CREDIT REPORTING ACT

to provide for the regulation of credit reporting agencies by the Bank of Zambia; the licensing of credit reporting agencies; the establishment of a Credit Registry; the governance and management of credit reporting agencies; the protection of data subjects; information sharing and reporting to enable assessment of the credit worthiness of a data subject; and matters connected with, or incidental to, the foregoing.

[17th October, 2019]

Act 8 of 2018.

SI 70 of 2019.

PART I
PRELIMINARY PROVISIONS

1. Short title

This Act may be cited as the Credit Reporting Act.

2. Interpretation

In this Act, unless the context otherwise requires—

"access log" means a record of every access made to credit information held by a credit reporting agency;

"account" means any account between a credit provider and a data subject that involves the provision of credit, and includes any new account created as a result of a scheme of arrangement involving one or more previous accounts;

"account general data" includes—

(a) the identity of a credit provider;

(b) the account number;

(d) the date when the account was opened and closed;

(e) the type of credit facility and the currency in which that facility was provided;

(f) the approved credit limit;

(g) the repayment period and terms of a credit facility;

(h) the status of the account;

(i) the credit facility maturity date;

(j) particulars for the identification of the asset used as security;

(k) instalment amount payable; and

(l) any other detail as may be prescribed;

"account repayment data" includes—

(a) the amount last due;

(b) the total repayment made towards the previous credit facility;

(d) default data being—

(i) amount past due and number of days past due; and

(ii) date of settlement of amount past due;

"adverse action" means any denial of credit cancellation or an unfavourable change in the terms and conditions of a transaction regarding a data subject based in whole or in part on information contained in a credit report;

"appeals tribunal" means an ad hoc tribunal appointed and convened by the Minister as specified in section 49;

"appropriate authority" means the Minister having responsibility for, or such public body having powers under, any other law over an incorporated or unincorporated entity and the management of credit information, and includes a public or statutory office, body or institution under the following laws—

(a) the Zambia Police Act;

(b) the Narcotic Drugs and Psychotropic Substances Act;

(d) the Anti-Corruption Act, 2012;

(e) the Prohibition and Prevention of Money Laundering Act, 2001;

(f) the Zambia Revenue Authority Act;

(g) the Information and Communication Technologies Act, 2009;

(h) the Banking and Financial Services Act, 2017;

(i) the Companies Act, 2017;

(j) the Corporate Insolvency Act, 2017;

(k) the Standards Act, 2017;

(l) the Compulsory Standards Act, 2017; and

(m) the Competition and Consumer Protection Act, 2010;

"Bank" means the Bank of Zambia established under the Constitution;

"beneficial owner" has the meaning assigned to the words in the Companies Act, 2017;

"chief executive officer" means the principal officer of a credit reporting agency, whether that person is or is not a director;

"company" has the meaning assigned to the word in the Companies Act, 2017;

"constituent documents" means the articles of association, incorporation form and share certificate;

"control" has the meaning assigned to the word in the Companies Act, 2017;

"court" means a court of competent jurisdiction;

"credit" includes—

(a) a loan, an overdraft facility or other kind of credit provided by a credit provider to, and for the use of, a person;

(b) financing under a lease or hire purchase agreement;

(c) an advance, trade credit or other facility, in whatever form or by whatever name called, whereby the person to whom the benefit is given has access, directly or indirectly, to the funds or property of the person giving it;

(d) a guarantee or any security in relation to the obligations of a person;

(e) any hire purchase, leasing, factoring, debt trading and such similar dealings or transactions; or

(f) any other dealing or transaction as may be prescribed by the Minister, on the recommendation of the Bank;

"credit information" means information relating to a data subject’s—

(a) identification, full name and date of birth;

(b) place of residence and previous places of residence;

(d) place of employment and previous places of employment;

(e) paying habits and outstanding debt obligations;

(f) assets and inquiries made of credit history or information relating to a legal entity or business that would identify the legal entity or business information on incorporation;

(g) tax, directors governance, outstanding debt obligations, assets or credit history; or

(h) other business details;

"credit provider" means a person who carries on a business involving the provision of credit, and includes—

(a) a financial service provider within the meaning of the Banking and Financial Services Act;

(b) a subsidiary of a financial service provider;

(d) a person whose business, whether or not the person carries on any other business, is that of providing finance for the acquisition of goods by way of leasing or hire purchase;

(e) a person who provides goods or services on credit; or

(f) any other person as may be designated by the Bank;

"Credit Registry" means the database established by the Bank under section 17;

"credit report" means information relating to the financial obligations of a person, including the payment history of such obligations, guarantees, publicly available information and any other relevant data compiled by a credit reporting agency;

"credit reporting agency" means a credit registry or company licensed in accordance with this Act, to collect credit reports and process information on the credit status of a data subject;

"data controller" has the meaning assigned to the words in the Electronic Communications and Transactions Act, 2009;

"data provider" means a person providing credit information to a credit reporting agency or credit provider;

"data system" means any system automated or otherwise, which is used, in whole or in part, by a credit reporting agency for the processing of credit information, and includes any document and equipment forming part of the system;

"data subject" has the meaning assigned to the words in the Electronic Communications and Transactions Act, 2009;

"licence" means a licence granted in accordance with section 9;

"personal information" excludes information about a data subject on—

(a) credit information;

(b) the data subject’s name, present and past addresses, taxpayer registration number or other numerical reference, cataloguing or reference scheme used for identification purposes; and

"processing" means collecting, recording, holding, storing or transferring credit information or carrying out an operation or sets of operations on the credit information, including—

(a) organisation, adaptation or alteration of credit information;

(b) retrieval, consultation on, or use of, credit information; or

"Register" means the Register established and maintained in accordance with section 5;

"Registrar" means the person appointed as Registrar of Banks and Financial Institutions in accordance with the Banking and Financial Services Act, 2017;

"regulatory statement" has the meaning assigned to the words in the Banking and Financial Service Act, 2017;

"senior management officer" includes the chief executive officer or any other officer as determined by the Bank;

"significant shareholder" has the meaning assigned to the words in the Banking and Financial Services Act, 2017;

"subscriber" means a person who has entered into a subscriber agreement with a credit reporting agency; and

"subscriber agreement" means a written agreement providing a subscriber with access to credit information held by a credit reporting agency.

