1 PART I PRELIMINARY-1. Short title and commencement

(1) This Act may be cited as the Credit Reporting Agencies Act 2010 .

(2) This Act comes into operation on a date to be appointed by the Minister by notification in the Gazette, and the Minister may appoint different dates for different provisions of this Act.

2 PART I PRELIMINARY-2. Interpretation

In this Act, unless the context otherwise requires:-

  "credit reporting agency"  means a person who carries on a credit reporting business and is registered under subsection 14(2);

  "relevant credit reporting agency"  , in relation to:-

(a) an inspection, means the credit reporting agency who uses the data system which is the subject of the inspection;

(b) a complaint, means the credit reporting agency specified in the complaint;

(c) an investigation:-

(i) in the case of an investigation initiated by a complaint, means the credit reporting agency specified in the complaint;

(ii) in any other case, means the credit reporting agency who is the subject of the investigation;

(d) an enforcement notice, means the credit reporting agency on whom the enforcement notice is serve

3 PART II APPOINTMENT, FUNCTIONS AND POWERS OF REGISTRAR-3. Appointment of Registrar

(1) The Minister shall appoint a public officer to be known as the "Registrar of Credit Reporting Agencies" for the purposes of carrying out the functions and powers assigned to the Registrar under this Act.

(2) The appointment of the Registrar shall be published by notification in the Gazette .

4 PART II APPOINTMENT, FUNCTIONS AND POWERS OF REGISTRAR-4. Functions of Registrar

The Registrar shall have all the functions imposed on him under this Act and without prejudice to the generality of the foregoing, shall also have the following functions:

(a) to advise the Minister on all matters in relation to the administration of this Act;

(b) to implement and enforce this Act including the formulation of operational policies and procedures;

(c) to promote awareness and dissemination of information to the public in relation to the operation of this Act;

(d) to be responsible for the monitoring, controlling, supervision and regulation of credit reporting agencies;

(e) to encourage and promote the sound and orderly development of credit reporting agencies and the credit reporting sector;

(f) to create a conducive environment for credit reporting agencies to carry out their activities; and

(g) to carry out such activities or do such things as are necessary, advantage

5 PART II APPOINTMENT, FUNCTIONS AND POWERS OF REGISTRAR-5. Powers of Registrar

(1) The Registrar shall have all such powers to do all things necessary or expedient for or in connection with the performance of his functions under this Act.

(2) Without prejudice to the generality of subsection (1), the powers of the Registrar shall include the power:-

(a) to appoint such agents, experts or consultants as he thinks fit to assist him in the performance of his functions;

(b) to enter into contracts;

(c) to establish and maintain the Register;

(d) to collect such fees as may be prescribed under this Act; and

(e) to do all such other things as he thinks fit to enable him to perform his functions effectively or which may be incidental to or consequential upon the performance of his functions.

6 PART II APPOINTMENT, FUNCTIONS AND POWERS OF REGISTRAR-6. Appointment of Deputy Registrar and Assistant Registrar

(1) The Minister shall appoint such number of public officers as Deputy Registrars and Assistant Registrars as are necessary to assist the Registrar in the performance of his functions and the exercise of his powers under this Act.

(2) The Deputy Registrars and Assistant Registrars appointed under subsection (1) shall be subject to the supervision, direction and control of the Registrar.

7 PART II APPOINTMENT, FUNCTIONS AND POWERS OF REGISTRAR-7. Appointment of officers

(1) The Registrar may, with the approval of the Minister, appoint such number of public officers as are necessary to assist the Registrar in the performance of his functions and the exercise of his powers under this Act.

(2) All officers appointed under subsection (1) shall be subject to the supervision, direction and control of the Registrar.

8 PART II APPOINTMENT, FUNCTIONS AND POWERS OF REGISTRAR-8. Delegation of Registrar's functions and powers

(1) The Registrar may, subject to such conditions, limitations or restrictions as he may think fit to impose, delegate any of his functions or powers imposed or conferred upon him under this Act, except his power of delegation, to any of the officers appointed under subsections 6(1) and 7(1) and any function or power so delegated may be performed and exercised by the officer in the name and on behalf of the Registrar.

(2) The delegation under subsection (1) shall not preclude the Registrar himself from performing or exercising at any time the delegated functions or powers.

9 PART II APPOINTMENT, FUNCTIONS AND POWERS OF REGISTRAR-9. Register of Credit Reporting Agencies

(1) The Registrar shall establish and maintain a .

(2) The Register shall contain the names and addresses of all credit reporting agencies which have been registered under subsection 14(2) and any other particulars regarding such credit reporting agencies as may be determined by the Registrar.

(3) Subject to subsection (4), the Registrar shall make the Register available for inspection by the public, subject to such conditions as he may think fit.

(4) A person may on payment of the prescribed fee:-

(a) inspect the Register; or

(b) make a copy of or take extracts from an entry in the Register.

10 PART II APPOINTMENT, FUNCTIONS AND POWERS OF REGISTRAR-10. Restriction on enquiring specifically into affairs of particular customer

Without prejudice to the powers of inspection, examination, investigation or enquiry conferred on the Registrar or authorized officer, nothing in this Act shall:-

(a) authorize the Minister to direct the Registrar; or

(b) authorize the Registrar,

to enquire specifically into the affairs of a particular customer.

11 PART III REGISTRATION OF CREDIT REPORTING AGENCIESREGISTRATION OF CREDIT REPORTING AGENCIES-11. Prohibition to carry on credit reporting business unless registered

(1) No person shall carry on a credit reporting business unless:-

(a) it is a company; and

(b) it has been registered as a credit reporting agency and been issued a certificate of registration by the Registrar under subsection 14(5).

