The Overseas Companies Regulations 2009

6.— [F1 (1)]  The credit reference agency—

(a) is carrying on in the United Kingdom or in another EEA State a business comprising the furnishing of information relevant to the financial standing of individuals, being information collected by the agency for that purpose;

(b) maintains appropriate procedures—

(i) to ensure that an independent person can investigate and audit the measures maintained by the agency for the purposes of ensuring the security of any protected information disclosed to that agency; and

[F2 (ii) for the purposes of ensuring that it complies with its data protection obligations;]

(c) has not been found guilty of an offence under—

(i) section 1112 (general false statement offence) of the Companies Act 2006 or section 2 of the Fraud Act 2006 M1 (fraud by false representation);F3 ...

(ii) section 47 (failure to comply with enforcement notice) of the Data Protection Act 1998 in circumstances where it has used the protected information for purposes other than those described in sub-paragraphs (a) to (e) of paragraph 7 below[F4 ; or ]

[F4 (ii) for the purposes of ensuring that it complies with its data protection obligations;]

[F5 (d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.]

[F6 (2) In this paragraph, “data protection obligations”, in relation to a credit reference agency, means—

(a) where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);

(b) where the agency carries on business in a EEA State other than the United Kingdom, obligations under—

(i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018),

(ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and

(iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).]

Textual Amendments

F1 Sch. 2 para. 6 renumbered as Sch. 2 para. 6(1) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 340(2) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F2 Sch. 2 para. 6(1)(b)(ii) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 340(3) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F3 Word in Sch. 2 para. 6(1)(c)(i) omitted (25.5.2018) by virtue of Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 340(4)(a) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F4 Sch. 2 para. 6(1)(c)(iii) and word inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 340(4)(b) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F5 Sch. 2 para. 6(1)(d) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 340(5) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F6 Sch. 2 para. 6(2) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 340(6) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

Marginal Citations

M1 2006 c.35.