Act 20 2023 - Act 20 - 2023 - Credit Reporting Act 2023

[20th November 2023] Credit Reporting Act 577 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT CREDIT REPORTING ACT, 2023 (Act 20 of 2023) ARRANGEMENT OF SECTIONS PART I - PRELIMINARY Sections 1. Short title and commencement 2. Interpretation 3. Exemption from application PART II - ADMINISTRATION OF THE ACT 4. Establishment of the CIS 5. Operation of the CIS 6. Functions of the Central Bank 7. Powers of the Central Bank 8. Cooperation with authorities in Seychelles PART III - DATA PROVIDERS 9. Categories of data providers 10. Submission of data by data provider 11. Duty to inform data subjects 12. Duty to obtain consent PART IV - DATA SUBJECTS AND DATA MANAGEMENT 13. Right to access own information 14. Access to credit reports 15. Access reports 16. Data access 17. Restriction of data 18. Purpose of access 19. Data quality 20. Validity of information 21. Accuracy of information 22. Data security [20th November 2023] Credit Reporting Act 578 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT 23. Data protection 24. System downtime or outage 25. Data processing and usage 26. Data confidentiality 27. Data submission 28. Data validation 29. Data retention 30. Archive 31. Disputes and complaints 32. Examination PART V - INFRINGEMENTS, REMEDIAL MEASURES AND PENALTIES 33. Offences 34. Enforcement action 35. Right to submit written representations and oral submissions 36. Publication and sharing of information PART VI - MISCELLANEOUS 37. Protection of action taken in good faith 38. Regulations 39. Amendment of Cap 26 SCHEDULES [20th November 2023] Credit Reporting Act 579 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT CREDIT REPORTING ACT, 2023 (Act 20 of 2023) I assent Wavel Ramkalawan President 6th November, 2023 AN ACT TO PROVIDE FOR THE ESTABLISHMENT, OPERATION, REGULATION AND OVERSIGHT OF THE CREDIT INFORMATION SYSTEM WITH THE OBJECTIVE OF ENSURING THE SAFE, RELIABLE AND EFFICIENT PROCESSING OF INFORMATION, TO PROVIDE FOR THE FUNCTIONS AND DUTIES OF THE CENTRAL BANK IN RELATION TO ITS RESPONSIBILITIES UNDER THIS ACT, TO PROVIDE FOR THE RIGHTS AND RESPONSIBILITIES OF DATA PROVIDERS, DATA USERS AND DATA SUBJECTS, AND FOR OTHER CONNECTED OR INCIDENTAL MATTERS. ENACTED by the President and the National Assembly. PART I - PRELIMINARY Short title and commencement 1.(1) This Act may be cited as the Credit Reporting Act, 2023. (2) This Act shall come into operation on such date as the Minister may, by notice in the Gazette appoint. [20th November 2023] Credit Reporting Act 580 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT Interpretation 2. In this Act, unless the context otherwise requires — “Central Bank” means the Central Bank of Seychelles established under section 3 of the Central Bank of Seychelles Act (Cap.26); “CIS” means the Credit Information System established under section 4; “CIS Operator” means a person designated and permitted by the Central Bank to access the CIS to conduct operational activities; “consent” means a data subject's freely informed and specific written agreement to the collection, processing and disclosure of the subject's data; “credit history” means the record of a data subject's payment behaviour over a period of time made in accordance with section 29; “credit report” means a report issued by the CIS containing the recorded credit history of a data subject; “credit scoring” means a method of evaluating the probability of a prospective borrower fulfilling its financial obligations associated with a facility, by considering both positive and negative data; “customer credit portal” means an online platform accessible to a data subject to access the data subject's information contained within the CIS, and lodge any dispute in accordance with section 31; “data provider” means an entity that is required to supply information to the CIS in a structured manner; [20th November 2023] Credit Reporting Act 581 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT “data subject” means a natural or legal person who — (a) applies for credit; (b) is a guarantor; or (c) signs a service or product agreement that involves a payment, and whose data is collected, processed and disclosed to data users in the CIS; “data user” means an entity having authorised access and use in respect of information contained in the CIS; “facility” means an arrangement or means by which a debt is incurred by a data subject, including a declaration of bankruptcy by a court; “guarantor” means a person who gives his or her immovable property or offers his or her guarantee as security for the repayment of a credit facility by a borrower; “interbank market participants” comprises the Central Bank, banks licensed under the Financial Institutions Act, 2004 and credit unions established under the Credit Union Act, 2009; “Minister” means the Minister responsible for finance; “negative data” means adverse information relating to a data subject including defaults, arrears, bankruptcies and other non- compliance with contractual or legal obligations; “personal data” means any information that can be used to identify a person, including name, identification number and address; “positive data” means favourable information relating to a data subject on contractual or legally compliant behaviour; [20th November 2023] Credit Reporting Act 582 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT “regulatory authority” means an authority or a public body which exercises any functions of prudential, technical or economic regulation