Fair Credit Reporting Act, 2021

FAIR CREDIT REPORTING ACT, 2021-31
Arrangement of Sections
PART 1
PRELIMINARY
Short title
Interpretation
PART II
ADMINISTRATION
Powers, duties and functions of Central Bank
PART III
LICENSING
Credit bureau to be licensed
Application for licence
Grant of licence
Refusal to grant licence
Terms and conditions of licence
Variation of licence, terms and conditions 1.
2.
3.
4.
5.
6.
7.
8.
9.
29th December, 2021
2021-31

Restrictions on the transfer of licence Duration of licence Revocation Material change in circumstances affecting the credit bureau Publication by the Central Bank
PART IV
CREDIT REPORTING ACTIVITY
Permissible credit reporting activities Credit information providers Provision of credit information Duties of credit information providers Credit reports Permissible purposes The requirement for consent Restrictions regarding disclosure of data subject information Supplying false information Subscriber agreements Data management and quality control 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 2 FAIR CREDIT REPORTING ACT, 2021-31

Security and control measures
Data subject’s rights of access and correction Adverse actions against data subjects Cross-border credit reporting
PART V
SUPERVISION BY THE CENTRAL BANK
Information gathering powers of the Central Bank Inspections Warrants Costs of inspections Auditors and annual reports
PART VI
MISCELLANEOUS
Determination of disputes
Civil liability for negligent non-compliance Agreement with another regulatory authority Confidentiality and restrictions regarding access to information Limitation on prosecution 26. 27. 28. 29. 30. 31. 32. 33. 34. 35. 36. 37. 38. 39. FAIR CREDIT REPORTING ACT, 2021-31 3

Penalties
Fixed penalty
Immunity
Protection of databases upon liquidation Application of Data Protection Act, 2019 (Act 2019-29) Regulations Transitional provisions Commencement 40. 41. 42. 43. 44. 45. 46. 47. 4 FAIR CREDIT REPORTING ACT, 2021-31

BARBADOS
I assent
S. MASON
President of Barbados
24th December, 2021.
2021-31
An Act to provide for a credit reporting system in Barbados that is fair, for the regulation of the use of data collected and for related purposes. [Commencement: by Proclamation] ENACTED by the Parliament of Barbados as follows:
FAIR CREDIT REPORTING ACT, 2021-31 5

PART 1
PRELIMINARY
Short title
This Act may be cited as the Fair Credit Reporting Act, 2021. Interpretation In this Act, “adverse action” means a decision taken by a credit information provider, based on the data subject’s information from the credit bureau, that adversely affects a data subject, including the refusal of an application for credit; an increase in the interest rate on a loan or other credit facility; a decrease in the credit limit on a revolving credit facility; the cancellation, freezing or suspension of a loan or other credit account; the refusal of business or employment; an unfavourable change in terms of coverage and the amount of any credit or insurance, existing or applied for in connection with underwriting credit or insurance, on the part of the data subject or the request for a guarantor or collateral; or any other action that adversely affects a transaction between the data subject and the credit provider; “applicant” means a person applying for a licence under section 5; “authorized person” means a credit bureau; or 1. 2. (a) (b) (c) (d) (e) (f) (g) (a) 6 FAIR CREDIT REPORTING ACT, 2021-31

a person authorized by the Central Bank to perform an activity set out in section 16; “Caribbean Community” has the meaning assigned to it by section 2 of the Caribbean Community Act, Cap. 15 and includes The Bahamas; “Central Bank” means the Central Bank of Barbados established by section 3 of the Central Bank of Barbados Act, 2020 (Act 2020-30); “company” means a body incorporated, continued or registered under the Companies Act, Cap. 308; “credit” means any transaction the terms of which provide for payment to be made at a future date in respect of money lent or money payable in relation to goods, services, real property sold or leased or any other financial arrangement between the data subject and a third party; and includes any money payable pursuant to an order of court. “credit bureau” means a person licensed under section 6 to prepare, produce or provide credit reports, credit scores, credit references and other value-added products; “credit file” means in relation to a data subject, a file in electronic form or otherwise containing the data subject’s information and other records collected, kept, maintained or otherwise processed by a credit bureau with respect to a data subject from which a credit report is prepared or produced; “credit information” means any positive or negative information bearing on a data subject’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living, including the history or profile of the data subject with regard to credit, assets or financial obligations; “credit information provider” means a person specified in section 16 that gives credit information on a data subject to a credit bureau; (b) (a) (b) FAIR CREDIT REPORTING ACT, 2021-31 7

“credit report” in relation to a data subject, means credit information processed by a credit bureau, whether in electronic form or otherwise; “credit reporting system” includes the institutions, individuals, rules, procedures, standards and technology that enables information flow relevant to making decisions for any purpose mentioned in section 20; “credit scoring” means a statistical analysis with the goal of estimating the probability of a data subject fulfilling its financial obligations related to the extension of credit; “cross-border” means the transfer of information electronically or otherwise from the country of origin to the target country; “data” means information that is being processed by means of equipment operating automatically in response to instructions given for that purpose; is recorded with the intention that it should be processed by means of such equipment; is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system; does not fall within paragraph (a), (b) or (c) but forms part of an accessible record; or does not fall within paragraph (a), (b), (c) or (d) but is recorded information held by a public authority; “data base” means a collection of credit information administered by a credit bureau or a credit information provider, which is stored electronically or otherwise; “data breach” means any act or omission leading to the accidental loss, alteration, unauthorized disclosure or access to credit information; “data subject” means any individual who, or partnership, corporation, trust, estate, cooperative, association, government or ministry or state-owned (a) (b) (c) (d) (e) 8 FAIR CREDIT REPORTING ACT, 2021-31

enterprise or agency, or other entity which, is the subject of personal information that may be or has been furnished to or by a credit bureau. “data subject information” includes any information relating to the credit information or personal information of a data subject, whether such information is obtained from the data subject, a third party or a specified public register, that may be processed under this Act; “director” means, in relation to a credit bureau, a member of its board of directors; “inspector” means a person appointed by the Central Bank under section 31; “licence” means a licence granted under section 6 to carry on business as a credit bureau; “licensee” means a credit bureau which is licensed under this Act; “loan” includes direct, indirect or contingent obligations incurred by a person with a third party; a discount, advance or overdraft; export bills or other bills purchased or receivable; import bills or data subject’s liabilities on off-balance sheet items; or any other credit facilities extended to a data subject by a credit provider; “manager” in relation to a credit bureau includes the chief executive officer, chief financial officer, treasurer, chief internal auditor and the manager of a significant unit of the credit bureau; “material change in circumstances” means, in relation to a credit bureau, a change in circumstances set out in this Act or prescribed by the regulations; “Minister” means the Minister responsible for Finance; (a) (b) (c) (d) (e) FAIR CREDIT REPORTING ACT, 2021-31 9