(2) A person who contravenes subsection (1) commits an offence and shall, upon conviction, be liable to a fine not exceeding one million ringgit or to imprisonment for a term not exceeding three years or to both.

(3) In the case of a continuing offence, the offender shall, in addition to the penalties under subsection (2), be liable to a fine not exceeding ten thousand ringgit for each day or part of a day during which the offence continues after conviction.

12 PART III REGISTRATION OF CREDIT REPORTING AGENCIESREGISTRATION OF CREDIT REPORTING AGENCIES-12. Restriction to carry on business other than credit reporting business

(1) A credit reporting agency shall not carry on any business other than a credit reporting business, unless it has obtained the prior written approval of the Registrar.

(2) A person who contravenes subsection (1) commits an offence and shall, upon conviction, be liable to a fine not exceeding two hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.

13 PART III REGISTRATION OF CREDIT REPORTING AGENCIESREGISTRATION OF CREDIT REPORTING AGENCIES-13. Application for registration

(1) A person who intends to carry on a credit reporting business shall submit an application in writing for registration as a credit reporting agency to the Registrar in such form as he may determine.

(2) Every application for registration shall be accompanied by:-

(a) a copy of the memorandum of association and articles of association or other constituent documents under which the applicant is established, and its certificate of incorporation duly verified by a statutory declaration made by a director of the applicant;

(b) a copy of the latest audited accounts of the applicant, where applicable; and

(c) such other information or documents as may be determined by the Registrar for the purposes of determining the application and the suitability of the applicant.

(3) The Registrar may in writing at any time after receiving the application and before it is determined, require the applicant

14 PART III REGISTRATION OF CREDIT REPORTING AGENCIESREGISTRATION OF CREDIT REPORTING AGENCIES-14. Certificate of registration

(1) In considering an application for registration as a credit reporting agency, the Registrar shall be satisfied that:-

(a) the applicant has a minimum paid-up capital as prescribed in section 20; and

(b) the chief executive and directors of the applicant have fulfilled the criteria as specified in the Third Schedule.

(2) After having given due consideration to the application for registration and the conditions as referred to in subsection (1), the Registrar may register the applicant or refuse the application for registration.

(3) The decision of the Registrar to register the applicant or refuse the application for registration shall be communicated to the applicant in a written notice issued by the Registrar as soon as practicable.

(4) Where the Registrar refuses the application for registration in pursuance of subsection (2), he shall in the written notice issued under subsection (

15 PART III REGISTRATION OF CREDIT REPORTING AGENCIESREGISTRATION OF CREDIT REPORTING AGENCIES-15. Renewal of certificate of registration

(1) A credit reporting agency may make an application for the renewal of the certificate of registration not later than ninety days before the date of expiry of the certificate of registration in the manner and form as determined by the Registrar and the application shall be accompanied with the prescribed renewal fee and such documents as may be required by the Registrar, but no application for renewal shall be allowed where the application is made after the date of expiry of the certificate of registration.

(2) When renewing a certificate of registration, the Registrar may vary the conditions or restrictions imposed upon the issuance of the certificate of registration or impose additional conditions or restrictions.

(3) The Registrar may refuse to renew a certificate of registration:-

(a) if the credit reporting agency has failed to comply with any of the provisions of this Act;

(b) if the credit reporting

16 PART III REGISTRATION OF CREDIT REPORTING AGENCIESREGISTRATION OF CREDIT REPORTING AGENCIES-16. Revocation of registration

(1) The Registrar may revoke the registration of a credit reporting agency if he is satisfied that:-

(a) the credit reporting agency has failed to comply with any of the provisions of this Act;

(b) the credit reporting agency has failed to comply with any of the conditions or restrictions imposed upon the issuance of the certificate of registration;

(c) the issuance of the certificate of registration was induced by a false representation of fact by the credit reporting agency;

(d) the credit reporting agency is in the course of being wound up or otherwise dissolved;

(e) a receiver, manager or receiver and manager or an equivalent person has been appointed in respect of any property of the credit reporting agency;

(f) the credit reporting agency has ceased to carry on the credit reporting business for a continuous period of three months;

(g) the credit reporting agency carries on the c

17 PART III REGISTRATION OF CREDIT REPORTING AGENCIESREGISTRATION OF CREDIT REPORTING AGENCIES-17. Surrender of certificate of registration

(1) Where the certificate of registration is revoked pursuant to section 16, the holder of the certificate shall, within fourteen days from the date of service of the notice of revocation of registration, surrender the certificate to the Registrar.

(2) A person who fails to comply with subsection (1) commits an offence and shall, on conviction, be liable to a fine not exceeding two hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.

18 PART III REGISTRATION OF CREDIT REPORTING AGENCIESREGISTRATION OF CREDIT REPORTING AGENCIES-18. Appeal against decision of Registrar

Where the Registrar:-

(a) refuses an application for registration under section 14 or an application for the renewal of registration under section 15; or

(b) revokes the certificate of registration under section 16, the person so aggrieved by the decision of the Registrar may appeal to the Minister against such decision in accordance with section 59.

19 PART III REGISTRATION OF CREDIT REPORTING AGENCIESREGISTRATION OF CREDIT REPORTING AGENCIES-19. Handling of credit information when registration of credit reporting agency is revoked, etc

(1) Any credit reporting agency which:-

(a) has ceased to be a credit reporting agency; or

(b) has its certificate of registration revoked by the Registrar pursuant to section 16,

shall, within the period as determined by the Registrar, hand over all the credit information in its databases or within its possession, in whatever form available, and the databases, including back-up files, to the Registrar.

