Credit Reference Agency Information Notice (CRAIN)

Version: 1.2 - Adopted: 2 December 2024

IN BRIEF

We (Equifax, Experian and TransUnion, collectively referred to as “we” and “us” throughout this Privacy Notice) are credit reference agencies and we play an important role in the UK’s financial ecosystem. This Credit Reference Agency Information Notice (referred to as “this Privacy Notice”) explains how we collect, process and share personal data about consumers and businesses (referred to as “you”).

This section briefly summarises the key processing activities common to all of us. For more detail, please refer to the rest of this document. We recommend reviewing each credit reference agency’s own privacy notices, which explain the specific processing activities of that credit reference agency. Links to these documents can be found in Section 14.

Throughout this Privacy Notice, where we use “data” we mean the data types as described in Section 4.

What do Credit Reference Agencies do?

• We collect information about you from various sources and build databases that hold this data. 
• We need to hold relevant permissions from the Financial Conduct Authority to collect and share this financial information about you.

Where do Credit Reference Agencies get information from?

• The primary source of information we collect is from public records, such as court judgments (CCJs) and electoral register information, financial information from financial account providers, and information generated by us based on the information received and/or our own analytical research. 
• In addition, we may also collect information from payment accounts via the use of open banking, gambling organisations, employers, utilities suppliers, telecoms businesses as well as (business data only) from publicly available business websites.

Who uses the information, and what do they use it for?

• Financial account providers and other organisations carry out searches against information with one or more of us.
• Organisations can carry out searches for several reasons. These include assessing creditworthiness and ability to afford financial products, checking the accuracy of other information, preventing and detecting crime (such as fraud or money laundering), checking identity, locating individuals (for example to recover debts that they owe), calculating how much their insurance premiums should be, employment verification, including assessing their suitability for a job or a tenancy, and helping to protect individuals from the impacts of problem gambling.
• When an organisation carries out a search of someone’s data, we will record details of that search. This is known as a search footprint. Depending on the type of search they can be visible to the individual and/or to other organisations that may conduct searches on that individual. Some organisations may draw adverse inference from the presence of some search footprints, for example if a person has multiple debt collection searches recorded. 
• We link people who appear to be financially associated, for example, through a joint account, joint application for credit or a joint County Court Judgment. This information on financial associates may be checked by companies when undertaking credit searches for the purposes of assessing credit risk. This is because your link with financial associates may affect your ability to repay debt.
  Examples of this include, acting as guarantor for a personal loan that another individual is taking out, or in the capacity as a director or business owner, where the relevant business is applying for a commercial loan. See the table in Section 4 for further information on how the financial associate’s data affects your credit report and score.
• We also use some data for marketing-related purposes. Each of us provide different marketing services, to help organisations to better direct their marketing to consumers and (where relevant) business owners and directors, for example excluding individuals from advertising for credit products they would not be eligible for. We may also use the data to predict information or characteristics about the population, to inform product and marketing strategy, to help organisations identify who they want to market their products and services to, and how they should be delivered.
• The data relating to you held by each of us might be different. This is because not every financial account provider supplies data to every one of us.

What else do Credit Reference Agencies do with my information?

• We also use the data in our databases for other activities, including analytics and profiling. This can help financial account providers build scorecards to use in assessing credit applications.
• We carry out several types of data processing to help achieve the aims described above. These include loading data, matching and linking data together, generating credit scores, as well as testing, developing and building products and services for our clients.
• Individuals have certain rights that they can exercise in relation to the personal data held by us. For example, they have the right to obtain a copy of the data, to ask us to correct it if it is inaccurate, and to object to the processing of the data. The ICO's website provides more details on the available rights and details of how these rights can be exercised are set out in Sections 9, 10, 11 and 12 below. Personal data about individuals in their role as owners, directors, and employees of UK businesses may also be obtained, processed and shared by commercial data sharing credit reference agencies not referenced in this Privacy Notice. For further information please refer to the Business Information Providers Association’s website. 

