Credit Information Act 2021

A.65 CREDIT INFORMATION ACT, 2021 ARRANGEMENT OF SECTIONS SECTION PART I — Preliminary

1. Short title and commencement
2. Interpretation
3. Application of Act PART II — Licensing of Credit Bureaus
4. Register of credit bureau
5. Access to Register
6. Operating credit bureau without licence
7. Application for credit bureau licence
8. Issuance of licence
9. Validity of licence
10. Variation of licence
11. Rejection of application
12. Surrender of licence
13. Transfer of licence
14. Suspension and revocation of licence
15. Handling of consumer information after revocation of licence PART III — Governance, Regulation and Supervision of Credit Bureaus   16.  Beneficial interest and control of credit bureau
16. Owning shares in another credit bureau
17. Appointment of credit bureau board of directors   19.  Disqualification for appointment as director or senior manager of credit bureau
18. Collection of information on data subjects
19. Disclosure of consumer information
20. Security of consumer information
21. Retention period of consumer information by credit bureau
22. Credibility of consumer information
23. Credit report No. 17 of 2021

A.66 26. Information to be excluded from credit report 27. Bank’s order on inaccurate, incomplete or outdated information 28. Inspection of records or documents 29. Supervisory action 30. Complaints procedure PART IV — Obligations of Data Providers and Data Users 31. Obligations of data provider 32. Obligations of data user 33. Assessment of risk and affordability by data provider PART V — Rights of Data Subjects Relating to Consumer Information 34. Data provider to provide information to data subject 35. Access to consumer information maintained by credit bureau   36.  Notification of adverse action 37. Right to challenge consumer information PART VI — Investigation of Complaints 38. Initiation of investigation 39. Refusal to investigate or discontinuation of investigation 40. Continuation of investigation 41. Referral of matter 42. Collaboration on investigation 43. Enforcement notice 44. Variation or cancellation of enforcement notice 45. Reason for decision 46. Appeals PARTVII — Miscellaneous Provisions 47. Access to documents 48. Destruction of documents 49. Restriction on use of name indicating credit reporting business 50. Power to summon board director, senior manager and shareholders 51. Submission of information and documents to Bank 52. Publication of information   53.  Indemnity of senior management officer, agent, etc. 54. Cross-border consumer information sharing 55. General penalty 56. Administrative penalties 57. Rules 58. Regulations 59. Transitional provisions

A.67 An Act to provide for the regulation of the credit reporting system, the licensing and supervision of credit bureaus and for matters connected therewith or incidental thereto. Date of Assent: 08.10.2021 Date of Commencement: ON NOTICE ENACTED by the Parliament of Botswana. PART I — Preliminary

1. This Act may be cited as the Credit Information Act, 2021, and shall come into operation on such a date as the Minister may, by Order published in the Gazette, appoint.
2. In this Act, unless the context otherwise requires — “adverse action” means any denial of credit cancellation or an unfavourable change in the terms and conditions of a transaction regarding a data subject based in whole or in part on information contained in a credit report; “adverse consumer information” means information which indicates that a data subject is not satisfying all debt obligations in terms of an agreement relating to the extension of credit; “appropriate authority” means an authority empowered by an Act of Parliament to investigate or prosecute unlawful practices; “Bank” means the Bank of Botswana established under the Bank of Botswana Act; “company” has the meaning assigned to it in the Companies Act; “consumer information” means positive and adverse information relating to a data subject’s — (a) credit history, including applications for credit, agreements to which the data subject is or has been a party to in terms of which credit is extended, pattern of payment or default under any such agreement, incidence of enforcement actions with respect to any agreement in terms of which credit is extended, and the circumstances of termination of any such agreement; (b) financial history, including the data subject’s past and current income, assets, debts and other matters within the scope of that data subject’s financial means, prospects and obligations and related matters; (c) education, employment, career, professional or business history, including the circumstances of termination of any education, employment, career, professional or business relationships and related matters; (d) identity, including the data subject’s name, date of birth, identity number, marital status and family relationships, past and current addresses and other contacts; or (e) court judgments related to debts; Short title and commencement Interpretation Cap. 55:01 Cap. 42:01

A.68 “credit” includes — (a) a loan, an overdraft facility or other kind of credit provided by a credit provider to, and for the use of, a person; (b) an advance, trade credit or other facility, in whatever form or by whatever name called, whereby the person to whom the benefit is given has access, directly or indirectly, to the funds or property of the person giving it; (c) a guarantee or any security in relation to the obligations of a person; (d) any hire purchase, leasing, invoice discounting, factoring, debt trading, letters of credit and such similar dealings or transactions; or (e) any other dealing or transaction as may be prescribed by the Minister, on the recommendation of the Bank; “credit bureau” means a company licenced under section 8 to collect, compile and disclose credit reports; “credit report” means a data subject’s consumer information; “data provider” means a person who submits customer information to a credit bureau, and includes — (a) a bank licensed under the Banking Act; (b) the Botswana Savings Bank established under Botswana Savings Bank Act; (c) the National Development Bank established under the National Development Bank Act; (d) a non-bank financial institution regulated under the Non￾Bank Financial Institutions Regulatory Authority Act; (e) a person whose business, whether or not the person carries on any other business, is that of providing finance for the acquisition of goods by way of leasing or hire purchase; (f) a person who provides goods or services on credit; (g) any agency or entity that carries on business involving the provision of credit; (h) any person who provides service under a deferred payment arrangement; (i) any person who supplies goods, services or untilities to consumers, whether for cash or on credit; (j) entities involved in fraud investigation; (k) educational institutions; (m) other credit bureaus; or (n) any other person as may be designated by the Bank; “data subject” means an individual or a business entity whose data is collected, processed and disclosed to third parties in the credit information sharing system; “debt collection agency” means an entity or institution that collects unpaid or past due debts for other businesses, creditors or lenders, and may include a legal practitioner involved in collection of debts on behalf of individuals or businesses; Cap. 46:04 Cap. 56:03 Cap. 74:05 Cap. 46:08

