ICO left with egg on its face as Experian sees off appeal

The Information Commissioner’s Office has suffered yet another ignominious defeat in its attempt to force Experian to overhaul its offline marketing practices, with the Upper Tribunal rejecting the regulator’s appeal against its February 2023 ruling.

The issue dates back to 2017, when the ICO began a major investigation into the data broking industry, with Experian, Equifax and TransUnion coming under close scrutiny over how they used personal data for direct marketing purposes.

The ICO’s probe claimed to have found how the three companies were trading, enriching and enhancing people’s personal data without their knowledge. This processing resulted in products which were used by commercial organisations, political parties or charities to find new customers, identify the people most likely to be able to afford goods and services, and build profiles about people, the regulator said.

It then ruled that significant ‘invisible’ processing had taken place, likely affecting millions of adults in the UK. It was ‘invisible’ because the individual was not aware that the organisation was collecting and using their personal data.

Under pressure from the ICO, Equifax and TransUnion changed their practices but Experian stuck to its guns and, in 2020, it was issued with an enforcement notice, compelling the company to make changes within nine months – and delete all “unlawful data”. The ICO threatened further action for breaching GDPR, including a potential fine of up to £20m or 4% of the organisation’s total annual worldwide turnover of $5.2bn, a whopping £208m.

However, Experian successfully appealed the decision in a ruling which was published in early 2023. At the time, Experian UK&I managing director Jose Luiz Rossi said the move represented “a welcome development for the consumers, small businesses and charities across the UK that rely on the services provided by Experian”.

He added: “The Tribunal found, in contrast to the ICO’s enforcement notice, that the vast majority of our practices meet GDPR requirements.”

Industry body the DMA then waded in, with CEO Chris Combemale saying: “The Tribunal ruling reaffirms key principles for the use of legitimate interests for direct marketing, particularly that any balancing test must take into account the economic benefits and the benefits to the individual of receiving the relevant offers.

“The DMA agrees fully with the Tribunal’s judgment that receiving more relevant offers are unlikely to cause any distress or harm and are more likely to create benefits.”

Even so, Information Commissioner John Edwards then launched an appeal, having reportedly told delegates at the International Association of Privacy Professionals (IAPP): “Having carefully considered that judgment, I believe that the Tribunal has got the law wrong.”

And in an interview with MLex, he added: “Transparency is so at the heart of data protection that we couldn’t really let those findings in Experian go unchallenged, when they represent, I think, a reading down of the importance of transparency.”

However, in a decision published late yesterday (Tuesday) the Upper Tribunal threw out the case; quite where this leaves Edwards’ reputation has yet to be determined.

An Experian spokesperson said: “We welcome the Upper Tier Tribunal’s decision. As we have stated throughout these proceedings, we remain deeply committed to transparency, safeguarding privacy and helping consumers to better understand and control the use of their data.”

One industry expert told Decision Marketing: “This ruling makes Edwards look a right chump. Instead of accepting the first decision he has staked his reputation on getting it overturned and has now been humiliated. Many thought (former Commissioner) Elizabeth Denham was a showboater for chasing headlines but, unlike Edwards, even she knew when she’d been defeated.”