“negative credit information” includes, in relation to a credit transaction between a data subject and a credit information provider, credit defaults, collections and late payments; accounts compulsorily closed other than for administrative reasons; voluntary or mandatory surrender of assets; convictions involving financial impropriety, fraud or theft; receiverships, bankruptcies and liquidations; liens; garnishment or any other order of court; and any other act or information which could cause a credit application or existing credit to be declined or restricted according to a creditor’s policy relating to the overdue, past due, charge off, or delinquent status of the credit transaction between a data subject and a credit provider; “personal information” means any information about a data subject that may be used to identify a data subject, including credit information; a data subject’s present and past names; a data subject’s current contact information; the national registration number, tax identification number or other numerical reference or reference scheme used in relation to a data subject for identification purposes; and any other relevant information about a data subject which is reasonably required in order to enable the credit information to be utilized for the purposes of this Act; or (a) (b) (c) (d) (e) (f) (g) (h) (a) (b) (c) (d) (e) (i) 10 FAIR CREDIT REPORTING ACT, 2021-31

in the possession of or is likely to come into the possession of the credit information provider or a credit bureau; “positive credit information” means any information relating to the historical status of a credit transaction between a data subject and a credit provider, including the date an account was opened; the date of the last payment; credit approval terms and conditions on which credit was granted; the payments made; the current balance; repayment patterns; utilization of credit and any collateral pledged; or any other act or information which could cause a credit application to be approved; “process” means to collect, record, hold or store data subject information or data; to carry out an operation or set of operations on data subject information or data including its organization, adaptation, alteration or updating; retrieval, consultation or use; disclosure by transmission, transfer, dissemination or being otherwise made available; alignment, combination, correction, erasure; or destruction; (ii) (a) (b) (c) (d) (e) (f) (g) (h) (a) (b) (i) (ii) (iii) (iv) (v) FAIR CREDIT REPORTING ACT, 2021-31 11

“public information” means any information subject to disclosure to the general public according to the laws of any country; “record” means, in relation to a credit bureau, a book, paper, file, document in electronic form or otherwise, that may contain information regarding the finances or business of the credit bureau; “sensitive personal information” means personal information on a data subject’s racial or ethnic origin; political opinions; religious beliefs or other beliefs of a similar nature; membership of a political body; membership of a trade union; genetic data; biometric data; sexual orientation or sex life; physical or mental health or condition; or criminal record; “subscriber” means a credit information provider or other person that has entered into a subscriber agreement to provide or access credit information; “subscriber agreement” means an agreement referred to in section 24(1) between a credit bureau and a subscriber whereby the subscriber furnishes data subject information to the credit bureau in an agreed format; “Tribunal” means such tribunal as may be established by an Act for the purpose of determining disputes under this Act; “user” means any person or entity other than a subscriber that has access to a credit bureau’s products and services; (a) (b) (c) (d) (e) (f) (g) (h) (i) (j) 12 FAIR CREDIT REPORTING ACT, 2021-31

“value-added product” means any product or service based on the data or information provided by credit information providers and any other data lawfully obtained by a credit bureau which the credit bureau may, in addition to credit reporting, provide to increase the value of the service it offers, including alert, anti-fraud, credit scoring and identity theft prevention.
PART II
ADMINISTRATION
Powers, duties and functions of Central Bank The Central Bank shall be responsible for the overall management of this Act; and the day to day administration, supervision and implementation of this Act and the regulations. Without prejudice to the generality of subsection (1), the Central Bank shall regulate and supervise the activities of credit bureaux; issue standards and targets regarding the provision of fair credit reporting services; institute proper standards of conduct and acceptable credit reporting practices; protect the integrity of the credit reporting system in Barbados against abuses; and take measures to protect the rights and interests of data subjects. In the exercise of its duties and functions under subsections (1) and (2), the Central Bank may grant licences to credit bureaux; 3.(1) (a) (b) (2) (a) (b) (c) (d) (e) (3) (a) FAIR CREDIT REPORTING ACT, 2021-31 13

in accordance with this Act and the regulations; evaluate every application for a licence to operate or carry on the business of a credit bureau; issue guidelines for operating a credit bureau; inspect the premises, systems and operations of a credit bureau; exercise such other duties and functions as may be conferred upon or assigned to the Central Bank by or under this Act; and impose any sanction set out in subsection (4). The sanctions that the Central Bank may impose under subsection (3)(e) are a warning or reprimand; a monetary penalty not exceeding $100 000; suspension or revocation of the licence; or the giving of a directive that the Central Bank deems appropriate.
PART III
LICENSING
Credit bureau to be licensed
No person shall operate as or carry on the business of a credit bureau; or use or continue to use words implying that the person is a credit bureau in the description or title pursuant to which such person is carrying on business, unless such person is licensed under this Act. (b) (i) (ii) (iii) (c) (d) (4) (a) (b) (c) (d) 4.(1) (a) (b) 14 FAIR CREDIT REPORTING ACT, 2021-31

Any person who contravenes subsection (1) is guilty of an offence and is liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both. In the prosecution of a person for an offence under this section, evidence that the accused person provided credit information to another person with the knowledge that such information is being relied on by the recipient to make a decision pertaining to the credit of another is proof in the absence of evidence to the contrary, that the accused person operated as or carried on the business of a credit bureau under this Act. Application for licence An application for the grant of a licence to carry on the business of a credit bureau shall be submitted to the Central Bank in the prescribed form and shall include a copy of its articles, by-laws or other instrument under which the company is incorporated or organized; an address for service in Barbados; a statement of the address of the applicant’s registered office and the location of the principal and other places where it proposes to do business in Barbados; the prescribed application fee which is non-refundable; and any other document or information that the Central Bank may require. Where the Central Bank is not satisfied with the adequacy of any information submitted by the applicant under subsection (1), the Central Bank may request such further information including, the incorporation and ownership structure of the applicant; the nature and sufficiency of the financial resources of the applicant’s shareholders to provide continuing financial support for the applicant; (2) (3) 5.(1) (a) (b) (c) (d) (e) (2) (a) (b) FAIR CREDIT REPORTING ACT, 2021-31 15

the nature of any activity regulated under this Act or the regulations that the applicant conducts or seeks authorization to conduct; the soundness and feasibility of the business plan of the applicant; the adequacy of the systems and arrangements that have been put in place by the applicant to ensure compliance with the provisions of this Act; whether the overall design and flexibility of the data collection mechanism for data subject information conforms to relevant provisions of this Act and the regulations; any information needed to minimise the extent to which it is possible for the business carried on by the applicant to be used for a purpose connected with financial crime; and the qualifications, experience and integrity of the proposed directors, officers and significant shareholders and whether they are fit and proper persons to operate or, as the case may be, hold shares in a credit bureau. For the purposes of this section, a “significant shareholder” is a person who holds 10 percent of any class of shares of the company. Grant of licence The Central Bank may, after consideration of an application made under section 5, grant a licence to the applicant subject to such terms and conditions as the Central Bank thinks fit where it is satisfied with respect to the matters referred to in section 5; and the applicant has paid the prescribed licence fee. The Central Bank shall advise the Minister in writing of its decision to grant a licence under this section. (c) (d) (e) (f) (g) (h) (3) 6.(1) (a) (b) (2) 16 FAIR CREDIT REPORTING ACT, 2021-31