A.69 “inspector” means a person appointed by the Bank under section 28 (2); “licence” means a credit bureau licence issued under section 8; “nominee” has the meaning assigned to it in the Companies Act; “personal information” means any other relevant information about a data subject which is reasonably required for the purpose of this Act, but excludes information about a data subject on — (a) consumer information; and (b) the data subject’s name, present and past addresses, taxpayer registration number or other numerical reference, cataloguing or reference scheme used for identification purposes; “processing” means collecting, recording, holding, storing or transferring consumer information or carrying out an operation or sets of operations on the consumer information, including — (a) organisation, adaptation or alteration of consumer information; (b) retrieval, consultation on, or use of, consumer information; or (c) alignment, combination, correction, erasure or destruction of consumer information; “Register” means a Register established and maintained under section 4; “senior management officer” includes the Governor or any other officer as determined by the Bank; “subscriber” means a person that is a party to a subscription agreement and is otherwise eligible to access credit bureau reports, but excludes a data subject; and “subscription agreement” means an agreement between a credit bureau and a subscriber that sets forth the modalities for requesting a credit bureau report, and such other material terms of the arrangement. 3. This Act applies to credit bureaus licensed under this Act, data providers, data users, data subjects and any other person designated by the Bank. PART II — Licensing of Credit Bureaus 4. (1) Subject to the provisions of this Act, the Bank shall establish and maintain a Register of credit bureaus in which shall be entered — (a) particulars of a credit bureau; (b) notices of matters which are required, in accordance with this Act to be entered in the Register; and (c) such other matters as may be prescribed. (2) The Register under subsection (1) may be established and maintained wholly or partly in electronic form. Application of Act Register of credit bureau

A.70 5. (1) Subject to the provisions of this Act, the Register shall, on payment of a prescribed fee, be open for inspection by data providers during normal working hours. (2) A copy of an entry in the Register or an extract from the Register certified by the Bank, may be admitted in evidence without further proof and without production of the original copy. 6. (1) A person shall not — (a) establish, maintain or hold out as providing or maintaining a credit bureau, unless that person is licensed in accordance with this Act; or (b) assist in establishing or maintaining, or hold out as providing or maintaining, or carrying on a business as a credit bureau that is not established and operated by a company licensed in accordance with this Act. (2) A person who contravenes this section commits an offence and is liable to a fine not exceeding P250 000 or to imprisonment for a term not exceeding five years, or to both. 7. (1) A person may apply to the Bank for a licence to establish and operate a credit bureau, in the prescribed manner and form upon payment of a prescribed fee. (2) An applicant may withdraw an application for a licence under subsection (1), by giving notice, in writing, to the Bank at any time before the licence is issued or rejected. (3) The Bank shall, in considering an application for a licence, made in accordance with subsection (1), have regard to the following — (a) the capital resources of the applicant; (b) the adequacy and integrity of the operational systems of the applicant; (c) the prospects for the profitable operation of the business; (d) the transparency of the legal, operational, managerial, governance and ownership structures; and (e) the character and experience of the directors, shareholders, beneficial owners or persons proposing to be concerned in the management of the business. (4) The Bank shall, after the commencement of this Act, reserve a licence for citizens, or a citizen-owned company which has a minimum of 60 per cent of its shares held by citizens. (5) Subsection (4) shall not apply to a credit bureau licensed before the commencement of this Act. (6) The following entities shall not operate a credit bureau or apply for a credit bureau licence — (a) a Bank licensed under the Banking Act; (b) the National Development Bank established under the National Development Bank Act; (c) the Botswana Savings Bank established under the Botswana Savings Bank Act; Access to Register Operating credit bureau without licence Application for credit bureau licence

A.71 (d) a non-bank financial institution regulated under the Non-Bank Financial Institutions Regulatory Authority Act; (e) a debt collection agency; and (f) any other data provider as may be designated by the Bank. 8. (1) The Bank shall, where the applicant meets the requirements of this Act, within three months of the receipt of the application for a credit bureau licence under section 7, issue the applicant with a credit bureau licence. (2) A licence issued under subsection (1) shall authorise the holder of the licence to — (a) obtain and receive consumer information; (b) process, store, update, manage and disseminate the information of data subjects in accordance with this Act; (c) compile and maintain files of information on data subjects from which credit reports shall be generated; (d) develop a credit rating system; (e) provide information to the public relating to its activities; (f) carry out market and statistical research relating to matters set out in this Act; and (g) carry out any other activity as may be prescribed. (3) A licence issued under this section shall be subject to the terms and conditions attached to that licence. (4) A licence issued under this section shall be subject to the payment of an annual prescribed fee and to compliance, by the licensed credit bureau, with the conditions of the licence and this Act. (5) A credit bureau shall not provide or offer to provide services in breach of the terms and conditions of its licence. 9. A licence issued under this Act shall be valid for such period as shall be stipulated in the licence. 10.  The Bank may, upon receipt of an application of a licensee in the prescribed manner and form, vary the terms and conditions of a licence as specified by the Bank. 11. (1) The Bank shall, within three months of receipt of an application for a credit bureau licence under section 7, reject an application by an applicant to operate a credit bureau if the — (a) activity or business to be carried out by the applicant contravenes any law; (b) applicant submits false information in relation to the application; (c) applicant fails to comply with the requirements of this Act; (d) applicant has made a false or misleading statement, with respect to any matter that the Bank considers material, in an application or in any of the information or material submitted to the Bank in support of an application; (e) applicant directly or indirectly holds a controlling interest or share in a debt collection agency or another credit bureau; or (f) issuance of the licence is not in the public interest. Issuance of licence Validity of licence Variation of licence Rejection of application

