Duties relating to customer information
13.—(1) A licensed credit bureau and any of its officers must not use any of its members’ customer information received from any of its members except —(a)
where it is strictly necessary to create a credit report; or
(b)
for any other purpose that the Authority may permit by written notice to the licensed credit bureau.
(2) Without affecting section 16, a licensed credit bureau and any of its officers must not disclose any of its members’ customer information (including a credit report of a member’s customer that contains such information) received from any of its members to any person except —(a)
to an approved member of the licensed credit bureau where the disclosure is strictly necessary to enable the approved member to assess the creditworthiness of its customer; or
(b)
to any other person if it is permitted by the Authority by written notice to the licensed credit bureau and in accordance with such conditions as may be specified in the notice.
(3) The Authority may at any time add to, vary or revoke any condition imposed under this section.
(4) Despite any provision in this Act, a licensed credit bureau and any of its officers must not collect from its members —(a)
customer information concerning a customer that is —(i)
a public authority;
(ii)
a monetary authority or central bank of any country or territory; or
(iii)
a sovereign wealth fund; or
(b)
their deposit information.
(5) Despite subsection (2), a licensed credit bureau and any of its officers must not use or disclose to any person —(a)
any of its members’ customer information received from the member where the customer is —(i)
a public authority;
(ii)
a monetary authority or central bank of any country or territory; or
(iii)
a sovereign wealth fund; or
(b)
any of its members’ deposit information received from the member.
(6) Despite subsection (2), a licensed credit bureau that holds a licence under section 7(2)(b) or (c) and any of its officers must not —(a)
collect from its members customer information; or
(b)
use or disclose any customer information received from any of its members,
concerning a customer that is a prescribed entity.
(7) Despite anything in this section —(a)
a licensed credit bureau may disclose its members’ customer information received from any of its members to any of its officers if the disclosure is solely for the purpose of carrying on the licensed credit bureau’s credit reporting business; and
(b)
an officer of a licensed credit bureau may disclose customer information of a member of the licensed credit bureau received from any of its members to —(i)
another officer of the licensed credit bureau; or
(ii)
the licensed credit bureau,
if the disclosure is solely in connection with the performance of the duties of such officer.
(8) Any person that contravenes subsection (1), (2), (4), (5) or (6) shall be guilty of an offence and shall be liable on conviction —(a)
in the case of an individual, to a fine not exceeding $125,000 or to imprisonment for a term not exceeding 3 years or to both; or
(b)
in any other case, to a fine not exceeding $250,000.
(9) In this section, unless the context otherwise requires —(a)
where customer information of a member of a licensed credit bureau may be disclosed under subsection (2) to any person that is a body corporate, the customer information may be disclosed to such officers of the body corporate as may be necessary for the purpose for which the disclosure is authorised under subsection (2); and
(b)
the obligation of any officer of the licensed credit bureau not to disclose any customer information of a member of the licensed credit bureau mentioned in subsection (2), (5) and (6) continues after the termination or cessation of his or her appointment, employment, engagement or other capacity or office with the licensed credit bureau.
(10) In this section —“officer” has the meaning given by section 2(1) of the Banking Act 1970;
“sovereign wealth fund” means the central government of a country or territory, or an entity wholly and beneficially owned by such government, whose funds (which may include the reserves of that government and any pension or provident fund of that country) are managed by a government‑owned entity.
(11) This section applies to any data received by a licensed credit bureau in a request under section 18(1) or (2) as it applies to customer information of any member of the licensed credit bureau.
(12) This section does not affect the duty of a licensed credit bureau or any of its officers to provide any customer information of any of its members to the Authority or any other person under any other provision of the Act.
Duty to maintain security and integrity of data
14.—(1) A licensed credit bureau must, in respect of any data that it collects from a data provider —(a)
ensure the integrity of the data that the licensed credit bureau processes (except when erasing or destroying such data); and
(b)
protect the data by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.
(2) For the purposes of subsection (1)(a), the integrity of the data collected by a licensed credit bureau from a data provider is assumed unless the licensed credit bureau is required to correct the data under section 18(3)(b)(i), 19(1) or 35(3)(a).