Refusal to grant licence
The Central Bank shall refuse to grant a licence where the application is not made in accordance with this Act; the Central Bank is of the opinion that the applicant has failed to satisfy the matters set out in section 5; the applicant has, with respect to a matter that it considers material, knowingly or intentionally made a false or misleading statement in the application or in the information, particulars, declarations, documents or other materials submitted to the Central Bank in support of the application; or it is not in the public interest to grant the licence. Where the Central Bank refuses to grant a licence, it shall notify the applicant in writing within 7 days of making the decision; state the reasons for its refusal; inform the applicant of his right to seek review under section 35; and inform the Minister of its decision. Terms and conditions of licence An applicant under section 5 of this Act shall within 30 days of being granted a licence, submit to the Central Bank an irrevocable guarantee from a financial institution or credit union in Barbados in such an amount as may be prescribed; within 6 months of being granted a licence, or within such further period as the Central Bank may specify, commence operations as a credit bureau; adhere to such capital requirements as the Central Bank may specify; 7.(1) (a) (b) (i) (ii) (iii) (2) (a) (b) (c) (d) 8.(1) (a) (b) (c) FAIR CREDIT REPORTING ACT, 2021-31 17

inform the Central Bank of the fees it will charge customers for its services or any change in such fees. The irrevocable guarantee referred to in paragraph (a) of section 8(1) shall be in a form determined by the Central Bank. Where credit information providers or the beneficial owners of credit information providers are permitted to acquire shares in a credit bureau the credit bureau shall restrict the aggregate share ownership in the credit bureau by such credit information providers and beneficial owners of credit information providers to a maximum of 49 per cent; and a single credit information provider or beneficial owner of such credit information provider, as the case may be, shall hold no more than 5 per cent of the shares of the credit bureau. A credit bureau shall comply with such terms and conditions as may be prescribed. Variation of licence, terms and conditions The Central Bank may at any time amend or vary the terms and conditions set out in section 8 relating to the grant of a licence. The Central Bank shall, before it amends or varies the terms and conditions of a licence, give written notice to the credit bureau of its intention to amend or vary the terms and conditions and include in the notice the reason for the intended amendment or variation; and give the credit bureau, within such time as may be specified in the notice, an opportunity to make representation on the intended amendment or variation. (d) (2) (3) (a) (b) (4) 9.(1) (2) (a) (b) 18 FAIR CREDIT REPORTING ACT, 2021-31

Restrictions on the transfer of licence A licensee shall not, without the prior written approval of the Central Bank, transfer a licence granted or reinstated pursuant to this Part; or sell, lease or transfer title to any of its credit files except to another credit bureau licensed under this Act. A licensee which contravenes or fails to comply with a provision of subsection (1) is guilty of an offence. Duration of licence A licence granted under this Act is valid for a period of one year and is renewable annually on the anniversary of the date on which it is first granted and on payment of the prescribed fee. The Minister may prescribe the fee payable on application for the grant of a licence; for the grant of a licence; for the renewal of a licence; and for the reinstatement of a licence that was revoked. Revocation Subject to subsection (2), the Central Bank may revoke a licence where there is a request in writing by the licensee for revocation of the licence; the licensee has failed to pay the annual renewal fee; the licensee has failed to comply with a term or condition specified in the licence; 10.(1) (a) (b) (2) 11.(1) (2) (a) (b) (c) (d) 12.(1) (a) (b) (c) (i) FAIR CREDIT REPORTING ACT, 2021-31 19

this Act or the regulations; a direction issued under this Act by the Central Bank; or the licensee has provided the Central Bank with false, inaccurate or misleading information; does not commence operations within 6 months after the issuance of its licence or within such longer period as the Central Bank may approve after the grant of a licence; becomes insolvent or makes an arrangement with its creditors; is found to have committed an act of fraud or dishonesty; has demonstrated incompetence or untrustworthiness in the operation of its business; has acted in a manner that has caused data subjects’ rights and interests in respect of their data to be compromised; or is carrying on business in a manner that is no longer in the interest of the public or puts the effective and efficient operation of the credit reporting system at risk. The Central Bank shall, before it revokes a licence, give the licensee one month’s notice in writing of its intention to revoke the licence; include in the notice the reason for the intended revocation; and give the credit bureau, within such time as may be specified in the notice, an opportunity to show cause why the licence should not be revoked. Where a licensee shows cause to the Central Bank pursuant to subsection (2), the Central Bank shall within one month consider the credit bureau’s case and make a determination; and (ii) (iii) (d) (i) (ii) (iii) (iv) (v) (vi) (vii) (2) (a) (b) (c) (3) (a) 20 FAIR CREDIT REPORTING ACT, 2021-31

subject to subsection (4), notify the credit bureau in writing of its determination. Where the Central Bank revokes a licence, it shall notify the licensee in writing of its decision. The Central Bank shall in the notice referred to in subsection (4) state the reasons for its decision; and inform the credit bureau of its right of review under section 35. A credit bureau shall cease to carry on business from the date specified in the notice of revocation. Notwithstanding anything contained in this section, the Central Bank may at any time revoke a licence where the licensee ceases to carry on the business of a credit bureau for a period exceeding 6 months. The Central Bank may restore a licence that has been revoked, for non-payment of the annual renewal fee, upon payment of that fee; for a cause other than non-payment of the annual renewal fee upon request of the Tribunal, after the Tribunal has conducted a review pursuant to section 35. Material change in circumstances affecting the credit bureau A licensee or an applicant shall, within 7 days, notify the Central Bank; and any other body which it is required to notify by virtue of any enactment of a material change in the circumstances affecting the operations of the licensee or the applicant. For the purposes of subsection (1) a material change includes a merger or consolidation with another credit bureau; (b) (4) (5) (a) (b) (6) (7) (8) (a) (b) 13.(1) (a) (b) (2) (a) FAIR CREDIT REPORTING ACT, 2021-31 21

a change of the name of the applicant or the licensee; an amendment of the articles of incorporation or any other constituent document under which the credit bureau is incorporated, registered or continued; engagement in any business other than that of a credit bureau; a change of majority shareholding or beneficial ownership; a change in the directors or officers of the applicant or licensee whether by death, retirement, resignation or termination; a change of the address of the registered office, head office or other place of business where the credit bureau or the applicant carries on or proposes to carry on business in Barbados and details on where the credit bureau or applicant’s data server is hosted; an event that results in a compromise of the confidentiality, security or integrity of data subject information; any civil or criminal proceedings instituted against the credit bureau or applicant, whether in Barbados or elsewhere; an event or irregularity that impedes or prevents access to or impairs the usual operations of the licensee or applicant; the credit bureau or applicant becomes or is likely to become, insolvent or unable to meet its financial, statutory, contractual or other obligations; or the occurrence of any other event that the Minister may prescribe or specify by notice in writing as a material change in circumstances. Publication by the Central Bank The Central Bank shall cause every notice of the grant, revocation or reinstatement of a licence to be published in the Official Gazette . (b) (c) (d) (e) (f) (g) (h) (i) (j) (k) (l) 14. 22 FAIR CREDIT REPORTING ACT, 2021-31