A.72 (2) The Bank shall, where the Bank rejects an application for a licence, inform the applicant, in writing, and give reasons for the rejection. 12. (1) Where a licensed credit bureau decides to cease operations, it shall notify the Bank, in writing, and shall agree with the Bank the terms and conditions of the surrender of the licence. (2) Where a credit bureau surrenders its licence in accordance with subsection (1), the licence shall be revoked and the credit bureau shall cease to operate. 13. (1) A licence issued under section 8 shall not be transferable. (2) Notwithstanding subsection (1), a licence may be transferable where there is amalgamation or other corporate restructuring, subject to the approval of the Bank. 14. (1) The Bank may suspend or revoke a licence issued under this Act if the licensed credit bureau — (a) obtained the licence by submission of false information; (b) contravenes this Act, any terms and conditions of the licence or any other law; (c) fails to comply with a decision or rules made by the Bank; (d) enters into bankruptcy or takes any action for the winding up or dissolution of the company; (e) enters into any arrangement, other than for purposes of amalgamation or corporate restructuring; or (f) is the subject of an order that is made by a court for its compulsory winding-up or dissolution. (2) The Bank shall, before suspending or revoking a licence in accordance with subsection (1), notify the credit bureau, in writing, of such an intention and — (a) give the reasons for the intended suspension or revocation; and (b) require the credit bureau to show cause, within a period not exceeding 30 days from the date of receipt of the notification, why the licence should not be suspended or revoked. (3) The Bank shall not suspend or revoke a licence under this section if the credit bureau takes remedial measures, to the satisfaction of the Bank, within the period referred to in subsection (2) (b). (4) The Bank shall, where the Bank suspends or revokes a licence, in accordance with this section, publish in the Gazette and a daily newspaper of general circulation in Botswana, details of the suspension or revocation of licence, as the case may be. 15. (1) A credit bureau whose licence has been revoked, in accordance with section 14, shall, within a period determined by the Bank, hand over all consumer information within its possession to the Bank. (2) The Bank may, on receipt of the consumer information referred to in subsection (1), keep the information in the Register. (3) A person who contravenes subsection (1) commits an offence and is liable to a fine not exceeding P250 000 or to imprisonment for a term not exceeding five years, or to both. Surrender of licence Transfer of licence Suspension and revocation of licence Handling of consumer information after revocation of licence

A.73 PART III — Governance, Regulation and Supervision of Credit Bureaus 16.  (1) A person shall not acquire shares or a beneficial interest in a credit bureau without the prior written approval of the Bank. (2)  A person shall not acquire a beneficial interest in a credit bureau if that person is a debt collection agency, a data provider regulated under the Banking Act, National Development Bank Act, Botswana Savings Bank Act, Non-Bank Financial Institutions Regulatory Authority Act or that person’s significant shareholder. (3) A person who contravenes this section commits an offence and is liable to a fine not exceeding P250 000 or to imprisonment for a term not exceeding five years, or to both. 17. (1) A person who owns a credit bureau shall not own any share in another credit bureau, or hold any shares in a credit bureau as a nominee: Provided that such a person may, with the prior written approval of the Bank, merge or acquire another credit bureau. (2) A person who contravenes this section commits an offence and is liable to a fine not exceeding P150 000 or to imprisonment for a term not exceeding three years, or to both. 18. (1) A credit bureau shall have a board of directors, with a majority of its members being non-executive members. (2) A person shall not be appointed as a member of the board of directors of a credit bureau without the prior written approval of the Bank. (3) A person shall not be appointed as a member of the board of directors of a credit bureau if the person is a member of a board of a data provider under this Act or another credit bureau. (4) Where a director of the board or a member of the senior management of a credit bureau ceases to hold office, the credit bureau shall, within 14 days of such cessation, notify the Bank, in writing, of the cessation and reasons therefor. 19. (1) A person shall not qualify for appointment as a director of the board or a senior manager of a credit bureau if that person — (a) has failed fit and proper test as determined by the Bank; (b) has been found to be physically or mentally incapable of performing his or her duties efficiently, and a medical doctor has issued a certificate to that effect; (c) has been adjudged or otherwise declared bankrupt and has not been discharged; (d) has been convicted of an offence involving fraud, forgery or uttering a false statement; (e) is serving a suspension or has been removed from office as specified in this Act; (f) has — (i) an adverse listing with any credit bureau, Beneficial interest and control of credit bureau Owning shares in another credit bureau Appointment of credit bureau board of directors Disqualification for appointment as director or senior manager of credit bureau

