Experian is now required to make changes to its data processing procedures within nine months or risk further action. This could include a fine of up to £20m or 4% of the organisation’s total annual worldwide turnover.

The enforcement notice follows a two-year investigation by the ICO into how Experian, Equifax and TransUnion used personal data within their data broking businesses for direct marketing purposes.

As a result of the ICO’s work, all three credit reference agencies (CRAs) made improvements to their direct marketing services business. Equifax and TransUnion made the improvements alongside withdrawing some products and services. The ICO is therefore taking no further action against them.

The investigation found how the three CRAs were trading, enriching and enhancing people’s personal data without their knowledge. This processing resulted in products which were used by commercial organisations, political parties or charities to find new customers, identify the people most likely to be able to afford goods and services, and build profiles about people.

The ICO found that significant ‘invisible’ processing took place, likely affecting millions of adults in the UK. It is ‘invisible’ because the individual is not aware that the organisation is collecting and using their personal data, which is against data protection law.

Although the CRAs varied widely in size and practice, the ICO found significant data protection failures at each company. As well as the failure to be transparent, the regulator found that personal data provided to each CRA, in order for them to provide their statutory credit referencing function, was being used in limited ways for marketing purposes.

Some of the CRAs were also using profiling to generate new or previously unknown information about people, which is often privacy invasive.

In addition, the ICO said that although the CRAs did provide some privacy information on their websites about their data broking activities, their privacy information did not clearly explain what they were doing with people’s data. They were also using certain lawful bases incorrectly for processing people’s data.

Overall, the ICO found the information the CRAs are privileged to hold for statutory credit reference purposes was unlawfully used by them in their capacity as a data broker, with poor regard for what people might want or expect.

Experian

The ICO ruled that although Experian made progress in improving compliance, it did not go far enough.

Experian did not accept that they were required to make the changes set out by the ICO, and as such were not prepared to issue privacy information directly to individuals nor cease the use of credit reference data for direct marketing purposes.

Information Commissioner Elizabeth Denham said: ‘The data broking sector is a complex ecosystem where information appears to be traded widely, without consideration for transparency, giving millions of adults in the UK little or no choice or control over their personal data.

‘The lack of transparency and lack of lawful bases combined with the intrusive nature of the profiling has resulted in a serious breach of individuals’ information rights.’

The ICO’s notice requires Experian to inform people that it holds their personal data and how it is using or intends to use it for marketing purposes. Experian has until July 2021 to do this subject to any appeal.

The ICO also requires Experian to stop using personal data derived from the credit referencing side of its business by January 2021, which it does currently for limited direct marketing purposes.

In the enforcement notice, the ICO states that people have no choice about whether their data is shared with Experian for credit referencing purposes and that Experian’s processing of this data for marketing purposes is unexpected.

As an example it should stop screening out prospective customers from marketing lists on the basis of financial status.

The enforcement notice applies to the marketing services Experian provides in the UK , which account for 1% of Experian’s Group revenue worldwide.

Brian Cassin, Experian CEO, said: ‘We disagree with the ICO’s decision today and we intend to appeal.

‘At heart this is about the interpretation of GDPR and we believe the ICO’s view goes beyond the legal requirements.

‘This interpretation also risks damaging the services that help consumers, thousands of small businesses and charities, particularly as they try to recover from the Covid-19 crisis.

‘We use long standing publicly and commercially available sources to build our marketing products, such as the edited electoral roll, the UK Census and market research data. 

‘We develop statistical models from data to infer insights useful to businesses and public bodies in order that they can function more efficiently.

‘We do not track internet activity nor do we collect actual consumer purchases, behavioural data or actual preferences, nor is there any location tracking of individuals.’

The campaign group Privacy International, which raised concerns about the data broking industry in a complaint to the ICO in 2018, welcomed the report.

Privacy International said: ‘Data brokers are key actors in the hidden data ecosystem. The data they collect and later sell can be used for a range of different purposes, from commercial advertising to political campaigning, and in some worrying instances, law enforcement.

‘Most people will never have heard of these companies, as most data brokers are not consumer facing or household names. People cannot assert their rights if there is no transparency around who is collecting their personal data and for what purpose.

‘While these companies claim that they can process people's data with or without their consent, today's report has made it clear that the consent relied on to pass on data to third parties was often invalid.

‘Therefore, the ICO's announcement today about three of the most recognisable data brokers in the ecosystem is an important step forward.’

Further reading:

ICO Experian enforcement notice