on the basis of statutory powers; “Seychelles Revenue Commission” means the Seychelles Revenue Commission established under section 3 of the Seychelles Revenue Commission Act, 2009; and “signature” means a written, and often stylized depiction of someone's name, or other mark that a person writes on documents as a proof of identity and intent. Exemption from application 3. This Act doeps not apply to — (a) any funds provided by the Central Bank in its capacity as lender of last resort, for resolution or financial stability purposes made in line with written law; (b) instruments issued by the Central Bank for liquidity management; (c) borrowing between interbank market participants, the Development Bank of Seychelles established under the Development Bank of Seychelles Decree (Cap 63), and the Housing Finance Comany Limited; or (d) Government financing. PART II - ADMINISTRATION OF THE ACT Establishment of CIS 4. The Central Bank shall establish and operate the CIS to collect, store and process facility information on data subjects from data providers. Operation of CIS 5.(1) No person shall establish or operate a credit information system. [20th November 2023] Credit Reporting Act 583 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (2) A person who contravenes subsection (1) commits an offence and shall be liable on conviction to a fine not exceeding level 5 on the standard scale or to imprisonment not exceeding 2 years or both. Functions of the Central Bank 6.(1) The Central Bank shall administer and enforce this Act. (2) Without prejudice to subsection (1), the Central Bank shall — (a) operate the CIS for the purposes of collection, processing and dissemination of facility information of data subjects in the form of credit reports and other services including statistical reports; (b) have oversight of the CIS for the purpose of ensuring its safety, security, efficient and effective operation; (c) regulate the data users and data providers in respect of CIS related activities; (d) manage disputes and complaints in accordance with this Act; (e) provide information to data subjects in respect of their rights, and the responsibilities of data users and data providers under this Act; (f) consult any person, organisation or institution with regard to any matter under this Act; (g) perform such other functions as may be necessary to ensure the effective implementation and administration of this Act. Powers of the Central Bank 7.(1) The Central Bank shall have powers to do things necessary or expedient for, or in connection with, the performance of its functions under this Act. [20th November 2023] Credit Reporting Act 584 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (2) Without prejudice to the generality of subsection (1), the powers of the Central Bank shall include the power to — (a) access and process data in the CIS; (b) grant access to the CIS to qualified persons for the purpose of maintenance, support and other technical work as may be required for the proper functioning of the CIS; (c) appoint such agents, experts or consultants and procure goods or services as may be necessary for the performance of its functions; (d) amend data within the CIS to rectify system issues; (e) impose and collect such fees as may be prescribed under this Act; (f) manage access to the CIS and establish procedures and rules for persons accessing the CIS; (g) establish operating procedures and data validation processes in relation to the CIS; (h) perform onsite and offsite examination of data providers and data users to determine and assess their compliance with this Act; (i) coordinate and cooperate with other authorities within the scope of this Act; (j) conduct education and advocacy programmes in relation to the functions of the CIS; (k) issue regulations, directions and guidelines as may be necessary for the implementation of this Act; (l) do all such other things as the Central Bank deems fit to allow for the performance of its functions under this Act or which may be incidental to or consequential upon the performance of those functions. [20th November 2023] Credit Reporting Act 585 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT Cooperation with authorities in Seychelles 8. The Central Bank may share or disclose information resulting from inspections or through its supervision of the CIS with a relevant local regulatory authority or law enforcement agency if the Central Bank has the reasonable belief that such sharing or disclosure is necessary for the prevention or detection of criminal offences. PART III - DATA PROVIDERS Categories of data providers 9.(1) The categories of data providers which are required to submit data to the CIS shall be as specified in the First Schedule. (2) Data providers shall submit data as required under the relevant category following the issuance of regulations, except data under Category 1 which shall be provided upon the coming into operation of this Act. (3) The Central Bank may issue regulations, guidelines and rules to provide for the requirements on data submission, quality, usage and any other related matters for each category of data provider. Submission of data by a data provider 10.