(2) Upon receipt of the credit information and databases from the credit reporting agency under subsection (1), referred to as the "first credit reporting agency", the Registrar may decide either:-

(a) to destroy the credit information and databases; or

(b) with the approval of the Minister, to hand over the credit information and databases to another credit reporting agency, referred to as the "subsequent credit reporting agency", upon payment of compensation by the

20 PART IV MANAGEMENT OF CREDIT REPORTING AGENCIES-20. Minimum paid-up capital

(1) The minimum amount of paid-up capital of a credit reporting agency shall be one million ringgit or such other amount as may be prescribed in an order made by the Minister, on the recommendation of the Registrar, from time to time.

(2) Subject to subsection (4), every credit reporting agency shall maintain the minimum amount of paid-up capital as prescribed in subsection (1), and if such minimum amount is at any time increased, the credit reporting agency shall maintain the increased amount within such period as may be stated in the order that prescribed the increased amount, but such period shall not be less than three months.

(3) Subject to subsection (4), no person shall be issued a certificate of registration under subsection 14(5) and no credit reporting agency shall carry on a credit reporting business if its paid-up capital unimpaired by losses or otherwise is less than the minimum amount prescribed in subsection (1).

21 PART IV MANAGEMENT OF CREDIT REPORTING AGENCIES-21. Appointment of chief executive, etc

(1) A credit reporting agency shall appoint a chief executive who shall satisfy the criteria as set out in the Third Schedule.

(2) The credit reporting agency shall notify the Registrar of the appointment of its chief executive within fourteen days from the date of the appointment.

(3) Where a person, who is a director or chief executive of a credit reporting agency, at any time does not satisfy the criteria as set out in the Third Schedule, he shall immediately cease to hold the office and act in such capacity, and the credit reporting agency concerned shall immediately terminate his appointment in such capacity.

(4) A credit reporting agency which contravenes subsection (1) or (2) commits an offence and shall, on conviction, be liable to a fine not exceeding two hundred thousand ringgit.

(5) A person who contravenes subsection (3) commits an offence and shall, on conviction, be liable to a fine not exceeding two hundre

22 PART V CONDUCT OF BUSINESS OF CREDIT REPORTING AGENCIES-22. Collection of credit information

(1) No credit reporting agency shall collect any credit information about a customer unless:-

(a) the credit information is collected for a specific and lawful purpose directly related to an activity of the credit reporting agency and shall not be further processed in any manner incompatible with that purpose;

(b) the collection of the credit information is necessary for or directly related to that purpose; and

(c) the credit information is adequate but not excessive in relation to that purpose.

(2) A credit reporting agency which contravenes subsection (1) commits an offence and shall, upon conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.

(3) The collection and use of credit information by a credit reporting agency under subsection (1) shall not require the consent of the customer concerned.

23 PART V CONDUCT OF BUSINESS OF CREDIT REPORTING AGENCIES-23. Notice to customer on processing of credit information

(1) A credit reporting agency shall by written notice inform a customer:-

(a) that credit information of the customer is being processed by or on behalf of the credit reporting agency, and shall provide a description of the credit information to that customer;

(b) the purposes for which the credit information is being or is to be processed;

(c) of any information available to the credit reporting agency as to the source of that credit information;

(d) of how to contact the credit reporting agency with any inquiries or complaints in respect of the credit information and of the customer's right to request access to and to request correction of the credit information;

(e) of the subscribers or other persons to whom the credit reporting agency discloses or may disclose the credit information;

(f) of the choices and means the credit reporting agency offers the customer for limiting the processing

24 PART V CONDUCT OF BUSINESS OF CREDIT REPORTING AGENCIES-24. Disclosure of credit information

(1) No credit reporting agency shall disclose any credit information for any purpose or to any person unless:-

(a) the customer has given his consent to the disclosure;

(b) the disclosure is necessary for the purpose of preventing or detecting crime or for the purpose of investigations; or

(c) the disclosure is required or authorized by or under any law, or by the order of a court.

(2) Subject to subsection (3), where a credit reporting agency has obtained the consent of the customer under paragraph (1)(a), it shall not disclose the credit information:-

(a) for any other purpose other than the purpose for which; or

(b) to any other person other than the person to whom,

the customer has consented under that paragraph.

(3) Where a credit reporting agency intends to disclose the credit information:-

(a) for any other p

25 PART V CONDUCT OF BUSINESS OF CREDIT REPORTING AGENCIES-25. Prohibited disclosure in credit report

(1) Subject to section 24, a credit reporting agency shall not include any of the following in a credit report:-

(a) any information unless such information includes the name and address of the source of the credit information;

(b) any information unless the identity of the customer can be identified;

(c) any information in relation to a person's bankruptcy two years after the date of his discharge from the bankruptcy;

(d) any information in relation to a pecuniary action in court against a person more than two years after the date of commencement of the proceedings, unless the current status of the court action has been ascertained and is included in the credit report; and

(e) any information in relation to any default in repayment of credit two years after the date of final settlement of the amount in default, including settlement of the amounts payable pursuant to a scheme of arrangement with the

26 PART V CONDUCT OF BUSINESS OF CREDIT REPORTING AGENCIES-26. Storage and security of credit information

(1) A credit reporting agency shall, when processing any credit information, take practical steps to protect the credit information from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction by having regard:-

(a) to the nature of the credit information and the harm that would result from such loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction;

(b) to the place or location where the credit information is stored;

(c) to any security measures incorporated into any equipment in which the credit information is stored;

(d) to the measures taken for ensuring the reliability, integrity and competence of personnel having access to the credit information; and

(e) to the measures taken for ensuring the secure transfer of the credit information.

