Gazette December 9 2021 - Part A | Government Printing Department

Resolution No. 22/2021 for the sum of $17,358,475 …………….2, 3

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ Bill re Fair Credit Reporting Act, 2021.

2 OFFICIAL GAZETTE

December 9, 2021

Resolution No. 22/2021 Ref. No.: M.P.: 6102/5/1 Vol. I

HOUSE OF ASSEMBLY

RESOLVED that the sum of SEVENTEEN MILLION, THREE HUNDRED AND FIFTY-EIGHT THOUSAND, FOUR HUNDRED AND

SEVENTY-FIVE DOLLARS be granted from the Consolidated Fund and be placed at the disposal of the Government to supplement the Estimates 2021—2022 as shown in the Supplementary Estimates No. 5, 2021—2022 which form the Schedule to this Resolution.

2021-12-07.

HOLDER Speaker.

SCHEDULE

Supplementary Estimates 2021 – 2022 No. 5

HEAD	Code Number	Provision in Approved Estimates2021 – 2022	Provision in Supplementary Esti- mates Nos. 1— 4	Supplementary Provision Required
Other Expenditure	Other Expenditure	Other Expenditure
HEAD 35 — MINISTRY OF PEOPLE EMPOWERMENT AND ELDER AFFAIRSProgram 423: Personal Social Services Delivery ProgramSubprogram 0427: Welfare DepartmentAccount Code: 103 – Employers ContributionsAccount Code: 211 – Maintenance of PropertySubprogram 0428: National Assistance BoardAccount Code: 316 – Grants to Public Institutions HEAD 81 — MINISTRY OF TRANSPORT, WORKS AND WATER RESOURCESProgram 510: Road Networks ServicesSubprogram 0511: Highway Construction and Maintenance ServicesAccount Code: 103 — Employers ContributionsAccount Code: 211 — Maintenance of PropertySubprogram 0530: IDB Road Rehabilitation & Improving ConnectivityAccount Code: 103 — Employers ContributionsAccount Code: 785 — Assets Under Construction	354230427	$	$	$

	318,467		31,621
	91,241		27,529
354230428
	10,068,670		1,954,024
815100511
	1,683,000	28,118	4,402,335
	4,724,450	25,812,898	3,832,621
815100530
	171,924
11,000,000	149,675

December 9, 2021

OFFICIAL GAZETTE 3

SCHEDULE – Cont’d

Supplementary Estimates 2021 – 2022 No. 5 – Cont’d

HEAD	Code Number	Provision in Approved Estimates 2021 – 2022	Provision in Supplementary Esti- mates Nos. 1— 4	Supplementary Provision Required
Other Expenditure	Other Expenditure	Other Expenditure
HEAD 81 — MINISTRY OF TRANSPORT, WORKS AND WATER RESOURCES – Cont’dProgram 511: Drainage Services Subprogram 0515: Maintenance of Drainage to Prevent Flooding Account Code: 103 — EmployersContributionsAccount Code: 211 — Maintenance of Property HEAD 82 — MINISTRY OF ENVIRONMENT AND NATIONAL BEAUTIFI- CATIONProgram 650: Preservation and Conservation of the Terres- trial and Marine EnvironmentSubprogram 0117: National Cleanup ProgramAccount Code: 103 — Employers ContributionsAccount Code: 212 — Operating Expenses HEAD 87 — MINISTRY OF EDUCATION, TECHNO- LOGICAL AND VOCA- TIONAL TRAININGProgram 271: Basic Educational DevelopmentSubprogram 0571: Nursery and Primary SchoolsAccount Code: 103 — Employers ContributionsAccount Code: 212 — Operating Expenses HEAD 93 — MINISTRY OF HOUSING, LANDS AND MAINTENANCEProgram 520: Housing ProgramSubprogram 0533: National Housing CorporationAccount Code: 316 — Grants to Public Institutions	815110515	$	$	$

	193,799		327,685
	3,000,000		285,279
826500117
			2,100,569
	6,938,400	5,846,000	1,828,731
872710571
	11,934,164	707,692
	4,673,604	616,109
935200533
200,000	922,681

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Printed and Published by

the Barbados Government Printing Department

FAIR CREDIT REPORTING ACT, 2021

OBJECTS AND REASONS

This Bill would provide for

the creation of a regulatory environment to promote the development of a fair credit reporting system in Barbados;
the regulation of the use of such data;
secure keeping of the private data of persons collected by credit bureaux; and
related matters.

FAIR CREDIT REPORTING ACT, 2021

Arrangement of Sections PART 1 PRELIMINARY

Short title
Interpretation
PART II ADMINISTRATION
Powers, duties and functions of Central Bank
PART III LICENSING
Credit bureau to be licensed
Application for licence
Grant of licence
Refusal to grant licence
Terms and conditions of licence
Variation of licence, terms and conditions
4
Restrictions on the transfer of licence
Duration of licence
Revocation
Material change in circumstances affecting the credit bureau
Publication by the Central Bank
PART IV CREDIT REPORTING ACTIVITY
Permissible credit reporting activities
Credit information providers
Provision of credit information
Duties of credit information providers
Credit reports
Permissible purposes
The requirement for consent
Restrictions regarding disclosure of data subject information
Supplying false information
Subscriber agreements
Data management and quality control
5
Security and control measures
Data subject’s rights of access and correction
Adverse actions against data subjects
Cross-border credit reporting
PART V SUPERVISION BY THE CENTRAL BANK
Information gathering powers of the Central Bank
Inspections
Warrants
Costs of inspections
Auditors and annual reports
PART VI MISCELLANEOUS
Determination of disputes
Civil liability for negligent non-compliance
Agreement with another regulatory authority
Confidentiality and restrictions regarding access to information
Limitation on prosecution
6
Penalties
Fixed penalty
Immunity
Protection of databases upon liquidation
Application of Data Protection Act, 2019 (Act 2019-29)
Regulations
Transitional provisions
Commencement

BARBADOS

A Bill entitled

An Act to provide for a credit reporting system in Barbados that is fair, for the regulation of the use of data collected and for related purposes.

ENACTED by the Parliament of Barbados as follows:

PART 1 PRELIMINARY

Short title 1.

This Act may be cited as the Fair Credit Reporting Act, 2021.

Interpretation

In this Act,“adverse action” means a decision taken by a credit information provider, based on the data subject’s information from the credit bureau, that adversely affects a data subject, including
1. the refusal of an application for credit;
2. an increase in the interest rate on a loan or other credit facility;
3. a decrease in the credit limit on a revolving credit facility;
4. the cancellation, freezing or suspension of a loan or other credit account;
5. the refusal of business or employment;
6. an unfavourable change in terms of coverage and the amount of any credit or insurance, existing or applied for in connection with underwriting credit or insurance, on the part of the data subject or the request for a guarantor or collateral; or
7. any other action that adversely affects a transaction between the data subject and the credit provider;

“applicant” means a person applying for a licence under section 5; “authorized person” means

a credit bureau; or
9
a person authorized by the Central Bank to perform an activity set out in section 16;

“Caribbean Community” has the meaning assigned to it by section 2 of the

Caribbean Community Act, Cap. 15 and includes The Bahamas;

“Central Bank” means the Central Bank of Barbados established by section 3 of the Central Bank of Barbados Act, 2020 (Act 2020-30);

“company” means a body incorporated, continued or registered under the

Companies Act, Cap. 308; “credit”

means any transaction the terms of which provide for payment to be made at a future date in respect of money lent or money payable in relation to goods, services, real property sold or leased or any other financial arrangement between the data subject and a third party; and
includes any money payable pursuant to an order of court.

