| (1) | Records of consumer credit information must be maintained in accordance with the following standards: |
| (a) | identified by the consumer’s identity number or passport number, or where no identity number or passport number is available for a particular person, any other reasonable method to identify the record; |
| (b) | collected, processed and distributed in a manner that ensures that the records remain confidential and secure; |
| (c) | protected against accidental, unlawful destruction and unlawful intrusion; |
| (d) | protected against loss or wrongful alteration, and |
| (e) | protected against unauthorised disclosure or access by any unauthorised person. |
| (2) | The credit bureau must take all reasonable steps to ensure that all records are kept up to date. |
| (3) | Consumer credit information relating to the following subjects may not be contained on the records of the credit bureau: |
| (b) | political affiliation; |
| (c) | medical status or history; |
| (d) | religion or thought, belief or opinion; |
| (e) | sexual orientation, except to the extent that such information is self-evident from the record of the consumer’s marital status and list of family members; and |
| (f) | membership of a trade union, except to the extent that such information is self-evident from the record of the consumer’s employment information. |
| (4) | The prescribed purposes, other than for purposes contemplated in the Act, for which a report may be issued in terms of section 70(2)(g), are: |
| (a) | an investigation into fraud, corruption or theft, provided that the South African Police Service or any other statutory enforcement agency conducts such an investigation; |
| (b) | fraud detection and fraud prevention services; |
| (c) | considering a candidate for employment in a position that requires honesty in dealing with cash or finances; |
[Regulation 18(4)(c) substituted by Notice No. R. 202, GG 38557 dated 13 March 2015]
| (d) | an assessment of the debtors book of a business for the purposes of: |
| (i) | the sale of the business or debtors book of that business; or |
| (ii) | any other transaction that is dependant upon determining the value of the business or debtors book of that business; |
| (e) | setting a limit of service provision in respect of any continuous service; |
| (f) | assessing an application for insurance; |
| (g) | verifying educational qualifications and employment; |
| (h) | obtaining consumer information to distribute unclaimed funds, including pension funds and insurance claims; |
| (i) | tracing a consumer by a credit provider in respect of a credit agreement entered into between the consumer and the credit provider; |
| (j) | developing a credit scoring system by a credit provider or credit bureau. |
| (5) | Should a report be required for a purpose set out in sub-regulation (4)(c) or (e) to (g), the consent of the consumer must be obtained prior to the report being requested. |
| (6) | In addition to the consumer credit information contemplated in section 70(1) of the Act, a registered credit bureau may receive, compile and report only the following information in respect of a consumer: |
| (a) | payment history and status in respect of continuous services; |
| (b) | information that is relevant for the purpose of credit fraud detection and prevention; |
| (c) | payments made by a consumer in respect of a debt, where the debt has been ceded or sold by the credit provider to another party; |
| (d) | information that is not related to and not intended for the purpose of providing consumer credit, provided that the consumer’s consent has been obtained to use the information for such purpose and to submit, compile and report such information. |
| (7) | In addition to the sources of consumer credit information contemplated in section 70(2) of the Act, a registered credit bureau may receive consumer credit information in respect of a consumer from any person, provided the originating source of the information is one of the following persons: |
| (a) | An organ of state, a court or judicial officer; |
| (b) | Any provider of a continuous service as defined in the Act; |
| (c) | A person providing long term and short term insurance; |
| (d) | Entities involved in fraud investigation; |
| (e) | Educational institutions; |
| (f) | Debt collectors to whom book debt was ceded or sold by a credit provider; |
| (g) | Other registered credit bureaux. |
| (8) | maximum fees that may be charged for assessing and inspecting any file or information as contemplated in section 72(1)(b)(ii) of the Act is set out in Schedule 2. |