(2) Where processing of credit informatio

27 PART V CONDUCT OF BUSINESS OF CREDIT REPORTING AGENCIES-27. Obligation of subscribers, etc

(1) Any subscriber or other person, including a person providing services to a credit reporting agency, who has access to the credit information processed by the credit reporting agency shall take appropriate measures to safeguard the credit information against any unauthorized or improper access, use, modification or disclosure, including:-

(a) developing written policies and procedures to be followed by its employees, agents and contractors;

(b) establishing controls, including:-

(i) the use of passwords, credential tokens, digital signatures or other mechanisms; and

(ii) user identification;

(c) providing information and training to ensure compliance with the policies, procedures and controls;

(d) monitoring usage and regularly checking compliance with the policies, procedures and controls;

(e) taking appropriate action in relation to identified breaches

28 PART V CONDUCT OF BUSINESS OF CREDIT REPORTING AGENCIES-28. Unfavourable credit action

Where a credit provider has taken an unfavourable credit action against a customer based on a credit report, the credit provider shall, upon request of the customer, disclose to the customer:-

(a) that the unfavourable credit action was on the basis of the credit report provided by a credit reporting agency; and

(b) the identity of the credit reporting agency from which the credit report was obtained that resulted in such unfavourable credit action.

29 PART V CONDUCT OF BUSINESS OF CREDIT REPORTING AGENCIES-29. Accuracy of credit information

(1) A credit reporting agency shall not use or further process any credit information without taking such steps as are in the circumstances reasonable to ensure that the credit information is accurate, up-to-date, complete, relevant and not misleading.

(2) A credit reporting agency shall, when undertaking a comparison of credit information within its control with any other credit information for the purpose of producing or verifying information about an identifiable customer, take such measures as are reasonably practicable to avoid the incorrect matching of the credit information.

(3) Without limiting the generality of subsection (1), a credit reporting agency shall:-

(a) establish and maintain controls to ensure that, as far as is reasonably practicable, only credit information that is accurate, up-to-date, complete, relevant and not misleading is used or further processed;

(b) monitor credit information t

30 PART V CONDUCT OF BUSINESS OF CREDIT REPORTING AGENCIES-30. Right of access to credit information or credit report

(1) Subject to subsection (5), a credit reporting agency shall not later than twenty-one days from the date of receipt of an access request from a requestor:-

(a) provide the requestor with a confirmation of whether or not the credit reporting agency has processed the credit information of a customer; and

(b) where the credit reporting agency has processed the credit information of the customer, it shall:-

(i) allow the requestor to have access to the credit information held; or

(ii) allow the requestor to have access to the credit information held and any credit report furnished by the credit reporting agency to any subscriber or other person, within the period of twelve months preceding the date of the access request; or

(c) where the credit reporting agency has processed the credit information of the customer, it shall, upon payment of the prescribed fee by the requestor

31 PART V CONDUCT OF BUSINESS OF CREDIT REPORTING AGENCIES-31. Right to correct credit information or credit report

(1) Where:-

(a) a copy of the credit information or credit report has been supplied by the credit reporting agency in compliance with an access request under section 30 and the requestor considers that the credit information or credit report is inaccurate, not up-to-date, incomplete, irrelevant or misleading; or

(b) the customer knows that the credit information being held by the credit reporting agency is inaccurate, not up-to-date, incomplete, irrelevant or misleading, the requestor or customer, as the case may be, may make a correction request in writing to the credit reporting agency that it makes the necessary correction to the credit information or credit report.

(2) Where a credit reporting agency does not hold the credit information, but controls the processing of the credit information in such a way as to prohibit the credit reporting agency who holds the credit information from complying, whe

32 PART VI INSPECTION, COMPLAINT AND INVESTIGATION-32. Inspection of data system

(1) The Registrar may carry out an inspection of any data system used by credit reporting agencies for the purpose of ascertaining information to assist the Registrar in making recommendations to the relevant credit reporting agency relating to the promotion of compliance with the provisions of this Act by the relevant credit reporting agency.

(2) For the purposes of this section:-

  "credit reporting agency"  includes a credit information processor;

  "data system"  means any system, whether automated or otherwise, which is used, whether in whole or in part, by a credit reporting agency for the processing of credit information, and includes any document and equipment forming part of the system.

33 PART VI INSPECTION, COMPLAINT AND INVESTIGATION-33. Relevant credit reporting agency to be informed of result of inspection

Where the Registrar has completed an inspection of a data system, he shall in such manner and at such time as he thinks fit inform the relevant credit reporting agency of:-

(a) the results of the inspection;

(b) any recommendations arising from the inspection that the Registrar thinks fit to make relating to the promotion of compliance with the provisions of this Act by the relevant credit reporting agency; and

(c) such other comments arising from the inspection as he thinks fit.

34 PART VI INSPECTION, COMPLAINT AND INVESTIGATION-34. Reports by Registrar

(1) The Registrar may, after completing the inspection of any data system used by a credit reporting agency, publish a report:-

(a) setting out any recommendations arising from the inspection that the Registrar thinks fit to make relating to the promotion of compliance with the provisions of this Act by the relevant credit reporting agency; and

(b) in such manner as he thinks fit.

(2) A report published under subsection (1) shall be so framed as to prevent the identity of any individual being ascertained from it.

35 PART VI INSPECTION, COMPLAINT AND INVESTIGATION-35. Complaint

Any person or relevant person may make a complaint in writing to the Registrar about an act, practice or request:-

(a) specified in the complaint;

(b) that has been done or engaged in, or is being done or engaged in, by the relevant credit reporting agency specified in the complaint;

(c) that relates to credit information of which the person is the customer; and

(d) that may be a contravention of the provisions of this Act, including any codes of practice.