“credit bureau” means a person licensed under section 6 to prepare, produce or provide credit reports, credit scores, credit references and other value-added products;

“credit file” means in relation to a data subject, a file in electronic form or otherwise containing the data subject’s information and other records collected, kept, maintained or otherwise processed by a credit bureau with respect to a data subject from which a credit report is prepared or produced;

“credit information” means any positive or negative information bearing on a data subject’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living, including the history or profile of the data subject with regard to credit, assets or financial obligations;

“credit information provider” means a person specified in section 16 that gives credit information on a data subject to a credit bureau;

“credit report” in relation to a data subject, means credit information processed by a credit bureau, whether in electronic form or otherwise;

“credit reporting system” includes the institutions, individuals, rules, procedures, standards and technology that enables information flow relevant to making decisions for any purpose mentioned in section 20;

“credit scoring” means a statistical analysis with the goal of estimating the probability of a data subject fulfilling its financial obligations related to the extension of credit;

“cross-border” means the transfer of information electronically or otherwise from the country of origin to the target country;

“data” means information that

is being processed by means of equipment operating automatically in response to instructions given for that purpose;
is recorded with the intention that it should be processed by means of such equipment;
is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system;
does not fall within paragraph (a), (b) or (c) but forms part of an accessible record; or
does not fall within paragraph (a), (b), (c) or (d) but is recorded information held by a public authority;“data base” means a collection of credit information administered by a credit bureau or a credit information provider, which is stored electronically or otherwise;“data breach” means any act or omission leading to the accidental loss, alteration, unauthorized disclosure or access to credit information;“data subject” means any individual who, or partnership, corporation, trust, estate, cooperative, association, government or ministry or state-owned
11
enterprise or agency, or other entity which, is the subject of personal information that may be or has been furnished to or by a credit bureau.“data subject information” includes any information relating to the credit information or personal information of a data subject, whether such information is obtained from the data subject, a third party or a specified public register, that may be processed under this Act;“director” means, in relation to a credit bureau, a member of its board of directors; “inspector” means a person appointed by the Central Bank under section 31; “licence” means a licence granted under section 6 to carry on business as a creditbureau;“licensee” means a credit bureau which is licensed under this Act; “loan” includes
1. direct, indirect or contingent obligations incurred by a person with a third party;
2. a discount, advance or overdraft;
3. export bills or other bills purchased or receivable;
4. import bills or data subject’s liabilities on off-balance sheet items; or
5. any other credit facilities extended to a data subject by a credit provider;

“manager” in relation to a credit bureau includes the chief executive officer, chief financial officer, treasurer, chief internal auditor and the manager of a significant unit of the credit bureau;

“material change in circumstances” means, in relation to a credit bureau, a change in circumstances set out in this Act or prescribed by the regulations;

“Minister” means the Minister responsible for Finance;

“negative credit information” includes, in relation to a credit transaction between a data subject and a credit information provider,

credit defaults, collections and late payments;
accounts compulsorily closed other than for administrative reasons;
voluntary or mandatory surrender of assets;
convictions involving financial impropriety, fraud or theft;
receiverships, bankruptcies and liquidations;
liens;
garnishment or any other order of court; and
any other act or information which could cause a credit application or existing credit to be declined or restricted according to a creditor’s policy relating to the overdue, past due, charge off, or delinquent status of the credit transaction between a data subject and a credit provider;

“personal information” means any information about a data subject that may be used to identify a data subject, including

credit information;
a data subject’s present and past names;
a data subject’s current contact information;
the national registration number, tax identification number or other numerical reference or reference scheme used in relation to a data subject for identification purposes; and
any other relevant information about a data subject which is
1. reasonably required in order to enable the credit information to be utilized for the purposes of this Act; or
  13
2. in the possession of or is likely to come into the possession of the credit information provider or a credit bureau;

“positive credit information” means any information relating to the historical status of a credit transaction between a data subject and a credit provider, including

the date an account was opened;
the date of the last payment;
credit approval terms and conditions on which credit was granted;
the payments made;
the current balance;
repayment patterns;
utilization of credit and any collateral pledged; or
any other act or information which could cause a credit application to be approved;

“process” means

to collect, record, hold or store data subject information or data;
to carry out an operation or set of operations on data subject information or data including its
1. organization, adaptation, alteration or updating;
2. retrieval, consultation or use;
3. disclosure by transmission, transfer, dissemination or being otherwise made available;
4. alignment, combination, correction, erasure; or
5. destruction;

“public information” means any information subject to disclosure to the general public according to the laws of any country;

“record” means, in relation to a credit bureau, a book, paper, file, document in electronic form or otherwise, that may contain information regarding the finances or business of the credit bureau;

“sensitive personal information” means personal information on a data subject’s

(a)

(b)

(c)

(d)

(e)

(f)

(g)

(h)

(i)

(j)

racial or ethnic origin; political opinions;

religious beliefs or other beliefs of a similar nature; membership of a political body;

membership of a trade union; genetic data;

biometric data;

sexual orientation or sex life;

physical or mental health or condition; or criminal record;

“subscriber” means a credit information provider or other person that has entered into a subscriber agreement to provide or access credit information;

“subscriber agreement” means an agreement referred to in section 24(1) between a credit bureau and a subscriber whereby the subscriber furnishes data subject information to the credit bureau in an agreed format;

“Tribunal” means such tribunal as may be established by an Act for the purpose of determining disputes under this Act;

“user” means any person or entity other than a subscriber that has access to a credit bureau’s products and services;

“value-added product” means any product or service based on the data or information provided by credit information providers and any other data lawfully obtained by a credit bureau which the credit bureau may, in addition to credit reporting, provide to increase the value of the service it offers, including alert, anti-fraud, credit scoring and identity theft prevention.

PART II ADMINISTRATION

Powers, duties and functions of Central Bank

3.(1)

(a)

(b)

The Central Bank shall be responsible for the overall management of this Act; and

the day to day administration, supervision and implementation of this Act and the regulations.

(2)

shall

Without prejudice to the generality of subsection (1), the Central Bank

regulate and supervise the activities of credit bureaux;
issue standards and targets regarding the provision of fair credit reporting services;
institute proper standards of conduct and acceptable credit reporting practices;
protect the integrity of the credit reporting system in Barbados against abuses; and
take measures to protect the rights and interests of data subjects.
In the exercise of its duties and functions under subsections (1) and (2),the Central Bank may
1. grant licences to credit bureaux;
  16
2. in accordance with this Act and the regulations;
  1. evaluate every application for a licence to operate or carry on the business of a credit bureau;
  2. issue guidelines for operating a credit bureau;
  3. inspect the premises, systems and operations of a credit bureau;
3. exercise such other duties and functions as may be conferred upon or assigned to the Central Bank by or under this Act; and
4. impose any sanction set out in subsection (4).(4)
5. are

The sanctions that the Central Bank may impose under subsection (3)

a warning or reprimand;
a monetary penalty not exceeding $100 000;
suspension or revocation of the licence; or
the giving of a directive that the Central Bank deems appropriate. PART III

LICENSING

Credit bureau to be licensed

4.(1)

(a)

(b)

No person shall

operate as or carry on the business of a credit bureau; or

use or continue to use words implying that the person is a credit bureau in the description or title pursuant to which such person is carrying on business,

unless such person is licensed under this Act.

