Part 2: General processing Chapter 2: The GDPR Section 13: Obligations of credit reference agencies
This section concerns the treatment of right of access requests by data subjects under Article 15 of the GDPR when the data controller is a credit reference agency.
	Subsection (2) retains the effect of section 9(2) of the 1998 Act. It deems a data controller’s obligations under Article 15 of the GDPR as limited to information concerning the data subject’s financial standing unless the data subject has indicated a contrary intention.
	Where the controller discloses personal data in pursuance of Article 15 of the GDPR, subsection (3) requires the disclosure to be accompanied by a statement informing the data subject of their rights under section 159 of the Consumer Credit Act 1974. This continues the position under section 9(3) of the 1998 Act.