ICO v Experian – Defining Legitimate Interests

The case of The Information Commissioner v Experian Limited is an unusual case in which the ICO has been ruled against multiple times. The ICO claims that Experian has defied the GDPR and other data protection legislation because it uses customer data for direct marketing purposes, specifically, selling people’s data to third parties relying upon the lawful basis of ‘legitimate interests’.

Case History

Following a 2017 probe by the ICO, Experian and two other credit reference agencies Equifax and Transunion have been collecting and selling customer data and selling it to third parties for marketing purposes. Equifax and Transunion have since changed their policies but Experian continued and the ICO issued an enforcement notice in 2020, along with a potential fine of up to £208 million. 

This enforcement notice was successfully appealed by Experian in 2023 in a First-tier Tribunal ruling, and they were found to not be in breach of the GDPR, claiming they had a legitimate interest in processing the data in this way. The ICO appealed this decision, but on 23rd April 2024, it was overruled once again by the Upper Tribunal. 

CEO of the Data & Marketing Association Chris Combemale stated that the data processing by Experian offered “benefits to the individual […] receiving the relevant offers”, but Information Commissioner John Edwards asserts that “I believe the Tribunal has got the law wrong”. – Source 

The ICO could be seen as doubly embarrassed now after a second rejection of their claims that Experian is in violation of the GDPR, but this decision could have a further reaching effect on the future of legitimate interests as a basis for data processing. Article 6 of the GDPR says that organisations must have a legitimate reason for processing personal data and that those who do use legitimate interest as a basis for processing must take on additional responsibility for protecting individuals’ rights. There also must be a balance between the interests of the data controller or processor and those of the individual. Could the Tribunals be setting a dangerous precedent in this case?

How Does Experian Process Customer Data?

Experian has published an explanation of how they process customer data on their website in their consumer information portal (CIP), featuring a summary that states the following:

“We work with household brands and public service organisations, such as car manufacturers or local councils, so you receive advertising and information that is most relevant to you. We also try to make sure you aren’t sent marketing about products, offers or services that aren’t right for you.” – Source

They also include a downloadable version of an ‘Article 14 notice’ referring to Article 14 of the GDPR, which refers to the data subject’s right to be informed about what data is processed about them and why. The Experian consumer information portal also has a dedicated section called ‘our legal basis for processing your data’ – read it here.  

A word on this case from Mike Martin the Data Protection Lead at the Griffin House Consultancy 

One of the most challenging risk assessments that a Controller must undertake is a Legitimate Interest Assessment (LIA). Not because they are difficult to do, but because the third part, the balance test, is so nuanced that it can often be argued in any way that interested parties wish. For example, marketing and fundraising teams will always stress that their processing activity is for the good of the organisation and ‘not privacy intrusive’, whereas DPOs and privacy rights groups will argue the opposite case.

To demonstrate the uncertainty in this area, in June 2023 a Dutch court ruled that a Controller who obtained the details of doctors from the public domain to write to them and place their details on a public domain register was unlawful, and the Controller could not rely upon legitimate interests. However, in the same year, the German Supreme Court held that an online platform collecting and publishing personal data of medical doctors in connection with user reviews does not violate the GDPR.

I must confess to finding the decision of the First and Upper Tier Tribunals interesting. Taking into account the spirit of the GDPR and guidance from the European Data Protection Board (EDPB), in my opinion, the ICO interpreted the GDPR legislation correctly, albeit, I believe the evidence from the ICO’s subject matter expert was flawed. For example, in the UTT ruling, they stated ‘We do not accept the emotive evidence from Mr Hulme that the use of CRA data to screen individuals stigmatises poor people’. This perfectly demonstrates that a risk assessment should be based on evidence and not on emotions or subjection.

That the Tribunals stated that Experian can rely upon the privacy policies of third parties, some of which did not even mention Experian’s name was not expected. As long as a Controller has a lawful basis then processing can take place, and the Tribunals confirmed that whilst some of the original data was collected under consent Experian could then process the data under their legitimate interests. I do find the fact that even though Experian are processing the records of, and profiling millions of UK residents, the Tribunals did not agree with the ICO position which stated that ‘Experian’s processing was intrusive, non-transparent and harmful.’

The Precedent Set by ICO v Experian

This case highlights the complexity and nuance required in the application of data protection laws, as well as the need for a balance between protecting individual privacy and allowing businesses to use data for legitimate purposes, including marketing. The decisions of the Tribunals could set a precedent that influences future decisions about what constitutes legitimate interest’, leading to potential uncertainties in how the GDPR is interpreted.

Author: Paul Adams LLB (HONS)

Paul is an information governance specialist and one of the founder Directors of the Griffin House Consultancy, a leading specialist data protection and information governance consultancy firm that supports hundreds of clients annually with their training, consulting and auditing requirements.