Law / Canada / New Brunswick
Credit Reporting Services Act, credit reporting agencies: licence, permitted disclosure, report contents and consent
S.N.B. 2017, c. 27, ss. 4, 9-11
In force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Financial and Consumer Services Commission of New Brunswick
- Obligation class
- Licensing, Consent, Disclosure
As of .
What it requires
- These duties bind a credit reporting agency, which is a person who for gain or profit provides credit reports or creates and maintains files from which credit reports are directly generated and provided, and, for the consent duties, an end-user that obtains a credit report.
- Do not carry on business as a credit reporting agency unless you are licensed under the Act (s. 4 (1)).
- Provide information from your files only in response to a court warrant or order or an order under the Act, in a credit report to an end-user that has obtained the consumer's consent, or to the consumer to whom it pertains; do not knowingly obtain information from a consumer's file held by an agency except in those circumstances (s. 9 (1)-(2)).
- Adopt all reasonable procedures to ensure accuracy and fairness in the contents of your credit reports, and do not maintain or include information about a consumer's health or medical history or about gender identity or expression, sex, sexual orientation, political belief or activity, creed or religion, race, colour, ancestry or national origin (s. 10 (1)-(2)).
- Include in each credit report the source of each item of information and the source's contact information, or make it readily ascertainable by the consumer, and record both in the consumer's file (s. 10 (4)).
- If you are an end-user obtaining a consumer's consent to release a credit report, tell the consumer the purpose and use of the report, the purpose of any release to a third party, the date the consent takes effect and whether it expires or continues during an agreement; take reasonable steps to verify the consumer's identity and record them; consent obtained by false or misleading information or deceptive practices is void (s. 11 (1), (2), (4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
An individual convicted under section 45 (1) is liable to a fine of not more than $50,000 or to imprisonment for a term of not more than one year, or to both.
Penalty structure
Section 45 (1) of the Credit Reporting Services Act provides for a fine of not more than $50,000 for an individual and not more than $250,000 for a person other than an individual; section 48 (1) separately lets the Tribunal order an administrative penalty of not more than $25,000 for an individual and not more than $100,000 for any other person.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 250,000
What this law does
No person shall carry on business as a credit reporting agency unless the person has been licensed as provided by the Act and the regulations. A credit reporting agency is a person who, for gain or profit, provides credit reports or creates and maintains files from which credit reports are directly generated and provided.
No credit reporting agency shall knowingly provide information from its files to a person except in response to a court warrant or order or an order under the Act, in a credit report to an end-user that has obtained the consumer's consent or to a third party at the end-user's direction or to an end-user in accordance with section 18 (5), or to the consumer to whom the information pertains.
No person shall knowingly obtain information from a consumer's file held by a credit reporting agency except in those circumstances. A credit reporting agency shall adopt all procedures reasonable for ensuring accuracy and fairness in the contents of its credit reports. A credit reporting agency shall not maintain in its files or include in a credit report information about a consumer's health or medical history, including a physical or mental disability.
It shall also not maintain or include information about a consumer's gender identity or expression, sex, sexual orientation, political belief or activity, creed or religion, race, colour, ancestry or national origin.
A credit reporting agency shall not include information in a credit report unless the source of the information is included in the report, the source's contact information is included or can be readily ascertained by the consumer, and the source and its contact information are recorded in the consumer's file.
An end-user obtaining consent to the release of a credit report shall inform the consumer of the purpose for obtaining the report and how it will be used, the purpose of any release to a third party, the date the consent is effective, and whether the consent expires on a specified date or continues during the term of an agreement. The consent is void if the end-user obtains it by providing false or misleading information respecting the consent or by using deceptive or misleading practices.
An end-user obtaining a consumer's consent shall take reasonable steps to verify the identity of the consumer and record the steps taken. The Act, with the exception of one paragraph of section 10, was proclaimed and came into force on .
A person who violates a provision of the Act listed in its Schedule A commits an offence and is liable on conviction, for each offence, to a fine of not more than $50,000 or to imprisonment for a term of not more than one year, or to both, if an individual, and to a fine of not more than $250,000 if a person other than an individual.
The Tribunal may order a person who has violated or failed to comply with the Act to pay an administrative penalty of not more than $25,000 for an individual and not more than $100,000 for a person other than an individual.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or provides financial services.