(1) Data submitted by a data provider to the CIS shall only include such information as is necessary to — (a) obtain a complete and valid identification of a data subject; (b) evaluate the creditworthiness of a data subject; and (c) build the credit history of a data subject. (2) A data provider shall submit information to the CIS in respect of a data subject in accordance with the Second Schedule. (3) A data provider shall submit information to the CIS at intervals specified by the Central Bank. [20th November 2023] Credit Reporting Act 586 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (4) A data provider which fails to provide information to the CIS as required under subsections (1), (2) and (3) shall be liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of the day during which the contravention continues. (5) Data submitted by a data provider relating to the gender, age and nationality of a data subject shall not be processed for the sole purpose of determining a person’s creditworthiness and shall be used for statistical purposes by the Central Bank. Duty to inform data subjects 11.(1) A data provider shall provide the following information verbally and in writing to a data subject prior to submission of the subject's data to the CIS — (a) the manner in which its information may be used and processed; (b) the data users which may access their information; (c) the name of the institution operating the CIS; and (d) the procedures which allow the data subject to exercise its rights of access and verification in relation to its own data. (2) A data provider which fails to provide information to a data subject under subsection (1) is liable to an administrative penalty not exceeding SCR100,000. (3) Subsection (1) shall not apply to — (a) the Judiciary of Seychelles prior to the submission of a data subject's declaration of bankruptcy by the Court; and (b) the Seychelles Revenue Commission prior to the submission of information pertaining to a data subject's failure to pay taxes. [20th November 2023] Credit Reporting Act 587 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT Duty to obtain consent 12.(1) Subject to subsection (2), prior to accessing a data subject's information from the CIS, a data provider shall — (a) conduct and record appropriate identity verification of the data subject; and (b) record the data subject's consent in accordance with the form specified in the Third Schedule. (2) A data provider shall not require the consent of the data subject to access information which a data provider had submitted to the CIS under Regulation 6 of the Central Bank of Seychelles (Credit Information System) Regulations, 2012 (S.I. 10 of 2012) as a participating institution. (3) Upon request by the Central Bank, a data provider shall provide evidence of consent made by a data subject to submit its data to the CIS. (4) A data provider who fails to obtain and record the consent of a data subject in accordance with subsection (1), commits an offence and is liable upon conviction to a fine of Level 5 on the Standard Scale. (5) A data provider who fails to provide evidence of a data subject's consent to the Central Bank commits an offence and is liable upon conviction to or a fine of Level 5 on the Standard Scale. (6) Section 12 shall not apply to the Seychelles Revenue Commission when accessing a data subject's information from the CIS to assess the suitability of a compromise agreement with the data subject, in line with section 22 of the Revenue Administration Act (Cap 308). PART IV - DATA SUBJECTS Right to access own information 13. A data subject has the right to access and verify his, her or its information stored in the CIS through the CIS customer credit portal, or by request to a data user, in accordance with section 14. [20th November 2023] Credit Reporting Act 588 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT Access to credit reports 14.(1) A data subject may, once registered by the Central Bank in the required form and manner, access the CIS customer credit portal and have unlimited and free access to the data subject's credit report. (2) A data user shall, within two working days, upon request by its data subject, provide the data subject's credit report — (a) at no fee for credit reports which are requested twice in a calendar year; and (b) at a fee as specified in the Fourth Schedule for any additional reports requested during the calendar year. (3) A data user who contravenes subsection (2) is liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of a day during which the contravention continues. Access reports 15. The CIS Operator shall provide within two working days, upon request by a data subject, an access report of the names of data users who have accessed their information and the report shall be provided — (a) at no fee for a report requested once in a calendar year; and (b) at a fee as specified in the Fourth Schedule, for any additional reports requested during the calendar year. Data access 16. The Central Bank may prescribe the procedures and rules for access to the CIS by data providers, data users, data subjects and other persons provided for under this Act. Restriction of access 17. Access to the information contained in the CIS shall be restricted to the entities and conditions specified under section 26. [20th November 2023] Credit Reporting Act 589 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT Purpose of access 18.(1) A data user shall have access to the information contained in the CIS for the following purposes — (a) to assess the creditworthiness of a data subject; (b) to enable the data user to make informed decisions regarding the provision of credit, goods or services; and (c) as authorised by the data subject in writing. (2) A person who knowingly or willfully accesses or obtains information from the CIS without lawful authority or under false pretence commits an offence and is liable upon conviction to imprisonment not exceeding 2 years or to a fine of Level 6 on the Standard Scale. Data quality 19.(1) The Central Bank shall safeguard the accuracy of data stored in the CIS by — (a) acquiring and implementing the necessary technology, protocols and procedures for the operations and functioning of the CIS; (b) developing validation rules and tools ensuring adequate data quality in the CIS; and (c) conducting periodic audits of the CIS by officers of the Central Bank or by a qualified third party. Validity of information 20. Information contained within the CIS shall be considered valid unless it has been flagged as a result of the information being — (a) disputed in accordance with section 31; [20th November 2023] Credit Reporting Act 590 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (b) the subject of mediation or arbitration; or (c) the subject of proceedings before a Court. Accuracy of information 21.(1) A data provider shall submit to the CIS accurate and up to date information in accordance with the provisions of this Act. (2) A data provider shall take reasonable measures to verify the accuracy of a data subject's information and identity prior to submission to the CIS. (3) A data provider which furnishes inaccurate information to the CIS is liable to an administrative penalty not exceeding SCR100,000 and an additional penalty of SCR2,500 for each day or part of a day during which the contravention continues. (4) A person who knowingly submits inaccurate information to the CIS commits an offence and is liable on conviction to a fine of Level 6 on the Standard Scale or to imprisonment not exceeding 2 years or both. Data security 22.(1) The Central Bank shall take reasonable measures to maintain the integrity of the CIS database, network technology and infrastructure. (2) The Central Bank may issue regulations, instructions or guidelines related to specific security measures in the CIS to data providers and data users. Data protection 23.(1) A data provider shall ensure that its data subjects' information is protected from unauthorised access, use, modification or disclosure. (2) A data provider shall implement data recovery and disaster plans, which shall be submitted to the Central Bank upon request. [20th November 2023] Credit Reporting Act 591 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (3) A data provider who fails to implement or submit data recovery and disaster plans to the Central Bank in accordance with subsection (2) is liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of a day during which the contravention continues. System downtime or outage 24.(1) The Central Bank shall not be liable for any loss or damage resulting from downtime or system outage of the CIS. (2) The Central Bank shall, through the local media as soon as is practicable, advise stakeholders and the public of any downtime or system outage of the CIS. Data processing and usage 25.(1) Data processed by the CIS shall be limited to the following activities — (a) evaluating the creditworthiness of a data subject by a data user; (b) allowing a data user to make an informed decision regarding the provision of credit, goods and services subject to deferred payment to a data subject; and (c) monitoring and analysis of credit trends by the Central Bank which are relevant to the Central Bank's mandate, including those pertaining to price and financial stability. (2) A person who receives, uses, compiles and processes information from the CIS for a purpose other than that which has been provided for under this Act commits an offence and is liable on conviction to a fine of Level 5 on the Standard Scale or to imprisonment not exceeding 2 years or both. Data confidentiality 26.(1) Information contained within the CIS is confidential and may only be disclosed — [20th November 2023] Credit Reporting Act 592 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (a) to a data subject in relation to the data subject's own data; (b) to the Central Bank in accordance with the provisions of this Act; (c) to a third party as authorised by a power of attorney by the data subject concerned; (d) to a legal heir or legatee of a deceased data subject; (e) to the executor of a data subject's estate; (f) to a local regulatory authority or law enforcement agency in accordance with written law; (g) in accordance with a Court order; or (h) to a data user in accordance with the First Schedule. (2) A person who fails to comply with subsection (1), commits an offence and is liable on conviction to a fine of level 5 on the standard scale or imprisonment not exceeding 2 years or both. (3) A person selling or offering to sell data from the CIS commits an offence and is liable on conviction to a fine of level 6 on the standard scale or imprisonment not exceeding 3 years or both. Data submission 27.(1) A data provider shall submit identification and facility information to the CIS in respect of a data subject in accordance with the Second Schedule to this Act. (2) A data provider who fails to provide the requisite information in the CIS in accordance with subsection (1) is liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of a day during which the contravention continues. [20th November 2023] Credit Reporting Act 593 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (3) A person who, with intent to deceive, makes false entries or fails to enter required information in the CIS, commits an offence and is liable on conviction to a fine of Level 6 on the Standard Scale or to imprisonment not exceeding 3 years or both. Data validation 28.