Any person who contravenes subsection (1) is guilty of an offence and isliable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both.
In the prosecution of a person for an offence under this section, evidencethat the accused person provided credit information to another person with the knowledge that such information is being relied on by the recipient to make a decision pertaining to the credit of another is proof in the absence of evidence to the contrary, that the accused person operated as or carried on the business of a credit bureau under this Act.
Application for licence‌5.(1)An application for the grant of a licence to carry on the business of acredit bureau shall be submitted to the Central Bank in the prescribed form and shall include
1. a copy of its articles, by-laws or other instrument under which the company is incorporated or organized;
2. an address for service in Barbados;
3. a statement of the address of the applicant’s registered office and the location of the principal and other places where it proposes to do business in Barbados;
4. the prescribed application fee which is non-refundable; and
5. any other document or information that the Central Bank may require.

Where the Central Bank is not satisfied with the adequacy of anyinformation submitted by the applicant under subsection (1), the Central Bank may request such further information including,
1. the incorporation and ownership structure of the applicant;
2. the nature and sufficiency of the financial resources of the applicant’s shareholders to provide continuing financial support for the applicant;
  18
3. the nature of any activity regulated under this Act or the regulations that the applicant conducts or seeks authorization to conduct;
4. the soundness and feasibility of the business plan of the applicant;
5. the adequacy of the systems and arrangements that have been put in place by the applicant to ensure compliance with the provisions of this Act;
6. whether the overall design and flexibility of the data collection mechanism for data subject information conforms to relevant provisions of this Act and the regulations;
7. any information needed to minimise the extent to which it is possible for the business carried on by the applicant to be used for a purpose connected with financial crime; and
8. the qualifications, experience and integrity of the proposed directors, officers and significant shareholders and whether they are fit and proper persons to operate or, as the case may be, hold shares in a credit bureau.
For the purposes of this section, a “significant shareholder” is a personwho holds 10 percent of any class of shares of the company.
Grant of licence‌6.(1)The Central Bank may, after consideration of an application madeunder section 5, grant a licence to the applicant subject to such terms and conditions as the Central Bank thinks fit where
1. it is satisfied with respect to the matters referred to in section 5; and
2. the applicant has paid the prescribed licence fee.
The Central Bank shall advise the Minister in writing of its decision togrant a licence under this section.
19
Refusal to grant licence7.(1)
(a)(b)The Central Bank shall refuse to grant a licence where the application is not made in accordance with this Act; the Central Bank is of the opinion that
1. the applicant has failed to satisfy the matters set out in section 5;
2. the applicant has, with respect to a matter that it considers material, knowingly or intentionally made a false or misleading statement in the application or in the information, particulars, declarations, documents or other materials submitted to the Central Bank in support of the application; or
3. it is not in the public interest to grant the licence.
Where the Central Bank refuses to grant a licence, it shall
1. notify the applicant in writing within 7 days of making the decision;
2. state the reasons for its refusal;
3. inform the applicant of his right to seek review under section 35; and
4. inform the Minister of its decision.

Terms and conditions of licence ‌

8.(1)

(a)

(b)

(c)

An applicant under section 5 of this Act shall

within 30 days of being granted a licence, submit to the Central Bank an irrevocable guarantee from a financial institution or credit union in Barbados in such an amount as may be prescribed;

within 6 months of being granted a licence, or within such further period as the Central Bank may specify, commence operations as a credit bureau;

adhere to such capital requirements as the Central Bank may specify;

(d) inform the Central Bank of the fees it will charge customers for its services or any change in such fees.

The irrevocable guarantee referred to in paragraph (a) of section 8(1) shallbe in a form determined by the Central Bank.
Where credit information providers or the beneficial owners of creditinformation providers are permitted to acquire shares in a credit bureau
1. the credit bureau shall restrict the aggregate share ownership in the credit bureau by such credit information providers and beneficial owners of credit information providers to a maximum of 49 per cent; and
2. a single credit information provider or beneficial owner of such credit information provider, as the case may be, shall hold no more than 5 per cent of the shares of the credit bureau.
A credit bureau shall comply with such terms and conditions as may be

prescribed.

Variation of licence, terms and conditions

9.(1)

The Central Bank may at any time amend or vary the terms and

conditions set out in section 8 relating to the grant of a licence.

The Central Bank shall, before it amends or varies the terms andconditions of a licence,
1. give written notice to the credit bureau of its intention to amend or vary the terms and conditions and include in the notice the reason for the intended amendment or variation; and
2. give the credit bureau, within such time as may be specified in the notice, an opportunity to make representation on the intended amendment or variation.

Restrictions on the transfer of licence

10.(1)

Bank,

(a)

(b)

A licensee shall not, without the prior written approval of the Central

transfer a licence granted or reinstated pursuant to this Part; or

sell, lease or transfer title to any of its credit files except to another credit bureau licensed under this Act.

(2) A licensee which contravenes or fails to comply with a provision of

subsection (1) is guilty of an offence.

Duration of licence

11.(1)

A licence granted under this Act is valid for a period of one year and

is renewable annually on the anniversary of the date on which it is first granted and on payment of the prescribed fee.

The Minister may prescribe the fee payable
1. on application for the grant of a licence;
2. for the grant of a licence;
3. for the renewal of a licence; and
4. for the reinstatement of a licence that was revoked.
  Revocation12.(1)where(a)(b)(c)Subject to subsection (2), the Central Bank may revoke a licence
  there is a request in writing by the licensee for revocation of the licence; the licensee has failed to pay the annual renewal fee;the licensee has failed to comply with
  1. a term or condition specified in the licence;
    22
  2. this Act or the regulations;
  3. a direction issued under this Act by the Central Bank; or
the licensee
1. has provided the Central Bank with false, inaccurate or misleading information;
2. does not commence operations within 6 months after the issuance of its licence or within such longer period as the Central Bank may approve after the grant of a licence;
3. becomes insolvent or makes an arrangement with its creditors;
4. is found to have committed an act of fraud or dishonesty;
5. has demonstrated incompetence or untrustworthiness in the operation of its business;
6. has acted in a manner that has caused data subjects’ rights and interests in respect of their data to be compromised; or
7. is carrying on business in a manner that is no longer in the interest of the public or puts the effective and efficient operation of the credit reporting system at risk.

The Central Bank shall, before it revokes a licence,
1. give the licensee one month’s notice in writing of its intention to revoke the licence;
2. include in the notice the reason for the intended revocation; and
3. give the credit bureau, within such time as may be specified in the notice, an opportunity to show cause why the licence should not be revoked.
Where a licensee shows cause to the Central Bank pursuant to subsection(2), the Central Bank shall within one month
1. consider the credit bureau’s case and make a determination; and
  23
2. subject to subsection (4), notify the credit bureau in writing of its determination.
Where the Central Bank revokes a licence, it shall notify the licensee inwriting of its decision.
The Central Bank shall in the notice referred to in subsection (4)
1. state the reasons for its decision; and
2. inform the credit bureau of its right of review under section 35.
A credit bureau shall cease to carry on business from the date specifiedin the notice of revocation.
Notwithstanding anything contained in this section, the Central Bank mayat any time revoke a licence where the licensee ceases to carry on the business of a credit bureau for a period exceeding 6 months.
The Central Bank may restore a licence that has been revoked,
1. for non-payment of the annual renewal fee, upon payment of that fee;
2. for a cause other than non-payment of the annual renewal fee upon request of the Tribunal, after the Tribunal has conducted a review pursuant to section 35.

