Collection of credit information
(1) No credit reporting agency shall collect any credit information about a customer unless—
(a) the credit information is collected for a specific and lawful purpose directly related to an activity of the credit reporting agency and shall not be further processed in any manner incompatible with that purpose;
(b) the collection of the credit information is necessary for or directly related to that purpose; and
(c) the credit information is adequate but not excessive in relation to that purpose.
(2) A credit reporting agency which contravenes subsection (1) commits an offence and shall, upon conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
(3) The collection and use of credit information by a credit reporting agency under subsection (1) shall not require the consent of the customer concerned.
Notice to customer on processing of credit information
(1) A credit reporting agency shall by written notice inform a customer—
(a) that credit information of the customer is being processed by or on behalf of the credit reporting agency, and shall provide a description of the credit information to that customer;
(b) the purposes for which the credit information is being or is to be processed;
(c) of any information available to the credit reporting agency as to the source of that credit information;
(d) of how to contact the credit reporting agency with any inquiries or complaints in respect of the credit information and of the customer’s right to request access to and to request correction of the credit information;
(e) of the subscribers or other persons to whom the credit reporting agency discloses or may disclose the credit information;
(f) of the choices and means the credit reporting agency offers the customer for limiting the processing of credit information, including credit information relating to other persons who can be identified from that credit information;
(g) whether it is obligatory or voluntary for the customer to supply the credit information;
(h) where it is obligatory for the customer to supply the credit information, the consequences for the customer if he fails to supply the credit information; and
(i) of a summary of the customer’s rights as contained in the Summary of Rights.
(2) The notice under subsection (1) shall be given as soon as practicable to the customer—
(a) when the credit reporting agency first collects the credit information of the customer; or
(b) when the customer is first asked to provide his credit information to the credit reporting agency,
and such notice shall be in the national and English languages.
(3) Where the credit reporting agency possesses a website, the credit reporting agency shall conspicuously display on its website a statement that sets out the purposes for which it collects credit information and the purposes for which the credit information will be further processed.
(4) A credit reporting agency which contravenes this section commits an offence and shall, upon conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
Disclosure of credit information
(1) No credit reporting agency shall disclose any credit information for any purpose or to any person unless—
(a) the customer has given his consent to the disclosure;
(b) the disclosure is necessary for the purpose of preventing or detecting crime or for the purpose of investigations; or
(c) the disclosure is required or authorized by or under any law, or by the order of a court.
(2) Subject to subsection (3), where a credit reporting agency has obtained the consent of the customer under paragraph (1)(a), it shall not disclose the credit information—
(a) for any other purpose other than the purpose for which; or
(b) to any other person other than the person to whom,
the customer has consented under that paragraph.
(3) Where a credit reporting agency intends to disclose the credit information—
(a) for any other purpose other than the purpose for which the customer has consented to under paragraph (1)(a); or
(b) to any other person other than the person to whom the customer has consented to under paragraph (1)(a),
the credit reporting agency shall obtain the consent of the customer under paragraph (1)(a) to disclose the credit information for that other purpose or to that other person, as the case may be.
(4) A credit reporting agency which contravenes this section commits an offence and shall, upon conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
Prohibited disclosure in credit report
(1) Subject to section 24, a credit reporting agency shall not include any of the following in a credit report:
(a) any information unless such information includes the name and address of the source of the credit information;
(b) any information unless the identity of the customer can be identified;
(c) any information in relation to a person’s bankruptcy two years after the date of his discharge from the bankruptcy;
(d) any information in relation to a pecuniary action in court against a person more than two years after the date of commencement of the proceedings, unless the current status of the court action has been ascertained and is included in the credit report; and
(e) any information in relation to any default in repayment of credit two years after the date of final settlement of the amount in default, including settlement of the amounts
payable pursuant to a scheme of arrangement with the credit provider.
(2) A credit reporting agency which contravenes subsection (1) commits an offence and shall, upon conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
Storage and security of credit information
(1) A credit reporting agency shall, when processing any credit information, take practical steps to protect the credit information from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction by having regard—
(a) to the nature of the credit information and the harm that would result from such loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction;
(b) to the place or location where the credit information is stored;
(c) to any security measures incorporated into any equipment in which the credit information is stored;
(d) to the measures taken for ensuring the reliability, integrity and competence of personnel having access to the credit information; and
(e) to the measures taken for ensuring the secure transfer of the credit information.
(2) Where processing of credit information is carried out by a credit information processor on behalf of the credit reporting agency, the credit reporting agency shall, for the purpose of protecting the credit information from any loss, misuse, modification, unauthorized or
accidental access or disclosure, alteration or destruction, ensure that the credit information processor—
(a) provides sufficient guarantees in respect of the technical and organizational security measures governing the processing to be carried out; and
(b) takes reasonable steps to ensure compliance with those measures.
