Duty to maintain confidentiality of customer information
33.—(1) Except for a purpose mentioned in subsection (2), an approved member of a licensed credit bureau and any of the member’s officers must not —(a)
request from the licensed credit bureau, any customer information (including a credit report of the member’s customer) of that or any other approved member of the licensed credit bureau; or
(b)
use any customer information (including any such information in a credit report) of that or any other approved member of the licensed credit bureau received from the licensed credit bureau.
(2) The purposes in subsection (1) are —(a)
where the customer information is strictly necessary to assess the creditworthiness of a customer of the approved member; or
(b)
any other purpose that the Authority may permit, by written notice.
(3) An approved member of a licensed credit bureau, and any of the member’s officers, must not disclose to the licensed credit bureau, any customer information of that or any other approved member of the licensed credit bureau except —(a)
where the customer information is strictly necessary to create a credit report;
(b)
to enable the licensed credit bureau to make a disclosure under section 13(2)(b);
(c)
to enable the licensed credit bureau to make a disclosure under section 16; or
(d)
for any other purpose that the Authority may permit by written notice and in accordance with such conditions as may be specified in the notice.
(4) An approved member of a licensed credit bureau, and any of the member’s officers, must not disclose to any other person customer information of any other approved member of the licensed credit bureau that the firstmentioned approved member has received from the licensed credit bureau except —(a)
to the customer to which the information relates;
(b)
where the disclosure is by any of the approved member’s officers, such disclosure is to the approved member;
(c)
to that licensed credit bureau; or
(d)
to any other person if the disclosure is permitted by the Authority by written notice and in accordance with such conditions as may be specified in the notice.
(5) Despite subsections (3) and (4)(c), an approved member of a licensed credit bureau, and the approved member’s officers, must not disclose to the licensed credit bureau, any customer information of that or any other approved member of the licensed credit bureau, if the licensed credit bureau’s licence —(a)
has lapsed;
(b)
is revoked; or
(c)
is suspended.
(6) The Authority may at any time add to, vary or revoke any condition imposed under this section.
(7) Despite subsections (3) and (4)(c), an approved member of a licensed credit bureau and the approved member’s officers must not disclose any of its deposit information to the licensed credit bureau.
(8) To avoid doubt, subsections (3), (4), (5) and (7) do not affect the rights of disclosure that the approved member or any of its officers has under any other written law, including the Banking Act 1970.
(9) Any person that contravenes subsection (1), (3), (4), (5), (7) or any condition imposed under subsection (6) shall be guilty of an offence and shall be liable on conviction —(a)
in the case of an individual, to a fine not exceeding $125,000 or to imprisonment for a term not exceeding 3 years or to both; or
(b)
in any other case, to a fine not exceeding $250,000.
(10) In this section, unless the context otherwise requires —(a)
where customer information of an approved member of a licensed credit bureau may be disclosed under subsection (3) or (4) to any person that is a body corporate, the customer information may be disclosed to such officers of the body corporate as may be necessary for the purpose for which the disclosure is authorised under that subsection; and
(b)
the obligation of any officer of the approved member not to disclose any customer information of any approved member of the licensed credit bureau mentioned in subsection (3), (4), (5) and (7) continues after the termination or cessation of his or her appointment, employment, engagement or other capacity or office in which he or she has been provided the customer information.
(11) In this section, “officer” has the meaning given by section 2(1) of the Banking Act 1970.
(12) This section applies to corrected data received by the approved member from the licensed credit bureau under section 18(3)(b)(ii) as it applies to customer information of any approved member of the licensed credit bureau received by the approved member from the licensed credit bureau.
Duty to maintain security and integrity of data
34.—(1) An approved member of a licensed credit bureau must —(a)
ensure the integrity of any data it provides to the licensed credit bureau;
(b)
protect any data received from the licensed credit bureau by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks; and
(c)
dispose of any data received from the licensed credit bureau if —(i)
the purpose for which that data was provided is no longer being served by retention of the data; and
(ii)
retention is no longer necessary for the approved member’s legal or business purposes.
(2) Any person that contravenes subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $250,000 and, in the case of a continuing offence, to a further fine not exceeding $25,000 for every day or part of a day during which the offence continues after conviction.
Duty to correct data
35.—(1) A data subject may request an approved member of a licensed credit bureau to correct an error or omission in any data of the data subject that —(a)
has been processed by the licensed credit bureau; and
(b)
is in the possession or under the control of the approved member.