Material change in circumstances affecting the credit bureau

13.(1)

(a)

(b)

A licensee or an applicant shall, within 7 days, notify the Central Bank; and

any other body which it is required to notify by virtue of any enactment

of a material change in the circumstances affecting the operations of the licensee or the applicant.

For the purposes of subsection (1) a material change includes
1. a merger or consolidation with another credit bureau;

(b)

(c)

(d)

(e)

(f)

(g)

(h)

(i)

(j)

(k)

(l)

a change of the name of the applicant or the licensee;

an amendment of the articles of incorporation or any other constituent document under which the credit bureau is incorporated, registered or continued;

engagement in any business other than that of a credit bureau; a change of majority shareholding or beneficial ownership;

a change in the directors or officers of the applicant or licensee whether by death, retirement, resignation or termination;

a change of the address of the registered office, head office or other place of business where the credit bureau or the applicant carries on or proposes to carry on business in Barbados and details on where the credit bureau or applicant’s data server is hosted;

an event that results in a compromise of the confidentiality, security or integrity of data subject information;

any civil or criminal proceedings instituted against the credit bureau or applicant, whether in Barbados or elsewhere;

an event or irregularity that impedes or prevents access to or impairs the usual operations of the licensee or applicant;

the credit bureau or applicant becomes or is likely to become, insolvent or unable to meet its financial, statutory, contractual or other obligations; or

the occurrence of any other event that the Minister may prescribe or specify by notice in writing as a material change in circumstances.

Publication by the Central Bank

14. The Central Bank shall cause every notice of the grant, revocation or

reinstatement of a licence to be published in the Official Gazette .

PART IV

CREDIT REPORTING ACTIVITY

Permissible credit reporting activities

15.(1)

(a)

(b)

A credit bureau shall not engage in any activity other than an activity specified in subsection (2); or

an activity approved by the Central Bank by notice published in the

Official Gazette.

A credit bureau may, for its own account or on behalf of an individual ora data subject, engage in the following activities:
1. ascertain whether a credit information provider holds information relevant to the financial standing of an individual or a data subject;
2. develop and make credit reports, credit scores and value-added products available to subscribers or users;
3. collect, compile, manage, and update the contents of information referred to in paragraphs (a) and (b);
4. carry out market and statistical research on matters related to credit reports or assessments;
5. provide, on a consistent basis, consultancy services and training regarding credit reporting, including the publication of educational material;
6. collect, process and manage public information resulting from the enforcement of actions and judgments and declarations of bankruptcy and the insolvency of data subjects;
7. collect, process and manage information of consumer dispute settlements;

(h)

(i)

(j)

(k)

(l)

develop and apply credit scores and ratings as well as other systems of classification of data subjects;

analyse statistics relating to credit and credit behaviour of data subjects and aggregate analyses;

manage identity theft and debtor tracing;

compile reports for the purposes of its business; and

compile and maintain databases in respect of data subjects’ information and generate reports from such databases.

Credit information providers ‌

16.(1)

For the purposes of this Act, the following credit information

providers shall provide data subject’s information to a credit bureau:

a financial institution licensed under the Financial Institutions Act , Cap. 324A;
an insurance company licensed under the Insurance Act , Cap. 310, if such information is limited to information obtained by such a company in its capacity as a credit provider; and
a credit union registered under the Co-operative Societies Act , Cap. 378A.

A credit information provider may engage in the following activitiespermitted under this Act
1. securing the correction of or the omission of anything from or the making of any other kind of modification to credit information, if the making of such modification is fair to the data subject and does not contravene this Act; and
2. advising a data subject with respect to the taking of any steps from credit reports or assessments generated for this purpose.
  27
The Central Bank may in the public interest, by notice, designate any ofthe following as credit information providers:(a)
(b)
(c)
(d)
(e)
(f)
(g)
(h)
(i)
(j)the Barbados Light and Power Company Limited continued under theCompanies Act , Cap. 308;the Barbados Water Authority established under the Barbados Water Authority Act , Cap. 274A;the Corporate Affairs and Intellectual Property Office established under the Corporate Affairs and Intellectual Property Office Act;,Cap. 21A the Land Registry established under the Land Registration Act , Cap. 229;the Registration Office established under the Registration Office Act , Cap. 33;any person licensed pursuant to the Telecommunications Act , Cap. 282B;any person carrying on the business of selling goods pursuant to a hire purchase agreement, conditional sale agreement or credit sale agreement pursuant to the Hire Purchase Act , Cap. 328;a dealer in securities who is licensed under the Securities Act , Cap. 318A;the Student Revolving Loan Fund established under the Student Revolving Fund Act , Cap. 54A; andany other entity possessing credit information not referred to in subsection (1).
Before the Central Bank designates an entity as a credit informationprovider under subsection (3), the Central Bank must be satisfied that
1. the entity has systems in place for proper data management, security and control; and
  28
2. adequate systems and arrangements have been put in place by the entity to ensure compliance with the provisions of this Act,and the Central Bank shall consult with the relevant Minister or the regulator of the entity as appropriate.
Notwithstanding that an entity has not been designated under subsection(3), it may, with the consent of a data subject, and subject to subsection (7), opt to furnish data subject information to a credit bureau.
Where an entity proposes to provide data subject information to a creditbureau pursuant to subsection (6), it shall submit a request to the Central Bank for approval setting out its procedures and standards for data capturing, data transmission and compliance with this Act and any proposed subscriber agreement.
The Central Bank may in its own discretion opt to provide information to

a credit bureau on data subjects who are its employees where such information is limited to information obtained by the Central Bank in its capacity as a credit provider.

Provision of credit information

A credit information provider shall, upon providing credit to a datasubject or entering into a credit or loan agreement with a data subject, furnish a credit bureau with information relating to the data subject
1. from the date of the provision of the credit to the data subject; and
2. within the time specified in the subscriber agreement with the credit bureau.
  Duties of credit information providers18.(1)(a)A credit information provider shallprovide any information required to be furnished to a credit bureau in the standard data format specified by the Central Bank;
  29
  1. upon receipt of any new credit information about the data subject, furnish the information to the credit bureau within the time specified in the applicable subscriber agreement;
  2. ensure the timely, sufficient and accurate provision of credit information to a credit bureau; and
  3. comply with the security standards and measures prescribed in respect of the data subject’s credit information it keeps and maintains, including taking all necessary actions prescribed in this Act or the regulations in order to protect the information.

Notwithstanding the provisions of subsection (1)(c), a credit informationprovider shall provide information monthly to a credit bureau on the status of the performance of the obligations of the data subject under a credit or loan agreement.
The information respecting a data subject that a credit informationprovider shall furnish to a credit bureau includes
1. the personal information of the data subject;
2. in the case of a loan from a credit information provider
  1. the type, nature and amount of the loan or other similar credit facility granted to the data subject from a credit information provider;
  2. all outstanding loans including contingent liabilities extended to the data subject by the credit information provider;
  3. the date on which the loan account was opened and the dates for payment of the principal and the interest as agreed;
  4. information on the composition and the types of collateral or security provided by any data subject which secured the debt obligation;
  5. the loan balance and the maximum balance on the loan;
    30
  6. the account status and the liability of the data subject on the account, including the date of the last activity respecting the loan obligations; and
  7. the nature of any guarantee or other secondary debt obligation to which the data subject is a party;
3. in the case of an entity that sells goods or offers services on a credit basis or with delayed payment terms,
  1. the amount of the goods and services provided on a credit basis together with contingent and possible obligations;
  2. the dates on which the goods or services were provided;
  3. the agreed schedule of payment for the goods or services; and
  4. information on the composition and the types of collateral that secured the payment obligations;(d)
    (e)(f)(g)
    (h)
    (i)any comments made in respect of the loan obligations of the data subject on the file kept for this purpose by the credit information provider;the amount, if any, that is past due; the minimum payment due;the date and the amount of the last payment, the closed date of the account and the expiry date;credit information about a data subject’s income, creditworthiness or history of financial transactions including antecedents and adverse court judgments obtained by the credit information provider in relation to transactions involving the credit provider;other credit information required to be disclosed under this Act;
    31
    1. any other information that the Central Bank
      1. considers appropriate to include as credit information for the purposes of this Act and the regulations; and
      2. specifies by notice published in the Official Gazette and a newspaper circulating in Barbados; and
    2. analysis of the information referred to in paragraphs (a) to (j), including any conclusions as to creditworthiness, whether in the form of a system of credit or other numerical or alphabetical scores or otherwise.
Notwithstanding the provisions of this section, the Minister may by

regulations provide for additional obligations of credit information providers.

