S.L. 376.10 Art. 19 Databases.     Cap. 586.

(1) A creditor making use of public and private databases to assess the creditworthiness of consumers shall comply with the applicable provisions of the General Data Protection

Regulation and the Data Protection Act, including any regulations made thereunder, and shall not process:

(a) special categories of data as referred to in Article 9(1) of the said Regulation; and

(b) personal data processed from social networks.

(2) If the credit application is rejected on the basis of a consultation of a database referred to sub-regulation (1), the creditor shall inform the consumer immediately and free of charge of the result of such consultation and of the particulars of the details of the database consulted as well as the categories of data taken into account.