(2) Upon receiving a request under subsection (1), the approved member must —(a)
as soon as practicable after receiving the request, inform the licensed credit bureau of the request;
(b)
within such period as the Authority may specify by written notice to the approved member or the class of approved members to which that member belongs, conduct and complete an investigation to ascertain the integrity of the data; and
(c)
unless the approved member is satisfied on reasonable grounds that a correction should not be made, within such period as the Authority may specify by written notice to it —(i)
correct the data in its possession or under its control; and
(ii)
inform the licensed credit bureau in writing of its assessment that a correction to the data should be made.
(3) Where a licensed credit bureau has been informed by its approved member under subsection (2)(c)(ii) that a correction to the data should be made, the licensed credit bureau must, within such period as the Authority may specify by written notice to it —(a)
correct the data that is in the possession or under the control of the licensed credit bureau; and
(b)
send the corrected data to every approved member of the licensed credit bureau to which the licensed credit bureau disclosed the data within a year before the date the correction was made.
(4) Any person that contravenes subsection (2) or (3) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $250,000 and, in the case of a continuing offence, to a further fine not exceeding $25,000 for every day or part of a day during which the offence continues after conviction.
Duty to submit data to licensed credit bureau
36.—(1) The Authority may, by written notice, require an approved member of a licensed credit bureau to provide to the licensed credit bureau, such data relating to the licensed credit bureau’s credit reporting business within such period and in such manner as the Authority may specify in the notice.
(2) Any person that contravenes subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000 and, in the case of a continuing offence, to a further fine not exceeding $10,000 for every day or part of a day during which the offence continues after conviction.
Duty to provide information to Authority
37.—(1) Subject to subsection (4), the Authority may, by written notice, require an approved member of a licensed credit bureau, or any person acting on behalf of the approved member, to provide to the Authority, information relating to —(a)
the approved member’s membership of the licensed credit bureau; and
(b)
the approved member’s activities as an approved member of the licensed credit bureau,
within such period as the Authority may specify in the notice.
(2) Without limiting subsection (1), the Authority may in the notice require the approved member to provide, whether in the form of a return to be provided on a periodic basis or otherwise —(a)
information relating to its involvement as an approved member of the licensed credit bureau;
(b)
information relating to the confidentiality, security or integrity of any data provided to the licensed credit bureau; and
(c)
any other information that the Authority may require for the purposes of this Act.
(3) Subject to subsection (4) —(a)
a requirement imposed by the Authority under this section has effect despite any obligation as to secrecy or other restrictions upon the disclosure of information imposed by any rule of law or contract; and
(b)
a person that complies with a requirement imposed by the Authority under this section is not to be treated as being in breach of any restriction on the disclosure of the information imposed by any rule of law or contract.
(4) Nothing in this section requires a person to disclose any information subject to legal privilege.
(5) Any person that fails to comply with a notice issued under subsection (1) shall be guilty of an offence and shall be liable on conviction —(a)
in the case of an individual, to a fine not exceeding $50,000 or to imprisonment for a term not exceeding 2 years or to both and, in the case of a continuing offence, to a further fine not exceeding $5,000 for every day or part of a day during which the offence continues after conviction; or
(b)
in any other case, to a fine not exceeding $100,000 and, in the case of a continuing offence, to a further fine not exceeding $10,000 for every day or part of a day during which the offence continues after conviction.
Duty to provide information in credit facility document
38.—(1) The Authority may, by written notice to an approved member or a class of approved members of a licensed credit bureau, require the approved member or the member within that class to include any information specified by the Authority in any credit facility document that the approved member provides to its customer.
(2) Without limiting subsection (1), the notice in subsection (1) may require the approved member to specify in the credit facility document that the customer is entitled, if the customer is the data subject of a credit report by the licensed credit bureau, to —(a)
request a copy of the credit report from the licensed credit bureau; and
(b)
receive the copy of the credit report from the licensed credit bureau free of charge to the customer if the customer is an individual, but subject to the requirements of section 17(3).
(3) Any person that fails to comply with a notice given under subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $25,000.
(4) In this section, “credit facility document” means any application form, approval letter, rejection letter or any other document in relation to an application for a credit facility.
Source: Singapore Statutes Online (Attorney-General's Chambers), © Government of Singapore.