A.74 (ii) been a director of the board or senior manager of a company which has been adjudged insolvent in accordance with the Insolvency Act, or (iii) entered into any arrangement with creditors or taken any other action with similar effect in Botswana or elsewhere; or (g) has been removed from office due to misconduct, abuse of office or corruption. (2) For purposes of subsection (1) (g),“misconduct” includes any act done without reasonable cause by a director or senior manager which — (a) amounts to a failure to perform in a proper manner any duty imposed on the director or senior manager as such; (b) is prejudicial to the efficient carrying out of the functions of a credit bureau; or (c) tends to bring a credit bureau into disrepute. (3) The Bank may direct a credit bureau to suspend, remove or take any other action against a member of a board of directors or senior management in order to enforce the provision of this Act. (4) A person who contravenes subsection (1), commits an offence and is liable to a fine not exceeding P150 000 or to imprisonment for a term not exceeding three years, or to both. 20. (1) A credit bureau shall not collect consumer information on a data subject unless the information is collected for a purpose directly related to an activity authorised under the licence. (2) A person who contravenes subsection (1) commits an offence and is liable to a fine not exceeding P150 000 or to imprisonment for a term not exceeding three years, or to both. 21. (1) A credit bureau shall not disclose consumer information to a person unless — (a) with the written consent of the data subject, where required in terms of this Act; (b) the disclosure is in accordance with any other law or an order of a court; (c) the Bank, in carrying out its functions in accordance with this Act, orders the disclosure of such information; or (d) the disclosure is intended to safeguard the integrity of a credit market. (2) A person who contravenes subsection (1) commits an offence and is liable to a fine not exceeding P150 000 or to imprisonment for a term not exceeding three years, or to both. 22.  A credit bureau shall, when processing consumer information, put measures in place to protect consumer information from loss, misuse, unauthorised access, unauthorised disclosure, alteration, deletion or destruction by — (a) developing written policies and procedures to be followed by its employees, agents and contractors; (b) imposing access authentication controls; Collection of information on data subjects Disclosure of consumer information Security of consumer information Cap. 42:02

A.75 (c) providing information and training to its employees so as to ensure compliance with policies, procedures and controls; (d) ensuring that a subscriber agreement is entered into with the subscriber, before information is disclosed; (e) taking appropriate and immediate action where a security breach is identified; (f) periodically reviewing policies, procedures and controls; (g) maintaining an access log; and (h) imposing any other measures as may be necessary to secure the information. 23.  A credit bureau shall retain consumer information on a data subject, maintained on its database, for a period of at least 20 years from — (a) final loan repayment; (b) a credit being written off; (c) a declaration of bankruptcy; or (d) discharge from bankruptcy. 24. (1) A credit bureau shall, before disseminating consumer information, take necessary steps to ensure that the consumer information is, in relation to the users of the information — (a) accurate; (b) complete; (c) relevant; (d) up to date; and (e) not misleading. (2) A credit bureau shall, when undertaking a comparison of consumer information within its possession with any other consumer information, for the purpose of producing or verifying information on a data subject, take reasonable steps to avoid the incorrect comparison of such information with other information. 25. (1) A credit bureau shall, notwithstanding any other law on data privacy or confidentiality of consumer information, provide a credit report — (a) to a person who intends to use the information — (i) to assess the affordability of a proposed amount of credit and related repayment terms and conditions by a data subject, (ii) in connection with the extension of credit to a data subject or the purchase or collection of a debt of a data subject, (iii) in connection with the entering into, or renewal of a tenancy agreement involving a data subject, (iv) for employment purposes, in relation to a data subject, (v) in connection with the underwriting of insurance involving a data subject, (vi) to determine the eligibility of a data subject in accordance with any other written law, (vii) in connection with a credit transaction involving the data subject not covered by subparagraphs (i) to (vi), or (viii) for purposes of updating information in a credit report previously provided by a credit bureau; Retention period of consumer information by credit bureau Credibility of consumer information Credit report

A.76 (b) to a law enforcement officer for purposes of, conducting an investigation into fraud, corruption or theft; (c) for purposes of fraud detection and fraud prevention services; (d) in response to a court order; (e) for an assessment of the debtor’s book of a business for purposes of — (i) the sale of the business or debtors book of that business, or (ii) any other transaction that is dependent upon determining the value of the business or debtors book of that business; (f) for tracing a data subject by a data provider in respect of a financial transaction entered into between a data subject and a data provider; (g) for developing a scoring system by a data provider or credit bureau; (h) in accordance with a written request from the data subject to whom the information relates; (i) in response to an order made by the Bank as provided in this Act; or (j) for any other purposes that may be prescribed. (2) Notwithstanding subsection (1), a credit bureau may provide information identifying a data subject, limited to the data subject’s name, address, former addresses and former places of employment to — (a) a Government agency; (b) a law enforcement officer, in the course of the officer’s duty; or (c) an appropriate authority. (3) The form and content of a credit report shall be as may be prescribed. 26.  A credit bureau shall not include any of the following in a credit report — (a) any information that does not record the name and address of the source of the information; (b) any information on the bankruptcy of a data subject which is more than ten years from the date on which the data subject was discharged; (c) any information relating to a court judgment against a data subject which is more than two years from the date such judgment was rendered, unless the judgment creditor or the creditor’s agent confirms that the judgment amount remains unpaid, and such confirmation is on record; (d) any information regarding a debt, five years after the final payment of such debt or if no payment is made, five years after a data subject incurred such debt; (e) any information regarding an administrative fine, three years after payment of such fine or if no payment is made, five years after the fine was incurred; (f) any information given orally, unless the content of the oral report is reduced into writing; Information to be excluded from credit report