3. Application of Act

This Act applies to credit reporting agencies licensed under this Act, credit providers, data subjects, data providers and any other person designated by the Bank.

PART II
ADMINISTRATION

4. Administration of Act

(1) The Act shall be administered by the Bank.

(2) The Bank shall—

(a) licence, regulate and supervise credit reporting agencies;

(b) maintain proper standards of conduct and acceptable credit reporting practices;

(d) protect the integrity of the credit reporting system; and

(e) do any other things that are necessary or incidental to the performance of its functions as provided in this Act.

PART III
LICENSING OF CREDIT REPORTING AGENCIES

5. Register of credit reporting agencies

(1) The Bank shall establish and maintain a Register of credit reporting agencies in which shall be entered—

(a) particulars of a credit reporting agency;

(b) notices of matters which are required, in accordance with this Act to be entered in the Register; and

(2) The Register may be established and maintained wholly or partly in electronic form.

6. Inspection of Register

(1) Subject to this Act, the Register shall, on payment of a prescribed fee, be open for inspection by the public during normal working hours.

(2) A copy of an entry in the Register or an extract from the Register certified by the Registrar, may be admitted in evidence without further proof and without production of the original copy.

7. Operating credit reporting agency without licence

(1) A person shall not—

(a) establish, maintain or hold out as providing or maintaining a credit reporting agency, unless that person is licensed in accordance with this Act; or

(b) assist in establishing or maintaining, or hold out as providing or maintaining, or carrying on a business as a credit reporting agency that is not established and operated by a company licensed in accordance with this Act.

(2) A person who contravenes this section commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both.

8. Application for credit reporting licence

(1) A company may apply to the Bank for a licence to establish and operate a credit reporting agency in the prescribed manner and form on payment of a prescribed fee.

(2) An applicant may withdraw an application for a licence, by notice in writing to the Bank at any time before the licence is granted or rejected.

(3) The Bank shall, in considering an application for a licence, made in accordance with sub-section (1), have regard to the—

(a) capital resources of the applicant;

(b) adequacy and integrity of the operational systems of the applicant;

(d) transparency of the legal, operational, managerial, governance and ownership structures; and

(e) character and experience of the directors, shareholders, beneficial owners or persons proposing to be concerned in the management of the business.

(4) This section does not apply to a Bank licenced under the Banking and Financial Services Act, 2017.

9. Consideration and grant of credit reporting agency licence

(1) The Bank shall, where the applicant meets the requirements of this Act, within 120 days of receipt of the application for a credit reporting licence as provided under section 8, grant the licence.

(2) A licence granted under sub-section (1) shall authorise the holder of the licence to—

(a) obtain and receive credit information;

(b) process, store, update, manage and disseminate information of data subjects in accordance with this Act;

(d) develop a credit scoring system;

(e) provide specialised literature relating to its activities;

(f) carry out market and statistical research relating to matters set out in this Act; and

(g) carry out any other activity as may be prescribed.

(3) A credit reporting agency shall not provide or offer to provide services in breach of the terms and conditions of the licence.

10. Validity of licence

(1) A licence granted under section 9 shall be subject to the terms and conditions attached to that licence.

(2) A licence granted under section 9 shall be subject to the payment of an annual prescribed fee and to compliance, by the licensed credit reporting agency, with the conditions of the licence and this Act and regulations and rules made under this Act.

11. Variation of licence

The Bank may, on the application of a licensee, vary the terms and conditions of a licence as specified by the Bank.

12. Rejection of application

(1) The Bank shall, within 120 days of receipt of an application for a credit reporting licence, reject an application by an applicant to operate a credit reporting agency if the—

(a) activity or business to be carried out by the applicant contravenes any law;

(b) applicant submits false information in relation to the application;

(d) past conduct of the applicant, or any officers, directors or representatives of the applicant will affect carrying on the business with honesty and integrity in accordance with this Act, or any term or condition of the licence;

(e) applicant has made a false or misleading statement, with respect to any matter that the Bank considers material, in an application or in any of the information or material submitted to the Bank in support of an application;

(f) applicant directly or indirectly holds a controlling interest or share in a debt collection agency or a regulated entity; or

(g) the issuance of the licence is not in the public interest.

(2) The Bank shall, where the Bank rejects an application for a licence, inform the applicant, in writing, and give reasons for the rejection.

13. Surrender of licence

(1) Where a licensed credit reporting agency decides to cease operations, it shall notify the Bank, in writing, and shall agree with the Bank the terms and conditions of the surrender of the licence, with particular reference to anything done or any benefit obtained under the licence.

(2) Where a credit reporting agency surrenders its licence, in accordance with sub-section (1), the licence shall be cancelled and the credit reporting agency shall cease to be entitled to any benefits.

14. Transfer of licence

A licence shall not be transferable, except in the event of an amalgamation or other corporate restructuring.

15. Suspension or cancellation of licence

(1) Subject to this Act, the Bank may suspend or cancel a licence if the licensed credit reporting agency—

(a) obtained the licence by submission of false information or statement;

(b) contravenes this Act, any other law or any terms and conditions of the licence;

(d) enters into receivership or takes any action for the winding up or dissolution of the company;

(e) enters into any scheme of arrangement, other than for purposes of amalgamation or corporate restructuring; or

(f) is the subject of an order that is made by a court for its compulsory winding-up or dissolution.