Credit reports ‌

19.(1)

Subject to section 21, a user may, with the consent of the data subject

request a credit report, credit score, any value-added product or any other credit information with respect to a data subject from a credit bureau in accordance with the appropriate permissible purpose for the request.

A credit bureau shall ensure that a credit report
1. specifies the name of the person making the credit report or value- added product or the person on whose behalf the report or value-added product is made; and
2. is provided in the standard data format specified by the Central Bank.
The credit bureau shall omit from a credit report
1. the identity of creditors, unless the information disclosed therein is directed to the data subject to which the credit report relates, in which case, the report shall also include the identity of all institutions which have accessed the information in the previous 24 months;
  32
2. any price related information such as interest rates so as to prevent anti- competitive coordination and collusion among reporting institutions; and
3. any sensitive personal information.
A credit bureau shall not
1. provide a credit report or value-added product that lists all data subjects with good payment history unless there is a permissible purpose under section 21 regarding such listing;
2. omit from a credit report of a data subject, information that can affect the ability of the data subject to access credit;
3. give an undertaking to remove negative information which is accurate from a customer’s credit file, including entries concerning negative credit information and court judgments;
4. mislead a customer about the length of time that negative information is held on the customers’s credit file or any official register; or
5. give an undertaking to create a new credit file by changing the address of the customer or in any other way.
In processing credit information for any of the purposes of this Act or theregulations a credit bureau must take reasonable steps to ensure that
1. a credit report is balanced, clear, fair and not misleading particularly where it contains a comparison or contrast;
2. each credit report or value-added product is clearly identifiable as such, is accurate, balanced and is sufficient for and presented in a way that is likely to be understood by the average member of the group to which it is directed, or by which it is likely to be received;
3. does not disguise, omit, diminish or obscure important information, statements or warnings;
  33
4. credit information processed for the purpose of this Act and the regulations must be accurate and, where necessary, kept up to date;
5. statements based on facts are distinguished from credit information based on personal assessments;
6. credit information which is inaccurate, incomplete or not capable of being brought up to date is not transmitted or made available for any of the purposes of this Act or the regulations and is erased or rectified without delay;
7. the quality of credit information is verified before it is transmitted or made available; and
8. in all transmissions of credit information, the necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of the data and the extent to which it is up to date is included in such transmissions.
Subsection (5) is not to be regarded as being contravened by reason ofany inaccuracy in a credit report which accurately recorded information obtained by the credit bureau from a credit information provider in a case where, having regard to the purpose for which the credit information was obtained and further processed, the credit bureau has taken reasonable steps to ensure its accuracy.
A credit bureau which wilfully or intentionally contravenes or fails to

comply with a provision of this section is guilty of an offence and is liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both.

Permissible purposes ‌

20.(1)

A credit bureau may not knowingly provide to any person any

information from the credit files of a data subject except for a purpose specified in subsection (2).

A credit bureau may, where it is satisfied that a data subject has consented,provide a credit report, credit score or value-added product on the basis of
34
information contained in the credit file of the data subject to a subscriber or user for
1. the consideration of
  1. an application for credit; or
  2. an offer to act as a guarantor of an applicant for credit;
2. use in connection with
  1. the purchase or collection of a debt of a data subject;
  2. the entering into or the renewal of a tenancy agreement with a data subject; or
  3. the underwriting of insurance involving a data subject;
3. use, relating to a pre-employment check of a data subject for a position that entails significant financial responsibilities;
4. periodic portfolio monitoring and risk assessment purposes, collection and skip tracing; or
5. any other purpose prescribed by regulations under this Act.
Where a person requires data subject information for any purpose underthis Act from a credit bureau, the person shall
1. submit sufficient information to the credit bureau in order to enable the credit bureau to confirm and validate the identity of the data subject and the identity of the person requiring the information;
2. submit to the credit bureau evidence of the data subject’s consent;
3. agree to properly dispose of the data subject’s information so that the data subject’s information cannot reasonably be read or reconstructed; and
4. ensure that the confidentiality of the data subject’s information is maintained and prevent unauthorized access to or misuse of the information or reconstruction of the credit report.
  35
Subject to the provisions of any subscription or other agreementspertaining to the provision of credit reports, the credit bureau shall, before forwarding the information required under subsection (3),
1. confirm receipt of the data subject’s consent as required by subsection (3)(b);
2. confirm the identity of the data subject and the identity of the person who requires the information; and
3. ensure that the integrity of the information provided is not altered during its transmission.
A person who obtains data subject information under this section shallensure that the information is processed only for the purpose for which it was obtained and not be further processed in any manner incompatible with that purpose.
A credit bureau may provide a data subject with a copy of the datasubject’s own credit report, but it shall first confirm and validate the identity of the data subject before disclosing the information.
A credit bureau shall take steps to ensure that
1. a credit report is clear, fair, and not misleading; and
2. that credit information processed for the purposes of this Act or the regulations is accurate and, where necessary, kept up to date.
A credit bureau which discloses data subject information in contraventionof this section is guilty of an offence and is liable on summary conviction to a fine of $50 000.
The requirement for consent‌21.(1)A credit information provider may disclose credit information to acredit bureau
1. with the consent of a data subject; or
  36
2. if the credit information provider gives notice to the data subject at the time of entering into an agreement between the credit information provider and the data subject, that credit information and personal information may be disclosed to a credit bureau.

The notice and consent referred to in subsection (1) must be included inany written application, document or process completed by the data subject.
Without prejudice to subsection (2), the credit information provider mayalso give notice
1. by affixing a legible sign to that effect at its place of business;
2. by publication on its website; or
3. by any other method that would effectively bring the notice to the attention of the data subject.
Subject to this section and the regulations, a person other than a creditinformation provider or a user may, with the consent of the data subject, obtain a credit report in respect of the data subject for a purpose referred to in section 20.
Subject to section 22, the consent of a data subject shall expire when theagreement with respect to the credit relationship between the credit information provider or other user and the data subject is terminated; but the credit information respecting the data subject shall remain in the database of the credit bureau and the user in accordance with section 22.
A credit bureau which discloses a data subject’s information incontravention of this section is guilty of an offence and is liable on summary conviction to a fine of $50 000.
Any person who obtains information relating to a data subject from acredit bureau by deception is guilty of an offence and liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both.
37
A credit bureau does not contravene this section where the data subjectinformation is required
1. in response to an order of a court of competent jurisdiction;
2. to avoid prejudice to the administration of justice including the prevention, detection, investigation, prosecution or punishment of offences;
3. to enable an insurer to investigate any allegation of insurance fraud;
4. for the enforcement of any law;
5. for protection of the public revenue;
6. for the conduct of proceedings before any court or tribunal;
7. to be used in a form in which the identity of the data subject concerned is protected; or
8. for statistical or research purposes.
Data subject information published pursuant to paragraph (h) of

subsection (8) shall be in a form which protects the identity of the data subject to whom it relates.

