Australia Privacy (Credit Reporting) Code 2025 14: Notify recipients of the use and disclosure limits before disclosing credit reporting information, and on a mistaken identity advise the other party, destroy the information, quarantine derived information and review disclosure practices

Before a body discloses credit reporting information to a provider, mortgage insurer or trade insurer it must have taken reasonable steps to ensure the recipient has been notified of the Part IIIA, Regulations and Code limits on use and disclosure. Where information disclosed in response to a request (by a body, or credit eligibility information by a provider) turns out to concern a different individual, the recipient must advise the discloser of the mistake (unless the discloser found it), destroy the information and take reasonable steps to ensure derived information based on it is not used or disclosed to assess the individual's credit worthiness; the discloser must advise the recipient (unless the recipient found it) and take reasonable steps to review its practices, procedures and systems to minimise repeats.