The credit reporting provisions of the Privacy Act 1988 regulate the transfer of an individual's consumer credit information in the private sector within the credit reporting industry. They also restrict the information that may be disclosed by banks, building societies and other credit providers (as defined in the Act) relating to an individual's credit worthiness. With some exceptions they do not apply to commercial credit. The two principles enshrined by the provisions are that 'credit provider needs to know only information on whether an individual is a good or bad credit risk' and 'people who aren't credit providers have no need to know an individual's credit information'. For example, a credit reporting agency may not keep details of an individual's political, social or religious beliefs or affiliations, criminal record, medical history or physical handicap, race, ethnic origins, sexual preference, lifestyle, character or reputation [s 18E]. The Privacy Commissioner has issued (under section 18A(1) a legally binding code of conduct for credit providers and credit reporting agencies which promises amongst other things, retention of only accurate permitted records, proper dispute resolution procedures and prompt access and amendment where appropriate. Breach of the code is an interference with privacy and a complaint may be made to the Privacy Commissioner.