Schedule 1 Amendments (b) both: (i) a credit reporting body holds credit reporting information relating to one or more individuals; and (ii) the credit reporting body is required to comply with section 20Q in relation to the credit reporting information; or (c) both: (i) a credit provider holds credit eligibility information relating to one or more individuals; and (ii) the credit provider is required to comply with subsection 21S(1) in relation to the credit eligibility information; or (d) both: (i) a file number recipient holds tax file number information relating to one or more individuals; and (ii) the file number recipient is required under section 18 not to do an act, or engage in a practice, that breaches a section 17 rule that relates to the tax file number information. Eligible data breach (2) For the purposes of this Act, if: (a) both of the following conditions are satisfied: (i) there is unauthorised access to, or unauthorised disclosure of, the information; (ii) a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates; or (b) the information is lost in circumstances where: (i) unauthorised access to, or unauthorised disclosure of, the information is likely to occur; and (ii) assuming that unauthorised access to, or unauthorised disclosure of, the information were to occur, a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates; then: 6 Privacy Amendment (Notifiable Data Breaches) Act 2017 Authorised Version C2017A00012 No. 12, 2017