(1) Data submitted to the CIS by a data provider shall be validated by the CIS prior to the data upload to the CIS database. (2) A data provider shall be informed of errors identified by the CIS following the data validation process provided for under subsection (1), and the data provider shall, within the timeframe directed by the Central Bank, correct and submit the correct data to the CIS. (3) A data provider who fails, refuses or delays to correct and submit information in accordance with subsection (2) shall be liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of a day during which the contravention continues. Data retention 29.(1) Information reflecting the last 24 months of repayment or non- repayment of active facilities shall be available to data subjects and data users. (2) Positive data collected in the CIS shall be available to data users for a period of 5 years from the date of full repayment of a facility. (3) Negative data collected in the CIS shall be available to data users for a period of 5 years as from — (a) the date of a data subject's full repayment of outstanding balances; (b) the date the debt is written off, settled whether by compromise or through a decision of a court releasing the data subject from liability, or otherwise liquidated; or [20th November 2023] Credit Reporting Act 594 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (c) the date of a data subject's discharge from bankruptcy. Archive 30.(1) The Central Bank shall maintain an archive to store all data collected in the CIS for a period of 25 years from the date at which the data is no longer available to data users, and after which the data shall be erased from the archive. (2) A request to access information stored within the archive shall be managed by the Central Bank. (3) Access to information in the archive shall be limited — (a) to a data subject in relation to the data subject's own information; (b) to the CBS and data provider if relevant to a dispute submitted under section 31; (c) as provided for by a Court order; and (d) to a local regulatory authority or law enforcement agency in accordance with written law. (4) The Central Bank may access and process information, in statistical format, contained within the archive to assist the Central Bank in the formulation of its policies to support financial stability, financial inclusion and monetary policy objectives. Disputes and complaints 31.(1) Where a data subject believes that the data subject's information contained within the CIS is inaccurate, the data subject shall either submit a dispute directly to the data provider or lodge a dispute through the CIS customer credit portal. (2) A data provider shall, within five working days of receipt of a dispute, — [20th November 2023] Credit Reporting Act 595 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (a) amend the information contained within the CIS where it is found that the information contested is erroneous, and inform the data subject and the CIS operator of the amendment in writing; or (b) inform the data subject and the CIS operator in writing where the information contested is correct according to its records. (3) A data provider who fails to respond to a dispute in accordance with subsection (2) is liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of a day during which the contravention continues. (4) A data subject, being dissatisfied with the outcome of the data subject's dispute in accordance with subsection 2, may submit a complaint to the Central Bank. (5) A data provider who is the subject of, or has information relevant to a complaint shall promptly cooperate with the Central Bank in its efforts to resolve the complaint by providing all relevant documents, information and communication to the Central Bank. (6) A data provider who fails to comply with subsection (5) is liable to an administrative penalty not exceeding SCR25,000 and an additional penalty of SCR1,000 for each day or part of a day during which the contravention continues. Examination 32.(1) The Central Bank may carry out an examination of a data provider or data user where the Central Bank determines it is necessary or desirable to ascertain whether they are complying with the provisions of this Act. (2) In conducting an examination under subsection (1), the Central Bank shall have the powers to — [20th November 2023] Credit Reporting Act 596 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (a) access any premises reasonably believed to be premises at which a data provider or data user is carrying on its business; (b) inspect relevant documents or information, and examine those documents or information where they are located or where data is processed; (c) obtain a copy of any documents or information in a form that can be removed and is visible and legible; and (d) inspect equipment, systems or premises used to store or process data, documents or information, and request the running, processing or managing of any such systems. (3) An examination under subsection (1) shall be conducted during business hours by officers of the Central Bank or persons authorised by the Central Bank. (4) The Central Bank and any person authorised under this section to examine a data provider or data user shall be subject to the confidentiality provisions of this Act and section 11 of the Central Bank of Seychelles Act in respect of information acquired in the course of performing functions under this section and may require — (a) a director, officer, employee or agent of a data provider to furnish such information as deemed necessary for the purpose of the examination; or (b) any such director, officer, employee or agent to produce for inspection any books, records or other documents in their possession containing or likely to contain any such information. (5) A director, officer, employee or agent of a data provider or data user who impedes, prevents or obstructs an examination under this section commits an offence and is liable upon conviction to imprisonment not exceeding 2 years or to a fine of Level 5 on the Standard Scale. [20th November 2023] Credit Reporting Act 597 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT PART V - INFRINGEMENTS, REMEDIAL MEASURES AND PENALTIES Offences 33.