17. (1) The Bank shall, following consultation with the Data Protection Commissioner and with the consent of the Minister, make regulations which make provision about—

(a) applications to access information under section 14 or 15,

(b) the information to which the Bank is to be required to give access in response to such applications,

(c) when access to the information is to be given, and

(d) the manner in which access to the information is to be given.

(2) Regulations under subsection (1) may make different provision in relation to—

(a) different classes of persons who are applicants to access information held on the Register, or

(b) different descriptions of information so held.

(3) A credit information provider shall keep for 5 years a record of each occasion on which the credit information provider has been given access to information held on the Register under section 14 or 15.

(4) A credit information provider shall, if required to do so by the Bank, provide to the Bank information about any occasion on which the credit information provider has been given access to information held on the Register in response to an application under section 14 or 15.

(5) The Bank shall keep for 5 years a record of each occasion on which access has been given to information held on the Register in response to an application under section 14 or 15.

(6) A credit information subject may by notice to the Bank require the Bank to provide a record of—

(a) each occasion on which access has been given to information held on the Register which relates to the credit information subject in response to applications made under section 14 or 15 within the period of 5 years ending with the day on which the notice is given,

(b) the identity of the persons by whom the applications were made, and

(c) the dates on which they were made.