PART IV
CREDIT REPORTING ACTIVITY
Permissible credit reporting activities A credit bureau shall not engage in any activity other than an activity specified in subsection (2); or an activity approved by the Central Bank by notice published in the Official Gazette. A credit bureau may, for its own account or on behalf of an individual or a data subject, engage in the following activities:
ascertain whether a credit information provider holds information relevant to the financial standing of an individual or a data subject; develop and make credit reports, credit scores and value-added products available to subscribers or users; collect, compile, manage, and update the contents of information referred to in paragraphs (a) and (b); carry out market and statistical research on matters related to credit reports or assessments; provide, on a consistent basis, consultancy services and training regarding credit reporting, including the publication of educational material; collect, process and manage public information resulting from the enforcement of actions and judgments and declarations of bankruptcy and the insolvency of data subjects; collect, process and manage information of consumer dispute settlements; 15.(1) (a) (b) (2) (a) (b) (c) (d) (e) (f) (g) FAIR CREDIT REPORTING ACT, 2021-31 23

develop and apply credit scores and ratings as well as other systems of classification of data subjects; analyse statistics relating to credit and credit behaviour of data subjects and aggregate analyses; manage identity theft and debtor tracing; compile reports for the purposes of its business; and compile and maintain databases in respect of data subjects’ information and generate reports from such databases. Credit information providers For the purposes of this Act, the following credit information providers shall provide data subject’s information to a credit bureau:
a financial institution licensed under the Financial Institutions Act, Cap. 324A; an insurance company licensed under the Insurance Act, Cap. 310, if such information is limited to information obtained by such a company in its capacity as a credit provider; and a credit union registered under the Co-operative Societies Act, Cap. 378A. A credit information provider may engage in the following activities permitted under this Act securing the correction of or the omission of anything from or the making of any other kind of modification to credit information, if the making of such modification is fair to the data subject and does not contravene this Act; and advising a data subject with respect to the taking of any steps from credit reports or assessments generated for this purpose. (h) (i) (j) (k) (l) 16.(1) (a) (b) (c) (2) (a) (b) 24 FAIR CREDIT REPORTING ACT, 2021-31

The Central Bank may in the public interest, by notice, designate any of the following as credit information providers:
the Barbados Light and Power Company Limited continued under the Companies Act, Cap. 308; the Barbados Water Authority established under the Barbados Water Authority Act, Cap. 274A; the Corporate Affairs and Intellectual Property Office established under the Corporate Affairs and Intellectual Property Office Act;, Cap. 21A the Land Registry established under the Land Registration Act, Cap. 229; the Registration Office established under the Registration Office Act, Cap. 33; any person licensed pursuant to the Telecommunications Act, Cap. 282B; any person carrying on the business of selling goods pursuant to a hire purchase agreement, conditional sale agreement or credit sale agreement pursuant to the Hire Purchase Act, Cap. 328; a dealer in securities who is licensed under the Securities Act, Cap. 318A; the Student Revolving Loan Fund established under the Student Revolving Fund Act, Cap. 54A; and any other entity possessing credit information not referred to in subsection (1). Before the Central Bank designates an entity as a credit information provider under subsection (3), the Central Bank must be satisfied that the entity has systems in place for proper data management, security and control; and (3) (a) (b) (c) (d) (e) (f) (g) (h) (i) (j) (4) (a) FAIR CREDIT REPORTING ACT, 2021-31 25

adequate systems and arrangements have been put in place by the entity to ensure compliance with the provisions of this Act, and the Central Bank shall consult with the relevant Minister or the regulator of the entity as appropriate. Notwithstanding that an entity has not been designated under subsection (3), it may, with the consent of a data subject, and subject to subsection (7), opt to furnish data subject information to a credit bureau. Where an entity proposes to provide data subject information to a credit bureau pursuant to subsection (6), it shall submit a request to the Central Bank for approval setting out its procedures and standards for data capturing, data transmission and compliance with this Act and any proposed subscriber agreement. The Central Bank may in its own discretion opt to provide information to a credit bureau on data subjects who are its employees where such information is limited to information obtained by the Central Bank in its capacity as a credit provider. Provision of credit information A credit information provider shall, upon providing credit to a data subject or entering into a credit or loan agreement with a data subject, furnish a credit bureau with information relating to the data subject from the date of the provision of the credit to the data subject; and within the time specified in the subscriber agreement with the credit bureau. Duties of credit information providers A credit information provider shall provide any information required to be furnished to a credit bureau in the standard data format specified by the Central Bank; (b) (5) (6) (7) 17. (a) (b) 18.(1) (a) 26 FAIR CREDIT REPORTING ACT, 2021-31

upon receipt of any new credit information about the data subject, furnish the information to the credit bureau within the time specified in the applicable subscriber agreement; ensure the timely, sufficient and accurate provision of credit information to a credit bureau; and comply with the security standards and measures prescribed in respect of the data subject’s credit information it keeps and maintains, including taking all necessary actions prescribed in this Act or the regulations in order to protect the information. Notwithstanding the provisions of subsection (1)(c), a credit information provider shall provide information monthly to a credit bureau on the status of the performance of the obligations of the data subject under a credit or loan agreement. The information respecting a data subject that a credit information provider shall furnish to a credit bureau includes the personal information of the data subject; in the case of a loan from a credit information provider the type, nature and amount of the loan or other similar credit facility granted to the data subject from a credit information provider; all outstanding loans including contingent liabilities extended to the data subject by the credit information provider; the date on which the loan account was opened and the dates for payment of the principal and the interest as agreed; information on the composition and the types of collateral or security provided by any data subject which secured the debt obligation; the loan balance and the maximum balance on the loan; (b) (c) (d) (2) (3) (a) (b) (i) (ii) (iii) (iv) (v) FAIR CREDIT REPORTING ACT, 2021-31 27

the account status and the liability of the data subject on the account, including the date of the last activity respecting the loan obligations; and the nature of any guarantee or other secondary debt obligation to which the data subject is a party; in the case of an entity that sells goods or offers services on a credit basis or with delayed payment terms, the amount of the goods and services provided on a credit basis together with contingent and possible obligations; the dates on which the goods or services were provided; the agreed schedule of payment for the goods or services; and information on the composition and the types of collateral that secured the payment obligations; any comments made in respect of the loan obligations of the data subject on the file kept for this purpose by the credit information provider; the amount, if any, that is past due; the minimum payment due; the date and the amount of the last payment, the closed date of the account and the expiry date; credit information about a data subject’s income, creditworthiness or history of financial transactions including antecedents and adverse court judgments obtained by the credit information provider in relation to transactions involving the credit provider; other credit information required to be disclosed under this Act; (vi) (vii) (c) (i) (ii) (iii) (iv) (d) (e) (f) (g) (h) (i) 28 FAIR CREDIT REPORTING ACT, 2021-31

any other information that the Central Bank considers appropriate to include as credit information for the purposes of this Act and the regulations; and specifies by notice published in the Official Gazette and a newspaper circulating in Barbados; and analysis of the information referred to in paragraphs (a) to (j), including any conclusions as to creditworthiness, whether in the form of a system of credit or other numerical or alphabetical scores or otherwise. Notwithstanding the provisions of this section, the Minister may by regulations provide for additional obligations of credit information providers. Credit reports Subject to section 21, a user may, with the consent of the data subject request a credit report, credit score, any value-added product or any other credit information with respect to a data subject from a credit bureau in accordance with the appropriate permissible purpose for the request. A credit bureau shall ensure that a credit report specifies the name of the person making the credit report or value￾added product or the person on whose behalf the report or value-added product is made; and is provided in the standard data format specified by the Central Bank. The credit bureau shall omit from a credit report the identity of creditors, unless the information disclosed therein is directed to the data subject to which the credit report relates, in which case, the report shall also include the identity of all institutions which have accessed the information in the previous 24 months; (j) (i) (ii) (k) (4) 19.(1) (2) (a) (b) (3) (a) FAIR CREDIT REPORTING ACT, 2021-31 29

