(1) Where a creditor or an owner refuses to enter into an agreement with a consumer, he shall disclose to the consumer the name and address of any person from whom he sought information concerning the financial standing of the consumer who gave information which influenced the refusal, within 14 days after receiving a request in writing to that effect from the consumer.
(2) Subsection (1) does not apply to a request -
(a) received more than 28 days after the refusal, or
(b) which relates to information that constitutes personal data to which the Data Protection Regulation applies.
(3) Subject to subsection (4), a person who has supplied information to a creditor or an owner in respect of the financial standing of a consumer in respect of an agreement shall provide the consumer with a copy in legible form of any information held by the person concerning the financial standing of the consumer. The information must be provided within 14 days after the person has received from the consumer
…