Restrictions regarding disclosure of data subject information ‌

22.(1)

The Minister may, on the recommendation of the Central Bank, make

regulations relating to the disclosure and protection of data information.

Where a credit bureau or user obtains credit information regarding creditextended to or in respect of a data subject, the credit bureau or user shall not disclose such information or retain it for a period longer than 7 years after the date of settlement of such credit.
Notwithstanding subsection (2), a credit bureau or a user may, forhistorical, statistical, research or regulatory purposes, retain data subject information for a period in excess of 7 years.
38
The Central Bank may issue guidelines with respect to the terms ofretention of negative information and the calculation of the period of retention.
A credit bureau or user that contravenes subsection (2) is guilty of an

offence and is liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both.

Supplying false information

23.(1)

A person shall not knowingly supply false or misleading information

regarding a data subject to any credit information provider or credit bureau.

(2) A person who contravenes subsection (1) is guilty of an offence and is

liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both.

Subscriber agreements

24.(1)

A credit bureau and credit information provider may, with the

approval of the Central Bank, enter into a subscriber agreement to provide for the receipt of data subject information by the credit bureau from the credit information provider in accordance with paragraph (a) of section 18(1).

A subscriber agreement referred to in subsection (1), is void where theagreement states or implies that
1. the provisions of this Act or the regulations do not apply to the agreement; and
2. a right or remedy provided by or pursuant to this Act or the regulations
  1. does not apply to the agreement; or
  2. is in any way limited, modified or abrogated by the agreement.
A credit bureau which contravenes this section is guilty of an offence and

is liable on summary conviction to a fine of $50 000.

Data management and quality control

25.(1)

(a)

(b)

(c)

(d)

(e)

A credit bureau shall

implement procedures that ensure that the information registered or contained in its database is updated as frequently as needed or at least monthly;

implement strict quality control procedures in order to ensure the accuracy and completeness of its database;

take all necessary steps to ensure that data subject information maintained by the credit bureau is up to date, authentic, legitimate, reliable, accurate and comprehensive;

maintain and keep all records prescribed by this Act and regulations; and

otherwise maintain reasonable procedures to limit the furnishing of data subject credit reports to the permissible purposes referred to in section 20.

(2) A credit bureau which contravenes subsection (1) is guilty of an offence

and is liable on summary conviction to a fine of $50 000.

Security and control measures

26.(1)

A credit bureau shall ensure that credit information processed for any

purpose under this Act or the regulations is processed in a manner that ensures appropriate security of that information, using appropriate technical or organisational measures, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage.

The measures referred to in subsection (1) must ensure a level of securityappropriate to
1. the harm that might result from such unauthorized or unlawful processing or accidental loss, destruction or damage; and
  40
2. the nature of the data to be protected.
A credit bureau shall take reasonable steps to ensure the reliability of anyof its employees who have access to credit information.
A credit bureau shall, in respect of data subject information kept andmaintained by the credit bureau,
1. take the necessary security and control measures in order to avoid
  1. illegal interception or interruption of the data subject information during transmission; or
  2. other misuse regarding the data subject information, including misuse by anyone with authorized access to the data subject information;
2. keep and maintain an access log regarding the data subject information, including procedures performed; and
3. make available to the data subject upon request, the name of each user and the date on which the user obtained access to the data subject’s information.
Without limiting paragraph (a) of subsection (4), a credit bureau shall, forthe purpose of safeguarding and protecting the data subject information which it keeps and maintains,
1. develop written policies and procedures to be followed by its employees, agents and contractors in relation to the provision of credit reporting services pursuant to this Act and the regulations;
2. ensure that there is a subscriber agreement before disclosing information to a subscriber;
3. provide information and training to ensure compliance with the policies and procedures referred to in paragraph (a); and
  41
4. monitor usage of, and regularly check for compliance with or breaches of the subscriber agreement and the policies, procedures and controls required by this section.
A credit bureau which contravenes this section is guilty of an offence and

is liable on summary conviction to a fine of $50 000.

Data subject’s rights of access and correction

27.(1)

A data subject is entitled to be given by a credit bureau once every

calendar year, a copy of the data subject’s credit report without cost to the data subject.

A credit bureau and a credit information provider shall, at the request ofthe data subject, give electronically or otherwise to the data subject, a written report in a language that the data subject specifies relating to
1. the credit information of which that individual is the data subject;
2. the purposes for which the credit information is being or is to be processed; and
3. the recipients or classes of recipients to whom the credit information has been or may be disclosed.
A data subject is entitled to submit a letter of dispute to a credit bureauregarding any inaccurate data respecting the data subject held in the credit bureau’s database and request correction of the inaccurate data by the credit bureau.
Where a letter of dispute has been submitted under subsection (3), thecredit bureau shall, within 7 business days,
1. investigate the dispute and the inaccuracy of any data and report its findings to the data subject making any corrections as may be warranted; and
2. inform the data subject that he may report the dispute to the Central Bank.
  42
Where a data subject requests from a credit bureau, a credit report or otherdata subject information processed in respect of the data subject, the credit bureau shall, within no more than 3 business days after receipt of the request, furnish to the data subject, the credit report or other information.
Where a credit bureau discloses personal information in pursuance ofsection 19, the credit bureau shall forward, together with the disclosure, a statement informing the data subject of his rights and the procedures for accessing or correcting data kept and maintained by that credit bureau in relation to the data subject.
A credit bureau is not obligated to supply any information unless the creditbureau has
1. received a request in writing; and
2. received such fee as the credit bureau may require, unless otherwise prescribed.
Where a credit bureau
1. requires further information in order to
  1. satisfy itself as to the identity of the person making a request; or
  2. locate the information which that person seeks; and
2. has informed the requesting person of the requirement for further information,the credit bureau is not obliged to comply with the request unless it is supplied with that further information.
A data subject is entitled by notice in writing to require a credit bureau,within such period as is reasonable in the circumstances of the case,
1. to cease processing for a specified purpose or in a specified manner; or
2. not to commence processing
  43
  any credit information relating to the data subject for the reasons specified in subsection (10).
The reasons referred to in subsection (9) are
1. the data is inaccurate or misleading;
2. the processing of the data or the processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another; and
3. that damage or distress is or would be unwarranted.
The credit bureau shall within 21 days of receiving a notice, hereinafterreferred to as “the data subject notice”, give the data subject a written response
1. stating that it has complied or intends to comply with the data subject notice; or
2. stating its reasons for regarding the data subject notice as being unjustified and the extent, if any, to which it has complied or intends to comply with the data subject notice.
Where the Central Bank is satisfied, on the application of a data subject,that a data subject notice which appears to be justified has not been complied with, the Central Bank may order the credit bureau to take such steps as the Central Bank deems appropriate to comply with the data subject notice.
Adverse actions against data subjects28.(1)Where, as a result of any data subject information contained in a creditreport, a credit provider
1. takes any adverse action against the data subject;
2. denies credit to a data subject, in whole or in part; or
3. changes the terms and conditions of an existing credit to the detriment of a data subject,

the credit provider shall, within 30 days after taking the action, inform the data subject by notice in writing hereinafter called “an adverse action notice”.