any price related information such as interest rates so as to prevent anti￾competitive coordination and collusion among reporting institutions; and any sensitive personal information. A credit bureau shall not provide a credit report or value-added product that lists all data subjects with good payment history unless there is a permissible purpose under
section 21 regarding such listing;
omit from a credit report of a data subject, information that can affect the ability of the data subject to access credit; give an undertaking to remove negative information which is accurate from a customer’s credit file, including entries concerning negative credit information and court judgments; mislead a customer about the length of time that negative information is held on the customers’s credit file or any official register; or give an undertaking to create a new credit file by changing the address of the customer or in any other way. In processing credit information for any of the purposes of this Act or the regulations a credit bureau must take reasonable steps to ensure that a credit report is balanced, clear, fair and not misleading particularly where it contains a comparison or contrast; each credit report or value-added product is clearly identifiable as such, is accurate, balanced and is sufficient for and presented in a way that is likely to be understood by the average member of the group to which it is directed, or by which it is likely to be received; does not disguise, omit, diminish or obscure important information, statements or warnings; (b) (c) (4) (a) (b) (c) (d) (e) (5) (a) (b) (c) 30 FAIR CREDIT REPORTING ACT, 2021-31

credit information processed for the purpose of this Act and the regulations must be accurate and, where necessary, kept up to date; statements based on facts are distinguished from credit information based on personal assessments; credit information which is inaccurate, incomplete or not capable of being brought up to date is not transmitted or made available for any of the purposes of this Act or the regulations and is erased or rectified without delay; the quality of credit information is verified before it is transmitted or made available; and in all transmissions of credit information, the necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of the data and the extent to which it is up to date is included in such transmissions. Subsection (5) is not to be regarded as being contravened by reason of any inaccuracy in a credit report which accurately recorded information obtained by the credit bureau from a credit information provider in a case where, having regard to the purpose for which the credit information was obtained and further processed, the credit bureau has taken reasonable steps to ensure its accuracy. A credit bureau which wilfully or intentionally contravenes or fails to comply with a provision of this section is guilty of an offence and is liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both. Permissible purposes A credit bureau may not knowingly provide to any person any information from the credit files of a data subject except for a purpose specified in subsection (2). A credit bureau may, where it is satisfied that a data subject has consented, provide a credit report, credit score or value-added product on the basis of (d) (e) (f) (g) (h) (6) (7) 20.(1) (2) FAIR CREDIT REPORTING ACT, 2021-31 31

information contained in the credit file of the data subject to a subscriber or user for the consideration of an application for credit; or an offer to act as a guarantor of an applicant for credit; use in connection with the purchase or collection of a debt of a data subject; the entering into or the renewal of a tenancy agreement with a data subject; or the underwriting of insurance involving a data subject; use, relating to a pre-employment check of a data subject for a position that entails significant financial responsibilities; periodic portfolio monitoring and risk assessment purposes, collection and skip tracing; or any other purpose prescribed by regulations under this Act. Where a person requires data subject information for any purpose under this Act from a credit bureau, the person shall submit sufficient information to the credit bureau in order to enable the credit bureau to confirm and validate the identity of the data subject and the identity of the person requiring the information; submit to the credit bureau evidence of the data subject’s consent; agree to properly dispose of the data subject’s information so that the data subject’s information cannot reasonably be read or reconstructed; and ensure that the confidentiality of the data subject’s information is maintained and prevent unauthorized access to or misuse of the information or reconstruction of the credit report. (a) (i) (ii) (b) (i) (ii) (iii) (c) (d) (e) (3) (a) (b) (c) (d) 32 FAIR CREDIT REPORTING ACT, 2021-31

Subject to the provisions of any subscription or other agreements pertaining to the provision of credit reports, the credit bureau shall, before forwarding the information required under subsection (3), confirm receipt of the data subject’s consent as required by subsection (3)(b); confirm the identity of the data subject and the identity of the person who requires the information; and ensure that the integrity of the information provided is not altered during its transmission. A person who obtains data subject information under this section shall ensure that the information is processed only for the purpose for which it was obtained and not be further processed in any manner incompatible with that purpose. A credit bureau may provide a data subject with a copy of the data subject’s own credit report, but it shall first confirm and validate the identity of the data subject before disclosing the information. A credit bureau shall take steps to ensure that a credit report is clear, fair, and not misleading; and that credit information processed for the purposes of this Act or the regulations is accurate and, where necessary, kept up to date. A credit bureau which discloses data subject information in contravention of this section is guilty of an offence and is liable on summary conviction to a fine of $50 000. The requirement for consent A credit information provider may disclose credit information to a credit bureau with the consent of a data subject; or (4) (a) (b) (c) (5) (6) (7) (a) (b) (8) 21.(1) (a) FAIR CREDIT REPORTING ACT, 2021-31 33

if the credit information provider gives notice to the data subject at the time of entering into an agreement between the credit information provider and the data subject, that credit information and personal information may be disclosed to a credit bureau. The notice and consent referred to in subsection (1) must be included in any written application, document or process completed by the data subject. Without prejudice to subsection (2), the credit information provider may also give notice by affixing a legible sign to that effect at its place of business; by publication on its website; or by any other method that would effectively bring the notice to the attention of the data subject. Subject to this section and the regulations, a person other than a credit information provider or a user may, with the consent of the data subject, obtain a credit report in respect of the data subject for a purpose referred to in section 20. Subject to section 22, the consent of a data subject shall expire when the agreement with respect to the credit relationship between the credit information provider or other user and the data subject is terminated; but the credit information respecting the data subject shall remain in the database of the credit bureau and the user in accordance with section 22. A credit bureau which discloses a data subject’s information in contravention of this section is guilty of an offence and is liable on summary conviction to a fine of $50 000. Any person who obtains information relating to a data subject from a credit bureau by deception is guilty of an offence and liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both. (b) (2) (3) (a) (b) (c) (4) (5) (6) (7) 34 FAIR CREDIT REPORTING ACT, 2021-31

A credit bureau does not contravene this section where the data subject information is required in response to an order of a court of competent jurisdiction; to avoid prejudice to the administration of justice including the prevention, detection, investigation, prosecution or punishment of offences; to enable an insurer to investigate any allegation of insurance fraud; for the enforcement of any law; for protection of the public revenue; for the conduct of proceedings before any court or tribunal; to be used in a form in which the identity of the data subject concerned is protected; or for statistical or research purposes. Data subject information published pursuant to paragraph (h) of subsection (8) shall be in a form which protects the identity of the data subject to whom it relates. Restrictions regarding disclosure of data subject information The Minister may, on the recommendation of the Central Bank, make regulations relating to the disclosure and protection of data information. Where a credit bureau or user obtains credit information regarding credit extended to or in respect of a data subject, the credit bureau or user shall not disclose such information or retain it for a period longer than 7 years after the date of settlement of such credit. Notwithstanding subsection (2), a credit bureau or a user may, for historical, statistical, research or regulatory purposes, retain data subject information for a period in excess of 7 years. (8) (a) (b) (c) (d) (e) (f) (g) (h) (9) 22.(1) (2) (3) FAIR CREDIT REPORTING ACT, 2021-31 35