(2) The Bank shall, before suspending or cancelling a licence in accordance with sub-section (1), notify the credit reporting agency, in writing, of such an intention and—

(a) give the reasons for the intended suspension or cancellation; and

(b) require the agency to show cause, within a period not exceeding 30 days, why the licence should not be suspended or cancelled.

(3) The Bank shall not suspend or cancel a licence, as provided in this section if the credit reporting agency takes remedial measures, to the satisfaction of the Bank, within the period referred to in sub-section (2).

(4) The Bank shall, where the Bank suspends or cancels a licence, in accordance with this section, publish the suspension or cancellation, as the case may be, in the Gazette and a daily newspaper of general circulation in Zambia.

16. Handling of credit information when licence cancelled

(1) A credit reporting agency whose licence has been cancelled, in accordance with section 15, shall, within a period determined by the Bank, handover all credit information within its possession to the Bank.

(2) The Bank may, on receipt of the credit information referred to in sub-section (1)—

(a) keep the information in the Credit Registry; or

(b) hand over the information to another credit reporting agency, on the terms that the Bank may determine.

(3) Where the Bank decides to hand over information to another credit reporting agency as provided under sub-section (2)(b), that credit reporting agency shall notify, in writing, all data subjects whose information has been handed over to it.

(4) An obligation in relation to a data subject and consent previously obtained from a data subject by a credit reporting agency whose licence has been cancelled, in accordance with section 15, shall pass to the credit reporting agency to which the information is handed over as provided under sub-section (2)(b).

(5) A person who contravenes sub-section (1) commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both.

PART IV
CREDIT REGISTRY

17. Establishment of Credit Registry

(1) The Bank shall establish, maintain and operate a Credit Registry which shall be a database for credit information.

(2) A credit provider regulated under the Banking and Financial Services Act, 2017 shall supply credit information to the Credit Registry.

(3) The Bank may impose the obligation to supply credit information to the Credit Registry on other credit providers.

(4) The Bank shall prescribe the category of persons who may access and the manner in which information from the Credit Registry may be accessed.

(5) A person who contravenes this section commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both.

18. Retention of information on Credit Registry

The Bank may retain information kept on the Credit Registry for at least 10 years, except that—

(a) in the case of credit information which identifies a data subject and relates to a credit application, for a period not exceeding six months;

(b) in the case of credit information which identifies a data subject and relates to a credit agreement, for a period not exceeding five years; and

PART V
MANAGEMENT OF CREDIT REPORTING AGENCY

19. Beneficial interest and control of credit reporting agency

(1) A person shall not acquire shares or a beneficial interest in a credit reporting agency without the prior written approval of the Bank.

(2) A person shall not acquire a beneficial interest in a credit reporting agency if that person is a credit provider regulated under the Banking and Financial Services Act, 2017 or that person’s significant shareholder.

(3) A person who contravenes this section commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both.

20. Owning of shares in another credit reporting agency

(1) A person who controls a credit reporting agency shall not own any share in another credit reporting agency, or acquire and maintain control over another agency, without the prior written approval of the Bank.

(2) A person shall not hold shares in a credit reporting agency as a nominee.

21. Appointment of board of directors

(1) A credit reporting agency shall have a board of directors with a majority of its members being non-executive.

(2) A person shall not be appointed as a member of the board of directors of a credit reporting agency without the prior written approval of the Bank.

(3) A person shall not be appointed as a member of the board of directors of a credit reporting agency if the person is a member of a board of a credit provider regulated under the Banking and Financial Services Act, 2017 or another credit reporting agency.

(4) Where a director of the board or a member of the senior management of a credit reporting agency ceases to hold office, the credit reporting agency shall, within 14 days of such cessation, notify the Bank, in writing, of the cessation and reasons for the cessation.

{mprestriction ids="2,3,5"}

22. Disqualification for appointment as director or senior manager

(1) A person shall not qualify for appointment as a director of the board or a senior management officer if that person—

(a) is not a fit and proper person as prescribed by the Bank;

(b) is below the age of 21 years;

(d) is an undischarged bankrupt;

(e) has been convicted of an offence involving fraud, forgery or uttering a false document;

(f) is serving a suspension or has been removed from office as specified in this Act;

(g) has an adverse listing with any credit reporting agency, been a director of the board or senior management officer of a company which has been adjudged insolvent in accordance with the Corporate Insolvency Act, 2017 entered into a composition with creditors, gone into liquidation, or has entered into any arrangement with creditors or taken any other action with similar effect in Zambia or elsewhere; or

(h) has been removed from an office of trust due to misconduct, abuse of office or corruption.

(2) The Bank may direct a credit reporting agency to suspend, remove or take any other action against a member of a board of directors or senior management in order to enforce the provision of this Act.

(3) A person who contravenes sub-section (1), commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both.

PART VI
SUPERVISION AND REGULATION OF CREDIT REPORTING AGENCIES

23. Collection of information on data subject

(1) A credit reporting agency shall not collect credit information on a data subject unless the information is collected for a purpose directly related to an activity authorised under the licence.

(2) The collection of credit information, referred to in sub-section (1), shall not require the consent of the data subject.

(3) A person who contravenes sub-section (1) commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both.

24. Disclosure of credit information

(1) A credit reporting agency shall not disclose credit information to a person unless—

(a) with the written consent of the data subject;

(b) the disclosure is in accordance with any other law or an order of a court;

(d) the disclosure is intended to safeguard the integrity of a credit market.

(2) A credit reporting agency shall not require consent from a data subject to disclose credit information where the credit information relating to the data subject is adverse.

25. Security of credit information

(1) A credit reporting agency shall take appropriate measures to safeguard credit information against unauthorised access.

