ICO Orders 'Fundamental Changes' from Experian

In the UK, the Information Commissioner's Office (ICO) has ordered information giant Experian to make 'fundamental changes' to the way it handles people's personal data for marketing services purposes. Experian CEO Brian Cassin says his company will appeal the decision.

The enforcement notice follows a two-year investigation by the ICO into how credit reference agencies (CRAs) Experian, Equifax and TransUnion were trading, enriching and enhancing people's personal data without their knowledge; with processing resulting in products being used by commercial organisations, political parties and charities to find new customers, identify the people most likely to be able to afford goods and services, and build individual profiles. As a result of the ICO's work, all three CRAs made improvements to their direct marketing services business. Equifax and TransUnion withdrew some products and services, and the ICO is taking no further action against these two companies.

The Office says Experian made progress in improving compliance, but did not go far enough. The company also did not accept it was required to make the changes set out by the ICO, and was not prepared to issue privacy information directly to individuals, nor cease the use of credit reference data for direct marketing purposes. As a result, the ICO has lodged an enforcement notice with Experian, compelling it to make changes within nine months - by July 2021 - or risk further action. This notice requires the company to inform people that it holds their personal data and how it is using or intends to use it for marketing purposes. Should Experian fail to do so, ICO action could include a fine of up to £20m or 4% of the organisation's total, annual worldwide turnover.

In response, Experian CEO Cassin stated that his firm does not track Internet activity, or collect actual consumer purchases, behavioural data or actual preferences, nor is there any location tracking of individuals. He also said that Experian believes that the ICO's view of data use goes beyond the legal requirements of GDPR, adding: 'We disagree with the ICO's decision today and we intend to appeal'.

Web sites: www.ico.org.uk and www.experianplc.com .