ICO takes enforcement action against Experian after PI complaint

After a two year investigation into credit referencing agencies (CRAs) Experian, Equifax and TransUnion - initiated in part pursuant to a complaint filed by PI against Equifax and Experian in November 2018 - the ICO has published a report finding "widespread and systemic data protection failings" in the data broking sector. Pursuant to its investigation, the ICO issued an enforcement notice against Experian, requesting the company to achieve compliance with data protection laws within nine months. 

The ICO report highlighted that the combined CRAs' data processing activities concerned millions of individuals, almost every adult in the UK. Despite this, the ICO noted that the CRAs remained relatively unknown to the individuals whose data they processed, allowing for significant 'invisible' processing to take place. Further, all three CRAs were found to use personal data to create aggregated and anonymous profiling models which could be applied at postcode level.