Experian Nederland B.V. – €2,700,000 Fine (Netherlands, 2025)

The controller is Experian Nederland B.V.. It offered, among other things, the Credit Check service, from where its clients could obtain information about the creditworthiness of a consumer and take it into consideration it in a decision about entering into a contract with that consumer. On 6 December 2023, the DPA (AP), after investigations, imposed a fine in the amount of €2,700,000 on Experian for the violation of Article 5(1)(a) in conjunction with Article 6(1) GDPR and the violation of Article 12(1) in conjunction with Article 14(1) and Article 14(2) GDPR. Experian, then, lodged an internal appeal against the decision before the DPA, claiming that it processed personal data under legitimate interest, the offering of its creditworthiness assessment service. In January 2025, Experian terminated its services as a credit information agency, and therefore no longer processed personal data for this purpose. First, the DPA found that since personal data have not been obtained from data subjects, it was up to Experian to inform them about the processing, its purposes, the legal grounds for the processing, the legitimate interests involved and the rights a data subject has to access, rectification and data erasure (Article 14(1) and Article 14(2) GDPR). The DPA highlighted that it should have taken active steps in this regard. The DPA concluded that Experian failed to provide proof that it met the information obligations, in violation of Article 12(1) GDPR and Article 14 GDPR. It also found that Experian violated the principles of transparency and fairness (Article 5(1)(a) GDPR). Second, it found that the legitimate interest that Experian claimed failed the balancing test. More specifically: •Regarding the legitimate interest pursued, the DPA acknowledged that it was lawful. •With regard to the necessity of processing criterion, the DPA held that Experian had not made sufficiently clear why the processing of certain personal data was strictly necessary, and not merely nice to have, for the preparation of creditworthiness assessments. •Lastly, regarding the balancing of interests, the DPA pointed out that the processing of financial data (including bankruptcies and negative payment records) constitutes a serious interference with the fundamental rights of the data subject enshrined in Articles 7 and 8 of the Charter because they constitute sensitive information about their private life. Additionally, Experian processed a large amount of personal data from a (very) large number of data subjects, while an assessment of creditworthiness was not requested in all cases. As far as reasonable expectations were concerned, it is relevant that there was no relationship at all between Experian, as the party responsible for processing, and the data subject whose data are processed. The safeguards put in place by Experian, in particular regarding the accuracy of the data, were - in light of the foregoing - insufficient to mitigate the consequences for data subjects. This means that the DPA concluded, based on its investigation, that the interests or fundamental rights and freedoms of the data subjects outweighed the legitimate interest invoked by Experian. Therefore, the DPA found a violation of Article 5(1)(a) GDPR and Article 6(1) GDPR. Lastly, the DPA remained of the opinion, based on the facts, that a fine in the amount of €2,700,000 was appropriate for the GDPR violations at hand.