36 PART VI INSPECTION, COMPLAINT AND INVESTIGATION-36. Investigation by Registrar

(1) Where the Registrar receives a complaint under section 35, the Registrar shall, subject to section 37, carry out an investigation in relation to the relevant credit reporting agency to ascertain whether the act, practice or request specified in the complaint contravenes the provisions of this Act.

(2) Where the Registrar has reasonable grounds to believe that an act, practice or request has been done or engaged in, or is being done or engaged in, by the relevant credit reporting agency that relates to credit information and such act, practice or request may be a contravention of the provisions of this Act, the Registrar may carry out an investigation in relation to the relevant credit reporting agency to ascertain whether the act, practice or request contravenes the provisions of this Act.

(3) The provisions of Part VII shall apply in respect of investigations carried out by the Registrar under this Part.

37 PART VI INSPECTION, COMPLAINT AND INVESTIGATION-37. Restriction on investigation initiated by complaint

(1) The Registrar may refuse to carry out or continue an investigation initiated by a complaint if he is of the opinion that, having regard to all the circumstances of the case:-

(a) the complaint, or a complaint of a substantially similar nature, has previously initiated an investigation as a result of which the Registrar was of the opinion that there has been no contravention of the provisions of this Act;

(b) the act, practice or request specified in the complaint is trivial;

(c) the complaint is frivolous, vexatious or is not made in good faith; or

(d) any investigation or further investigation is for any other reason unnecessary.

(2) Notwithstanding the generality of the powers conferred on the Registrar by this Act, the Registrar may refuse to carry out or continue an investigation initiated by a complaint:-

(a) if:-

(i) the complainant; o

38 PART VI INSPECTION, COMPLAINT AND INVESTIGATION-38. Registrar may carry out or continue investigation initiated by complaint notwithstanding withdrawal of complaint

Where the Registrar is of the opinion that it is in the public interest so to do, he may carry out or continue an investigation initiated by a complaint notwithstanding that the complainant has withdrawn the complaint and, in any such case, the provisions of this Act shall apply to the complaint and the complainant as if the complaint had not been withdrawn.

39 PART VI INSPECTION, COMPLAINT AND INVESTIGATION-39. Enforcement notice

(1) Where, following the completion of an investigation about an act, practice or request specified in the complaint, the Registrar is of the opinion that the relevant credit reporting agency:-

(a) is contravening a provision of this Act; or

(b) has contravened such a provision in circumstances that make it likely that the contravention will continue or be repeated,

then the Registrar may serve on the relevant credit reporting agency an enforcement notice:-

(A) stating that he is of that opinion;

(B) specifying the provision of this Act on which he has based that opinion and the reasons why he is of that opinion;

(C) directing the relevant credit reporting agency to take such steps as are specified in the enforcement notice to remedy the contravention or, as the case may be, the matters occasioning it within such period as is specified in the enforcement notice; and

40 PART VI INSPECTION, COMPLAINT AND INVESTIGATION-40. Variation or cancellation of enforcement notice

The Registrar may, on his own initiative or on the application of a relevant credit reporting agency, vary or cancel an enforcement notice served under subsection 39(1) by notice in writing to the relevant credit reporting agency if the Registrar is satisfied with the action taken by the relevant credit reporting agency to remedy the contravention.

41 PART VII ENFORCEMENT-41. Authorized officers

The Registrar may, either generally or in any particular case, in writing authorize any officer appointed under subsection 6(1) or 7(1) or any public officer to exercise the powers of enforcement under this Act.

42 PART VII ENFORCEMENT-42. Authority card

(1) The Registrar shall issue to each authorized officer an authority card which shall be signed by the Registrar.

(2) Whenever the authorized officer exercises any of the powers of enforcement under this Act, he shall produce on demand to the person against whom the power is being exercised the authority card issued to him under subsection (1).

43 PART VII ENFORCEMENT-43. Power of investigation

(1) An authorized officer may investigate the commission of any offence under this Act.

(2) For the avoidance of doubt, it is declared that for the purposes of this Act, the authorized officer shall have all or any of the special powers of a police officer of whatever rank in relation to police investigations in seizable cases as provided for under the Criminal Procedure Code [Act 593] , and such powers shall be in addition to the powers provided for under this Act and not in derogation thereof.

44 PART VII ENFORCEMENT-44. Search and seizure with warrant

(1) If it appears to a Magistrate, upon written information on oath from the authorized officer and after such inquiry as the Magistrate considers necessary, that there is reasonable cause to believe that:-

(a) any premises has been used for; or

(b) there is in any premises evidence necessary to the conduct of an investigation into,

the commission of an offence under this Act, the Magistrate may issue a warrant authorizing the authorized officer named in the warrant at any reasonable time by day or night and with or without assistance, to enter the premises and if need be by force.

(2) Without affecting the generality of subsection (1), the warrant issued by the Magistrate may authorize the search and seizure of:-

(a) any computer, book, account, computerized data or other document which contains or is reasonably suspected to contain information as to any offence suspected

45 PART VII ENFORCEMENT-45. Search and seizure without warrant

If an authorized officer is satisfied upon information received that he has reasonable cause to believe that by reason of delay in obtaining a search warrant under section 44 the investigation would be adversely affected or evidence of the commission of an offence is likely to be tampered with, removed, damaged or destroyed, the authorized officer may enter the premises and exercise in, upon and in respect of the premises all the powers referred to in section 44 in as full and ample a manner as if he were authorized to do so by a warrant issued under that section.

46 PART VII ENFORCEMENT-46. Access to computerized data

(1) An authorized officer conducting a search under sections 44 and 45 shall be given access to computerized data whether stored in a computer or otherwise.

(2) For the purposes of this section, "access":-

(a) includes being provided with the necessary password, encryption code, decryption code, software or hardware and any other means required to enable comprehension of computerized data; and

(b) has the meaning assigned to it by subsections 2(2) and (5) of the Computer Crimes Act 1997 [Act 563] .