(2) A credit reporting agency shall, when processing credit information, put measures in place to protect credit information from loss, misuse, unauthorised access, unauthorised disclosure, alteration, erasure or destruction by—

(a) developing written policies and procedures to be followed by credit information processors, its employees, agents and contractors;

(b) imposing access authentication controls;

(c) providing information and training to its employees so as to ensure compliance with policies, procedures and controls;

(d) ensuring that a subscriber agreement, in a prescribed form, is entered into with the subscriber, before information is disclosed to the subscriber;

(e) taking appropriate action where a security breach is identified;

(f) periodically reviewing policies, procedures and controls;

(g) maintaining an access log in a prescribed form; and

(h) any other measures as may be necessary to secure the information.

(3) Where processing of credit information is carried out by a data controller, the credit reporting agency shall ensure that the credit information processor—

(a) provides sufficient guarantees with regard to technical and organisational security measures to be put in place when processing credit information; and

(b) takes reasonable steps to ensure compliance with measures referred to in paragraph (a).

(4) Where processing of credit information is carried out by a credit information processor, the credit reporting agency shall remain liable in the event of loss, misuse, unauthorised access, unauthorised disclosure, alteration, erasure or destruction of credit information.

26. Retention period of credit information by credit reporting agency

A credit reporting agency shall retain credit information on a data subject, maintained on its database, for a period of at least 10 years from—

(a) final loan repayment;

(b) a credit being written off;

(d) discharge from bankruptcy.

27. Credibility of credit information

(1) A credit reporting agency shall, before disseminating credit information, take necessary steps to ensure that the credit information is accurate, complete, relevant, up to date and not misleading to the users of the information.

(2) A credit reporting agency shall, when undertaking a comparison of credit information within its possession with any other credit information, for the purpose of producing or verifying information on a data subject, take reasonable steps to avoid incorrect matching of such information.

28. Credit report

(1) The Bank may, by Gazette notice, prescribe the form and content of a credit report.

(2) Subject to section 29, a credit reporting agency shall only provide a credit report —

(a) to a person who intends to use the information—

(i) in connection with the extension of credit to a data subject or the purchase or collection of a debt of a data subject;

(ii) in connection with entering into, or renewing of, a tenancy agreement involving a data subject;

(iii) for employment purposes of a data subject;

(iv) in connection with the underwriting of insurance involving a data subject;

(v) to determine the eligibility of a data subject in accordance with any other written law;

(vi) in connection with a credit transaction involving the data subject not covered by sub-paragraphs (i) to (v); or

(vii) for purposes of updating information in a credit report previously provided by a credit reporting agency;

(b) to a law enforcement officer for purposes of conducting an investigation;

(d) in accordance with written instructions from the data subject to whom the information relates;

(e) in response to an order made by the Bank as provided in this Act; or

(f) for purposes that the Bank may prescribe.

(3) Despite sub-section (1), a credit reporting agency may provide information identifying a data subject, limited to the data subject’s name, address, former addresses and former places of employment to—

(a) a Government agency;

(b) law enforcement officer in the course of the officer’s duty; or

29. Information to be excluded from credit report

A credit reporting agency shall not include, any of the following in a credit report—

(a) any information unless the name and address of the source of the information is recorded or retained in its database and can be readily ascertained by the data subject;

(b) any information not based on the most reliable evidence reasonably available;

(c) on the bankruptcy of a data subject which is more than 10 years from the date on which the data subject was discharged, unless the data subject has been bankrupt more than once;

(d) relating to a court judgment, against a data subject, which is more than two years from the date such judgment was rendered, unless the judgment creditor or the creditor’s agent, confirms that the judgment amount remains unpaid, and such confirmation is on record;

(e) regarding a debt, three years after the final payment of such debt or if no payment is made, five years after a data subject incurred such debt;

(f) regarding an administrative fine, three years after payment of such fine or if no payment is made, five years after the fine was incurred;

(g) any information given orally unless the content of the oral report is reduced into writing;

(h) regarding the state of health, race, creed, colour, ancestry, ethnic origin, religion, or political affiliation of a data subject;

(i) criminal record, except for financial fraud and other similar offences; or

(j) information which is not stored in a form capable of being reproduced in accordance with this Act.

30. Accuracy of data maintained by credit information provider

(1) A data provider shall take reasonable steps to ensure the accuracy and completeness of data provided to a credit reporting agency.

(2) Where a data provider discovers any inaccuracy or incompleteness in the data provided to a credit reporting agency, it shall, within 30 days, correct the data and inform a credit reporting agency of the inaccuracy or incompleteness of the data and the correction made to such data.

(3) A credit reporting agency informed by a data provider, as provided in sub-section (2), shall, within five days of being informed, make the necessary correction to such data.

(4) Every credit reporting agency shall maintain, in a prescribed manner and form, a record of information that has been challenged by a data subject.

31. Bank’s order on inaccurate, incomplete or outdated information

Where the Bank finds that the information contained in a database of a credit reporting agency is inaccurate, incomplete, outdated or does not comply with this Act, the Bank may make an order—

(a) directing the credit reporting agency to amend or delete the information;

(b) restricting or prohibiting the credit reporting agency from using the information; or

(c) directing the credit reporting agency to provide notice of any amendment, deletion, restriction or prohibition specified in paragraph (a) or (b) to a person who has received a credit report.

32. Inspections

(1) The Bank may inspect a credit reporting agency’s records or documents relating to the business, including the inspection of the bank accounts and financial transactions of a credit reporting agency for the purposes of ascertaining compliance with this Act, or the terms and conditions of a licence.

(2) The Bank may appoint a person to exercise the powers of the Bank specified in sub-section (1).

(3) A person appointed to conduct an inspection may—

(a) enter the premises of a credit reporting agency;

(b) require a credit reporting agency or any person who may be in possession of any record or document, referred to in sub-section (1), to produce it for the purposes of the inspection;

(c) make inquiries of any other person who may be reasonably believed to have information relating to any record or document, referred to in sub-section (1), concerning a transaction or activity which was undertaken in the course of, or which may affect, the business conducted by a credit reporting agency; and

(d) inspect and make copies of, or take extracts from, and where necessary, take possession of, the documents referred to in sub-section (1).

(4) A credit reporting agency shall afford an inspector access to any record or document for purposes of an inspection and produce, to the inspector, a record or document that the inspector may require.

(5) A person who, without reasonable excuse, fails to comply with a request made in accordance with this section, commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units, or to imprisonment for a term not exceeding one year, or to both.

33. Destruction of documents

A person who destroys, falsifies, conceals or disposes of, or causes or permits the destruction, falsification, concealment or disposal of, any document, which the person knows or ought to know is relevant to an inspection or investigation provided for in this Part, commits an offence and shall be liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both.

34. Supervisory action

(1) The Bank may take supervisory action against a credit reporting agency where a credit reporting agency—

(a) fails to comply with an order or directive of the Bank made in accordance with this Act;

(b) refuses to permit an inspection or obstructs an investigation provided for in this Act;

(c) is found to be undertaking its business in a manner which compromises the safety of data and is in breach of any other law; or

(d) is unable or is unlikely to continue its operations in the ordinary course of business.

(2) The supervisory action the Bank may take, as provided in sub-section (1), without prejudice to any other course of action or penalties provided for in this Act, includes—

(a) taking possession of the credit reporting agency;

(b) appointing a suitably qualified person to manage the affairs of the credit reporting agency, for such a period as the Bank considers necessary;

(c) removing or suspending, from office, any director of the board, senior management officer or other employee of the credit reporting agency, and requiring the credit reporting agency to reconstitute its board of directors within a period the Bank may specify;

(d) varying the authorised activities under licence of the credit reporting agency;

(e) suspending the licence of the credit reporting agency for a period not exceeding six months;

(f) cancelling the licence of the credit reporting agency; or

(g) imposing any other sanction as the Bank may consider appropriate.

PART VII
CONSUMER RIGHTS AND PROTECTION

35. Complaints procedure

A credit reporting agency shall—

(a) establish and make available, in writing, the procedure for dealing with complaints made by a person to the credit reporting agency;

(b) designate a person to be a customer service officer responsible for implementing and administering the procedure referred to in paragraph (a); and

(c) establish and maintain, for two years, or such longer period as the Bank may specify, a record stating the complaints received, when and how they were dealt with or disposed of.

36. Credit provider to provide information to data subject

(1) A credit provider shall provide the following information to a data subject—

(a) the contact details of credit reporting agencies that collect, process and disseminate credit information to third parties relating to the credit worthiness of a data subject; and

(b) the data subject’s right to check the data subject’s own credit history and to correct erroneous information.

(2) A credit provider shall provide to a data subject, detailed information on how to access or correct data maintained by the credit provider.

37. Access to credit information maintained by credit reporting agency

(1) A data subject has the right to receive a copy of all credit information maintained by a credit reporting agency relating to the data subject’s own credit history, in the form of a credit report, which shall include—

(a) a list of users that have accessed the data subject’s information in the last six months;

(b) detailed information on the description of any codes used in the report, so as to enable the data subject understand the report; and

(2) A request, made in accordance with sub-section (1), shall be accompanied by a certified copy of a national registration card or passport.

(3) Subject to sub-section (2), a credit reporting agency shall, within seven days of receiving a request, made in accordance with sub-section (1), provide the data subject with information requested.

(4) A data subject shall have the right to obtain, free of charge, within five days of making a request, a credit report from the credit reporting agency—

(a) at least once a year upon a request being made;

(b) after an investigation conducted in accordance with section 40; and

(5) A credit reporting agency may refuse to grant a request, made in accordance with sub-section (1), if the credit reporting agency—

(a) is not supplied with the information it requires to locate the credit information to which the request relates;

(b) cannot comply without disclosing credit information relating to another data subject, unless—

(i) the other data subject has consented to the disclosure; or

(ii) it is reasonable, in all circumstances, to comply without the consent of the other data subject; or

(i) violate a court order; or

(ii) disclose confidential commercial information.

(6) Where the credit reporting agency refuses to grant a request, as provided in sub-section (5), it shall, not later than 30 days of its refusal, inform the data subject, in writing, and give a reason for the refusal.

38. Notification of adverse action

(1) Where a credit provider takes adverse action against a data subject based, in whole or in part, on a credit report obtained from a credit reporting agency, it shall, within 30 days of taking such action, notify the affected data subject.

(2) Where a data subject is notified, in accordance with sub-section (1), the data subject may, within 30 days of receiving such notification, request for contact details of the credit reporting agency which prepared the credit report.

39. Right to challenge credit information

(1) A data subject shall have the right to challenge a credit reporting agency, in writing, on the information contained in a credit report, where a data subject is of the opinion that the information is inaccurate, incomplete or outdated.

(2) Where a credit reporting agency is notified of a challenge, in accordance with sub-section (1), the credit reporting agency shall—

(a) within five days of receiving the notice, send to a credit provider a notice accompanied by an endorsed copy of a credit report, specifying the challenged information; and

(b) where the inaccuracy or incompleteness of the information is attributed to a credit reporting agency, conduct an investigation within 14 days of receiving the notification.

(3) Where a credit provider receives a notice, referred to in sub-section (2)(a), the credit provider shall, within 30 days of receiving the notice, conduct an investigation into the challenged information and give the credit reporting agency a written report advising whether the challenged information is to be deleted, corrected or maintained, as the case may be.

(4) Where a credit provider fails to respond to the notice, within the period specified in sub-section (3), the credit reporting agency shall remove the challenged information from its database and shall inform the Bank of its action.

(5) Where a credit reporting agency receives a report, referred to in sub-section (3), it shall, within five days of receiving the report, notify—

(a) the data subject of the findings of the report; and

(b) any subscriber who has, in the last 12 months, obtained a credit report from the credit reporting agency containing the inaccurate, incomplete or outdated information.

(6) Where information that has been challenged is corrected, the credit reporting agency shall provide the data subject with a free copy of the credit report that has been corrected.