Please note:

• If you are looking for information about the role that data plays in lending decisions made by financial account providers, you may wish to consult Understanding your credit information and how lenders use it. This is published on the website of each of us, Equifax, Experian and TransUnion.
• This document describes our common processing activities detailing how we use and distribute the data described in Section 4.
• We are independent businesses. Not all of the products and services described in this document are provided by all three of us, or in the same way, and not all of the data is used by each of us.
• This document does not cover all personal data that we use and distribute; for example, this document does not cover processing of personal data in relation to our services you sign up to directly, such as services which allow you to view your own credit report and score. 
• Each of us offers other products and services (including marketing services) not covered by this Privacy Notice. Section 14 provides links to our own privacy notice(s) which outline other uses of data not fully described here that may be unique to one of us or includes additional detail about our core activities processing. The same links about our core processing activities are shown here below: 
• Experian | Data Privacy
• Experian | Marketing Transparency Notice | Business Information Experian UK
• Equifax | Privacy Hub | UK 
• TransUnion | Privacy Centre 

CONTENTS

This document answers these questions:

1. WHO ARE THE CREDIT REFERENCE AGENCIES AND HOW CAN THEY BE CONTACTED?
2. WHAT DO CREDIT REFERENCE AGENCIES USE DATA FOR?
3. WHAT ARE THE CREDIT REFERENCE AGENCIES’ LEGAL GROUNDS FOR HANDLING DATA?
4. WHAT KINDS OF DATA DO CREDIT REFERENCE AGENCIES USE, AND WHERE DO THEY GET IT FROM?
5. WHO DO CREDIT REFERENCE AGENCIES SHARE DATA WITH?
6. WHERE IS DATA STORED AND SENT?
7. FOR HOW LONG IS DATA RETAINED?
8. DO THE CREDIT REFERENCE AGENCIES MAKE DECISIONS ABOUT CONSUMERS OR PROFILE THEM?
9. HOW CAN A CONSUMER SEE WHAT DATA THE CREDIT REFERENCE AGENCIES HOLD ABOUT THEM? DO CONSUMERS HAVE A ‘DATA PORTABILITY’ RIGHT IN CONNECTION WITH THEIR DATA?
10. WHAT CAN A CONSUMER DO IF THEIR DATA IS WRONG?
11. CAN A CONSUMER OBJECT TO THE USE OF THEIR DATA AND HAVE IT DELETED?
12. CAN A CONSUMER RESTRICT WHAT THE CREDIT REFERENCE AGENCIES DO WITH THEIR DATA?
13. WHO CAN A CONSUMER COMPLAIN TO IF THEY ARE UNHAPPY ABOUT THE USE OF THEIR DATA?
14. WHERE CAN YOU FIND OUT MORE?

1. WHO ARE THE CREDIT REFERENCE AGENCIES AND HOW CAN THEY BE CONTACTED?

There are three main credit reference agencies in the UK.

Each is regulated by the Financial Conduct Authority (“FCA”) and authorised to conduct business as a credit reference agency. The full names and contact details for each are set out below.

In this Privacy Notice, these three companies are referred to as Equifax, Experian and TransUnion respectively and collectively referred to as “we” and “us” throughout. 

Controllers 

Each of us is a controller of the data that we hold. This means that we have certain responsibilities under data protection law to make sure that the data is used fairly and lawfully. 

Where we operate as part of a group of companies, we may share joint responsibility with the other members of that group when sharing data with them. You can contact the relevant credit reference agency using the details above if you want to enquire about any of those group companies or exercise any of your rights in respect of your personal data.

2. WHAT DO CREDIT REFERENCE AGENCIES USE DATA FOR?

We use data in products and services that we offer to our clients. The purposes for which those products and services are used are described below, but please note that different clients may use the products and services in different ways. Consumers should check the privacy policies of the organisations that they deal with for details about how they use any products and services provided by us.

(a) Credit risk assessment, financial vulnerability, and affordability checks

Each of us use data to provide credit reporting services, financial vulnerability and affordability checks to our clients.

CREDIT RISK ASSESSMENT

Organisations use credit reporting services to see how people and businesses are managing payments in respect of their credit commitments and how they have done so in the past. For example, if a person applies for a bank loan to buy a car, the bank may use credit reporting services to check whether that person has kept up with their repayments on any previous credit agreements. It will then use this information, together with information from other sources, to assess the risk of offering the loan, including identifying any financial vulnerabilities.

A financial account provider may also take into account the creditworthiness of a director or business owner as part of its assessment, when considering whether to agree to lend to a business associated with such individuals.

It is important to note that once a search has been undertaken with one of us, it is for the credit provider to decide whether or not to accept that person’s application for credit. While we may help clients to analyse the data or create application models, we are not the decision maker.

AFFORDABILITY AND FINANCIAL VULNERABILITY CHECKS

Organisations use affordability checks made available by us to help understand whether people or businesses are likely to be able to afford to make payments, and to highlight financial vulnerabilities. For example, when you apply for a loan, the lender will check whether you have previously suffered a CCJ or missed credit payments, which might impact your ability to afford the repayment instalments.