47 PART VII ENFORCEMENT-47. Warrant admissible notwithstanding defects

A search warrant issued under this Act shall be valid and enforceable notwithstanding any defect, mistake or omission therein or in the application for such warrant, and any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized under such warrant shall be admissible in evidence in any proceedings under this Act.

48 PART VII ENFORCEMENT-48. List of computer, book, account, etc , seized

(1) Except as provided in subsection (2), where any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article is seized pursuant to this Act, the authorized officer making the seizure:-

(a) shall prepare:-

(i) a list of the computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized and shall sign the list; and

(ii) a written notice of such seizure containing the grounds for the seizure and shall sign the notice; and

(b) shall as soon as practicable serve a copy of the list of the computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized and the written notice of the seizure to the occupier of the premises w

49 PART VII ENFORCEMENT-49. Release of computer, book, account, etc , seized

(1) If any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article has been seized under this Act, the authorized officer who effected the seizure may, after referring to the Public Prosecutor, release the computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article to the person as he determines to be lawfully entitled to it, if he is satisfied that the computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article is not liable to forfeiture under this Act, and is not otherwise required for the purpose of any proceedings under this Act or for the purpose of any prosecution under any other written law, and in such event neither the authorized officer effecting the seizure, nor the Federal Govern

50 PART VII ENFORCEMENT-50. No cost or damages arising from seizure to be recoverable

No person shall, in any proceedings before any court in respect of any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized in the exercise or the purported exercise of any power conferred under this Act, be entitled to the costs of such proceedings or to any damages or other relief unless such seizure was made without reasonable cause.

51 PART VII ENFORCEMENT-51. Obstruction to search

Any person who:-

(a) refuses any authorized officer access to any premise which the authorized officer is entitled to have under this Act or in the execution of any duty imposed or power conferred by this Act;

(b) assaults, obstructs, hinders or delays any authorized officer in effecting any entry which the authorized officer is entitled to effect under this Act, or in the execution of any duty imposed or power conferred by this Act; or

(c) refuses any authorized officer any information relating to an offence or suspected offence under this Act or any other information which may reasonably be required of him and which he has in his knowledge or power to give,

commits an offence and shall, on conviction, be liable to imprisonment for a term not exceeding two years or to a fine not exceeding two hundred thousand ringgit or to both.

52 PART VII ENFORCEMENT-52. Power to require production of computer, book, account, etc

An authorized officer shall, for the purposes of the execution of this Part, have the power to do all or any of the following:-

(a) to require the production of any computer, book, account, computerized data or other document kept by the credit reporting agency or any other person and to inspect, examine and to download from them, make copies of them or take extracts from them;

(b) to require the production of any identification document from any person in relation to any act or offence under this Act;

(c) to make such enquiries as may be necessary to ascertain whether the provisions of this Act have been complied with.

53 PART VII ENFORCEMENT-53. Power to require attendance of persons acquainted with case

(1) An authorized officer making an investigation under this Act may by order in writing require the attendance before himself of any person who appears to the authorized officer to be acquainted with the facts and circumstances of the case, and such person shall attend as so required.

(2) If any person refuses or fails to attend as so required, the authorized officer may report such refusal or failure to a Magistrate who shall issue a summons to secure the attendance of such person as may be required by the order made under subsection (1).

54 PART VII ENFORCEMENT-54. Examination of persons acquainted with case

(1) An authorized officer making an investigation under this Act may examine orally any person supposed to be acquainted with the facts and circumstances of the case and shall reduce into writing any statement made by the person so examined.

(2) Such person shall be bound to answer all questions relating to the case put to him by the authorized officer:-

Provided that such person may refuse to answer any question the answer to which would have a tendency to expose him to a criminal charge or penalty or forfeiture.

(3) A person making a statement under this section shall be legally bound to state the truth, whether or not such statement is made wholly or partly in answer to questions.

(4) The authorized officer examining a person under subsection (1) shall first inform that person of the provisions of subsections (2) and (3).

(5) A statement made by any person under this section shall, w

55 PART VII ENFORCEMENT-55. Admission of statements in evidence

(1) Except as provided in this section, no statement made by any person to an authorized officer in the course of an investigation made under this Act shall be used in evidence.

(2) When any witness is called for the prosecution or for the defence, other than the accused, the court shall, on the request of the accused or the prosecutor, refer to any statement made by that witness to the authorized officer in the course of the investigation under this Act and may then, if the courts thinks fit in the interest of justice, direct the accused to be furnished with a copy of it and the statement may be used to impeach the credit of the witness in the manner provided by the Evidence Act 1950.

(3) Where the accused had made a statement during the course of an investigation, such statement may be admitted in evidence in support of his defence during the course of the trial.

(4) Nothing in this section shall be deemed to apply to any stat

56 PART VII ENFORCEMENT-56. Forfeiture of computer, book, account, etc , seized

(1) Any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized shall be liable to forfeiture.

(2) An order for the forfeiture of the computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized and liable to forfeiture under this Act shall be made by the court before which the prosecution with regard thereto has been held if it is proved to the satisfaction of the court that an offence under this Act has been committed and that the computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized was the subject of or was used in the commission of the offence, notwithstanding that no person has been convicted of such offence.

(3) If there is no prosecution with

57 PART VII ENFORCEMENT-57. Joinder of offences

Notwithstanding anything contained in section 164 of the Criminal Procedure Code, where a person is accused of more than one offence under this Act, he may be charged with and tried at one trial for any number of such offences committed within the space of any length of time.

