ICO takes enforcement action against Experian after data broking investigation

The Information Commissioner’s Office (ICO) orders the credit reference agency Experian Limited to make fundamental changes to how it handles people’s personal data within its direct marketing services.

The enforcement notice follows a two-year investigation by the ICO into how Experian, Equifax and TransUnion used personal data within their data broking businesses for direct marketing purposes. A complaint from the campaign group Privacy International to the ICO also raised concerns about the data broking industry, specifically Equifax and Experian.

As a result of the ICO’s work, all three credit reference agencies (CRAs) made improvements to their direct marketing services business. Equifax and TransUnion made the improvements alongside withdrawing some products and services. The ICO is therefore taking no further action against them.

The investigation found how the three CRAs were trading, enriching and enhancing people’s personal data without their knowledge. This processing resulted in products which were used by commercial organisations, political parties or charities to find new customers, identify the people most likely to be able to afford goods and services, and build profiles about people.

The ICO found that significant ‘invisible’ processing took place, likely affecting millions of adults in the UK. It is ‘invisible’ because the individual is not aware that the organisation is collecting and using their personal data. This is against data protection law.

Findings from the investigation have been published today in an ICO report into data protection compliance in the direct marketing data broking sector.

Although the CRAs varied widely in size and practice, the ICO found significant data protection failures at each company. As well as the failure to be transparent, the regulator found that personal data provided to each CRA, in order for them to provide their statutory credit referencing function, was being used in limited ways for marketing purposes. Some of the CRAs were also using profiling to generate new or previously unknown information about people, which is often privacy invasive.

Other thematic failings identified were:

• Although the CRAs did provide some privacy information on their websites about their data broking activities, their privacy information did not clearly explain what they were doing with people’s data;
• Separately, they were using certain lawful bases incorrectly for processing people’s data.

Although Experian made progress in improving compliance, it did not go far enough. Experian did not accept that they were required to make the changes set out by the ICO, and as such were not prepared to issue privacy information directly to individuals nor cease the use of credit reference data for direct marketing purposes. As a result, Experian has been given an enforcement notice compelling it to make changes within nine months or risk further action. This could include a fine of up to £20m or 4% of the organisation’s total annual worldwide turnover.

Information Commissioner Elizabeth Denham said:

“Our investigation uncovered data protection failings that likely affected millions of adults in the UK. Our investigation has changed the way credit reference agencies operate their offline direct marketing services. It has found invisible processing, allowing people to better understand how their data is being used, meaning people can exercise their privacy and data protection rights.

“The information the CRAs are privileged to hold for statutory credit reference purposes was unlawfully used by them in their capacity as a data broker, with poor regard for what people might want or expect.

“The data broking sector is a complex ecosystem where information appears to be traded widely, without consideration for transparency, giving millions of adults in the UK little or no choice or control over their personal data. The lack of transparency and lack of lawful bases combined with the intrusive nature of the profiling has resulted in a serious breach of individuals’ information rights.

“The trade in personal data with other organisations has implications beyond the industry. Disrupting the flow of non-compliant personal data will have significant impact not just across the sector but will drive benefits for individuals and organisations wherever this data is used.

“I am encouraged by Equifax and TransUnion’s willingness to change their practices and put people’s legal rights first. Now I expect the data broking sector to make the same commitments.”

The ICO decided an enforcement notice would be the most effective and proportionate way to achieve compliance in this situation. It is a powerful regulatory tool to require an organisation to stop processing personal data in a certain way and the most likely tool to achieve the results necessary to change behaviour.

The ICO’s notice requires Experian to inform people that it holds their personal data and how it is using or intends to use it for marketing purposes. Experian has until July 2021 to do this subject to any appeal.

The ICO also requires Experian to stop using personal data derived from the credit referencing side of its business by January 2021, which it does currently for limited direct marketing purposes. In the enforcement notice, the ICO states that people have no choice about whether their data is shared with Experian for credit referencing purposes and that Experian’s processing of this data for marketing purposes is unexpected.

As an example it should stop screening out prospective customers from marketing lists on the basis of financial status.

Other key requirements of the notice include:

• Setting out improvements to privacy information to make clear what personal data is collected, where it has come from, what it is being used for or who the data is being sold to and why.
• Deleting any data supplied to Experian under the lawful basis of consent which is now being processed using a different lawful basis of legitimate interests.
• Stop the processing of any personal data that has been collected unlawfully.

The ICO’s engagement and educational work in this area is ongoing, with further audit findings to be published when they are concluded.

Notes to Editors

1. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
2. The ICO has specific responsibilities set out in the Data Protection Act 2018 (DPA2018), the General Data Protection Regulation (GDPR), the Freedom of Information Act 2000 (FOIA), Environmental Information Regulations 2004 (EIR), Privacy and Electronic Communications Regulations 2003 (PECR) and a further five Acts / Regulations.
3. Article 5 of the GDPR requires that personal data shall be:
   • Processed lawfully, fairly and in a transparent manner in relation to individuals;
   • Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
   • Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
   • Accurate and, where necessary, kept up to date
   • Kept in a form which permits identification of data subjects for no longer than is necessary; and
   • Processed using appropriate technical or organisational measures in a manner that ensures appropriate security of the personal data.
   • Article 5(2) requires that “the controller shall be responsible for, and be able to demonstrate, compliance with the principles.”
4. Section 146 of the DPA 2018 contains a provision for the Information Commissioner to issue an assessment notice. It’s a notice the ICO issues to a data controller or processor to allow it to audit and assess whether they are compliant with data protection legislation.
5. Section 149 of the DPA 2018 contains a provision for the Information Commissioner to issue an enforcement notice. It orders specific actions by an individual or organisation to resolve breaches (including potential breaches). An individual or organisation can be fined for failing to comply with the terms of an enforcement notice.
6. Organisations issued with an ICO enforcement notice have the right to appeal to the First Tier Tribunal (Information Rights) within 28 days of receiving the notice.
7. The ICO investigation into data analytics for political campaigns is one example of where invisible processing and profiling prevented people from exercising their data protection rights. As part of that investigation, the ICO announced that it had served assessment notices to Experian, Equifax and TransUnion (formerly Callcredit) in order to investigate the data broking sector further.
8. Data broking involves collecting people’s personal data from a variety of sources, then combining it and selling or licensing it to other organisations to support direct marketing.
9. The scope of this investigation was limited to ‘offline’ data broking. Offline direct marketing services focus on providing marketing to individuals through methods other than the internet. This can include postal, telephone and SMS marketing. It also means that the focus of the profiling activities we investigated and address in this report does not include data collected about an individual’s online behaviours. We are investigating participants in the online advertising industry separately.
10. The scope of the investigation did not cover online data broking. It also did not extend beyond looking at the provision of marketing services by the data brokers. In the context of the CRAs, this means that the investigation did not look at their credit referencing functions.