The Central Bank may issue guidelines with respect to the terms of retention of negative information and the calculation of the period of retention. A credit bureau or user that contravenes subsection (2) is guilty of an offence and is liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both. Supplying false information A person shall not knowingly supply false or misleading information regarding a data subject to any credit information provider or credit bureau. A person who contravenes subsection (1) is guilty of an offence and is liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both. Subscriber agreements A credit bureau and credit information provider may, with the approval of the Central Bank, enter into a subscriber agreement to provide for the receipt of data subject information by the credit bureau from the credit information provider in accordance with paragraph (a) of section 18(1). A subscriber agreement referred to in subsection (1), is void where the agreement states or implies that the provisions of this Act or the regulations do not apply to the agreement; and a right or remedy provided by or pursuant to this Act or the regulations does not apply to the agreement; or is in any way limited, modified or abrogated by the agreement. A credit bureau which contravenes this section is guilty of an offence and is liable on summary conviction to a fine of $50 000. (4) (5) 23.(1) (2) 24.(1) (2) (a) (b) (i) (ii) (3) 36 FAIR CREDIT REPORTING ACT, 2021-31

Data management and quality control
A credit bureau shall implement procedures that ensure that the information registered or contained in its database is updated as frequently as needed or at least monthly; implement strict quality control procedures in order to ensure the accuracy and completeness of its database; take all necessary steps to ensure that data subject information maintained by the credit bureau is up to date, authentic, legitimate, reliable, accurate and comprehensive; maintain and keep all records prescribed by this Act and regulations; and otherwise maintain reasonable procedures to limit the furnishing of data subject credit reports to the permissible purposes referred to in
section 20.
A credit bureau which contravenes subsection (1) is guilty of an offence and is liable on summary conviction to a fine of $50 000. Security and control measures A credit bureau shall ensure that credit information processed for any purpose under this Act or the regulations is processed in a manner that ensures appropriate security of that information, using appropriate technical or organisational measures, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage. The measures referred to in subsection (1) must ensure a level of security appropriate to the harm that might result from such unauthorized or unlawful processing or accidental loss, destruction or damage; and 25.(1) (a) (b) (c) (d) (e) (2) 26.(1) (2) (a) FAIR CREDIT REPORTING ACT, 2021-31 37

the nature of the data to be protected.
A credit bureau shall take reasonable steps to ensure the reliability of any of its employees who have access to credit information. A credit bureau shall, in respect of data subject information kept and maintained by the credit bureau, take the necessary security and control measures in order to avoid illegal interception or interruption of the data subject information during transmission; or other misuse regarding the data subject information, including misuse by anyone with authorized access to the data subject information; keep and maintain an access log regarding the data subject information, including procedures performed; and make available to the data subject upon request, the name of each user and the date on which the user obtained access to the data subject’s information. Without limiting paragraph (a) of subsection (4), a credit bureau shall, for the purpose of safeguarding and protecting the data subject information which it keeps and maintains, develop written policies and procedures to be followed by its employees, agents and contractors in relation to the provision of credit reporting services pursuant to this Act and the regulations; ensure that there is a subscriber agreement before disclosing information to a subscriber; provide information and training to ensure compliance with the policies and procedures referred to in paragraph (a); and (b) (3) (4) (a) (i) (ii) (b) (c) (5) (a) (b) (c) 38 FAIR CREDIT REPORTING ACT, 2021-31

monitor usage of, and regularly check for compliance with or breaches of the subscriber agreement and the policies, procedures and controls required by this section. A credit bureau which contravenes this section is guilty of an offence and is liable on summary conviction to a fine of $50 000. Data subject’s rights of access and correction A data subject is entitled to be given by a credit bureau once every calendar year, a copy of the data subject’s credit report without cost to the data subject. A credit bureau and a credit information provider shall, at the request of the data subject, give electronically or otherwise to the data subject, a written report in a language that the data subject specifies relating to the credit information of which that individual is the data subject; the purposes for which the credit information is being or is to be processed; and the recipients or classes of recipients to whom the credit information has been or may be disclosed. A data subject is entitled to submit a letter of dispute to a credit bureau regarding any inaccurate data respecting the data subject held in the credit bureau’s database and request correction of the inaccurate data by the credit bureau. Where a letter of dispute has been submitted under subsection (3), the credit bureau shall, within 7 business days, investigate the dispute and the inaccuracy of any data and report its findings to the data subject making any corrections as may be warranted; and inform the data subject that he may report the dispute to the Central Bank. (d) (6) 27.(1) (2) (a) (b) (c) (3) (4) (a) (b) FAIR CREDIT REPORTING ACT, 2021-31 39

Where a data subject requests from a credit bureau, a credit report or other data subject information processed in respect of the data subject, the credit bureau shall, within no more than 3 business days after receipt of the request, furnish to the data subject, the credit report or other information. Where a credit bureau discloses personal information in pursuance of
section 19, the credit bureau shall forward, together with the disclosure, a
statement informing the data subject of his rights and the procedures for accessing or correcting data kept and maintained by that credit bureau in relation to the data subject. A credit bureau is not obligated to supply any information unless the credit bureau has received a request in writing; and received such fee as the credit bureau may require, unless otherwise prescribed. Where a credit bureau requires further information in order to satisfy itself as to the identity of the person making a request; or locate the information which that person seeks; and has informed the requesting person of the requirement for further information, the credit bureau is not obliged to comply with the request unless it is supplied with that further information. A data subject is entitled by notice in writing to require a credit bureau, within such period as is reasonable in the circumstances of the case, to cease processing for a specified purpose or in a specified manner; or not to commence processing (5) (6) (7) (a) (b) (8) (a) (i) (ii) (b) (9) (a) (b) 40 FAIR CREDIT REPORTING ACT, 2021-31

any credit information relating to the data subject for the reasons specified in subsection (10). The reasons referred to in subsection (9) are the data is inaccurate or misleading; the processing of the data or the processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another; and that damage or distress is or would be unwarranted. The credit bureau shall within 21 days of receiving a notice, hereinafter referred to as “the data subject notice”, give the data subject a written response stating that it has complied or intends to comply with the data subject notice; or stating its reasons for regarding the data subject notice as being unjustified and the extent, if any, to which it has complied or intends to comply with the data subject notice. Where the Central Bank is satisfied, on the application of a data subject, that a data subject notice which appears to be justified has not been complied with, the Central Bank may order the credit bureau to take such steps as the Central Bank deems appropriate to comply with the data subject notice. Adverse actions against data subjects Where, as a result of any data subject information contained in a credit report, a credit provider takes any adverse action against the data subject; denies credit to a data subject, in whole or in part; or changes the terms and conditions of an existing credit to the detriment of a data subject, (10) (a) (b) (c) (11) (a) (b) (12) 28.(1) (a) (b) (c) FAIR CREDIT REPORTING ACT, 2021-31 41

the credit provider shall, within 30 days after taking the action, inform the data subject by notice in writing hereinafter called “an adverse action notice”. An adverse action notice under subsection (1) shall contain the following information:
the adverse action and the reasons for the action; the name, address and phone number of the credit bureau which provided the data subject information; and the right of the data subject to dispute the data subject information with the credit bureau; and to have the information corrected where the data subject information is erroneous or outdated. A credit provider is deemed to have notified the data subject under subsection (1) where the credit provider sends the adverse action notice by registered mail to the data subject’s last known address; or to the data subject’s last known email address. Notwithstanding any other provision of this Act, a data subject is entitled to a copy of the credit report from the credit bureau without cost to the data subject whenever an adverse action is taken against the data subject by reason of negative information in a credit report. Cross-border credit reporting A credit bureau may, with the prior written approval of the Central Bank outsource to a person or an entity operating in a country within the Caribbean Community; and enter into a contract with such a person or entity (2) (a) (b) (c) (i) (ii) (3) (a) (b) (4) 29.(1) (a) (b) 42 FAIR CREDIT REPORTING ACT, 2021-31

