Experian to appeal ICO's decision on data use

The statement came after the ICO ordered Experian to make "fundamental changes" to how it handles people’s personal data within its direct marketing services.

The enforcement notice followed a two-year investigation by the ICO into how Experian, Equifax and TransUnion used personal data within their data broking businesses for direct marketing purposes.

The ICO’s notice requires Experian to inform people that it holds their personal data and how it is using or plans to use it for marketing purposes. Experian has until July next year to do this subject to any appeal.

Experian will also need to stop using personal data derived from the credit referencing side of its business by January 2021.

Other key requirements of the notice include setting out improvements to privacy information to make clear what personal data is collected, where it has come from, what it is being used for or who the data is being sold to and why and ending the processing of any personal data that has been collected unlawfully.

Experian’s chief executive officer Brian Cassin said the company plans to appeal the decision.

"At heart this is about the interpretation of GDPR and we believe the ICO's view goes beyond the legal requirements. This interpretation also risks damaging the services that help consumers, thousands of small businesses and charities, particularly as they try to recover from the Covid-19 crisis," he said.

"We develop statistical models from data to infer insights useful to businesses and public bodies in order that they can function more efficiently. We do not track internet activity nor do we collect actual consumer purchases, behavioural data or actual preferences, nor is there any location tracking of individuals," he added.

Experian pointed out that the enforcement notice only applies to its UK marketing services business, which makes up just 1% of group revenues.