(3) Without limiting the generality of subsections (1) and (2), a credit reporting agency shall take the following measures to safeguard the credit information it holds against unauthorized access or misuse:
(a) develop written policies and procedures to be followed by its credit information processors, its employees, agents and contractors, or any other person providing services to it;
(b) impose access authentication controls such as the use of passwords, credential tokens, digital signatures or other mechanisms;
(c) provide information and training to its employees to ensure compliance with the policies, procedures and controls;
(d) ensure that a subscriber agreement that complies with the Fourth Schedule is in place before disclosing the credit information to a subscriber;
(e) identify and investigate possible breaches of the subscriber agreement, policies, procedures and controls;
(f) take prompt and effective action in respect of any breaches that are identified;
(g) systematically review the effectiveness of the policies, procedures and controls and promptly remedy any deficiencies; and
(h) maintain an access log.
(4) Without prejudice to section 27, a credit reporting agency shall ensure that if it is necessary for the credit information to be given to a person in connection with the provision of a service to the credit reporting agency, the credit reporting agency shall take all reasonable measures to prevent any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction of the credit information.
(5) The access authentication controls required under paragraph (3)(b) shall include, in respect of an access made, a means of identifying both the subscriber and the specific person of the subscriber who have access to the credit information, or other person who has access to that credit information.
(6) The access log required under paragraph (3)(h)—
(a) shall include a record of the time and date of access to the credit information, the identity of the subscriber or other person who has access to the credit information, and the purpose in relation to each access; and
(b) shall identify or provide a means to identify the specific person of the subscriber who has accessed that credit information and the specific customer whose credit information was so accessed.
(7) A credit reporting agency shall ensure that the access log contains records of all accesses made for a period of not less than two years preceding the date of the access.
(8) A credit reporting agency which contravenes this section commits an offence and shall, upon conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
Obligation of subscribers, etc.
(1) Any subscriber or other person, including a person providing services to a credit reporting agency, who has access to the credit information processed by the credit reporting agency shall take appropriate measures to safeguard the credit information against any unauthorized or improper access, use, modification or disclosure, including—
(a) developing written policies and procedures to be followed by its employees, agents and contractors;
(b) establishing controls, including—
(i) the use of passwords, credential tokens, digital signatures or other mechanisms; and
(ii) user identification;
(c) providing information and training to ensure compliance with the policies, procedures and controls;
(d) monitoring usage and regularly checking compliance with the policies, procedures and controls;
(e) taking appropriate action in relation to identified breaches of the policies, procedures and controls; and
(f) maintenance of logs of all accesses, amendments and audit trails to the credit information provided to it by the credit reporting agency.
(2) A person who contravenes subsection (1) commits an offence and shall, upon conviction, be liable to a fine not exceeding two hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
Unfavourable credit action
Where a credit provider has taken an unfavourable credit action against a customer based on a credit report, the credit provider shall, upon request of the customer, disclose to the customer—
(a) that the unfavourable credit action was on the basis of the credit report provided by a credit reporting agency; and
(b) the identity of the credit reporting agency from which the credit report was obtained that resulted in such unfavourable credit action.
Accuracy of credit information
(1) A credit reporting agency shall not use or further process any credit information without taking such steps as are in the circumstances reasonable to ensure that the credit information is accurate, up-to-date, complete, relevant and not misleading.
(2) A credit reporting agency shall, when undertaking a comparison of credit information within its control with any other credit information for the purpose of producing or verifying information about an identifiable customer, take such measures as are reasonably practicable to avoid the incorrect matching of the credit information.
(3) Without limiting the generality of subsection (1), a credit reporting agency shall—
(a) establish and maintain controls to ensure that, as far as is reasonably practicable, only credit information that is accurate, up-to-date, complete, relevant and not misleading is used or further processed;
(b) monitor credit information to ensure that it is accurate, up-to-date, complete, relevant and not misleading; and
(c) conduct regular checks on compliance with the controls.
(4) A credit reporting agency which contravenes this section commits an offence and shall, upon conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
Right of access to credit information or credit report
(1) Subject to subsection (5), a credit reporting agency shall not later than twenty-one days from the date of receipt of an access request from a requestor—
(a) provide the requestor with a confirmation of whether or not the credit reporting agency has processed the credit information of a customer; and
(b) where the credit reporting agency has processed the credit information of the customer, it shall—
(i) allow the requestor to have access to the credit information held; or
(ii) allow the requestor to have access to the credit information held and any credit report furnished by the credit reporting agency to any subscriber or other person,
within the period of twelve months preceding the date of the access request; or
(c) where the credit reporting agency has processed the credit information of the customer, it shall, upon payment of the prescribed fee by the requestor, supply the requestor with—
(i) a copy of the credit information mentioned in paragraph (b); or
(ii) a copy of the credit report mentioned in subparagraph (b)(ii) in an intelligible form.