PART VIII
COMPLAINT AND INVESTIGATION

40. Initiation of investigation

(1) The Bank may investigate a complaint—

(a) on the Bank’s own initiative; or

(b) on receipt of a complaint made by a complainant—

(i) acting in the complainant’s own interest;

(ii) that is an association acting in the interest of its members;

(iii) who is a person acting on behalf of a complainant;

(iv) who is a person acting on behalf, and in the interest, of a group or class of persons; or

(v) who is making a complaint anonymously.

(2) A complaint, made as provided in sub-section (1), shall be in the prescribed manner and form.

(3) Sub-section (2) shall not apply to a complaint made by a person specified in sub-section (1)(b)(v).

41. Refusal to investigate or discontinue a complaint

(1) The Bank may refuse to investigate a complaint or, having commenced an investigation, discontinue the investigation if the—

(a) complaint is frivolous, vexatious or not made in good faith;

(b) complainant does not have sufficient interest in the action complained of, except that this paragraph shall not apply to a complaint made by a person specified in section 40(1)(b)(v);

(d) conduct or involvement to which the complaint relates is or has been the subject of an investigation or other action by any other appropriate authority under any other law; or

(e) complaint has been withdrawn.

(2) The Bank shall not investigate a complaint unless the complaint is made within a period of two years from the date on which the complainant exhausted the complainant’s rights under section 35.

(3) Despite sub-section (1)(c), the Bank may investigate a complaint where the Bank is satisfied that the complainant has been prevented from exercising the complainant’s rights as specified.

(4) The Bank may, in exceptional circumstances, investigate a complaint received outside the period, referred to in sub-section (2), except that the Bank shall not investigate a complaint made in contravention of the Law Reform (Limitation of Actions, etc.) Act.

(5) The Bank shall, where it decides not to conduct an investigation or discontinue an investigation, inform the complainant, in writing, within 14 days of its decision and give reasons for the decision.

42. Continuation of investigation where complaint withdrawn

Where the Bank is of the opinion that it is in public interest to do so, it may continue an investigation initiated by a complaint despite the withdrawal by the complainant of the complaint.

43. Referral of matter

The Bank may, at any stage of investigating or dealing with a matter as provided in this Act, refer the matter to an appropriate authority.

44. Collaboration on investigation

The Bank may, where it commences an investigation or is investigating a matter and the matter is being dealt with by an appropriate authority—

(a) continue to investigate or decide on the matter and share its findings with the appropriate authority concerned;

(b) refer the matter to the appropriate authority concerned and request a report on the matter, once the matter has been finalised; or

45. Enforcement notice

(1) The Bank shall issue an enforcement notice directing a credit reporting agency to carry out such steps as the Bank considers appropriate, within a specified period where, after undertaking an investigation under this Act, the Bank is of the opinion—

(a) that the action which was the subject matter of the investigation is contrary to this Act or any other law, based wholly or partly on a mistake of law or fact;

(b) that—

(i) the matter should be given further consideration;

(ii) an omission should be rectified;

(iii) a decision should be cancelled, reversed or varied;

(iv) the practice on which the act, omission, decision or recommendation was based should be altered;

(v) reasons should have been given for the decision; or

(vi) any other steps should be taken.

(2) Where, on the specified expiry of the period, referred to in an enforcement notice, a credit reporting agency fails to comply with the enforcement notice without reasonable cause, the Bank shall make a decision to give effect to the steps specified in the enforcement notice.

46. Variation or cancellation of enforcement notice

(1) The Bank may, on its own initiative or on an application of a credit reporting agency, vary or cancel an enforcement notice issued in accordance with section 45.

(2) Where the Bank varies or cancels an enforcement notice, as provided in sub-section (1), the Bank shall immediately notify the concerned credit reporting agency, in writing, stating the reasons for the variation or cancellation.

PART IX
REPRESENTATION AND APPEALS PROCESS

47. Reason for decision and right to be heard

Where the Bank makes a decision, in accordance with this Act, the Bank shall, by notice in writing inform the person affected by the decision of the reasons for the decision.

48. Right to appeal

A person who is aggrieved by a decision of the Bank may, within seven days of receipt of the notice and reasons for the decision of the Bank, notify the Minister, in the prescribed manner and form, of the intention to appeal against the decision.

49. Appointment and convening of appeals tribunal

The Minister shall, within seven days after receipt of a notice made under section 48, appoint and convene an ad hoc appeals tribunal consisting of a chairperson who is an advocate of the High Court of not less than seven years standing and two other persons having qualifications and experience relating to the matter which is the subject of the appeal.

50. Tribunal rules

The Chief Justice shall prescribe rules of procedure for an ad hoc tribunal convened under this Act.

PART X
GENERAL PROVISIONS

51. Access to documents

(1) Subject to this section, a person may, on request, review or copy any document lodged with the Bank in terms of this Act.

(2) The Bank may, by rules, specify procedures for making requests for access, as provided in sub-section (1), and the terms and fees to be paid for such access.

(3) The Bank may refuse to authorise a document to be reviewed or copied, in whole or part, where it is satisfied that information in the document is—

(a) confidential to the person lodging the document and has a real commercial value to the person that would be seriously and unreasonably prejudiced if the information were to be made generally available; or

(b) personal information about a person and it is in the public interest that the information should not be generally available.

52. Continuing acts or offences

(1) A person commits a separate offence for each day on which a failure or refusal continues where in accordance with this Act—

(a) an act is required to be done within a particular period or before a particular time and the obligation to do the act continues after the period has ended or the time has passed; or

(b) failure or refusal to comply with the provision is an offence and such failure continues.

(2) A person convicted of an offence under sub-section (1) is liable to an administrative penalty prescribed by the Bank for each day on which the failure or refusal continues.