A.77 (g) any information regarding the state of health, race, creed, colour, ancestry, ethnic origin, religion, or political affiliation of a data subject; (h) any criminal record, except in relation to fraud and other similar offences; (i) any information which is not stored in a form capable of being reproduced; and (j) a debt that has been prescribed in terms of the Prescriptions Act. 27.  (1) Where the Bank finds that the information contained in a database of a credit bureau is inaccurate, incomplete, outdated or does not comply with this Act, the Bank may make an order — (a) directing the credit bureau to amend or delete the information; or (b) restricting or prohibiting the credit bureau from using the information. (2) The Bank may make an order directing a credit bureau to provide notice of any amendment, deletion, restriction or prohibition specified under subsection (1) to a person who has received a credit report. 28. (1) The Bank may inspect a credit bureau’s records or documents, whether in electronic form or otherwise, including the inspection of the bank accounts and financial transactions of a credit bureau, for the purposes of ascertaining compliance with this Act, or the terms and conditions of a licence. (2) The Bank may appoint an inspector to conduct the inspection under subsection (1). (3) An inspector may — (a) enter the premises of a credit bureau; (b) require a credit bureau or any person who may be in possession of any record or document referred to in subsection (1), to produce it for the purposes of the inspection; (c) make inquiries of any other person who may be reasonably believed to have information relating to any record or document referred to in subsection (1), concerning a transaction or activity which was undertaken in the course of, or which may affect, the business conducted by a credit bureau; and (d) inspect and make copies of, or take extracts from, and where necessary, take possession of the documents referred to in subsection (1). (4) A credit bureau shall allow an inspector access to any record or document for purposes of an inspection and produce, to the inspector, any record or document that the inspector may require. (5) An inspector shall be allowed access to the premises of a credit bureau or inspection of any other person provided under subsection (3) upon producing an inspector’s identity card issued by the Bank. (6) A person who, without reasonable excuse, fails to comply with a request made in accordance with this section, commits an offence and is liable to a fine not exceeding P250 000, or to imprisonment for a term not exceeding five years, or to both. Inspection of records or documents Cap. 13:01 Bank’s order on inaccurate, incomplete or outdated information

A.78 29. (1) The Bank may take supervisory action against a credit bureau where the credit bureau — (a) fails to comply with an order or directive of the Bank made in accordance with this Act; (b) refuses to permit an inspection or obstructs an investigation provided for in this Act; (c) is found to be undertaking its business in a manner which compromises the safety of data and is in breach of any other law; or (d) is unable or is unlikely to continue its operations in the ordinary course of business. (2) The supervisory action the Bank may take, as provided in subsection (1), without prejudice to any other course of action or penalties provided for in this Act, includes — (a) appointing a suitably qualified person to manage the affairs of the credit bureau, for such a period as the Bank considers necessary; (b) removing or suspending, from office, any director of the board, senior management officer or other employee of the credit bureau, and requiring the credit bureau to reconstitute its board of directors within a period the Bank may specify; (c) varying the authorised activities under licence of the credit bureau; (d) suspending the licence of the credit bureau under section 14 for a period not exceeding six months; (e) revoking the licence of the credit bureau under section 14; or (f) imposing any other sanction as the Bank may consider appropriate. 30.  A credit bureau shall — (a) establish and make available, in writing, the procedure for dealing with complaints made by a person to the credit bureau; (b) designate a person to be a customer service officer responsible for implementing and administering the procedure referred to in paragraph (a); and (c) establish and maintain, for such a period as the Bank may specify, a record stating the complaints received and when and how they were dealt with. PART IV — Obligations of Data Providers and Data Users 31. (1) A data provider shall provide consumer information to a credit bureau insuch a form as may be prescribed. (2) Notwithstanding the generality of the subsection (1), a data provider shall — Complaints procedure Obligations of data provider Supervisory action

A.79 (a) provide all positive and adverse consumer information in respect of a data subject; (b) prior to providing adverse consumer information under paragraph (a), give notice, in writing, to the concerned data subject of its intention to provide such adverse information; (c) ensure that the information is provided in a manner that secures the integrity of the information, by taking reasonable appropriate, technical and organisational measures to prevent — (i) loss of damage to or unauthorised destruction of consumer information, and (ii) unauthorised access to or processing of consumer information; (d) take reasonable steps to ensure the information is accurate, complete, relevant, up to date and not misleading; (e) in providing consumer information, have due regard to the information security measures put in place by the recipient credit bureau; and (f) upon discovering any inaccuracy or incompleteness in the data provided to a credit bureau, within 14 days, amend the data and inform a credit bureau of the inaccuracy or incompleteness of the data and the amendments made to such data. (3) A credit bureau which is informed by a data provider under subsection (2) (f) shall, within five days of being informed, make the necessary amendments to such data. (4) A data provider shall be held responsible for any errors or inaccuracies in the consumer information submitted to the credit bureau. (5) A credit bureau shall keep a record of information that has been amended by a data provider under this section. (6) A data provider who contravenes this section commits an offence and is liable to a fine not exceeding P150 000 or to imprisonment for a term not exceeding three years, or to both. 32. A person who accesses and uses consumer information shall protect the confidentiality of the information and shall ensure that — (a) the information is accessed and used for purposes set out in this Act; (b) the information is not used unfairly to discriminate against a data subject or prospective data subject; and (c) the consent of a data subject is obtained, where consent is required in terms of this Act. 33. (1) Subject to the provisions of section 32, a data provider shall, prior to extending credit, take reasonable steps to assess a data subject’s — (a) likelihood of satisfying, in a timely manner, the debt obligation under the agreement in terms of which credit is extended by considering a data subject’s debt repayment history; and (b) ability to satisfy, in a timely manner, the debt obligation under the agreement in terms of which credit is extended, by considering a data subject’s financial means, prospects and obligations. Obligations of data user Assessment of risk and affordability by data provider

