36Protection of personal information and designated business groups

1. This section applies to personal information that is either—

2. identity or verification information received for the purposes of section 32(1)(a); or
3. information received for the purposes of section 32(1)(b).

4. Any information supplied by any member of a designated business group to another member of that group must be subject to privacy protections at least equivalent to those set out in information privacy principles 5 to 12 set out in section 22 of the Privacy Act 2020.

5. Each member of the designated business group must agree, in writing, to comply with information privacy principles 5 to 12 set out in section 22 of the Privacy Act 2020 or their equivalent if the member is resident overseas.

6. The entity that provides information to another member of its designated business group remains responsible for the use or disclosure of that information.

7. A reporting entity may use or disclose information to which this section applies only as follows:

8. it may use identity and verification information received for the purposes of section 32(1)(a) in a suspicious activity report:
9. it may disclose information for the purposes of section 32(1)(b) to another member of the designated business group unless such disclosure is likely to result in a suspicious activity report being filed in an overseas jurisdiction by the member to whom the information is disclosed.