53. Restriction on use of name indicating credit reporting business

(1) Subject to sub-section (2), a company carrying on a business, unless the company is licensed as a credit reporting agency, shall not use any name which indicates or may reasonably be understood to indicate, whether in English or another language, that the business is being operated by a credit reporting agency or that it is carrying on credit reporting business.

(2) A person shall not falsely represent to the public or any member of the public that the person —

(a) holds a licence to conduct any credit reporting business or provides credit reporting services; or

(b) is licensed to conduct a credit reporting business of any kind.

(3) Any person acting contrary to this section commits an offence and shall be liable, on conviction, to a fine not exceeding five hundred thousand penalty units or to imprisonment for a term not exceeding five years, or to both.

(4) Sub-section (1) shall not prohibit the use of that kind of name by a company or other entity incorporated or otherwise established outside Zambia and which has no permanent place of business in Zambia for the purposes of soliciting business or advertising its business in Zambia.

(5) An authority which, in accordance with any other law, is responsible for the registration of companies or business names shall not register a company or a name of a business that would be in contravention of sub-section (1).

54. Validity of certain acts

(1) A transaction entered into, in contravention of this Act, shall not be void or ineffective by reason only of the contravention, and shall not be voidable by a person to whom this Act applies unless the Court orders otherwise.

(2) Subject to a credit reporting agency’s articles of association, it shall not be necessary for a credit reporting agency to pass a resolution in order to exercise any power conferred by this Act.

55. Power to summon senior management officer, directors and shareholders

(1) Where the Bank considers that a senior management officer, director of the board or shareholder, past or present, of a credit reporting agency, has any information relating to the operations of the credit reporting agency which the Bank considers necessary for the performance of its supervisory functions, the Bank may, in the prescribed manner, summon that officer, director of the board or shareholder, for an examination.

(2) A person commits an offence if that person, when summoned by the Bank, in accordance with sub-section (1)—

(a) fails without reasonable excuse to appear before the Bank for the examination;

(b) withholds information; or

(3) A person who commits an offence under sub-section (2) is liable, on conviction, to a fine not exceeding two hundred thousand penalty units or imprisonment for a term not exceeding two years, or to both.

56. Submission of information and documents to Bank

(1) Where, in the exercise of any of its powers, performance of its functions or the discharge of its duties as provided in this Act, or in accordance with any other law, the Bank requires any information from a credit reporting agency or any other person engaged in the provision of credit reporting services, a company affiliated, associated, holding or subsidiary company or any person who controls a credit reporting agency, on any matter relating to the affairs or business of the credit reporting agency, person or company, the credit reporting agency, person or company, shall submit the information to the Bank.

(2) A credit reporting agency required to furnish or supply a document to the Bank shall ensure that the document is signed by the chief executive officer of the credit reporting agency or by the person holding the office or offices as required by a prescribed form.

(3) At the request of a credit reporting agency or other interested person, the Bank may extend a period within which a credit reporting agency is obliged to furnish any document or information as provided in this Act.

57. Publication of information

(1) Where the Bank considers a publication to be necessary or appropriate, the Bank may publish, in whole or in part, any information or data furnished in accordance with this Act.

(2) The Bank shall not reveal to a person information regarding the affairs of a customer of a data controller that was obtained in the performance of the Bank’s functions, as provided in this Act, unless lawfully required to do so.

(3) A person who issues or takes part in the issuance of a document, referred to in this Act, which is false in any material particular, commits an offence and is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both.

58. Immunity of senior management officer, agent or employee of Bank

An act, matter or thing done by a senior management officer, agent or other employee of the Bank, in the exercise or performance, in good faith, of any power or function, in accordance with this Act, shall not give rise to any action, claim, liability, suit or demand against the officer, employee or agent concerned.

59. Exemptions

The Bank may, on the terms and conditions that the Bank may determine, exempt a credit reporting agency from any of the provisions of this Act and may, in like manner, provide for the variation or revocation of any exemption granted.

60. Penalty for offences where no specific penalty provided

A person who commits an offence, in contravention of this Act, for which no penalty is specifically provided, is liable, on conviction, to a fine not exceeding one hundred thousand penalty units or to imprisonment for a term not exceeding one year, or to both.

61. Offence by principal officer or shareholder of body corporate or unincorporated body

Where an offence under this Act is committed by a body corporate or unincorporated body, with the knowledge, consent or connivance of the director, manager or shareholder, that director, manager or shareholder of the body corporate or unincorporated body commits an offence and is liable, on conviction, to the penalty or term of imprisonment specified for the offence.

62. Administrative penalties

(1) Where the Bank is satisfied, after due investigation, or where a person admits that the person has committed an offence in accordance with this Act or regulations or rules made in accordance with this Act, the Bank may compound the offence and impose such an administrative penalty as may be prescribed.

(2) Where a person, on whom an administrative penalty is imposed, in accordance with this section, fails to pay the penalty within the time ordered by the Bank, the Bank may, recover the penalty by action in a court.

63. Regulatory statements

The Bank may issue and publish regulatory statements.

64. Rules

(1) The Bank may, by statutory instrument, make rules for, or with respect to, any matter that by this Act is required or permitted to be prescribed by the Bank, or that is necessary to be prescribed for purposes of carrying out or giving effect to this Act.