for the processing of data subject information in its possession or under its control. A credit bureau may, with the consent of the data subject and with the prior approval of the Central Bank, transfer credit information relating to the data subject from Barbados to a place outside Barbados if that place has an adequate level of protection for the rights and freedoms of data subjects with respect to the processing of credit information. For the purposes of subsection (2), in determining an adequate level of protection, regard shall be had to the nature of the credit information; the country or territory of origin of the information contained in the data; the country or territory or final destination of that information; the purposes for which and period during which the data is intended to be processed; the law in force in the country or territory; the international obligations of that country or territory; the relevant codes of conduct or other rules which are enforceable in that country or territory, whether generally or by arrangement in particular cases; and the security measures taken in respect of the data in that country or territory. Subsection (3) does not apply to a transfer of credit information falling within any of the following cases:
where the data subject has given his consent to the transfer; where the transfer is necessary for the performance of a contract between the data subject and the credit bureau, or for the taking of steps (2) (3) (a) (b) (c) (d) (e) (f) (g) (h) (4) (a) (b) FAIR CREDIT REPORTING ACT, 2021-31 43

at the request of the data subject, with a view to his entering into a contract with the credit bureau; where the transfer is necessary for the conclusion or the performance of a contract between the credit bureau and a person other than the data subject which is entered into at the request of the data subject, or is in the interest of the data subject; where the transfer is necessary for reasons of substantial public interest; where the transfer is necessary for the purpose of or in connection with legal proceedings, including prospective legal proceedings; for the purpose of obtaining legal advice; for the purpose of establishing, exercising or defending legal rights; where the transfer is part of the credit information on a public register and any conditions subject to which the register is open to inspection are complied with by any person to whom the data is or may be disclosed after the transfer; where the transfer is made on terms which are of a kind approved by the Central Bank as ensuring adequate safeguards for the rights and freedoms of data subjects; and where the transfer has been authorized by the Central Bank as being made in such a manner as to ensure adequate safeguards for the rights and freedoms of data subjects. (c) (d) (e) (i) (ii) (iii) (f) (g) (h) 44 FAIR CREDIT REPORTING ACT, 2021-31

PART V
SUPERVISION BY THE CENTRAL BANK
Information gathering powers of the Central Bank For the purposes of carrying out its functions under this Act and the regulations with respect to a licensee, the Central Bank may request from the credit bureau any information that the Central Bank requires in order to determine any matter arising under this Act or the regulations; or from the operations of the credit bureau; may issue such guidelines, rules or directives as the Central Bank considers appropriate; may require access to the books, records, accounts, vouchers, minutes of meetings and any other document of the licensee; may demand the production of and inspect any record of the licensee or a person with respect to whom an inspection or inquiry is being made or conducted under this Part; and shall exercise such other information gathering and enforcement powers set out in this Part or the regulations or as are necessary to fulfil its functions under this Part. Where the Central Bank demands the production of any record under paragraph (d) of subsection (1), any person who has the custody, possession or control of the record shall produce such record to the Central Bank. Every credit bureau shall comply with any guidelines, rules or directives issued by the Central Bank under paragraph (b) of subsection (1). 30.(1) (a) (i) (ii) (b) (c) (d) (e) (2) (3) FAIR CREDIT REPORTING ACT, 2021-31 45

A credit bureau which fails to comply with any guidelines, rules or directives issued by the Central Bank is guilty of an offence and liable on summary conviction to a fine of $50 000. Inspections The Central Bank or an officer appointed by the Central Bank may conduct an inspection of an applicant prior to the grant of a licence pursuant to section 6; and a licensee in order to determine that the licensee is compliant with the provisions of this Act and the regulations and is in a sound financial position. Where the Central Bank or an officer appointed under subsection (1)(b) on inspection of a licensee has reason to believe that the licensee is conducting its business in an unlawful manner; or in a condition that endangers, or is likely to endanger, the credit worthiness, credit standing, credit capacity, character, general reputation or personal characteristics of data subjects, the Central Bank may direct the licensee to take such measures as the Central Bank may specify to rectify the situation. The Central Bank may, in carrying out an inspection under subsection (1), inquire into and examine the business affairs of the credit bureau with respect to which the inspection is being made; any record of the credit bureau with respect to which the inspection is being made, including any payments to, by or on behalf of, in relation to or in connection with, the credit bureau; and (4) 31.(1) (a) (b) (2) (a) (b) (3) (a) (b) 46 FAIR CREDIT REPORTING ACT, 2021-31

any property or assets of, or things owned, acquired or alienated in whole or in part by the credit bureau with respect to which the inspection is being made; and any person acting on behalf of a credit bureau or as agent for the credit bureau with respect to which the inspection is being made. A credit bureau and any other person referred to in subsection (3) shall, within the period specified by the Central Bank, comply with any direction or request made by the Central Bank under this section. Where a credit bureau or any other person referred to in subsection (3) contravenes or fails to comply with subsection (4), the credit bureau or that person is guilty of an offence and liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both. Warrants A magistrate may issue a warrant permitting any member of the Police Force or other person named in the warrant to enter any premises belonging to or in the possession or control of a credit bureau or any officer or employee of such credit bureau and to search the premises and remove any document, material or other thing therein, where the magistrate is satisfied by evidence on oath by the Governor of the Central Bank that there are reasonable grounds to believe that a credit bureau has failed to produce any record required by the Central Bank under this Act. Any document, material or other thing removed pursuant to subsection (1) may be returned to the credit bureau upon completion of any investigation unless it is required for purposes of legal proceedings. Costs of inspections Where an inspector conducts an inspection or inquiry into a credit bureau pursuant to this Part, the person with respect to whom the inspection or (c) (i) (ii) (4) (5) 32.(1) (2) 33. FAIR CREDIT REPORTING ACT, 2021-31 47

inquiry is made shall pay the prescribed fees and costs of the inspection or inquiry, including the costs of any travel undertaken in the course of the conduct of the inspection or inquiry. Auditors and annual reports Every credit bureau shall appoint an independent auditor to conduct an annual audit and compliance review of the credit bureau in accordance with this Act and applicable best practice. The auditor shall, as part of the auditors’s annual audit, obtain from the credit bureau a copy of the most recent report respecting the inspection of the credit bureau prepared by the Central Bank; and any order, direction, notice or other action issued or taken by the Central Bank under this Act or the regulations to verify compliance. Every credit bureau shall, within 4 months of the end of its financial year, submit to the Central Bank a signed copy of its audited financial statements; a signed management letter; a list of shareholders of the credit bureau specifying the shareholdings of each shareholder; and such other documents as the Central Bank may reasonably require. A credit bureau shall, no later than 3 months after the end of its financial year, publish its audited financial statements in the Official Gazette and in a newspaper circulating in Barbados and also on its website. 34.(1) (2) (a) (b) (3) (a) (b) (c) (d) (4) 48 FAIR CREDIT REPORTING ACT, 2021-31