A.80 (2) A data provider shall access consumer information from a credit bureau for purposes of meeting its assessment obligations under subsection (1). (3) A data provider who contravenes this section commits an offence and is liable to a fine not exceeding P150 000 or to imprisonment for a term not exceeding three years, or to both. PART V — Rights of Data Subjects Relating to Consumer Information   34. A data provider shall provide the following information to a data subject — (a) the contact details of any credit bureaus that collect, process and disseminate consumer information to third parties relating to the credit worthiness of a data subject; (b) the data subject’s right to check the data subject’s own credit history and to correct erroneous information; and (c) information on how to access or correct data maintained by the data provider. 35. (1) A data subject shall have the right to receive a copy of all consumer information maintained by a credit bureau relating to the data subject’s own credit history, in the form of a credit report in accordance with sections 25 and 26, which shall include — (a) a list of users that have accessed the data subject’s information in the last six months; (b) detailed information on the description of any codes used in the report, so as to enable the data subject to understand the report; and (c) the source of the information. (2) A request for a credit report made by a data subject in accordance with subsection (1) and section 25 (1) (h), shall be accompanied by a certified copy of a national registration card or passport of the data subject. (3) A credit bureau shall, within seven days of receiving a request made in accordance with this section, provide the data subject with the credit report requested. (4) Notwithstanding the provisions of subsection (3), a data subject shall have the right to obtain, free of charge, within seven days of making a request, a credit report from the credit bureau — (a) after an investigation conducted in accordance with Part VI of this Act; and (b) within 30 days of receiving a notification of adverse action referred to in section 36. (5) A credit bureau may not grant a request made in accordance with this section, if the credit bureau — (a) is not supplied with the information it requires to locate the consumer information to which the request relates; or Data provider to provide information to data subject Access to consumer information maintained by credit bureau

A.81 (b) would, by complying with the request — (i) violate a court order, or (ii) disclose confidential commercial information. (6) Where the credit bureau does not grant the request, as provided in subsection (5), it shall, not later than five days of it not granting the request, inform the data subject, in writing, and give a reason for not granting the request. 36. Where a data provider takes adverse action against a data subject based, in whole or in part, on a credit report obtained from a credit bureau, itshall, within five days of taking such action, notify the affected data subject in writing, and give a reason for the adverse action. 37. (1) A data subject shall have the right to challenge a credit bureau, in writing, on the information contained in a credit report, where a data subject is of the opinion that the information is — (a) inaccurate; (b) incomplete; or (c) outdated. (2)  Where a credit bureau is notified of a challenge, in accordance with subsection (1), the credit bureau shall — (a) within five days of receiving the notice, send to a data provider a notice accompanied by a copy of a credit report, specifying the challenged information; and (b) where the inaccuracy or incompleteness of the information is attributed to a credit bureau, conduct an investigation within 14 days of receiving the notification. (3) Where a data provider receives a notice, referred to in subsection (2) (a), the data provider shall, within 30 days of receiving the notice, conduct an investigation into the challenged information and give the credit bureau a written report advising whether the challenged information is to be deleted, corrected or maintained, as the case may be. (4) Where a data provider fails to respond to the notice within the period specified in subsection (3), the credit bureau shall remove the challenged information from its database and shall inform the Bank of its action. (5) Where a credit bureau receives a report, referred to in subsection (3), it shall, within five days of receiving the report, notify — (a) the data subject of the findings of the report; and (b) any subscriber who has, in the last 12 months, obtained a credit report from the credit bureau containing the inaccurate, incomplete or outdated information. (6) Where information that has been challenged is corrected, the credit bureau shall provide persons under subsection (5) with a free copy of the credit report that has been corrected. (7) A credit bureau shall not report consumer information that is being challenged under this Act until such challenge has been resolved. Notification of adverse action Right to challenge consumer information