Organisations might also check your affordability by reviewing the transaction data or the level of income and expenditure in relation to your payment account. This could include the use of open banking or current account turnover data provided by Current Account providers (“Current Account” refers to bank accounts designed to be used for your day-to-day payment transactions). 

The information provided as part of the affordability checks may affect a person’s or business’s ability to obtain credit or other services. For example, where an individual has their own business, a lender may take into consideration the personal credit commitments of that individual, as well as how the business is maintaining its financial commitments, prior to granting credit.

Affordability checks are also used by organisations in the gambling sector to help identify and protect potentially vulnerable people from the impacts of problem gambling by helping organisations set appropriate spending limits and implement appropriate engagement strategies. These checks are used to support gambling organisations comply with their regulatory obligations.

These activities help promote responsible lending, prevent people and businesses from getting into more debt than they can afford, and reduce the amount of unrecoverable debt and insolvencies.

(b) Checks to validate and verify client data, and help prevent and detect fraud, money laundering and other criminal activity

VALIDATION AND VERIFICATION

We use data to provide validation and verification services to clients. For example:

• Where some products and services are only available to people of a certain age, organisations may check whether the person they are dealing with is eligible by looking at data held by us. For example, if a person is signing up to join a gambling website for people who are at least 18 years old, the organisation may check to see if the age or date of birth provided by the person matches the data held by us. 

HELP PREVENT AND DETECT FRAUD, MONEY LAUNDERING AND OTHER CRIMINAL ACTIVITY

We also use data to help prevent and detect fraud, money laundering and other criminal activity, and apprehend and prosecute offenders.

• When a person applies to an organisation for a product or service, the organisation might ask that person to answer questions about themselves, and then check the answers against the data held by us to see if they match. For example, they may ask “What is your current address?” If the address provided does not exist on our records (for example, because it is a fictitious address) or does not match the data held by us (for example, there is no record of the person at the address provided), this may be an indicator of a mistake or fraud. 
• When a person wants to make a payment to another person, the organisation making that payment might want to understand more about them. By using data about the person making the payment and the intended recipient, the organisation can determine if there are indicators of fraud present. If there are, the organisation may query the payment or take steps to stop it.
• Government and quasi-government bodies may use our services to check for potential fraud or other criminal activities, whether people are entitled to certain benefits, and to help recover unpaid taxes, overpaid benefits and similar debts. For example, if a person is claiming single person discount for council tax, a local authority may check with us to see if any other adults are living at the same address. Conversely, public bodies may use our services to identify individuals who may be entitled to discounts but are not claiming them. For further details on government use of our data, refer to Section 2(m).
• Law enforcement agencies (including police forces, security services and border control) may also access/ use data held by us to assist with the investigation, prevention or detection of crime and criminal activity.

An indication of invalid or unverified information, fraud, money laundering or other criminal activity may affect (amongst other things) the outcome of an application for a product or service, a tenancy agreement or employment. If clients using the services identify potentially fraudulent activity, they may also pass the applicant’s details to a fraud prevention agency such as Cifas and/or to the police.

For more details about the fraud prevention services offered and the personal data used by each of us please refer to Section 14. 

(c) Customer management

We use data to provide products and services for organisations to use for customer management purposes. Customer management is the ongoing maintenance of an organisation’s relationship with its customers. This could include activities designed to support:

• data accuracy: for example, to correct or update client customer data held on the organisation’s records, such as correcting spelling mistakes or adding missing fields; or providing services to link records together in order to show a single customer view; and
• ongoing relationship and account management activities: for example, to help organisations make decisions relating to credit limit adjustments, transaction authorisations, card reissue, lending requests, and to identify and manage the accounts of customers including those at risk of financial difficulties, showing signs of financial stress, in arrears, or going through a debt collection process. This may include ongoing monitoring of individuals’ data, and sending alerts to clients in specified circumstances.

(d) Tracing and debt recovery

We use data to provide products and services that allow organisations to trace people. This is typically needed where a person has moved address or changed their telephone number and has not provided their new contact details. We help organisations locate customers they have lost contact with by providing them with updated addresses and other contact details.

The products and services are used to support organisations’ debt recovery and debtor tracing activity. For example, if a person owes money to an organisation and moves to a new house without telling the organisation where they have moved to, the organisation may use these services to help find that person to recover the money that is owed to them.

We also assist debt collectors in predicting, analysing and evaluating the costs of debt recovery to enable them to determine appropriate collections strategies. 

