Experian appeal over legitimate interests processing, decision published

On Friday, law firm Pinsent Masons wrote about a long-awaited First-Tier Tribunal decision in the appeal brought by credit reference agency Experian against an enforcement notice issued by the Information Commissioner’s Office (ICO) in 2020 that was due to be made public. The article includes a detailed summary of the history of the case and points out its significance for businesses relying on legitimate interests for processing personal data.  

Time moves on quickly in the privacy industry because this morning, Monday, 20 February 2023, the Courts and Tribunals Judiciary published the General Regulatory Decision in the Experian Limited v Information Commissioner (EA/2020/0317) case. The judgment supports aspects of the action taken by the ICO in its enforcement notice but allows Experian’s appeal in other areas. While more detailed legal analysis is likely to follow from established commentators, a quick glance at the decision notice reveals:

• The Tribunal found "the Information Commissioner got the balance wrong in terms of proportionality in exercising her discretion because the Information Commissioner had fundamentally misunderstood the actual outcomes of Experian’s processing." 
• The Tribunal also found Experian "did not comply with the requirements of article 14 and it fully expects that Experian will rectify this noncompliance in respect of its future personal data collections. The Tribunal recognises the considerable expense and practical difficulties which Experian would face in attempting to identify the residual cohort and issue them with an article 14 notice."

Responding to the decision, the ICO issued a statement clarifying the Tribunal's findings:

• In support of the ICO that "Experian had not processed the personal data of over 5 million individuals transparently, fairly or lawfully because it failed to notify them that it was processing their data for direct marketing purposes." 
• Rejecting the ICO's view that "Experian’s privacy notice was not transparent, that using credit reference data for direct marketing purposes was unfair, or that Experian did not properly assess its lawful basis."

Stephen Bonner, ICO Deputy Commissioner, said: "The credit reference agency industry holds data on almost every adult in the UK. Information is screened, traded, profiled and enhanced to provide direct marketing services, and that process must happen in line with the law and in an open and honest way."

The ICO is considering whether to appeal today's judgment. Meanwhile, the Independent reveals Experian is said to be “very pleased” with the outcome and it remains "deeply committed to transparency, safeguarding privacy and helping consumers to better understand and control the use of their data." 

Related articles:

• Legal claim launched against Experian
• Insight from the ICO finding into Experian, data brokers and digital ads
• Businesses must rethink ‘legitimate interest’ after Experian GDPR violation

UPDATE: 230223 - The Privacy & Information Security Law Blog and Pinsent Masons have published legal analyses of the First-Tier Tribunal decision. In their analysis, Pinsent Masons conclude organisations can consider the  benefits of the processing to the data subjects as a supportive factor when evaluating whether legitimate interests can be used to process the data lawfully