PART VI
MISCELLANEOUS
Determination of disputes
Any person aggrieved by a decision made under this Act may apply to the Tribunal for relief. Civil liability for negligent non-compliance A person who, due to negligence, fails to comply with a requirement imposed by this Act or any regulations made under this Act shall be liable to a data subject for any injury suffered by the data subject by reason of such failure. Where 2 or more directors or officers of an authorized person are liable in respect of a failure under subsection (1), their liability shall be joint and several. Agreement with another regulatory authority The Central Bank may enter into an agreement with a local or an overseas regulatory authority for the purpose of administering or enforcing this Act; or for any other purpose respecting credit reporting services that the Central Bank believes to be in the public interest. The Central Bank must, in relation to third countries and international organizations, take appropriate steps to develop international cooperation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data; provide international mutual assistance in the enforcement of legislation for the protection of personal data, subject to appropriate safeguards for the protection of personal data, and other fundamental rights and freedoms; 35. 36.(1) (2) 37.(1) (a) (b) (2) (a) (b) FAIR CREDIT REPORTING ACT, 2021-31 49

engage relevant stakeholders in discussion and activities aimed at furthering international cooperation in the enforcement of legislation for the protection of personal data; and promote the exchange and documentation of legislation and practice for the protection of personal data, including legislation and practice relating to jurisdictional conflicts with third countries. Confidentiality and restrictions regarding access to information Information obtained by the Central Bank as a result of an inspection, audit, investigation or inquiry under this Act, shall not be available for access by any person except directors, officers or employees of the Central Bank whose responsibilities require or allow them to have access to the information; or such persons as may be authorized in writing by the Central Bank to have access to such information. No person, director, officer or employee of the Central Bank shall, unless authorized by this Act or any other enactment or with the consent of the person to whom the information relates, communicate, or allow to be communicated, information obtained pursuant to this Act to a person who is not legally entitled to obtain the information; or allow a person who is not legally entitled to information obtained pursuant to this Act to have access to such information. Limitation on prosecution No prosecution for an offence committed under this Act or the regulations shall be commenced after a period of 2 years has elapsed after the date on which the offence is alleged to have been committed. (c) (d) 38.(1) (a) (b) (2) (a) (b) 39. 50 FAIR CREDIT REPORTING ACT, 2021-31

Penalties
A person guilty of an offence under this Act for which no penalty is otherwise specifically provided is liable on summary conviction, to a fine of $100 000 or to imprisonment for 5 years or to both. Fixed penalty Notwithstanding section 40, where the Central Bank has reason to believe that a person has committed an offence pursuant to this Act or the regulations, the Central Bank may issue to the person a notice in writing specifying the offence against the Act or the regulations the Central Bank has reason to believe has been committed; offering the person the option to discharge any liability to prosecution and conviction in respect of the offence by payment of a fixed penalty of $10 000; and giving the person no less than 7 days from the date of receipt of the notice to show cause why the fixed penalty should not be imposed. A fixed penalty may be imposed by the Central Bank after the period referred to in paragraph (c) of subsection (1) has elapsed, by order of the Central Bank. A fixed penalty payable under paragraph (b) of subsection (1), any other provision of this Act or the regulations shall be paid to the Central Bank within 10 days from the date of its imposition, unless otherwise stated. Subject to subsection (6), the Central Bank may, where a credit bureau fails to pay a fixed penalty within such time as may be specified in a notice issued pursuant to subsection (1), recover the amount due on the fixed penalty from a bank guarantee provided under section 8. 40. 41.(1) (a) (b) (c) (2) (3) (4) FAIR CREDIT REPORTING ACT, 2021-31 51

The Central Bank shall, for the purpose of recovering from a bank guarantee the amount due on a fixed penalty payable by a credit bureau, issue an order to the bank issuing the guarantee notifying the bank of the failure of the credit bureau to pay the amount due on the fixed penalty; and directing the bank to immediately pay up the amount to the Central Bank. Where the amount due on a fixed penalty has been recovered from a bank guarantee in accordance with this section the Central Bank shall by notice in writing inform the credit bureau of the recovery; and the credit bureau shall, within 30 days of being notified by the Central Bank of the recovery from the bank guarantee, furnish the Bank with a new irrevocable bank guarantee in the amount required to be submitted pursuant to paragraph (b) of subsection (2) of section 8; and in a format acceptable to the Central Bank. Without prejudice to any action taken by the Central Bank pursuant to paragraph (a) of subsection (6), the Central Bank may suspend or revoke the licence of a credit bureau which fails to comply with subsection (3) or with paragraph (b) of subsection (6). Immunity No action or proceeding lies or shall be commenced against the Central Bank, its directors, officers, employees or agents or an authorized person, for anything done, caused, permitted or authorized to be done, attempted to be (5) (a) (b) (6) (a) (b) (i) (ii) (7) 42.(1) 52 FAIR CREDIT REPORTING ACT, 2021-31

done or omitted to be done in good faith by the Central Bank, its directors, officers, employees or agents or such authorized persons in the exercise or purported exercise of a power conferred by this Act or the regulations; or in the carrying out or purported carrying out of an order made pursuant to this Act or a duty imposed by this Act or the regulations. The Central Bank shall indemnify its directors, officers, employees, agents and authorized persons against the cost of defending their actions while discharging their functions under this Act or the regulations in good faith. Protection of databases upon liquidation Notwithstanding any provision to the contrary contained in the Companies Act, Cap. 308, a credit bureau shall not pass a resolution for the suspension of its activity or the voluntary winding up of its business unless the credit bureau first obtains the approval in writing of the Central Bank. Where a credit bureau is being wound up or liquidated the database containing data subject information shall be transferred to the Central Bank; the Central Bank shall determine whether the credit reporting activities which were undertaken by the credit bureau shall be continued or whether the data subject information shall be destroyed or transferred to another licensed credit bureau, following a bidding process; or where the Central Bank determines not to transfer data subject information to another licensed credit bureau, it may issue an order regarding the disposal or destruction of the data subject information held by the credit bureau which is being wound up or liquidated. (a) (b) (2) 43.(1) (2) (a) (b) (c) FAIR CREDIT REPORTING ACT, 2021-31 53

Application of Data Protection Act, 2019 (Act 2019-29) Where this Act is deficient in any respect for the protection of personal data, the Data Protection Act, 2019 (Act 2019-29) shall apply to remedy the deficiency. Regulations The Minister may, after consultation with the Central Bank, make regulations prescribing the fees to be paid for the grant or renewal of a licence; and the reinstatement of a licence that has been revoked; prescribing any matter that is required or authorized by this Act to be prescribed; relating to the disclosure and protection of data subject information; and generally for the proper administration of this Act. Transitional provisions Where on the day immediately preceding the commencement of this Act any person carried on the business of a credit bureau, that person may continue to carry on that business after the commencement of this Act but shall within 6 months after the commencement of this Act, make application to the Central Bank under section 5 for the grant of a licence to carry on the business of a credit bureau. Where a person fails to comply with the provisions of subsection (1), the Central Bank shall order that person to cease its business forthwith. 44. 45. (a) (i) (ii) (b) (c) (d) 46.(1) (2) 54 FAIR CREDIT REPORTING ACT, 2021-31

Where a person fails to comply with the provisions of this section, that person and every manager thereof is guilty of an offence and in the case of a body corporate, it is liable on summary conviction to a fine of $200 000; and a manager, he is liable on summary conviction to a fine of $50 000 or to imprisonment for 3 years or to both. Commencement This Act shall come into operation on a date to be fixed by Proclamation. (3) (a) (b) 47. FAIR CREDIT REPORTING ACT, 2021-31 55