An adverse action notice under subsection (1) shall contain the followinginformation:
1. the adverse action and the reasons for the action;
2. the name, address and phone number of the credit bureau which provided the data subject information; and
3. the right of the data subject
  1. to dispute the data subject information with the credit bureau; and
  2. to have the information corrected where the data subject information is erroneous or outdated.
A credit provider is deemed to have notified the data subject undersubsection (1) where the credit provider sends the adverse action notice
1. by registered mail to the data subject’s last known address; or
2. to the data subject’s last known email address.
Notwithstanding any other provision of this Act, a data subject is entitled

to a copy of the credit report from the credit bureau without cost to the data subject whenever an adverse action is taken against the data subject by reason of negative information in a credit report.

Cross-border credit reporting

29.(1)

Bank

(a)

(b)

A credit bureau may, with the prior written approval of the Central

outsource to a person or an entity operating in a country within the Caribbean Community; and

enter into a contract with such a person or entity

for the processing of data subject information in its possession or under its control.

A credit bureau may, with the consent of the data subject and with theprior approval of the Central Bank, transfer credit information relating to the data subject from Barbados to a place outside Barbados if that place has an adequate level of protection for the rights and freedoms of data subjects with respect to the processing of credit information.
For the purposes of subsection (2), in determining an adequate level ofprotection, regard shall be had to
1. the nature of the credit information;
2. the country or territory of origin of the information contained in the data;
3. the country or territory or final destination of that information;
4. the purposes for which and period during which the data is intended to be processed;
5. the law in force in the country or territory;
6. the international obligations of that country or territory;
7. the relevant codes of conduct or other rules which are enforceable in that country or territory, whether generally or by arrangement in particular cases; and
8. the security measures taken in respect of the data in that country or territory.
Subsection (3) does not apply to a transfer of credit information fallingwithin any of the following cases:
1. where the data subject has given his consent to the transfer;
2. where the transfer is necessary for the performance of a contract between the data subject and the credit bureau, or for the taking of steps
  46
  at the request of the data subject, with a view to his entering into a contract with the credit bureau;
3. where the transfer is necessary for the conclusion or the performance of a contract between the credit bureau and a person other than the data subject which is entered into at the request of the data subject, or is in the interest of the data subject;
4. where the transfer is necessary for reasons of substantial public interest;
5. where the transfer is necessary
  1. for the purpose of or in connection with legal proceedings, including prospective legal proceedings;
  2. for the purpose of obtaining legal advice;
  3. for the purpose of establishing, exercising or defending legal rights;
6. where the transfer is part of the credit information on a public register and any conditions subject to which the register is open to inspection are complied with by any person to whom the data is or may be disclosed after the transfer;
7. where the transfer is made on terms which are of a kind approved by the Central Bank as ensuring adequate safeguards for the rights and freedoms of data subjects; and
8. where the transfer has been authorized by the Central Bank as being made in such a manner as to ensure adequate safeguards for the rights and freedoms of data subjects.

PART V

SUPERVISION BY THE CENTRAL BANK

Information gathering powers of the Central Bank

30.(1)

For the purposes of carrying out its functions under this Act and the

regulations with respect to a licensee, the Central Bank

may request from the credit bureau any information that the Central Bank requires in order to determine any matter arising
1. under this Act or the regulations; or
2. from the operations of the credit bureau;
may issue such guidelines, rules or directives as the Central Bank considers appropriate;
may require access to the books, records, accounts, vouchers, minutes of meetings and any other document of the licensee;
may demand the production of and inspect any record of the licensee or a person with respect to whom an inspection or inquiry is being made or conducted under this Part; and
shall exercise such other information gathering and enforcement powers set out in this Part or the regulations or as are necessary to fulfil its functions under this Part.

Where the Central Bank demands the production of any record underparagraph (d) of subsection (1), any person who has the custody, possession or control of the record shall produce such record to the Central Bank.
Every credit bureau shall comply with any guidelines, rules or directivesissued by the Central Bank under paragraph (b) of subsection (1).
48
A credit bureau which fails to comply with any guidelines, rules ordirectives issued by the Central Bank is guilty of an offence and liable on summary conviction to a fine of $50 000.
Inspections‌31.(1)The Central Bank or an officer appointed by the Central Bank mayconduct an inspection of
1. an applicant prior to the grant of a licence pursuant to section 6; and
2. a licensee in order to determine that the licensee is compliant with the provisions of this Act and the regulations and is in a sound financial position.

Where the Central Bank or an officer appointed under subsection (1)(b)on inspection of a licensee has reason to believe that the licensee is
1. conducting its business in an unlawful manner; or
2. in a condition that endangers, or is likely to endanger, the credit worthiness, credit standing, credit capacity, character, general reputation or personal characteristics of data subjects,the Central Bank may direct the licensee to take such measures as the Central Bank may specify to rectify the situation.
The Central Bank may, in carrying out an inspection under subsection (1),inquire into and examine
1. the business affairs of the credit bureau with respect to which the inspection is being made;
2. any record of the credit bureau with respect to which the inspection is being made, including any payments to, by or on behalf of, in relation to or in connection with, the credit bureau; and
  49
3. any property or assets of, or things owned, acquired or alienated in whole or in part by
  1. the credit bureau with respect to which the inspection is being made; and
  2. any person acting on behalf of a credit bureau or as agent for the credit bureau with respect to which the inspection is being made.
A credit bureau and any other person referred to in subsection (3) shall,within the period specified by the Central Bank, comply with any direction or request made by the Central Bank under this section.
Where a credit bureau or any other person referred to in subsection (3)

contravenes or fails to comply with subsection (4), the credit bureau or that person is guilty of an offence and liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both.

Warrants

32.(1)

A magistrate may issue a warrant permitting any member of the Police

Force or other person named in the warrant to enter any premises belonging to or in the possession or control of a credit bureau or any officer or employee of such credit bureau and to search the premises and remove any document, material or other thing therein, where the magistrate is satisfied by evidence on oath by the Governor of the Central Bank that there are reasonable grounds to believe that a credit bureau has failed to produce any record required by the Central Bank under this Act.

(2) Any document, material or other thing removed pursuant to subsection

may be returned to the credit bureau upon completion of any investigation unless it is required for purposes of legal proceedings.
Costs of inspections33. Where an inspector conducts an inspection or inquiry into a creditbureau pursuant to this Part, the person with respect to whom the inspection or
50
inquiry is made shall pay the prescribed fees and costs of the inspection or inquiry, including the costs of any travel undertaken in the course of the conduct of the inspection or inquiry.
Auditors and annual reports34.(1)Every credit bureau shall appoint an independent auditor to conductan annual audit and compliance review of the credit bureau in accordance with this Act and applicable best practice.
The auditor shall, as part of the auditors’s annual audit, obtain from thecredit bureau a copy of
1. the most recent report respecting the inspection of the credit bureau prepared by the Central Bank; and
2. any order, direction, notice or other action issued or taken by the Central Bank under this Act or the regulations to verify compliance.
Every credit bureau shall, within 4 months of the end of its financialyear, submit to the Central Bank
1. a signed copy of its audited financial statements;
2. a signed management letter;
3. a list of shareholders of the credit bureau specifying the shareholdings of each shareholder; and
4. such other documents as the Central Bank may reasonably require.
A credit bureau shall, no later than 3 months after the end of its financial

year, publish its audited financial statements in the Official Gazette and in a newspaper circulating in Barbados and also on its website.

