Chapter VI
INFORMATION PRIVACY PRINCIPLES AND FURNISHING OF CREDIT INFORMATION
19. Accuracy and security of credit information.
19. Accuracy and security of credit information.—A credit information company or credit institution or specified user, as the case may be, in possession or control of credit information, shall take such steps (including security safeguards) as may be prescribed, to ensure that the data relating to the credit information maintained by them is accurate, complete, duly protected against any loss or unauthorised access or use or unauthorised disclosure thereof.
| Other Contents of Credit Information Companies (Regulation) Act, 2005 |
|---|
| Sections 1 to 8 Sections 9 to 18 Sections 19 to 26 Sections 27 to 37 Schedule |
20. Privacy principles.
20. Privacy principles.—Every credit information company, credit institution and specified user, shall adopt the following privacy principles in relation to collection, processing, collating, recording, preservation, secrecy, sharing and usage of credit information, namely:—
(a) the principles—
(i) which may be followed by every credit institution for collection of information from its borrowers and clients and by every credit information company, for collection of information from its member credit institutions or credit information companies, for processing, recording, protecting the data relating to credit information furnished by, or obtained from, their member credit institutions or credit information companies, as the case may be, and sharing of such data with specified users;
(ii) which may be adopted by every specified user for processing, recording, preserving and protecting the data relating to credit information furnished, or received, as the case may be, by it;
(iii) which may be adopted by every credit information company for allowing access to records containing credit information of borrowers and clients and alteration of such records in case of need to do so;
(b) the purpose for which the credit information may be used, restriction on such use and disclosure thereof;
(c) the extent of obligation to check accuracy of credit information before furnishing of such information to credit information companies or credit institutions or specified users, as the case may be;
(d) preservation of credit information maintained by every credit information company, credit institution, and specified user as the case may be (including the period for which such information may be maintained, manner of deletion of such information and maintenance of records of credit information);
(e) networking of credit information companies, credit institutions and specified users through electronic mode;
(f) any other principles and procedures relating to credit information which the Reserve Bank may consider necessary and appropriate and may be specified by regulations.
21. Alteration of credit information files and credit reports.
21. Alteration of credit information files and credit reports.—(1) Any person, who applies for grant or sanction of credit facility, from any credit institution, may request to such institution to furnish him a copy of the credit information obtained by such institution from the credit information company.
(2) Every credit institution shall, on receipt of request under sub-section (1), furnish to the person referred to in that sub-section a copy of the credit information subject to payment of such charges, as may be specified by regulations, by the Reserve Bank in this regard.
(3) If a credit information company or specified user or credit institution in possession or control of the credit information, has not updated the information maintained by it, a borrower or client may request all or any of them to update the information; whether by making an appropriate correction, or addition or otherwise, and on such request the credit information company or the specified user or the credit institution, as the case may be, shall take appropriate steps to update the credit information within thirty days after being requested to do so :
Provided that the credit information company and the specified user shall make the correction, deletion or addition in the credit information only after such correction, deletion or addition has been certified as correct by the concerned credit institution :
Provided further that no such correction, deletion or addition shall be made in the credit information if any dispute relating to such correction, deletion or addition is pending before any arbitrator or tribunal or court and in cases where such dispute is pending, the entries in the books of the concerned credit institution shall be taken into account for the purpose of credit information.
22. Unauthorised access to credit information.
22. Unauthorised access to credit information.—(1) No person shall have access to credit information in the possession or control of a credit information company or a credit institution or a specified user unless the access is authorised by this Act or any other law for the time being in force or directed to do so by any court or tribunal and any such access to credit information without such authorisation or direction shall be considered as an unauthorised access to credit information.
(2) Any person who obtains unauthorised access to credit information as referred to in sub-section (1) shall be punishable with fine which may extend to one lakh rupees in respect of each offence and if he continues to have such unauthorised access, with further fine which may extend to ten thousand rupees for every day on which the default continues and such unauthorised credit information shall not be taken into account for any purpose.
Chapter VII
OFFENCES AND PENALTIES
23. Offences and penalties.
23. Offences and penalties.—(1) Whoever, in any return or other document or in any information required or furnished by, or under, or for the purposes of, any provision of this Act, wilfully makes a statement which is false in any material particular, knowing it to be false, or wilfully omits to make a material statement, shall be punishable with imprisonment for a term which may extend to one year and shall also be liable to fine.
(2) Every credit information company or a credit institution or any specified user, wilfully, performing any act or engaging in any practice, in breach of any of the principles referred to in Section 20, shall be punishable with fine not exceeding one crore rupees.
(3) Any credit information company or credit institution or specified user wilfully providing to any other credit information company or credit institution or specified user or borrower or client, as the case may be, credit information which is false in any material particular, knowing it to be false, or wilfully omits to make a material statement, shall be punishable with fine which may extend to one crore rupees.
(4) Any person who contravenes any provision of this Act or of any rule or order made thereunder, or obstructs the lawful exercise of any power conferred by or under this Act, or makes default in complying with any requirement of this Act or of any rule or order made or direction issued thereunder, shall, if no specific provision is made under this Act for punishment of such contravention, obstruction or default, be punishable with fine which may extend to one lakh rupees and where a contravention or default is a continuing one, with a further fine which may extend to five thousand rupees for every day during which the contravention or default continues.