A.82 PART VI — Investigation of Complaints 38. (1) The Bank may investigate a complaint — (a) on the Bank’s own initiative; or (b) on receipt of a complaint made by a complainant — (i) acting in the complainant’s own interest, (ii) that is an association acting in the interest of its members, (iii)who is a person acting on behalf of a complainant, (iv) who is a person acting on behalf, and in the interest of a group or class of persons, or (v) who is making a complaint anonymously. (2) A complaint made under subsection (1), shall be in the prescribed manner and form: Provided that this subsection shall not apply to a complaint made by a person specified in subsection (1) (b) (v). (3) The Bank shall investigate a complaint made under subsection (1) (b) within such time as may be prescribed. 39. (1) The Bank may not investigate a complaint or, having commenced an investigation, discontinue the investigation if the — (a) complaint is frivolous, vexatious or not made in good faith; (b) complainant has a right of appeal, review or remedy that has not been exhausted; (c) conduct to which the complaint relates is or has been the subject of an investigation or other action by any other appropriate authority under any other law; or (d) complaint has been withdrawn. (2) Notwithstanding subsection (1) (c), the Bank may investigate a complaint where the Bank is satisfied that the complainant has been prevented from exercising the complainant’s rights under this Act. (3) The Bank shall, where it decides not to conduct an investigation or discontinue an investigation, inform the complainant, in writing, within 10 days of its decision and give reasons for the decision. 40.  Where the Bank is of the opinion that it is in public interest to do so, it may continue an investigation initiated by a complaint despite the withdrawal by the complainant of the complaint. 41.  The Bank may, at any stage of investigating or dealing with a matter provided for in this Act, refer the matter to an appropriate authority. 42.  The Bank may, where it commences an investigation or is investigating a matter and the matter has been referred to an appropriate authority under section 41 — (a) continue to investigate or decide on the matter and share its findings with the appropriate authority concerned; (b) refer the matter to the appropriate authority concerned and request a report on the matter, once the matter has been finalised; or (c) join the appropriate authority in investigating the matter and produce a joint report. Refusal to investigate or discontinuation of investigation Continuation of investigation Referral of matter Collaboration on investigation Initiation of investigation

A.83 43. (1) The Bank shall issue an enforcement notice directing a credit bureau to carry out such steps as the Bank considers appropriate, within a specified period where, after undertaking an investigation under this Act, the Bank is of the opinion — (a) that the action which was the subject matter of the investigation is contrary to this Act or any other law, based wholly or partly on a mistake of law or fact; or (b) that — (i) the matter should be given further consideration, (ii) an omission should be rectified, (iii) a decision should be cancelled, reversed or varied, (iv) the practice on which the act, omission, decision or recommendation was based should be altered, (v) reasons should have been given for the decision, or (vi) any other steps should be taken. (2)  Where, on the expiry of the specified period in an enforcement notice under subsection (1), a credit bureau fails to comply with the enforcement notice without reasonable cause, the Bank shall make a decision to give effect to the steps specified in the enforcement notice. 44. (1) The Bank may, on its own initiative or on an application of a credit bureau, vary or cancel an enforcement notice issued under section 43. (2) Where the Bank varies or cancels an enforcement notice, as provided in subsection (1), the Bank shall immediately notify the concerned credit bureau, in writing, stating the reasons for the variation or cancellation. 45.  Where the Bank makes a decision, in accordance with this Act, the Bank shall, by notice in writing, inform the person affected by the decision of the reasons for the decision. 46.  (1) A person who is aggrieved by a decision of the Bank may, within 30 days of receipt of the notice and reasons for the decision of the Bank, appeal against the decision to the Minister. (2) The Minister may reverse the decision of the Bank only if it is proven that — (a) the Bank failed to follow the laid down procedure; (b) the Bank’s decision contravenes any provision of the Act; (c) there was no factual basis for the Bank’s decision; or (d) based on the review of the record, the Bank committed an apparent error in its assessment of facts or abused its powers. (3) The Bank shall give effect to the decision of the Minister under subsection (2). PART VII — Miscellaneous Provisions 47. (1) Subject to this section, a person may, on request, access, make copies of, or take extracts of, any document lodged with the Bank in terms of this Act. Enforcement notice Variation or cancellation of enforcement notice Reason for decision Appeals Access to documents

A.84 (2) The Bank may, by rules, specify procedures for making any request under subsection (1), and the terms and fees to be paid for such request. (3) The Bank may refuse to authorise a request under subsection (1), in whole or part, where it is satisfied that any information in the document is — (a) confidential to the person lodging the document and has a real commercial value to the person that would be seriously and unreasonably prejudiced if the information were to be made generally available; or (b) personal information about a person and it is in the public interest that the information should not be generally available. 48.  A person who destroys, falsifies, conceals or disposes of, or causes or permits the destruction, falsification, concealment or disposal of any document, which the person knows or ought to know is relevant to an inspection or investigation provided for under this Act, commits an offence and is liable to a fine not exceeding P750 000 or to imprisonment for a term not exceeding 10 years, or to both. 49. (1) Subject to subsection (2), a company carrying on a business, unless the company is licensed as a credit bureau, shall not use any name which indicates or may reasonably be understood to indicate, whether in English or another language, that the business is operating as a credit bureau or that it is conducting credit reporting business or providing credit reporting services. (2) A person shall not falsely represent to the public or any member of the public that the person is licensed to conduct any credit reporting business or provides credit reporting services. (3) A person who contravenes this section commits an offence and is liable to a fine not exceeding P100 000 or to imprisonment for a term not exceeding three years, or to both. 50. (1) Where the Bank considers that a senior manager, director of the board or shareholder, past or present, of a credit bureau, has any information relating to the operations of the credit bureau which the Bank considers necessary for the performance of its supervisory functions, the Bank may, in the prescribed manner, summon that officer, director of the board or shareholder, for an examination. (2) A person commits an offence if that person, when summoned by the Bank, in accordance with subsection (1) — (a) fails without reasonable excuse to appear before the Bank for the examination; (b) withholds information; or (c) provides information which is false. (3) A person who commits an offence under subsection (2) is liable to a fine not exceeding P150 000 or imprisonment for a term not exceeding three years, or to both. Destruction of documents Restriction on use of name indicating credit reporting business Power to summon board director, senior manager and shareholders