These products and services are also used to find people to let them know about assets that they may have forgotten about or not be aware of, such as old dormant savings accounts or pension funds, or to find people to let them know about assets of a deceased person which they have an interest in, such as administrators or beneficiaries of a deceased person’s estate.

Please also see Section 2(h) below which describes how we may provide tracing services for marketing purposes.

(e) Tenant vetting

We use data to provide products and services that allow landlords to verify some of the information provided by their prospective tenants, as well as confirming that they are who they say they are and that they are likely to be willing and able to pay their rent on time. Landlords can use this information to help decide whether to agree to the tenancy, or how much of a deposit they should ask for.

(f) Staff and job candidate vetting

We use data to provide products and services that allow organisations to verify some of the information provided by their staff and job candidates and confirm that they are who they say they are. They also enable employers to assess whether the staff member or candidate has a history of managing their own financial commitments well, or whether they are financially compromised. This can be used to help them decide whether the person would be or will continue to be a suitable member of staff.

(g) Insurance risk assessments and pricing

We use data to provide products and services for organisations to use to assess insurance risk. For example, an insurer may find that a person’s financial standing and history can be used to help predict how likely that person is to make a claim on an insurance policy, or how large that claim might be. This can help the insurer to decide (i) whether to provide insurance to a person, (ii) how much the insurance premium should be, and (iii) whether to allow payment for insurance on a credit instalment basis.

(h) Marketing and marketing-related services

OVERVIEW 

We offer our clients marketing services. Some of these marketing services use data and some do not, and some impact consumers while others affect directors and/or business owners. For details about the marketing services offered and the personal data used by us for these services, please see the following links: 

• Experian | Consumer Information Portal
• Experian | Marketing Transparency Notice | Business Information UK
• Equifax | Privacy Hub | UK
• TransUnion | Marketing Services Privacy Notice | UK

As well as other rights, consumers have the right to object to the processing of their personal data for direct marketing purposes, including any profiling that is related to direct marketing. Section 11 sets out more details on how this right can be exercised. 

If we provide marketing services, we may use an individual’s title, name (including aliases), address, date of birth, gender and address links information (see Section 4 for more detail), as well as limited information relating to their financial standing.

SCREENING OUT 

We use data to provide screening services to our clients. This means that we identify people who clients may wish to screen out of marketing lists. Screening is used to help ensure that individuals do not receive irrelevant or inappropriate marketing information. These individuals will most often be consumers, but we also provide screening services which impact on company directors and/or business owners for our clients who carry out business-to-business marketing activities.

For example, a client may want to screen out from its marketing list someone who is deceased, or who is under 18, or does not reside at the address they hold, or who may not be interested in a product or service or is unlikely to be accepted for it.

OTHER MARKETING-RELATED ACTIVITIES 

In addition, we may use data to offer some or all of the following marketing services: 

• We may supply the open version of the electoral register (where people have not opted out from their electoral register data being used for marketing and other purposes) to organisations for marketing purposes. This can include identifying new potential customers, verifying that names, addresses and dates of birth collected from other sources are accurate and complete, and informing customers of any errors. 
• We may identify when someone has moved away from an address so that marketing is not sent to them at that old address.
• We may trace individuals to a new address so that their marketing preferences (opt-outs) collected at a previous address can continue to apply at their new address and so that marketing is not sent to them at their old address. 
• We may help build insight using profiling techniques used by organisations to help them identify people that they want to communicate with about particular products and services. This insight might predict, for example, age, marital status, household composition, length of residency at an address and gender. It can help give organisations insight into the likely characteristics of the UK population at an individual, household and postcode level. Data also helps us to validate the insight being created. This insight might also be used to help clients assess the financial standing of a person so that they can personalise their interactions with them and make communications more relevant and suitable. For example, they could use the insight to select products or offers that they believe would be relevant to that person. 
• Models and insight created by us can be matched to clients’ own contact lists so that they can make better informed decisions about how they interact with individuals (both consumers and company directors and/or business owners). 
• We may confirm whether individuals are resident at the address that we or our clients hold for them. This can be done by checking the data to see if there are any open credit accounts at an address and whether the accounts have recent activity, such as where a recent payment has been made. If they do, then it is likely that they have the correct address details. This will help ensure that an individual does not receive marketing for someone else and our clients do not send marketing to the wrong address. 
• We may also use data to help keep our own marketing suppression lists (or those of our group companies) accurate and up to date. For example, if you have previously asked to be excluded from marketing activity and your data indicates that you have since moved or changed your name, that information can be used to make sure that you continue to be excluded from marketing activity at your new address or under your new name.

(i) Profiling, statistical analysis and anonymisation

We use, and allow our clients to use, data to carry out profiling of consumers through statistical analysis. This includes the creation, validation and use of scorecards, models, and attributes in connection with the assessment of risks relating to credit, fraud, affordability, financial vulnerability and debt collection. It is also used in verifying identities, to monitor and predict market trends and to enable clients to refine lending and fraud strategies, and loss forecasting. This can include drawing inferences about individuals on the basis of the data available, such as inferences about whether a credit application they have made has been accepted or declined.

These practices profile consumers (typically a client’s own customers or previous applicants) to help determine the likelihood that a consumer with certain characteristics will act in a way that will produce certain outcomes; for example, to repay credit, to be able to afford credit, to claim on an insurance policy, to commit fraud, to respond to certain collection strategies or to become insolvent. 

We may also convert personal data into statistical or aggregated form so that individuals are not identified or identifiable (thereby creating anonymised data). Anonymised data is not personal data, and we may use such data to conduct research and analysis, including to produce statistical research and reports or for any other purposes.

We may share this anonymised data with organisations, such as those identified in Section 5. For example, this non personal data may be shared with government and public sector organisations to help them: assess the impact of changes to the financial economy on consumers and businesses; to inform policy setting and monitor the effectiveness of policy implementation; or to enable tailored economic support and other key resources to be directed to the groups that need it the most.

(j) Data management activities

We use data to carry out certain processing activities to support our own business operations. This includes supporting the effectiveness, efficiency and security of our databases, products and services, both in the context of our credit reference activities and more widely. For example: 

• Data loading: data is checked for integrity, validity, consistency, quality and age to help make sure it is accurate. These checks pick up issues such as irregular dates of birth, names, addresses, account start and default dates, and gaps in status history. 
• Data matching: data is matched to our existing databases to help make sure it is assigned to the right person, even when there are discrepancies like spelling mistakes or previous names or different versions of a person’s name. We use data to create and confirm identities, which we use to underpin the services that we provide. 
• Data linking: when we compile data into our databases, we create links between different pieces of information. For example, people who appear financially associated with each other may be linked together and a person can be linked with their previous and current addresses. Also, where someone has an alias, such as a maiden name and married name, these names will be linked. 
• System maintenance and testing: data may be used when carrying out system maintenance, repair and testing, and security activity. 

Each of us have our own processes and standards for data management activity.

(k) New development and testing

We use data to help develop new products, services and technologies and to test them. This may include the controlled use of artificial intelligence or machine learning techniques. We may combine data with information from other parts of our businesses and use data to develop products, services and technologies in other parts of our businesses. Where appropriate, we will anonymise data before it is used for these purposes.

(l) Compliance with laws

We use and disclose data where required by law. For example, this can happen in response to a court order or a request from a regulator, or in order to comply with a request from a person (or by a third party acting on their behalf), to exercise their legal rights in respect of any personal data, such as by requesting a copy of it.

(m) Government and public sector organisations

We may provide data to government and public sector organisations. For example, their uses of this data could include:

• the assessment or collection of any taxes, duties, or other such impositions; recovering unpaid income tax, council tax or national insurance contributions; 
• recovering unpaid television licence fees; 
• benefits eligibility assessment and monitoring (for example, by checking for changes in circumstances that would affect established eligibility); 
• the assessment or collection of any payments due to a public sector organisation in carrying out a statute or other legal obligation; 
• the detection and prevention of a crime, and the apprehension and prosecution of offenders;
• the detection, prevention and recovery of improper payments or overpayments from public funds; and
• for the purposes of any legal proceedings (including prospective legal proceedings).

3. WHAT ARE THE CREDIT REFERENCE AGENCIES’ LEGAL GROUNDS FOR HANDLING CREDIT REFERENCE DATA?

Data protection law requires us to always have what is referred to as a “lawful basis” (i.e. a reason or justification) for processing personal data. There are a number of lawful bases available, but the majority of our data processing activity is on the basis that:

• the processing is necessary to pursue our legitimate interests and those of third parties (such as our clients), and those interests do not unduly prejudice the rights and freedoms of individuals; or
• the processing is necessary to comply with a legal obligation binding on us.

For information about any other lawful basis relied on by each of us, please review our individual privacy notices (see Section 14).

LEGITIMATE INTERESTS 

We use data to pursue our legitimate interests, those of our clients and those of individuals. The following table explains these legitimate interests. We have carried out assessments and concluded that these interests are not overridden by the interests or fundamental rights and freedoms of individuals.

Our use of data is subject to an extensive framework of safeguards that balance the legitimate interests set out above with the fundamental rights and freedoms of the people whose data we use and share. The framework includes information given to people about how their data will be used and how they can exercise their rights to obtain their personal data, have it corrected, erased, or restricted, object to it being processed, and complain if they are dissatisfied. It also includes extensive due diligence checks on clients, robust contractual arrangements, and internal data management processes that we have in place. These safeguards help sustain a fair and appropriate balance and to protect the rights and freedoms of individuals.

LEGAL OBLIGATIONS 

In some circumstances we are required by law to use or share data in particular ways. This happens, for example, when a court, law enforcement agency or regulator makes a legally binding request or order for disclosure of data. It also happens when individual consumers exercise their rights, for example by requesting a copy of their own personal data from us.

4. WHAT KINDS OF DATA DO CREDIT REFERENCE AGENCIES USE, AND WHERE DO THEY GET IT FROM?

Each of us obtains and uses data (including your personal data) from different sources, so we often hold information that is different to some degree from that held by the others. 

However, most of the personal data we each hold falls into the categories outlined below from the sources described (please note that some of this data may relate to individuals from the Crown Dependencies as well as from the UK).

5. WHO DO CREDIT REFERENCE AGENCIES SHARE DATA WITH?

This section describes the types of organisations we share data with. Before sharing data with any third party we will, where appropriate, complete our own due diligence checks to ensure that the organisation is a real business and has applicable regulatory authorisations in place.

Clients

We supply our products and services to clients in various sectors, such as banks, building societies, other credit providers, buy now-pay later providers, utility companies, mobile phone companies, insurance companies, employers, credit report providers, retailers, gambling organisations, tenant and employee vetting firms, professional services organisations (such as firms of solicitors and accountants), estate agents, landlords, marketing companies, charities and public bodies such as the police, central and local government and regulators. 

Certain organisations that share financial data with us are members of closed user groups which entitle them to receive similar kinds of financial data contributed by other organisations in the group. These organisations are typically banks, building societies, and other lenders, as well as other credit providers like utilities companies, mobile phone networks and other organisations like gambling firms.

Resellers, distributors, partners, agents and other third parties

We sometimes use or partner up with other third party organisations to provide combined products or products which combine our data with other information to help provide our products and services to clients and to help us improve our own products and services. To do this, we may provide data to third parties so that they can provide the services.

Service providers 

We may use other external organisations and other members of our own groups of companies to perform tasks on their behalf (for example, IT service providers, call centre providers and security service providers). To do this, we may provide or make available data to them so that they can perform the tasks.

Fraud prevention agencies 

Each of us is a member of Cifas, a not-for-profit fraud prevention service. Where we believe that you may have been a victim of fraud, we may share that information with Cifas so that other Cifas members can access it. This enables other Cifas members to check when (for example) a credit application is made in your name. Please refer to the Cifas’ privacy notice for more details.

Government and other public sector organisations

We may share information with government and other public sector organisations, including the following bodies: ministerial government departments, such as the Department of Work and Pensions, HM Revenue & Customs, HM Treasury, the Cabinet Office; publicly owned corporations and other arm’s length bodies such as the Public Sector Fraud Authority) and private sector organisations providing services on behalf of a public sector organisations, such as a housing association acting on behalf of a local authority.

Regulators

Regulators, such as the Financial Conduct Authority, Competition & Markets Authority, Information Commissioner’s Office, Ofgem and Ofwat, can sometimes request or require us to supply them with personal data. This can be for a range of purposes such as investigating complaints or in response to legal obligations. The regulators may also need data insights from us when assessing how well a particular industry sector is working.

Law enforcement agencies

This includes police forces, security services and border control.

Individuals

People are entitled to obtain copies of the personal data we hold about them. Details on how to do this are set out in Section 9 below. 

6. WHERE IS DATA STORED AND SENT?

All three of us are based in the UK and keep our main databases there. We may also have operations and service providers elsewhere inside and outside the UK and the European Economic Area, and data may be accessed from those locations too. Regardless of where the data is processed, we ensure that it is always protected by applicable UK and European data protection standards.

While the UK and countries in the European Economic Area all ensure a high standard of data protection law, some parts of the world may not provide the same level of legal protection when it comes to personal data. As a result, when we send data overseas we make sure suitable safeguards are in place in accordance with applicable UK and European data protection requirements, to protect the data. For example, these safeguards might include:

• Sending the data to a country that has been approved by the relevant authorities as having a suitably high standard of data protection law. Examples include the Isle of Man, Switzerland and Canada.
• Putting in place a contract with the receiving organisation containing terms approved by the relevant authorities as providing a suitable level of protection.
• Sending the data to an organisation which is a member of a scheme that has been approved by the relevant authorities as providing a suitable level of protection. One example is the UK Extension to the EU-US Data Privacy Framework (UK-US “Data Bridge”) agreed between the UK and US authorities.

Overseas recipients of data include our group companies, clients, resellers and service providers. Please see Section 5 for more information about recipients of data.

More information about the safeguards we each use can be obtained by contacting us at the contact details in Section 1 above.

7. FOR HOW LONG IS DATA RETAINED?

Each of us may retain data for different periods of time. Information about our respective retention periods can be found at the following locations: 

• Equifax: Equifax I CRAIN - Data Retention Periods  
• Experian: Experian | CRAIN Data Retention Periods 
• TransUnion: TransUnion | CRAIN Data Retention Periods  

These periods are subject to regular review and may change from time to time.

8. DO THE CREDIT REFERENCE AGENCIES MAKE DECISIONS ABOUT CONSUMERS OR PROFILE THEM?

DECISIONS ABOUT CONSUMERS 

We do not tell organisations what decisions to make about consumers. Our role is primarily to provide information to other organisations which supports them in making their own decisions as this is for each organisation to decide. For example, we do not tell lenders whether to offer credit to consumers; we just provide services that help those lenders make decisions about consumers. An organisation’s own data, knowledge, processes and practices will also play a significant role in those decisions. 

We may provide similar services to our respective clients, but these services may lead to different decisions because (i) each credit reference agency may hold different information from the others, (ii) each client may place differing importance on some information compared to others, and (iii) each client may take into account information available to it from other sources. These are some of the reasons why a person may receive a “yes” from one lender but a “no” from another.

SCORES AND RATINGS 

When requested, we use the data we obtain to produce credit, risk, fraud, identity, affordability, screening, collection and insolvency scores and ratings; these are explained in Section 4 above. In providing these scores and ratings to our clients, we are not making decisions about consumers or telling organisations what decisions to make about consumers – this is for each organisation to decide on the basis of their own criteria.

9. HOW CAN A CONSUMER SEE WHAT DATA THE CREDIT REFERENCE AGENCIES HOLD ABOUT THEM? DO CONSUMERS HAVE A ‘DATA PORTABILITY’ RIGHT IN CONNECTION WITH THEIR DATA?

Data access right

Consumers have the right to find out what personal data we hold about them. Each of us provides more information about access rights on our websites.

Data protection legislation also contains a right to data portability. Where it applies, the right to data portability gives consumers a right to receive their personal data in a standard format. However, this right only applies when personal data is processed on certain lawful grounds, such as consent. This right does not apply to our data because it is processed on the grounds of “legitimate interests”. To find out more about legitimate interests please go to Section 3 above.

10. WHAT CAN A CONSUMER DO IF THEIR CREDIT REFERENCE DATA IS WRONG?

When the credit reference agencies receive personal data, they perform lots of checks on it to try and detect any defects or mistakes. Ultimately, though, the credit reference agencies rely on their suppliers to provide accurate data.

If a consumer thinks that any personal data a credit reference agency holds about them is wrong or incomplete, the consumer has the right to challenge it. If challenged, the credit reference agency will need to take reasonable steps to check the data, such as asking the organisation that supplied it to check and confirm its accuracy.

If the data turns out to be wrong, the credit reference agency will update its records accordingly. If the credit reference agency still believes that the data is correct after completing their checks, they will continue to hold and use it. Where the data is part of the consumer’s credit report, they can ask the credit reference agency to add a supplementary statement of up to 200 words explaining their views about the information. This statement will be supplied to organisations who subsequently access the information that the consumer has disputed.

To do this, consumers should contact the relevant credit reference agency using the contact details in Section 1 above. Where more than one credit reference agency holds incorrect information, it may be necessary to contact them separately.

11. CAN A CONSUMER OBJECT TO THE USE OF THEIR CREDIT REFERENCE DATA AND HAVE IT DELETED?

This section helps consumers understand how to exercise their data protection rights to object to data being used by us and how to ask for it to be deleted. To understand these rights and how they apply to the processing of data, it is important to know that we hold and process personal data under the “legitimate interests” basis for processing (see Section 3 above for more information about this), and do not rely on consent.

