Section 22
of Credit Reporting Agencies Act 2010
Section 22
No credit reporting agency shall collect any credit information about a customer unless—
(a)
the credit information is collected for a specific and lawful purpose directly related to an activity of the credit reporting agency and shall not be further processed in any manner incompatible with that purpose;
(b)
the collection of the credit information is necessary for or directly related to that purpose; and
(c)
the credit information is adequate but not excessive in relation to that purpose.
(2)
A credit reporting agency which contravenes subsection (1)
commits an offence and shall, upon conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
(3)
The collection and use of credit information by a credit reporting agency under subsection (1) shall not require the consent of the customer concerned.