SCHEDULE 2CONDITIONS FOR PERMITTED DISCLOSURE
PART 2DISCLOSURE TO CREDIT REFERENCE AGENCY
6
F11
The credit reference agency—
a
is carrying on in the United Kingdom F5... a business comprising the furnishing of information relevant to the financial standing of individuals, being information collected by the agency for that purpose;
b
maintains appropriate procedures—
i
to ensure that an independent person can investigate and audit the measures maintained by the agency for the purposes of ensuring the security of any protected information disclosed to that agency; and
ii
for the purposes of ensuring that it complies with its F6obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);
c
has not been found guilty of an offence under—
i
ii
section 47 (failure to comply with enforcement notice) of the Data Protection Act 1998 in circumstances where it has used the protected information for purposes other than those described in sub-paragraphs (a) to (e) of paragraph 7 belowF4; or
F4ii
for the purposes of ensuring that it complies with its data protection obligations;
F2d
has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.
F72
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .