4. ICO investigation

4.1 Scope of the investigation

Our investigation looked at the provision of offline marketing services by key data brokers. It focused on processing of personal data in the UK about individuals in the UK.

The scope of the investigation did not cover online data broking. It also did not extend beyond looking at the provision of marketing services by the data brokers. In the context of the CRAs, this means that the investigation did not look at their credit referencing functions. The findings set out below therefore do not relate to the credit referencing functions of the CRAs.

4.2 Decision to audit

In summer 2018 after a review of the intelligence we then held, the Commissioner exercised her power to undertake compulsory audits and issue assessment notices to the three CRAs. This allowed us to collect accurate, detailed and up-to-date information about their processing activities.

The Commissioner also decided to investigate practices at three of the non-CRA hubs of data broking we had previously identified, in order to provide contrast to the CRAs’ compliance and an overview of data protection compliance more widely across the sector. After reviewing current intelligence, we issued assessment notices to three data brokers of concern.

We announced our decision to conduct compulsory audits of the three CRAs in our 2018 report ‘Investigation into the use of data analytics in political campaigns’, as we investigated some of the organisations as part of our work on the use of personal data for political purposes.

4.3 The audits

4.3.1 Equifax

Equifax collected personal data from third party suppliers, the open electoral register and publicly available data. Equifax used the data to build datasets that they licensed to a number of clients and a small number of resellers (primarily for the open electoral register), who themselves further licensed the data. The datasets enabled organisations to identify new prospective customers and added more detail to clients’ existing customer or potential customer lists. Data was licensed for postal marketing only.

Credit reference data was used for limited purposes to confirm and trace postal addresses for marketing and to screen out individuals from clients’ postal marketing campaigns based on elements of their credit reference files which might indicate affordability concerns.

Equifax also used personal data to create aggregated and anonymous profiling models which could be applied at postcode level, which it licensed to assist clients with their postal marketing.

4.3.2 Experian

Experian collected personal data from third party suppliers, the open electoral register and publicly available data. Experian used the data to build datasets that they licensed to a comparatively large number of clients and resellers, who themselves further licensed the data. The datasets enabled organisations to find new prospective customers and/or to enrich existing or potential customer data with socio-demographic attributes. Experian also operated data pools with partner organisations.

Credit reference data was used for limited purposes to confirm and trace addresses for marketing and to screen out individuals from marketing campaigns. This was based on elements of their credit reference files which might indicate affordability concerns.

Experian also used personal data to create aggregated and anonymous profiling models which could be applied at postcode level, which it licensed to assist clients with their marketing.

4.3.3 TransUnion

TransUnion collected personal data from the open register and publicly available data. TransUnion used the data to build datasets added more detail to a small number of clients’ existing customer or potential customer lists, but did not provide individuals’ information for prospecting (save for the provision of the Open Register). Data was licensed for postal marketing only.

Credit reference data was used for limited purposes for a handful of clients in order to remove previous addresses from marketing lists and to screen out individuals from clients’ marketing campaigns based on elements of their credit reference files which might indicate affordability concerns.

TransUnion also used personal data to create aggregated and anonymous profiling models which could be applied at postcode level, which it licensed to a handful of clients to assist with their marketing.

4.4 Public awareness

It is likely that the vast majority of UK adults currently appear, or have previously appeared, within the databases of at least one data broker. However, this ecosystem and an individual’s place in it are largely unknown to the general public. Because of this lack of visibility and knowledge, the ICO is less able to rely on our usual indicators of the public’s opinion, such as complaints made to us. Similarly, as many individuals are unaware that their data is being bought and sold in this way, it is very difficult for individuals to understand who has possession of their personal data in order for them to exercise their information rights.

The ICO commissioned Harris Interactive to undertake a survey in early 2019 to help us understand public awareness and perceptions of data broking. This, in turn, helped to inform our decision-making at that time.

The key findings were that many people were unclear about what exactly happens to their personal data once they have shared it with organisations and generally do not consider that the balance of providing this information is solely in their favour. The majority of respondents considered that any organisation they do not have a direct relationship with should tell them that it has collected and is processing their data.

The results of the research commissioned by the ICO are on our website.

In addition to this subject-specific research, we have gained more insight into the public’s view on data broking through intelligence we gathered from the ICO’s Annual Track survey. This is a survey we commission each year to help us understand the public’s views on information rights issues. In 2020, our findings revealed that only 20% of people surveyed agreed that they would be fine with being contacted by an organisation they had not dealt with before who had bought their details from a partner organisation.

Similarly, only 24% of individuals surveyed agreed that they were fine with being contacted by an organisation they had not dealt with before who had obtained their information from a publicly available source.

There is more about our 2020 Annual Track survey on our website

4.5 Decision to enforce

Our investigation revealed systemic compliance failings within each of the CRAs data broking businesses, particularly for the lawfulness, fairness and transparency principle of the GDPR. Our findings are discussed in detail in section 5 of this report.

These key concerns were deeply embedded in each business. Comprehensive change was required in order to achieve compliance. Given the severity of our findings, in April 2019 we provided each of the three CRAs with a preliminary enforcement notice which set out our concerns, the steps we required them to take, and a clear timescale for compliance, alongside our detailed audit report.