(1) The Central Bank may impose penalties on data providers and data users if they — (a) contravene provisions relating to the supply of accurate, timely and up-to-date data; (b) fail to collaborate with the Central Bank during an examination; (c) fail to obtain or prove a data subject's consent prior to accessing the CIS; (d) fail to disclose information as lawfully requested by a data subject; or (e) do not adopt adequate security or consumer protection measures. Enforcement action 34.(1) Where a data provider or data user fails to comply with any of the provisions of this Act or any regulations, directives, rules, or guidelines made under this Act, the Central Bank may, in addition to a penalty under this Act, take one or more of the following enforcement actions against the data provider or data user — (a) issue a written warning; (b) issue written orders to cease and desist from such non- compliance and to undertake remedial action; (c) issue written orders to perform such acts as are necessary to comply with the Act, regulations, directions or guidelines; [20th November 2023] Credit Reporting Act 598 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (d) impose administrative penalties, not exceeding SCR1,000 per day for each day or part of a day that the act constituting the non-compliance continues; or (e) restrict, suspend or revoke access to the CIS temporarily or permanently. (2) The enforcement actions specified under this section shall be determined in particular cases by the Central Bank and shall be applied following consideration of — (a) the nature, duration, gravity and extent of the contravention; (b) any loss or damage suffered as a result of the contravention; (c) the monetary gain derived from the contravention; (d) whether the person has previously been found in contravention of similar or different provisions of this Act; and (e) the impact of the contravention on the functioning of the CIS. Right to submit written representation and oral submissions 35.(1) The Central Bank shall before imposing a penalty or taking any enforcement action under section 34, give an opportunity to a data provider or data user to submit a written representation and oral submissions on a matter before the Central Bank within the timeframe specified in writing. (2) Notwithstanding subsection (1), the Central Bank may immediately restrict or suspend a data provider or data user's access to the CIS where the Central Bank is of the reasonable belief that such action is necessary to safeguard the integrity of the CIS. [20th November 2023] Credit Reporting Act 599 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (3) Where a data provider or data subject's access to the CIS has been restricted or suspended in accordance with subsection (2), the Central Bank shall give an opportunity to the data provider or data subject to submit a written representation and oral submissions within the timeframe specified in writing as to why their access should be restored. Publication and sharing of information 36. The Central Bank may publish in a daily newspaper or other media or share with local regulatory authorities, law enforcement agencies or international bodies the following — (a) all general or individual measures adopted under this Act, including enforcement measures, imposition of penalties and its redress decisions; and (b) information extracted from the CIS in a statistical format for educational or information purposes. PART VI - MISCELLANEOUS Protection of action taken in good faith 37. An employee or agent of the Central Bank shall not be liable for damages for anything done or omitted to be done in good faith in the discharge or purported discharge of their functions under this Act. Regulations 38.(1) The Central Bank may, for the purpose of granting effect to the principles and provisions in this Act, make regulations with regard to any matter required by this Act. (2) Without prejudice to the generality of subsection (1), regulations may provide for — (a) fees and services relating to the CIS; (b) credit scoring; [20th November 2023] Credit Reporting Act 600 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT (c) categorisation of data providers; (d) access and submission of data to the CIS; (e) technological security measures for use or access of the CIS; (f) amendment of Schedules; and (g) the efficient implementation, administration and enforcement of this Act. Consequential amendment of (Cap 26) and savings 39.