(2) Where a credit reporting agency does not hold the credit information, but controls the processing of the credit information in such a way as to prohibit the credit reporting agency which holds the credit information from complying, whether in whole or in part, with the access request under subsection (1) which relates to the credit information, the first-mentioned credit reporting agency shall be deemed to hold the credit information and the provisions of this Act shall be construed accordingly.
(3) Subject to subsection (5), a credit reporting agency which is unable to comply with an access request within the period as specified in subsection (1) shall, before the expiration of that period—
(a) inform the requestor by notice in writing that it is unable to comply with the access request and the reasons why it is unable to do so; and
(b) comply with the access request to the extent that it is able to do so.
(4) Where the requestor is given access to, or supplied with a copy of the credit information or credit report pursuant to subsection (1), the credit reporting agency shall advise the requestor that he may request for the correction of that credit information or credit report under section 31.
(5) A credit reporting agency may refuse to comply with an access request made under subsection (1) if—
(a) the credit reporting agency is not supplied with such information as it may reasonably require—
(i) in order to satisfy itself as to the identity of the requestor; or
(ii) where the requestor claims to be a relevant person, in order to satisfy itself—
(A) as to the identity of the customer in relation to whom the requestor claims to be the relevant person; and
(B) that the requestor is the relevant person in relation to the customer;
(b) the credit reporting agency is not supplied with such information as it may reasonably require to locate the credit information to which the access request relates;
(c) the burden or expense of providing access is disproportionate to the risks to the customer’s privacy in relation to the credit information in the case in question;
(d) the credit reporting agency cannot comply with the access request without disclosing credit information relating to another person who can be identified from that information, unless—
(i) that other person has consented to the disclosure of the credit information to the requestor; or
(ii) it is reasonable in all the circumstances to comply with the access request without the consent of the other person;
(e) subject to subsection (7), any other credit reporting agency controls the processing of the credit information to which the access request relates in such a way as to prohibit the first-mentioned credit reporting agency from complying, whether in whole or in part, with the access request;
(f) providing access would constitute a violation of an order of a court;
(g) providing access would disclose confidential commercial information; or
(h) such access to credit information is regulated by another law.
(6) In determining for the purposes of subparagraph (5)(d)(ii) whether it is reasonable in all circumstances to comply with the access request without the consent of the other person, regard shall be had, in particular, to—
(a) any duty of confidentiality owed to the other person;
(b) any steps taken by the credit reporting agency with a view to seeking the consent of the other person;
(c) whether the other person is capable of giving consent; and
(d) any express refusal of consent by the other person.
(7) Paragraph (5)(e) shall not operate so as to excuse the credit reporting agency from complying with the access request—
(a) in so far as the access request relates to paragraph (1)(a), to any extent; or
(b) in so far as the access request relates to paragraph (1)(b) or (c), to any extent that the credit reporting agency can comply with the request without contravening the prohibition concerned.
(8) Where the credit reporting agency refuses to comply with an access request under subsection (1), the credit reporting agency shall not later than twenty-one days from the date of receipt of the access request, by notice in writing—
(a) inform the requestor of the refusal and the reasons for the refusal;
(b) advise the requestor of his rights under section 35; and
(c) provide the requestor with a copy of the Summary of Rights.
(9) A credit reporting agency which contravenes this section commits an offence and shall, upon conviction, be liable to a fine not exceeding two hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
Right to correct credit information or credit report
(1) Where—
(a) a copy of the credit information or credit report has been supplied by the credit reporting agency in compliance with an access request under section 30 and the requestor considers that the credit information or credit report is inaccurate, not up-to-date, incomplete, irrelevant or misleading; or
(b) the customer knows that the credit information being held by the credit reporting agency is inaccurate, not up-to-date, incomplete, irrelevant or misleading,
the requestor or customer, as the case may be, may make a correction request in writing to the credit reporting agency that it makes the necessary correction to the credit information or credit report.
(2) Where a credit reporting agency does not hold the credit information, but controls the processing of the credit information in such a way as to prohibit the credit reporting agency who holds the credit information from complying, whether in whole or in part, with the correction request under subsection (1) which relates to the credit information, the first-mentioned credit reporting agency shall be deemed to be the credit reporting agency to whom such a request may be made and the provisions of this Act shall be construed accordingly.
