may issue and publish regulatory statements.
63. The Bank may issue and publish regulatory statements. - 64 Verify source ↗
Rules
The Bank may make rules by statutory instrument on matters needed to carry out the Act, including credit reporting agency operations and data safeguards.
64. (1) The Bank may, by statutory instrument, make rules for, or with respect to, any matter that by this Act is required or permitted to be prescribed by the Bank, or that is necessary to be prescribed for purposes of carrying out or giving effect to this Act. (2) Without prejudice to the generality of subsection (1), rules made in accordance with subsection (1) may make provision for— Regulatory statements Rules (a) the conduct of business by credit reporting agencies and their representatives; (b) matters incidental to the licensing of any credit reporting agencies in accordance with this Act; (c) the class of persons in relation to whom, and the manner and circumstances in which, credit reporting agencies may conduct or provide credit reporting services; (d) the correction of any errors in any register or record kept in accordance with this Act; (e) particulars to be recorded for the purposes of this Act, in relation to accounts of credit reporting agencies; (f) the lodgment of auditor’s reports and the information to be contained in the auditor’s report; (g) the operating hours for credit reporting agencies; (h) the lodgment by credit reporting agencies of annual financial statements; (i) the exemption, on such terms and conditions as may be prescribed, of any credit reporting agencies from any specified provision of this Act or any rule made in accordance with this Act, and the revocation of any such exemption or the modification of any such terms or conditions; 220 No. 8 of 2018] Credit Reporting (j) administrative penalties to be imposed; (k) the types of business that the Bank considers as constituting credit reporting activities; (l) maintenance of the confidentiality of data subject information by credit reporting agencies; (m) information and the matters to be displayed on business stationery of credit reporting agencies; (n) the practice and conduct of share registers and other registers that are to be kept by credit reporting agencies in accordance with this Act; (o) the resolution of disputes among credit reporting agencies; (p) the making of annual or other regulatory returns to the Bank by credit reporting agencies; (q) mandatory disclosures and registration of interests in credit reporting agencies; and (r) determination of fit and proper test for purposes of this Act. (3) The Bank may, by statutory instrument, make other rules to provide for— (a) the contents, form and issue of a financial statement, annual report and other documents required or provided for in this Act; (b) requirements for the display and use of unique numbers allocated for licences; (c) requirements for transactions, including requirements prohibiting or restricting a licensed company from commencing or carrying out business; (d) the formulation and publication of codes of conduct for credit reporting agencies, their officers and employees; (e) requirements for credit reporting agencies to make reports to the Bank, either regularly or on the occurrence of specified events or circumstances; (f) requirements for contents, publication and dissemination of reports to the Bank by— Credit Reporting [No. 8 of 2018 221 (i) credit reporting agencies; and (ii) officers and former officers of credit reporting agencies; (g) prudential rules, including rules as to capital adequacy, assets and other resources for credit reporting agencies; (h) disclosures to be made by credit reporting agencies; (i) keeping of books and records by credit reporting agencies; (j) the collection of fees and the levying of charges; and (k) the effective administration and implementation of this Act. (4) The Bank may issue rules prescribing the segregation and safe custody of a data subject’s information. - 65 Verify source ↗
Regulations
The Minister may make regulations for carrying out the Act, on the Bank’s recommendation.
65. (1) The Minister may, on the recommendation of the Bank, Regulations make regulations for the better carrying out of this Act. (2) Without limiting the generality of subsection (1), regulations made in accordance with subsection (1) may— (a) prescribe fees or charges payable in respect of any matter arising under, provided for, or authorised by, this Act; (b) prescribe offences and fines not exceeding one hundred thousand penalty units or imprisonment for a term not exceeding one year; (c) prescribe the forms for applications, licences, approvals, registers, notices, orders and other documents required for the purposes of this Act; (d) prescribe the information to be given in returns and other documents delivered or made for the purposes of this Act; (e) provide the procedure for the service of notices, orders and documents as specified in this Act and the times at which they shall be taken to have been served; and (f) prescribe the procedure for complaints, for purposes of this Act, and the making, consideration, hearing and determination of complaints and appeals. 222
Provision text is displayed from LexChat’s stored statute record. Use the official source links to verify amendments, commencement, and current legal force.
Ask AI about this statute
Credit Reporting Act, 2018
Sign in to ask AI about this statute
Sign in to start authenticated, citation-grounded statute research.
Sign inLexChat organizes source-backed legal information for research. Verify amendments, commencement, and current legal force with the official publisher before relying on it.