Section 9: Confidentiality rights of Data Subjects.

(1)
Except this Act provides otherwise, Data Subjects shall have the right to the privacy, confidentiality and protection of their Credit Information.
(2) Notwithstanding any other provision of this Act-
(a)
Credit Information relating to a Data Subject may be disclosed by a credit information provider to a Credit Bureau without the prior consent of the Data Subject to which such information relates;
(b)
a Credit Bureau shall not disclose information relating to a Data
Subject to a Credit Information user except-
(i) it has a data exchange agreement with the Credit Information User and the disclosure is for a permissible purpose, provided that a Credit Bureau shall be entitled to assume that consent has been obtained
by the Credit Information User, unless the Credit Bureau knows, believes or has reasons to believe that such consent has not been obtained;
(ii) written consent of the Data Subject has been obtained by the Credit Information User in accordance with this Act, and provided to the Credit Bureau (such consento be in a form and substance satisfactory
to the Credit Bureau) ; or
(c) a Credit Information User shall not disclose any Credit Information
received from a Credit Bureau to any person or use such information for any purpose other than a permissible purpose, except with the written consent of the Data Subject.
(3) Notwithstanding subsections (I) and (2) or any other provision of
this Act-
(a)
a Credit Bureau, a Credit Information Provider or a Credit lnfonnation
User shall upon written request, disclose any information relating to a Data Subject to :
(i) the Bank,
(ii) any other person pursuant to a court order, or
(iii) where such disclosure is otherwise required under applicabl
(b) the consent of a Data Subject shall not be required to disclose Credit
Information on such Data Subject.where the Data Subject is involved in the
issuance of dishonoured cheques owning to lack of funds or involved in any
other financial or credit-related malpractice and such disclosure is required
for the purpose of investigating or prosecuting such malpractice.
(4) Where consent is obtained under this section, the consent shall be
valid only for the specific transaction or purpose in respect of which it was
obtained and shall lapse immediately after that transaction is consummated or
purpose is satisfied, such that, the consent shall be obtained for subsequent
transaction or purpose.
(5)
For the purpose of this Act any confidentiality obligation owed to a Data Subject by a Credit Information Provider or a Credit Information User (Whether under law or contract) are hereby waived or modified to the extent
required to bring the obligation in conformity with the provisions of this Act.
(6) Data Subjects shall have the following additional rights-
(a) a right to request and obtain, once a year, one free Credit Report
from a Credit Bureau, provided that a Data Subject shall be entitled to, at
any time, request additional Credit Reports on him or her upon payment of
any applicable fee;
(b)
the right to contest the accuracy of information in his or her Credit Report and have same resolved in line with the provisions of this Act, provided that a Data Subject that seeks to contest the accuracy of the
information on the Credit Report must do so within 15 working days of receiving the relevant Credit Report; and
(c) if an application or a transaction involving the Data Subject is declined
based on information in his or her Credit Report, the Data Subject shall be
entitled to be informed by the Credit Information User within 15 working
days the reason for the denial, and to receive a copy of the report from the
Credit Information User at no extra cost.