(2) Without prejudice to the generality of sub-section (1), rules made in accordance with sub-section (1) may make provision for—

(a) the conduct of business by credit reporting agencies and their representatives;

(b) matters incidental to the licensing of any credit reporting agencies in accordance with this Act;

(c) the class of persons in relation to whom, and the manner and circumstances in which, credit reporting agencies may conduct or provide credit reporting services;

(d) the correction of any errors in any register or record kept in accordance with this Act;

(e) particulars to be recorded for the purposes of this Act, in relation to accounts of credit reporting agencies;

(f) the lodgment of auditor’s reports and the information to be contained in the auditor’s report;

(g) the operating hours for credit reporting agencies;

(h) the lodgment by credit reporting agencies of annual financial statements;

(i) the exemption, on such terms and conditions as may be prescribed, of any credit reporting agencies from any specified provision of this Act or any rule made in accordance with this Act, and the revocation of any such exemption or the modification of any such terms or conditions;

(j) administrative penalties to be imposed;

(k) the types of business that the Bank considers as constituting credit reporting activities;

(l) maintenance of the confidentiality of data subject information by credit reporting agencies;

(m) information and the matters to be displayed on business stationery of credit reporting agencies;

(n) the practice and conduct of share registers and other registers that are to be kept by credit reporting agencies in accordance with this Act;

(o) the resolution of disputes among credit reporting agencies;

(p) the making of annual or other regulatory returns to the Bank by credit reporting agencies;

(q) mandatory disclosures and registration of interests in credit reporting agencies; and

(r) determination of fit and proper test for purposes of this Act.

(3) The Bank may, by statutory instrument, make other rules to provide for—

(a) the contents, form and issue of a financial statement, annual report and other documents required or provided for in this Act;

(b) requirements for the display and use of unique numbers allocated for licences;

(c) requirements for transactions, including requirements prohibiting or restricting a licensed company from commencing or carrying out business;

(d) the formulation and publication of codes of conduct for credit reporting agencies, their officers and employees;

(e) requirements for credit reporting agencies to make reports to the Bank, either regularly or on the occurrence of specified events or circumstances;

(f) requirements for contents, publication and dissemination of reports to the Bank by—

(i) credit reporting agencies; and

(ii) officers and former officers of credit reporting agencies;

(g) prudential rules, including rules as to capital adequacy, assets and other resources for credit reporting agencies;

(h) disclosures to be made by credit reporting agencies;

(i) keeping of books and records by credit reporting agencies;

(j) the collection of fees and the levying of charges; and

(k) the effective administration and implementation of this Act.

(4) The Bank may issue rules prescribing the segregation and safe custody of a data subject’s information.

65. Regulations

(1) The Minister may, on the recommendation of the Bank, make regulations for the better carrying out of this Act.

(2) Without limiting the generality of sub-section (1), regulations made in accordance with sub-section (1) may—

(a) prescribe fees or charges payable in respect of any matter arising under, provided for, or authorised by, this Act;

(b) prescribe offences and fines not exceeding one hundred thousand penalty units or imprisonment for a term not exceeding one year;

(c) prescribe the forms for applications, licences, approvals, registers, notices, orders and other documents required for the purposes of this Act;

(d) prescribe the information to be given in returns and other documents delivered or made for the purposes of this Act;

(e) provide the procedure for the service of notices, orders and documents as specified in this Act and the times at which they shall be taken to have been served; and

(f) prescribe the procedure for complaints, for purposes of this Act, and the making, consideration, hearing and determination of complaints and appeals.

CREDIT REPORTING ACT

Arrangement of Sections

Section

PART I
PRELIMINARY PROVISIONS

1. Short title

2. Interpretation

3. Application of Act

PART II
ADMINISTRATION

4. Administration of Act

PART III
LICENSING OF CREDIT REPORTING AGENCIES

5. Register of credit reporting agencies

6. Inspection of Register

7. Operating credit reporting agency without licence

8. Application for credit reporting licence

9. Consideration and grant of credit reporting agency licence

10. Validity of licence

11. Variation of licence

12. Rejection of application

13. Surrender of licence

14. Transfer of licence

15. Suspension or cancellation of licence

16. Handling of credit information when licence cancelled

PART IV
CREDIT REGISTRY

17. Establishment of Credit Registry

18. Retention of information on Credit Registry

PART V
MANAGEMENT OF CREDIT REPORTING AGENCY

19. Beneficial interest and control of credit reporting agency

20. Owning of shares in another credit reporting agency

21. Appointment of board of directors

22. Disqualification for appointment as director or senior manager

PART VI
SUPERVISION AND REGULATION OF CREDIT REPORTING AGENCIES

23. Collection of information on data subject

24. Disclosure of credit information

25. Security of credit information

26. Retention period of credit information by credit reporting agency

27. Credibility of credit information

28. Credit report

29. Information to be excluded from credit report

30. Accuracy of data maintained by credit information provider

31. Bank’s order on inaccurate, incomplete or outdated information

32. Inspections

33. Destruction of documents

34. Supervisory action

PART VII
CONSUMER RIGHTS AND PROTECTION

35. Complaints procedure

36. Credit provider to provide information to data subject

37. Access to credit information maintained by credit reporting agency

38. Notification of adverse action

39. Right to challenge credit information

PART VIII
COMPLAINT AND INVESTIGATION

40. Initiation of investigation

41. Refusal to investigate or discontinue a complaint

42. Continuation of investigation where complaint withdrawn

43. Referral of matter

44. Collaboration on investigation

45. Enforcement notice

46. Variation or cancellation of enforcement notice

PART IX
REPRESENTATION AND APPEALS PROCESS

47. Reason for decision and right to be heard

48. Right to appeal

49. Appointment and convening of appeals tribunal

50. Tribunal rules

PART X
GENERAL PROVISIONS

51. Access to documents

52. Continuing acts or offences

53. Restriction on use of name indicating credit reporting business

54. Validity of certain acts

55. Power to summon senior management officer, directors and shareholders

56. Submission of information and documents to Bank

57. Publication of information

58. Immunity of senior management officer, agent or employee of Bank

59. Exemptions

60. Penalty for offences where no specific penalty provided

61. Offence by principal officer or shareholder of body corporate or unincorporated body

62. Administrative penalties

63. Regulatory statements

64. Rules

65. Regulations

AN ACT

[On Notice]

Act 8 of 2018.

PART I
PRELIMINARY PROVISIONS

1. Short title

This Act may be cited as the Credit Reporting Act, and shall come into operation on the date appointed by the Minister by statutory instrument.