58 PART VII ENFORCEMENT-58. Power of arrest

(1) An authorized officer or police officer may arrest without warrant any person whom he reasonably believes has committedor is attempting to commit an offence under this Act.

(2) An authorized officer making an arrest under subsection (1) shall without unnecessary delay make over the person so arrested to the nearest police officer or, in the absence of a police officer, take such person to the nearest police station, and thereafter the person shall be dealt with as is provided for by the law relating to criminal procedure for the time being in force as if he had been arrested by a police officer.

59 PART VIII MISCELLANEOUS-59. Appeal to Minister

(1) A person who is aggrieved by a decision of the Registrar may appeal to the Minister.

(2) An appeal shall be made in writing to the Minister within thirty days from the date of the decision of the Registrar or, in the case of an enforcement notice, within thirty days after the enforcement notice is served upon the relevant credit reporting agency, and the appellant shall serve a copy of the appeal upon the Registrar.

(3) The appeal shall state briefly the substance of the decision of the Registrar against which an appeal is made to the Minister, contain an address at which any notice or document connected with the appeal may be served upon the appellant or his advocate, and shall be signed by the appellant or his advocate.

(4) A decision of the Registrar shall be valid, binding and enforceable pending the decision of an appeal by the Minister, except where an appeal against an enforcement notice has been made to the Minister

60 PART VIII MISCELLANEOUS-60. Exemption

(1) The Minister may, on the recommendation of the Registrar, if he considers it consistent with the purposes of this Act or in the interest of the public, by order published in the Gazette exempt a credit reporting agency, person or such class, category or description of persons, from all or any of the provisions of this Act for such duration and subject to such terms and conditions as the Minister may specify.

(2) The Minister may at any time, on the recommendation of the Registrar, by order published in the Gazette, revoke any order made under subsection (1).

61 PART VIII MISCELLANEOUS-61. Transfer of credit information to places outside Malaysia.

(1) A credit reporting agency shall not transfer any credit information of a customer to a place outside Malaysia unless to such place as specified by the Minister, upon the recommendation of the Registrar, by notification published in the Gazette .

(2) For the purposes of subsection (1), the Minister may specify any place outside Malaysia if:-

(a) there is in that place in force any law which is substantially similar to that as provided under this Act, or that serves the same purposes as this Act; or

(b) that place ensures an adequate level of protection in relation to the processing of credit information which is at least equivalent to the level of protection afforded by this Act.

(3) Notwithstanding subsection (1), a credit reporting agency may transfer any credit information to a place outside Malaysia if:-

(a) the customer has given his consent to the transfer;

62 PART VIII MISCELLANEOUS-62. Unlawful collecting, etc , of credit information

(1) A person shall not knowingly or recklessly, without the consent of the credit reporting agency:-

(a) collect or disclose credit information that is held by the credit reporting agency; or

(b) procure the disclosure to another person of credit information that is held by the credit reporting agency.

(2) Subsection (1) shall not apply to a person who shows:-

(a) that the collecting or disclosing of credit information or procuring the disclosure of credit information:-

(i) was necessary for the purpose of preventing or detecting a crime or for the purpose of investigations; or

(ii) was required or authorized by or under any law or by the order of a court;

(b) that he acted in the reasonable belief that he had in law the right to collect or disclose the credit information or to procure the disclosure of the credit information to th

63 PART VIII MISCELLANEOUS-63. Abetment and attempt punishable as offences

(1) A person who abets the commission of or who attempts to commit any offence under this Act shall be guilty of that offence and shall, on conviction, be liable to the punishment provided for that offence.

(2) A person who does any act preparatory to or in furtherance of the commission of any offence under this Act shall be guilty of that offence and shall, on conviction, be liable to the punishment provided for the offence:

Provided that any term of imprisonment imposed shall not exceed one-half of the maximum term provided for the offence.

64 PART VIII MISCELLANEOUS-64. Compounding of offences

(1) The Registrar may, with the consent in writing of the Public Prosecutor, compound any offence committed by any person under this Act and prescribed to be a compoundable offence by making a written offer to the person suspected to have committed the offence to compound the offence upon payment to the Registrar of an amount of money not exceeding fifty per centum of the amount of maximum fine for that offence within such time as may be specified in his written offer.

(2) An offer under subsection (1) may be made at any time after the offence has been committed but before any prosecution for it has been instituted, and if the amount specified in the offer is not paid within the time specified in the offer or such extended time as the Registrar may grant, prosecution for the offence may be instituted at any time after that against the person to whom the offer was made.

(3) Where an offence has been compounded under subsection (1), no pr

65 PART VIII MISCELLANEOUS-65. Offences by body corporate

(1) If a body corporate commits an offence under this Act, any person who at the time of the commission of the offence was a director or officer of the body corporate or was purporting to act in any such capacity or was in any manner or to any extent responsible for the management of any of the affairs of the body corporate or was assisting in such management:-

(a) may be charged severally or jointly in the same proceedings with the body corporate; and

(b) if the body corporate is found to have committed the offence, shall be deemed to have committed that offence unless, having regard to the nature of his functions in that capacity and to all circumstances, he proves:-

(i) that the offence was committed without his knowledge, consent or connivance; and

(ii) that he had taken all reasonable precautions and exercised due diligence to prevent the commission of the offence.

66 PART VIII MISCELLANEOUS-66. Prosecution

No prosecution for an offence under this Act shall be instituted except by or with the written consent of the Public Prosecutor.

67 PART VIII MISCELLANEOUS-67. Jurisdiction to try offences

Notwithstanding any other written law to the contrary, a Sessions Court shall have jurisdiction to try any offence under this Act and to impose full punishment for any such offence under this Act.