(5) Where a contravention or default has been committed by a credit information company or credit institution or specified user, as the case may be, every person who, at the time the contravention or default was committed, was in charge of, and was responsible to the credit information company or credit institution or specified user for the conduct of its business, shall be deemed to be guilty of the contravention or default and shall be liable to be proceeded against and punished accordingly :
Provided that nothing contained in this sub-section shall render any such person liable to any punishment provided in this Act if he proves that the contravention or default was committed without his knowledge or that he exercised all due diligence to prevent the contravention or default.
(6) Notwithstanding anything contained in sub-section (5), where a contravention or default has been committed by a credit information company or credit institution or specified user, as the case may be, and it is proved that the same was committed with the consent or connivance of, or is attributable to any gross negligence on the part of its chairperson, managing director, any other director, manager, secretary or other officer of the credit information company or the credit institution, such chairperson, managing director, any other director, manager, secretary or other officer shall also be deemed to be guilty of that contravention or default and shall be liable to be proceeded against and punished accordingly.
Explanation.—For the purposes of this section,—
(a) “company” means any body corporate and includes a firm or other association of individual, and
(b) “director”, in relation to a firm, means a partner in the firm.
24. Cognizance of offences.
24. Cognizance of offences.—(1) No court shall take cognizance of any offence committed by a member of a credit information company and punishable under Section 23 except upon a complaint in writing made by an officer of the credit information company generally or specially authorised in writing in this behalf by the credit information company or if so directed by the Reserve Bank so to do and no court other than that of a Metropolitan Magistrate or a Judicial Magistrate of the first class or any court superior thereto shall try any such offence.
Explanation.—For the purposes of this sub-section, “member of a credit information company” shall mean a member referred to in Section 15.
(2) No court shall take congizance of any offence committed by a credit information company punishable under Section 23 except upon a complaint in writing made by an officer of the Reserve Bank generally or specially authorised in writing in this behalf by the Reserve Bank and no court other than that of a Metropolitan Magistrate or a Judicial Magistrate of the first class or any court superior thereto shall try any such offence.
25. Power of Reserve Bank to impose penalty.
25. Power of Reserve Bank to impose penalty.—(1) Notwithstanding anything contained in Section 23, if a contravention or default of the nature referred to in sub-section (2) of Section 22 or sub-section (2) or sub-section (3) or sub-section (4) of Section 23, as the case may be, is made by a credit information company or a credit institution then, the Reserve Bank may impose on such credit information company or credit institution—
(i) where the contravention is of the nature referred to in sub-section (2) of Section 22, a penalty not exceeding one lakh rupees;
(ii) where the contravention is of the nature referred to in sub-section (2) or sub-section (3) of Section 23, a penalty not exceeding one crore rupees;
(iii) where the contravention is of the nature referred to in sub-section (4) of Section 23, a penalty not exceeding one lakh rupees and where such contravention or default is continuing one, a further penalty which may extend to five thousand rupees for every day, after the first, during which the contravention or default continues.
(2) For the purpose of adjudging the penalty under sub-section (1), the Reserve Bank shall serve notice on credit information company or credit institution or specified user, as the case may be, requiring it to show cause as to why the amount mentioned in the notice should not be imposed as penalty and a reasonable opportunity of being heard shall also be given to such credit information company or credit institution or specified user, as the case may be.
(3) No complaint shall be filed against credit information company or credit institution or specified user, as the case may be, in any court of law in respect of any contravention or default in respect of which any penalty has been imposed by the Reserve Bank under this section.
(4) Any penalty imposed by the Reserve Bank under this Act shall be payable within a period of fourteen days from the date on which notice issued by the Reserve Bank demanding payment of the sum is served on the credit information company or credit institution or specified user, as the case may be, and in the event of failure of such credit information company or credit institution or specified user to pay the sum within such period, may be levied on a direction made by the principal civil court having jurisdiction in the area where the registered office of the credit information company or credit institution or specified user, being a company, is situated and in case of credit institution incorporated outside India, where its principal place of business in India is situated :
Provided that such direction under this sub-section shall be made only upon an application made in this behalf to the court by the Reserve Bank.
(5) The court which makes a direction under sub-section (4) shall issue a certificate mentioning therein the sum payable by a credit information company or credit institution or specified user, as the case may be, and every such certificate shall be enforceable in the same manner as if it were a decree made by the court in a civil suit.
(6) Where any complaint has been filed against credit information company or credit institution or specified user, as the case may be, in any court in respect of the contravention or default of the nature referred to in sub-section (2) of Section 22 or sub-section (2) or sub-section (3) or sub-section (4) of Section 23, then, no proceedings for the imposition of any penalty on the credit information company or credit institution or specified user shall be taken under this section.
26. Application of fines.
26. Application of fines.—A court imposing any fine under this Act may direct that the whole or any part thereof shall be applied in or towards payment of the costs of the proceedings, or for such purposes as may be directed by the court.
[disclaimer]