PART VI MISCELLANEOUS

Determination of disputes ‌

35. Any person aggrieved by a decision made under this Act may apply

to the Tribunal for relief.

Civil liability for negligent non-compliance

36.(1)

A person who, due to negligence, fails to comply with a requirement

imposed by this Act or any regulations made under this Act shall be liable to a data subject for any injury suffered by the data subject by reason of such failure.

Where 2 or more directors or officers of an authorized person are liablein respect of a failure under subsection (1), their liability shall be joint and several.
Agreement with another regulatory authority37.(1)The Central Bank may enter into an agreement with a local or anoverseas regulatory authority
1. for the purpose of administering or enforcing this Act; or
2. for any other purpose respecting credit reporting services that the Central Bank believes to be in the public interest.
The Central Bank must, in relation to third countries and internationalorganizations, take appropriate steps to
1. develop international cooperation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;
2. provide international mutual assistance in the enforcement of legislation for the protection of personal data, subject to appropriate safeguards for the protection of personal data, and other fundamental rights and freedoms;
  52
3. engage relevant stakeholders in discussion and activities aimed at furthering international cooperation in the enforcement of legislation for the protection of personal data; and
4. promote the exchange and documentation of legislation and practice for the protection of personal data, including legislation and practice relating to jurisdictional conflicts with third countries.

Confidentiality and restrictions regarding access to information

38.(1)

Information obtained by the Central Bank as a result of an inspection,

audit, investigation or inquiry under this Act, shall not be available for access by any person except

directors, officers or employees of the Central Bank whose responsibilities require or allow them to have access to the information; or
such persons as may be authorized in writing by the Central Bank to have access to such information.
No person, director, officer or employee of the Central Bank shall, unlessauthorized by this Act or any other enactment or with the consent of the person to whom the information relates,
1. communicate, or allow to be communicated, information obtained pursuant to this Act to a person who is not legally entitled to obtain the information; or
2. allow a person who is not legally entitled to information obtained pursuant to this Act to have access to such information.

Limitation on prosecution

No prosecution for an offence committed under this Act or theregulations shall be commenced after a period of 2 years has elapsed after the date on which the offence is alleged to have been committed.
53
Penalties‌40.
A person guilty of an offence under this Act for which no penalty isotherwise specifically provided is liable on summary conviction, to a fine of $100 000 or to imprisonment for 5 years or to both.
Fixed penalty41.(1)Notwithstanding section 40, where the Central Bank has reason tobelieve that a person has committed an offence pursuant to this Act or the regulations, the Central Bank may issue to the person a notice in writing
1. specifying the offence against the Act or the regulations the Central Bank has reason to believe has been committed;
2. offering the person the option to discharge any liability to prosecution and conviction in respect of the offence by payment of a fixed penalty of $10 000; and
3. giving the person no less than 7 days from the date of receipt of the notice to show cause why the fixed penalty should not be imposed.

A fixed penalty may be imposed by the Central Bank after the periodreferred to in paragraph (c) of subsection (1) has elapsed, by order of the Central Bank.
A fixed penalty payable under paragraph (b) of subsection (1), any otherprovision of this Act or the regulations shall be paid to the Central Bank within 10 days from the date of its imposition, unless otherwise stated.
Subject to subsection (6), the Central Bank may, where a credit bureaufails to pay a fixed penalty within such time as may be specified in a notice issued pursuant to subsection (1), recover the amount due on the fixed penalty from a bank guarantee provided under section 8.
54
The Central Bank shall, for the purpose of recovering from a bankguarantee the amount due on a fixed penalty payable by a credit bureau, issue an order to the bank issuing the guarantee
1. notifying the bank of the failure of the credit bureau to pay the amount due on the fixed penalty; and
2. directing the bank to immediately pay up the amount to the Central Bank.
Where the amount due on a fixed penalty has been recovered from a bankguarantee in accordance with this section
1. the Central Bank shall by notice in writing inform the credit bureau of the recovery; and
2. the credit bureau shall, within 30 days of being notified by the Central Bank of the recovery from the bank guarantee, furnish the Bank with a new irrevocable bank guarantee
  1. in the amount required to be submitted pursuant to paragraph (b)of subsection (2) of section 8; and
  2. in a format acceptable to the Central Bank.
Without prejudice to any action taken by the Central Bank pursuant toparagraph (a) of subsection (6), the Central Bank may suspend or revoke the licence of a credit bureau which fails to comply with subsection (3) or with paragraph (b) of subsection (6).
Immunity42.(1)
No action or proceeding lies or shall be commenced against theCentral Bank, its directors, officers, employees or agents or an authorized person, for anything done, caused, permitted or authorized to be done, attempted to be
55
done or omitted to be done in good faith by the Central Bank, its directors, officers, employees or agents or such authorized persons
1. in the exercise or purported exercise of a power conferred by this Act or the regulations; or
2. in the carrying out or purported carrying out of an order made pursuant to this Act or a duty imposed by this Act or the regulations.

(2) The Central Bank shall indemnify its directors, officers, employees,

agents and authorized persons against the cost of defending their actions while discharging their functions under this Act or the regulations in good faith.

Protection of databases upon liquidation

43.(1)

Notwithstanding any provision to the contrary contained in the

Companies Act , Cap. 308, a credit bureau shall not pass a resolution for the suspension of its activity or the voluntary winding up of its business unless the credit bureau first obtains the approval in writing of the Central Bank.

Where a credit bureau is being wound up or liquidated
1. the database containing data subject information shall be transferred to the Central Bank;
2. the Central Bank shall determine whether the credit reporting activities which were undertaken by the credit bureau shall be continued or whether the data subject information shall be destroyed or transferred to another licensed credit bureau, following a bidding process; or
3. where the Central Bank determines not to transfer data subject information to another licensed credit bureau, it may issue an order regarding the disposal or destruction of the data subject information held by the credit bureau which is being wound up or liquidated.

Application of Data Protection Act, 2019 (Act 2019-29)

Where this Act is deficient in any respect for the protection of personaldata, the Data Protection Act, 2019 (Act 2019-29) shall apply to remedy the deficiency.
Regulations
The Minister may, after consultation with the Central Bank, makeregulations
1. prescribing the fees to be paid for
  1. the grant or renewal of a licence; and
  2. the reinstatement of a licence that has been revoked;
2. prescribing any matter that is required or authorized by this Act to be prescribed;
3. relating to the disclosure and protection of data subject information; and
4. generally for the proper administration of this Act.

Transitional provisions

46.(1)

Where on the day immediately preceding the commencement of this

Act any person carried on the business of a credit bureau, that person may continue to carry on that business after the commencement of this Act but shall within 6 months after the commencement of this Act, make application to the Central Bank under section 5 for the grant of a licence to carry on the business of a credit bureau.

Where a person fails to comply with the provisions of subsection (1), theCentral Bank shall order that person to cease its business forthwith.
57
Where a person fails to comply with the provisions of this section, thatperson and every manager thereof is guilty of an offence and in the case of
1. a body corporate, it is liable on summary conviction to a fine of$200 000; and
2. a manager, he is liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both.

Commencement

47. This Act shall come into operation on a date to be fixed by

Proclamation.

Read three times and passed the House of Assembly this day of , 2021.

Speaker

Read three times and passed the Senate this day of

, 2021.

President

PARLIAMENT

SECOND SESSION OF 2018-2023

BILL

cited as the Fair Credit Reporting Act, 2021

Government Printing Department

Gazette December 9 2021 – Part A