A.85 51. (1) Where, in the exercise of any of its powers, performance of its functions or the discharge of its duties as provided in this Act, or in accordance with any other law, the Bank requires any information from a credit reporting agency or any other person engaged in the provision of credit reporting services, a company affiliated, associated, holding or subsidiary company or any person heading a credit reporting agency, on any matter relating to the affairs or business of the credit reporting agency, person or company, the credit reporting agency, person or company, shall submit the information to the Bank. (2) A credit bureau or any entity required to furnish any information to the Bank under subsection (1) shall ensure that the document is signed by the chief executive officer of the credit bureau or by the person heading the entity, as may be prescribed. 52. (1) Where the Bank considers a publication of information to be necessary or appropriate, in the public interest, the Bank may publish, in whole or in part, such information in accordance with this Act. (2) The Bank shall not reveal to a person information relating to a customer of a data provider that was obtained in the performance of the Bank’s functions, as provided in this Act, unless lawfully required to do so. 53. No matter or thing done or omitted to be done by a senior management officer, agent, or employee of the Bank, in the exercise or performance of any power or function in accordance with this Act, shall, if the matter or thing is done or omitted to be done bona fide, render that officer, agent or employee personally liable to an action, claim or demand. 54.  (1) Consumer information may be processed by a credit bureau in a foreign country and then returned to Botswana, provided the recipient credit bureau is registered in terms of this Act and complies with the provision of this Act. (2) Notwithstanding the provisions of subsection (1), consumer information shall not be transferred to a third party who is in a foreign country unless — (a) the recipient of the information is subject to a law, binding code of conduct or contract that — (i) effectively upholds the international information protection principles for the processing of personal information, and (ii) contains a provision substantially similar to this section relating to transfer of information from the recipient to third parties in foreign countries; and (b) the data subject consents in writing to the transfer of the information. (3) Subject to the provisions of subsections (1) and (2), the transfer of consumer information shall be subject to the approval of the Bank. Indemnity of senior management officer, agent, etc. Cross-border consumer information sharing Submission of information and documents to Bank Publication of information

A.86 55.  A person who contravenes a provision of this Act, for which no penalty is specifically provided, commits an offence and is liable to a fine not exceeding P200 000 or to imprisonment for a term not exceeding four years, or to both. 56. Where the Bank is satisfied, after due investigation, or where a person admits that the person has committed an offence in accordance with this Act or regulations or rules made in accordance with this Act, the Bank may impose such administrative penalties as may be determined by it. 57. (1) The Bank may make rules for, or with respect to any matter that by this Act is required by the Bank, for purposes of carrying out or giving effect to this Act. (2) Without prejudice to the generality of subsection (1), the rules made under this section may make provision for — (a) the conduct of business by credit bureaus and their representatives; (b) matters incidental to the licensing of any credit bureaus in accordance with this Act; (c) the class of persons in relation to whom, and the manner and circumstances in which, credit bureaus may conduct or provide credit reporting services; (d) the correction of any errors in any register or record kept in accordance with this Act; (e) the administrative penalties to be imposed; (f) the types of business that the Bank considers as constituting credit reporting activities; (g) the maintenance of the confidentiality of data subject information by credit bureaus; (h) the type of information and the matters to be displayed on business stationery of credit bureaus; (i) the practice and conduct of share registers and other registers that are to be kept by credit bureaus in accordance with this Act; (j) the formulation and publication of codes of conduct for credit bureaus; (k) the requirement for credit bureaus to make reports to the Bank, either regularly or on the occurrence of specified events or circumstances; (l) the requirement for the publication and dissemination of reports to the Bank by credit bureaus, officers and former officers of credit bureaus; and (m) the determination of fit and proper test under section 19 (1) (a).   58. (1) The Minister may, in consultation with the Bank, make regulations for the better carrying out of the provisions of this Act and for any other matter required or permitted to be prescribed under this Act. Regulations General penalty Administrative penalties Rules

A.87 (2) Without prejudice to the generality of subsection (1), regulations made in accordance with subsection (1) may — (a) prescribe fees or charges payable in respect of any matter arising under, provided for, or authorised by, this Act; (b) prescribe the forms for applications, licences, approvals, registers, notices, orders and other documents required for the purposes of this Act; (c) prescribe the information to be given in returns and other documents delivered or made for the purposes of this Act; (d) provide the procedure for the service of notices, orders and documents as specified in this Act and the times at which they shall be taken to have been served; and (e) prescribe the procedure for complaints, for purposes of this Act, and the making, consideration, hearing and determination of complaints. 59. (1) Notwithstanding any other provision of this Act, any person, who at the commencement of this Act, is carrying out any acts, duties or operations, affected by this Act, shall, within 12 months from the date of the commencement of this Act, comply with the requirements of this Act or cease to carry out such acts, duties or operations. (2) A person who does not comply with subsection (1) commits an offence and is liable to the penalties set out under section 55. PASSED by the National Assembly this 31st day of August, 2021. BARBARA N. DITHAPO, Clerk of the National Assembly. Transitional provisions