18. (1) Where a credit information subject gives notice to the Bank that the credit information subject reasonably believes that the credit information subject may have been, may be being or may be about to be impersonated by any person, the Bank shall enter a notice of suspected impersonation on the Register as soon as is reasonably practicable and (in any event) within 48 hours of receiving the notice.

(2) The Bank shall remove the notice of suspected impersonation if the credit information subject gives it notice requiring it to do so.

(3) Subject to subsection (2), the Bank shall remove the notice of suspected impersonation at the end of the period of 90 days beginning with the day on which it is entered on the Register unless the credit information subject gives notice before the end of that period requiring the Bank to retain it.

(4) Where notice is given under subsection (3) the Bank shall, subject to subsection (2), retain the notice of suspected impersonation for the period specified in the notice under subsection (3) or (if shorter) the period of 90 days beginning with the day on which it would otherwise be removed under subsection (3).

(5) Where a notice of suspected impersonation of a credit information subject is entered on the Register, the Bank shall notify the credit information subject as soon as is reasonably practicable and (in any event) within 48 hours if—

(a) an application is made to access information held on the Register which relates to the credit information subject, or

(b) information is provided to the Bank in consequence of a credit application or credit agreement made by the credit information subject.

(6) Where the Bank gives any person access to information held on the Register which relates to a credit information subject at a time when a notice of suspected impersonation of the credit information subject is held on the Register, the Bank shall bring the notice to the person’s attention.