ICO appeals Experian ruling; 'Tribunal got law wrong'

Just 24 hours after joining forces to back the Government’s new shake-up of data protection laws, Information Commissioner John Edwards appears to be on a collision course with the DMA with confirmation his office plans to appeal the recent First-Tier Tribunal ruling against Experian.

The ruling, which effectively threw out an enforcement notice compelling Experian to change its practices or face a fine of over £200m, centred around the use of legitimate interests in marketing.

While the Data Protection & Digital Information Bill, published yesterday, attempts to make this clearer, under GDPR things are less transparent and Edwards reportedly told delegates at the International Association of Privacy Professionals (IAPP): “Having carefully considered that judgment, I believe that the Tribunal has got the law wrong.”

And in an interview with MLex, he added: “Transparency is so at the heart of data protection that we couldn’t really let those findings in Experian go unchallenged, when they represent, I think, a reading down of the importance of transparency.”

The enforcement notice, issued by the ICO in 2020, followed a three-year investigation into the data broking industry, with a focus on credit reference agencies. The regulator claimed that the companies were trading, enriching and enhancing people’s personal data without their knowledge.

At the time, the ICO claimed that, while Equifax and TransUnion had changed their practices, Experian had not gone far enough.

The enforcement notice compelled Experian to make changes within nine months – and delete all “unlawful data” or risk further action for breaching GDPR, including a potential fine of up to £20m or 4% of the organisation’s total annual worldwide turnover of $5.2bn, a whopping £208m.

Experian successfully appealed the decision in a ruling which was published last month. At the time, Experian UK&I managing director Jose Luiz Rossi said the move represented “a welcome development for the consumers, small businesses and charities across the UK that rely on the services provided by Experian”.

He added: “The Tribunal found, in contrast to the ICO’s enforcement notice, that the vast majority of our practices meet GDPR requirements.”

The DMA then waded in, with CEO Chris Combemale saying: “The Tribunal ruling reaffirms key principles for the use of legitimate interests for direct marketing, particularly that any balancing test must take into account the economic benefits and the benefits to the individual of receiving the relevant offers.

“The DMA agrees fully with the Tribunal’s judgment that receiving more relevant offers are unlikely to cause any distress or harm and are more likely to create benefits.”

The ICO appeal, however, now puts the future of legitimate interests – a key tenet of direct marketing practice – back in jeopardy, at least until the Data Protection & Digital Information Bill attempts to clear up the mess.