(1) The Central Bank of Seychelles Act (Cap 26) is amended — (a) in section 2 by repealing the definition of “Credit Information System”; and (b) by repealing section 32A. (2) Notwithstanding the repeal under subsection (1) (b), any statutory instrument made under the repealed section shall remain in operation as if made under this Act until it is repealed in accordance with this Act. (3) The Central Bank may amend, vary or repeal such statutory instruments. [20th November 2023] Credit Reporting Act 601 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT FIRST SCHEDULE Sections 9(1) and 26 (1) (g) Category of Data Providers Data Data Users Category 1 Categories 1, 2, 3, 4, Commercial banks, Credit facilities 5, 6 and 8 upon their Development Bank of including consumer designation as a data Seychelles, credit unions, loan, credit card, provider. Housing Finance Company Ltd overdraft and employee loans Category 2 Government, public enterprises Employee loans and the Central Bank Category 3 Entities providing hire Hire purchase, credit purchase, credit sales or sales, financial financial leasing facilities leasing facilities Category 4 Credit facilities Insurance Companies Category 5 Telecommunication and utility Telecommunication companies and Utility bills Category 6 Seychelles Revenue Tax Payments Commission Category 7 Judiciary Bankruptcy Category 8 Employee loans Private Enterprises [20th November 2023] Credit Reporting Act 602 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT SECOND SCHEDULE Section 10(2) Content of the submission of data subject's information by a data provider Identification Information Facility Information Natural Date of birth Person Gender Nationality National Identification Number (NIN) for Seychellois citizen Passport Number for non- Seychellois citizen Customer Identification number allocated by data provider Address Employment Status Employer Sector Income Vital Status Contact Details [20th November 2023] Credit Reporting Act 603 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT Security Details Company Name as reflected on Certificate of Incorporation for companies Registered business name (where applicable) Business registration number Customer identification number allocated by data provider Registered address Taxpayer Identification Number (where applicable) Nature of business Names of directors Legal Form Economic Sector Entity Status Entity Size Contact Details Other Entity Registered name (Partnership, Registration number Association, Customer identification Sole Traders, number allocated by data and NGO) provider Registered address Taxpayer Identification Number (where applicable) Type of entity Names of Partners and Board Members (where applicable) Legal Form Economic Sector Entity Status Entity Size Contact Details [20th November 2023] Credit Reporting Act 604 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT Consent of data subject (Natural Person) Purpose I …………………………………………. (NIN / Passport Number …………………………) provide consent to (name of data requestor) for the retrieval of my information contained within the Credit Information System (CIS), as established by the Credit Reporting Act, for the following purpose(s) - to be used as part of an application for a (facility type), and its management; for personal use Submission, access and use of data I consent to information relating to the facility being procured from the abovementioned entity to be submitted to the CIS and consent that this information may be accessed, processed and used by persons authorised in accordance with the Credit Reporting Act. Signature: ……………………. In the absence of a signature, insert finger print in the box below or produce valid photo identification. Witnessed by [Name] of [Name of entity]. Signature: Date: [20th November 2023] Credit Reporting Act 605 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT Consent of data subject (Company/Other Entity) Purpose I/We …………………………………………. (NIN/Passport Number …………………………) ………………………………………………. (NIN/Passport Number …………………………) ………………………………………………. (NIN/Passport Number …………………………) ………………………………………………. (NIN/Passport Number …………………………) ………………………………………………. (NIN/Passport Number …………………………) provide consent to (name of data requestor) for the retrieval of information pertaining to (insert name of entity) contained within the Credit Information System (CIS), as established by the Credit Reporting Act, for the following purpose(s) - to be used as part of an application for a (facility type), and its management; for business use Submission, access and use of data I/We consent to information relating to the facility being procured from the abovementioned entity to be submitted to the CIS and consent that this information may be accessed, processed and used by persons authorised in accordance with the Credit Reporting Act. Where consent is being provided for and on behalf of an entity, I confirm that I am authorised to consent and sign on behalf of (insert name of entity). Signature(s): ……………………. ……………………. ……………………. ……………………. ……………………. [20th November 2023] Credit Reporting Act 606 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT In the absence of a signature, insert finger print(s) in the box below or produce valid photo identification. Witnessed by [Name] of [Name of entity]. Signature: Date: FOURTH SCHEDULE Sections 14(2)(b) and 15(b) Report fees 1. Any additional credit report requested by a SCR25.00 data subject from a data user during the calendar year 2. Any additional access report requested by a SCR50.00 data subject from the CIS Operator during the calendar year 3. Credit report requested by a data user from SCR25.00 the CIS I certify that this is a correct copy of the Bill which was passed by the National Assembly on 24th October, 2023. Mrs. Tania Isaac Clerk to the National Assembly