Consumers have the right to object to the processing of personal data by us. This can be done by contacting the relevant credit reference agency using the contact details in Section 1 above.

Although consumers have complete freedom to contact us with objections at any time, under data protection law, a consumer’s right to object does not automatically lead to a requirement for processing to stop, or for personal data to be deleted.

Because of the importance of the credit referencing industry to the UK’s financial system, and the important purposes for which the data is needed (such as supporting responsible lending, and preventing over-indebtedness, fraud and money laundering) we will normally have compelling, overriding grounds to carry on using the personal data following an objection. In many cases, it will not be appropriate for us to restrict or to stop processing or delete data, for example, where the result would be to hide a poor credit history that could enable a person or organisation to get credit they otherwise would not be eligible for.

However, as an exception from the general rule described above, all consumers have an absolute right to object to their personal data being used for direct marketing purposes. If you object to us using your personal data for those purposes, you can get us to stop by contacting us using the details in Section 1 or specifically, in the case of Experian, through the online service at https://www.experianmarketingservices.digital/OptOut. 

12. CAN A CONSUMER RESTRICT WHAT THE CREDIT REFERENCE AGENCIES DO WITH THEIR DATA?

In some circumstances, consumers can ask us to restrict how we use their data. Contact details for each credit reference agency are in Section 1 above. 

This is not an absolute right and processing will only be restricted if certain conditions are met (for example, if the processing is unlawful or the personal data is no longer required by us for the purposes for which it was obtained). 

Even where a restriction condition is met, a consumer’s personal data may still be processed (and shared) by us where certain grounds exist. These are: 

• with the consumer’s consent 
• for the establishment, exercise, or defence of legal claims 
• for the protection of the rights of another natural or legal person 
• for reasons of important public interest 

We will consider and respond to requests we receive and will assess whether any of the restriction conditions apply and, if they do, whether there are any grounds that permit the continued processing of the personal data. 

Given the importance of complete and accurate data, for purposes including, for example, for responsible lending and preventing over-indebtedness, fraud and money laundering, it will usually be appropriate for us to continue processing data on the basis of protecting the rights of another natural or legal person or for reasons of important public interest. Consumers can contact us to ask about this processing of their personal data so that they can understand how their data will be used.

13. WHO CAN A CONSUMER COMPLAIN TO IF THEY ARE UNHAPPY ABOUT THE USE OF THEIR DATA?

THE CREDIT REFERENCE AGENCY 

Each credit reference agency tries to ensure that it delivers the best outcomes for its clients and for consumers. If a consumer wants to make a complaint to us, they can do so by contacting us at the following addresses.

Each of us also has a data protection officer who can be contacted about matters relating to the protection of personal data at the relevant credit reference agency. The contact details for each of our data protection officers are:

• Equifax: UKDPO@equifax.com
• Experian: uk.dpo@experian.com
• TransUnion: ukdpo@transunion.com

THE INFORMATION COMMISSIONER’S OFFICE 

If a consumer is not satisfied with how we have investigated a complaint, the consumer can refer their concerns to the Information Commissioner’s Office which is the body that regulates the handling of personal data in the UK. The contact details are: 

• Phone: 0303 123 1113 
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF 
• Website: https://www.ico.org.uk

You may also have the right to raise questions or complaints to the relevant supervisory authority or other data protection regulator in the jurisdiction where you are resident. If you are resident in the Isle of Man or the Channel Islands, the relevant data protection regulator’s details are:

THE FINANCIAL OMBUDSMAN SERVICE

Where the complaint relates to an activity which is regulated by the Financial Conduct Authority (such as credit reporting and affordability checks), consumers also have the right to refer the matter to the Financial Ombudsman Service (FOS) for free. The FOS is an independent public body that aims to resolve disputes between consumers and businesses like credit reference agencies. 

If you live in the Isle of Man or the Channel Islands, this service is also available to you because we are UK based businesses.

The contact details are:

• Phone: 0300 123 9 123 (or, from outside the UK, +44 20 7964 1000)
• Email: complaint.info@financial-ombudsman.org.uk
• Post: Financial Ombudsman Service, Exchange Tower London E14 9SR
• Website: https://www.financial-ombudsman.org.uk

14. WHERE CAN YOU FIND OUT MORE?

The work we do is very complex, and this document is intended to provide only a concise overview of the key points. More information about each credit reference agency and what it does with personal data is available at the following locations: 

The Information Commissioner’s Office also publishes advice and information for consumers in its Credit Explained leaflet.