(3) A credit reporting agency shall upon being satisfied that the credit information or credit report to which a correction request under
subsection (1) relates is inaccurate, not up-to-date, incomplete, irrelevant or misleading, or on its own initiative—
(a) take steps to correct the credit information or credit report to ensure that the credit information or credit report is accurate, up-to-date, complete, relevant and not misleading;
(b) pending the making of any correction under paragraph (a), either suppress the disputed credit information or credit report or clearly identify the credit information or credit report as disputed and being checked for accuracy; and
(c) provide the requestor with a copy of the Summary of Rights.
(4) Subject to subsections (5), (7) and (8), where a credit reporting agency receives a correction request under subsection (1), the credit reporting agency shall not later than twenty-one days from the date of receipt of the correction request—
(a) inform the requestor of the action taken as a result of the correction request;
(b) inform the requestor of the correction made in compliance with the request and supply the requestor with a copy of the credit information or credit report as corrected; and
(c) subject to subsection (6), where—
(i) the credit information or credit report has been disclosed to a subscriber or other person during the twelve months immediately preceding the day on which the correction is made; and
(ii) the credit reporting agency has no reason to believe that the subscriber or other person has ceased using that credit information or credit report for the purpose, including any directly related purpose, for
which the credit information or credit report was disclosed to the subscriber or other person,
take all practicable steps to supply the subscriber or other person with a copy of that credit information or credit report as so corrected accompanied by a notice in writing stating the reasons for the correction.
(5) A credit reporting agency which is unable to comply with a correction request within the period specified in subsection (4) shall before the expiration of that period—
(a) inform the requestor by notice in writing that it is unable to comply with the correction request within such period and the reasons why he is unable to do so; and
(b) comply with the correction request to the extent that it is able to do so.
(6) A credit reporting agency is not required to comply with paragraph (4)(c) in any case where the disclosure of the credit information or credit report to a subscriber or other person consists of the subscriber’s or other person’s own inspection of the Register—
(a) in which the credit information or credit report is entered or otherwise recorded; and
(b) which is available for inspection by the public.
(7) Where a credit reporting agency is requested to correct the credit information under subsection (1) and the credit information is being processed by another credit reporting agency that is in a better position to respond to the correction request—
(a) the first-mentioned credit reporting agency shall immediately transfer the correction request to such credit reporting agency, and notify the requestor of this fact; and
(b) section 31 shall apply as if the references therein to a credit reporting agency were references to such other credit reporting agency.
(8) A credit reporting agency may refuse to comply with a correction request if—
(a) the credit reporting agency is not supplied with such information as it may reasonably require—
(i) in order to satisfy itself as to the identity of the requestor; or
(ii) where the requestor claims to be a relevant person, in order to satisfy itself—
(A) as to the identity of the customer in relation to whom the requestor claims to be the relevant person; and
(B) that the requestor is the relevant person in relation to the customer;
(b) the credit reporting agency is not supplied with such information as it may reasonably require to ascertain in what way the credit information or credit report to which the correction request relates is inaccurate, not up-to-date, incomplete, irrelevant or misleading;
(c) the credit reporting agency is not satisfied that the credit information or credit report to which the correction request relates is inaccurate, not up-to-date, incomplete, irrelevant or misleading;
(d) the credit reporting agency is not satisfied that the correction which is the subject of the correction request is accurate, up-to-date, complete, relevant or not misleading; or
(e) subject to subsection (9), any other credit reporting agency controls the processing of the credit information to which the correction request relates in such a way as to prohibit the first-mentioned credit reporting agency from complying, whether in whole or in part, with the correction request.
(9) Paragraph (8)(e) shall not operate so as to excuse the credit reporting agency from complying with subsection (4) in relation to the correction request concerned to the extent that the credit reporting agency can comply with that subsection without contravening the prohibition concerned.
(10) Where a credit reporting agency refuses to comply with a correction request under subsection (1), the credit reporting agency shall, not later than twenty-one days from the date of receipt of the correction request, by notice in writing—
(a) notify the requestor of the refusal and the reasons for such refusal;
(b) advise the requestor that there is attached to the credit information or credit report a statement of the correction sought but not made;
(c) if so requested by the requestor, take such steps as are reasonable in the circumstances to attach to the credit information or credit report, in such a manner that it will always be read with the credit information or credit report, any statement provided by the requestor of the correction sought;
(d) where paragraph (8)(e) is applicable, notify the requestor of the name and address of the other credit reporting agency concerned; and
(e) advise the requestor of his rights under section 35.
(11) A credit reporting agency which contravenes this section commits an offence and shall, upon conviction, be liable to a fine not
exceeding two hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
Source: Laws of Malaysia, Attorney General's Chambers of Malaysia (lom.agc.gov.my). Not a copy of the Gazette printed by the Government Printer (Interpretation Acts 1948 and 1967, s 61).
