(1) Where a credit information subject gives notice to the Bank that the credit information subject reasonably believes that the credit information subject may have been, may be being or may be about to be impersonated by any person, the Bank shall enter a notice of suspected impersonation on the Register as soon as is reasonably practicable and (in any event) within 48 hours of receiving the notice.
(2) The Bank shall remove the notice of suspected impersonation if the credit information subject gives it notice requiring it to do so.
(3) Subject to subsection (2), the Bank shall remove the notice of suspected impersonation at the end of the period of 90 days beginning with the day on which it is entered on the Register unless the credit information subject gives notice before the end of that period requiring the Bank to retain it.
(4) Where notice is given under subsection (3) the Bank shall, subject to subsection (2), retain the notice of suspected impersonation for the period specif
…