68 PART VIII MISCELLANEOUS-68. Service of notice or other documents

(1) Service of a notice or any other document upon any person shall be effected:-

(a) by the delivering the notice or other document to the person;

(b) by leaving the notice or other document at the last-known address of residence or place of business of the person in a cover addressed to that person; or

(c) by forwarding the notice or other document by post in an A.R. registered letter addressed to the person at his last-known address of residence or place of business.

(2) Where the person to whom there has been addressed an A.R. registered letter containing any notice or other document which may be given under this Act is informed of the fact that there is an A.R. registered letter awaiting him at a post office, and such person refuses or neglects to take delivery of such A.R. registered letter, such notice or other document shall be deemed to have been served upon him on the date on which he

69 PART VIII MISCELLANEOUS-69. Protection against suit and legal proceedings

No action, suit, prosecution or other proceedings shall lie or be brought, instituted or maintained in any court against:-

(a) the Registrar;

(b) any Deputy Registrar, Assistant Registrar, authorized officer or any officer of the Registrar; or

(c) any person lawfully acting on behalf of the Registrar,

in respect of any act or omission done or omitted by him or it in good faith in such capacity.

70 PART VIII MISCELLANEOUS-70. Protection of informers

(1) Except as provided in subsections (2) and (3), no witness in any civil or criminal proceedings pursuant to this Act shall be obliged or permitted to disclose the name or address of any informer or the substance and nature of the information received from him or state any matter which might lead to his discovery.

(2) If any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article which is in evidence or is liable to inspection in any civil or criminal proceedings whatsoever contains any entry in which any informer is named or described or which might lead to his discovery, the court shall cause all such entries to be concealed from view or to be obliterated in so far as may be necessary to protect the informer from discovery.

(3) If in a trial for any offence under this Act the court, after full inquiry into the case, is of the opinion that the

71 PART VIII MISCELLANEOUS-71. Obligation of secrecy

(1) Except for any of the purposes of this Act or for the purposes of any civil or criminal proceedings under any written law or where otherwise authorized by the Minister:-

(a) the Registrar, Deputy Registrars, Assistant Registrars, authorized officers or officers of the Registrar, whether during or after his tenure of office or employment, shall not disclose any information obtained by him in the course of his duties; and

(b) no person who has by any means access to any information or documents relating to the affairs of the Registrar shall disclose such information or document.

(2) A person who contravenes subsection (1) commits an offence and shall, on conviction, be liable to a fine not exceeding one hundred thousand ringgit or to imprisonment for a term not exceeding one year or to both.

72 PART VIII MISCELLANEOUS-72. Power of Minister to make regulations

(1) The Minister may make such regulations as may be necessary or expedient for the purpose of carrying into effect the provisions of this Act.

(2) Without prejudice to the generality of the powers conferred by subsection (1), the Minister may make regulations for all or any of the following purposes:

(a) to regulate all matters relating to the registration of credit reporting agencies, including prescribing the registration fees and renewal fees;

(b) to provide and prescribe any fees to be imposed by the credit reporting agencies and any other fees payable in connection with the provision of any service or any matter under this Act;

(c) to regulate procedures in respect of the inspection of data systems, investigation of complaints and issuance of enforcement notices, and all matters related to them;

(d) to prescribe the offences which may be compounded and the forms to be used and the method and pr

73 PART VIII MISCELLANEOUS-73. Prevention of anomalies

(1) The Minister may, by order published in the Gazette , make such modifications to the provisions of this Act as may appear to him to be necessary or expedient for the purpose of removing any difficulties or preventing anomalies in consequence of the coming into operation of this Act.

(2) The Minister shall not exercise the powers conferred by subsection (1) after the expiration of one year from the appointed date.

(3) In this section, "modifications" means amendments, additions, deletions and substitutions of any provisions of this Act.

74 PART VIII MISCELLANEOUS-74. Power of Minister to amend First Schedule and Second Schedule

The Minister may, on the recommendation of the Registrar, from time to time, by order published in the Gazette , vary, delete, add to, substitute for, or otherwise amend the First and Second Schedules.

75 PART VIII MISCELLANEOUS-75. Power to issue Summary of Rights, codes of practice, etc

(1) The Registrar shall issue a Summary of Rights in such form and manner as determined by him that contains information about credit reporting agencies and a summary of rights of customers in respect of transactions involving such credit reporting agencies as provided under this Act.

(2) The Registrar may issue generally in respect of this Act or in respect of any particular provision of this Act, or generally in respect of the conduct of all or any of the credit reporting agencies, from time to time, codes of practice, guidelines, circulars or notes as may be necessary or expedient for giving full effect to the provisions of this Act, for carrying out or achieving the objects and purposes of this Act or any provision thereof, or for the further, better and more convenient implementation of the provisions of this Act.

76 PART VIII MISCELLANEOUS-76. Personal Data Protection Act 2009 shall not apply

The provisions of the Personal Data Protection Act 2010 [Act 709] shall not apply to the processing of credit information by a credit reporting agency.

77 PART IX SAVINGS AND TRANSITIONAL PROVISIONS-77. Carrying on credit reporting business before the commencement of this Act

(1) Any person who has been carrying on a credit reporting business prior to the appointed date may continue to do so as if this Act has not been enacted for a period of three months from the appointed date or such other period as may be allowed by the Registrar in writing, referred to as "grace period", and shall, if he or it intends to continue to carry on such business after the expiry of the grace period, make an application for registration as a credit reporting agency under section 13 within the grace period.

(2) Where the applicant has been registered as a credit reporting agency by the Registrar, the credit reporting agency shall within six months from the expiry of the grace period fully comply with the provisions of this Act in respect of all credit information collected and further processed, whether before or after the appointed date, by the credit reporting agency for the purpose of carrying on the credit reporting business.