Experian Limited – Violation Found (United Kingdom, 2020)

The ICO autonomously started an investigation into the three major Credit Reference Agencies ('CRAs') in 2018 under the Data Protection Act 1998. The investigation was paused and then resumed after the new GDPR entered into force in order to ensure the violations were addressed under the modern data protection regime, rather than a historical legal position, given the importance and relevance of such processing activities. The processing in question is on a very large scale (roughly 50 million people resident in the UK, with more than 500 attributes for each person). Experian acquired this information from a variety of sources and it also include credit reference data, which could lead to unexpected and 'invisible' processing activities. Experian uses them to propose a variety of marketing-led products (eg. Mosaic and Channelview), which are sold to third parties to enable them more targeted and effective direct marketing to data subjects. Having found several violations of the new Regulation, the Commissioner issued a Preliminary Enforcement notice on 17 April 2019 to Experian. Afterwards, Experian collaborated with the Authority and provided further details and documents in order to make the improvements requested. On 20 April 2020, a revised Enforcement Notice was proposed. The ICO had to determine whether all the information requested by art. 13 and 14 of the GDPR are clearly communicated to the data subjects involved in the processing activity carried out by Experian. Then, the Authority needs to establish if the lawful grounds used by Experian and its suppliers are correct and understood by the data subjects involved. The ICO found three main categories of failures on Experian's approach to data protection compliance: 1. Transparency and fairness The privacy notice and the Consumer information portal ('CIP') drafted by Experian were insufficiently clear in explaining how data is collected, processed and sold, in particular in relation to the credit data us