(3) Any person that contravenes subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $250,000 and, in the case of a continuing offence, to a further fine not exceeding $25,000 for every day or part of a day during which the offence continues after conviction.
Duty to safeguard integrity of data through contracts with data providers
15. A licensed credit bureau must ensure that any contract or arrangement it enters into, or renews, with a data provider on or after 31 May 2021 (whether or not the data provider is a member of the licensed credit bureau) to receive data from the data provider includes an obligation that the data provider makes a reasonable effort to ensure that the data provider provides data with integrity to the licensed credit bureau.
Disclosure of credit report to data subject or with data subject’s written consent
16.—(1) Despite section 13, a licensed credit bureau and any of its officers may disclose to any of the persons mentioned in subsection (2) —(a)
any of its members’ customer information received from a member; or
(b)
a credit report prepared by the licensed credit bureau.
(2) The persons in subsection (1) are —(a)
the data subject of the customer information or credit report; or
(b)
a third party if the licensed credit bureau has the written consent of the data subject for the disclosure.
(3) This section applies to any data received by a licensed credit bureau in a request under section 18(1) or (2) as it applies to customer information of any member of the licensed credit bureau.
Duty to provide access to data
17.—(1) Upon a data subject’s request, a licensed credit bureau must, within 5 business days after the request or any shorter period that the Authority may specify by written notice, provide the data subject with a copy of the credit report of the data subject.
(2) Subject to subsection (3), the licensed credit bureau may charge the data subject a fee each time it provides the data subject with a copy of the credit report under subsection (1).
(3) Despite subsection (2), where —(a)
a data subject (who is an individual) applies for a credit facility from an approved member of a licensed credit bureau; and
(b)
the individual requests, within 30 days after the approved member has approved or rejected the application for the credit facility, a credit report about the individual from the licensed credit bureau in relation to the individual’s application,
the licensed credit bureau must, within 5 business days after the request in paragraph (b) or any shorter period that the Authority may specify by written notice, provide the individual with a copy of the credit report free of charge.
(4) The licensed credit bureau must provide a copy of the credit report mentioned in subsection (1), in one of the following forms at the data subject’s option:(a)
a printed copy to be collected by the data subject at the registered office of the licensed credit bureau;
(b)
a printed copy sent by registered post to an address specified by the data subject;
(c)
an electronic copy;
(d)
an electronic copy sent by electronic mail to an electronic mail address specified by the data subject.
(5) Any person that contravenes subsection (1), (3) or (4) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $250,000 and, in the case of a continuing offence, to a further fine not exceeding $25,000 for every day or part of a day during which the offence continues after conviction.
Correction of data on request
18.—(1) A data subject may request a licensed credit bureau to correct an error or omission in any data of the data subject that is in the possession or under the control of the licensed credit bureau.
(2) A data provider may request a licensed credit bureau to correct an error or omission in any data provided by the data provider to the licensed credit bureau.
(3) Upon receiving a request under subsection (1) or (2), the licensed credit bureau must —(a)
within such period as the Authority may specify by written notice after receiving such request, conduct and complete an investigation to ascertain the integrity of the data; and
(b)
unless it is satisfied on reasonable grounds that a correction should not be made, within such period as the Authority may specify by written notice —(i)
correct the data in its possession or under its control; and
(ii)
send the corrected data to every approved member of the licensed credit bureau to which the licensed credit bureau disclosed the data within a year before the date the correction was made.
(4) Any person that contravenes subsection (3) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $250,000 and, in the case of a continuing offence, to a further fine not exceeding $25,000 for every day or part of a day during which the offence continues after conviction.
Correction of data on licensed credit bureau’s initiative
19.—(1) Subject to subsection (2), a licensed credit bureau must correct an error or omission in the data of a data subject that is in its possession or under its control if it is satisfied that there is evidence of a conflict between the data and other information relating to the data subject —(a)
in its possession or under its control; or
(b)
obtained from such public authority as may be prescribed.
(2) Except under prescribed circumstances, before the licensed credit bureau corrects any data under subsection (1), the licensed credit bureau must —(a)
inform the data provider that provided the data to the licensed credit bureau of the proposed correction; and
(b)
subject to subsection (3), obtain consent from that data provider to the proposed correction.
(3) The licensed credit bureau need not obtain the consent in subsection (2)(b) if it is satisfied that any refusal of consent is frivolous or vexatious.
(4) Any person that contravenes subsection (1) or (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000, and in the case of a continuing offence, to a further fine not exceeding $10,000 for every day or part of a day during which the offence continues after conviction.
Obligation to notify Authority of certain events
20.—(1) A licensed credit bureau must notify the Authority as soon as practicable after the occurrence of any of the following events:(a)
an event that results in a compromise of the confidentiality or security of any data in the possession or under the control of the licensed credit bureau;
(b)
any civil or criminal proceeding instituted against the licensed credit bureau, whether in Singapore or elsewhere;
(c)
any event (including an irregularity in any operations of the licensed credit bureau) that impedes or impairs the operations of the licensed credit bureau;
(d)
the licensed credit bureau is becoming, or is likely to become, insolvent or unable to meet any of its financial, statutory, contractual or other obligations;
(e)
any other event that the Authority may prescribe or specify by written notice from time to time.
(2) Subject to subsection (1), a licensed credit bureau must notify the Authority within 14 days after the occurrence of any of the following events:(a)
any change of any of its executive officers other than a director or the chief executive officer of the licensed credit bureau;
(b)
any other event that the Authority may prescribe or specify by written notice from time to time.
(3) Any person that contravenes subsection (1) or (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $250,000.
Obligation to provide information to Authority
21.—(1) Subject to subsection (4), the Authority may, by written notice, require any licensed credit bureau, or any person acting on behalf of a licensed credit bureau, to provide to the Authority all such information relating to the credit reporting business of the licensed credit bureau within such period as the Authority may specify in the notice.
(2) Without limiting subsection (1), the Authority may in the notice issued under that subsection require any person mentioned in subsection (1) to provide —(a)
information relating to the operations of the licensed credit bureau;
(b)
customer information of any member of the licensed credit bureau that is in the possession or under the control of the licensed credit bureau; and
(c)
any other information that the Authority may require for the purposes of this Act.
(3) Subject to subsection (4) —(a)
a requirement imposed by the Authority under this section has effect despite any obligation as to secrecy or other restrictions upon the disclosure of information imposed by any rule of law or contract; and
(b)
a person that complies with a requirement imposed by the Authority under this section is not to be treated as being in breach of any restriction on the disclosure of the information imposed by any rule of law or contract.
(4) Nothing in this section requires a person to disclose any information subject to legal privilege.
(5) Any person that fails to comply with a notice issued under subsection (1) shall be guilty of an offence and shall be liable on conviction —(a)
in the case of an individual, to a fine not exceeding $50,000 or to imprisonment for a term not exceeding 2 years or to both and, in the case of a continuing offence, to a further fine not exceeding $5,000 for every day or part of a day during which the offence continues after conviction; or
(b)
in any other case, to a fine not exceeding $100,000 and, in the case of a continuing offence, to a further fine not exceeding $10,000 for every day or part of a day during which the offence continues after conviction.
Obligation to submit periodic reports
22.—(1) A licensed credit bureau must submit to the Authority such reports or returns relating to its credit reporting business in such form, manner and frequency as the Authority may specify by written notice.
(2) Any person that contravenes subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000 and, in the case of a continuing offence, to a further fine not exceeding $10,000 for every day or part of a day during which the offence continues after conviction.
Source: Singapore Statutes Online (Attorney-General's Chambers), © Government of Singapore.
The Singapore legislation on this platform is subject to copyright of the Singapore Government and is used/reproduced for the purposes of this platform with the permission of the Attorney-General's Chambers. Users of this platform may check Singapore Statutes Online for the latest version of the Singapore legislation.
