Credit Reference Agency Information Notice

IN BRIEF

We are credit reference agencies and we play a key role in the UK’s financial ecosystem. This document explains how we obtain, process and share personal data about consumers and businesses.

This section briefly summarises the key processing activities common to the credit reference agencies. For more detail, please refer to the rest of this document. In addition, we recommend reviewing each credit reference agency’s own information notices, which explain the specific processing activities of that credit reference agency. Links to these documents can be found in section 14.

• Credit reference agencies collect information about consumers and businesses from various sources and build databases that hold all of this data.
• The sources of that information include public records, such as court judgments (CCJs) and electoral register information, and financial information from lenders, utilities suppliers and telecoms businesses.
• Lenders and other organisations carry out searches against that information with one or more credit reference agencies.
• Organisations can carry out searches for several reasons. These include assessing creditworthiness and ability to afford financial products, checking the accuracy of other information, preventing and detecting crime (such as fraud or money laundering), checking identity, tracing individuals (for example to recover debts that they owe), calculating how much their insurance premiums should be, and assessing their suitability for a job or a tenancy.
• When an organisation carries out a search of someone’s information, we will record details of that search. This is known as a search footprint.
• Credit reference agencies also use consumer data for marketing-related purposes, such as helping organisations to better direct their marketing, including by screening individuals out of advertising for credit products so that those products are not offered to people who would not be eligible for them. They may also use the data to build insight to predict information or characteristics about the population, to help organisations identify who they want to market their products and services to.
• Credit reference agencies also use the data in their databases for other activities. These include analytics and profiling, such as helping lenders build scorecards to use in assessing credit applications.
• Because not every lender supplies data to every credit reference agency, your credit reference information held at each credit reference agency might be different.
• Credit reference agencies carry out several types of data processing to help achieve the aims described above. These include loading data, matching and linking data together as well as testing, developing and building our products and services.
• Consumers have certain rights that they can seek to exercise in relation to the personal data held by credit reference agencies. For example, they have rights to obtain a copy of the data, to ask the credit reference agency to correct it if it is inaccurate, and to object to the processing of the data.

Please note:

• This document describes how the credit reference agencies use and distribute the personal data described in section 4. This data is referred to as “credit reference data”.
• The credit reference agencies are independent businesses. Not all of the products and services described in this document are provided by all three of the credit reference agencies, or in the same way, and not all of the data is used by each of them.
• This document does not cover all personal data that the credit reference agencies use and distribute; for example, this document does not cover processing of personal data in relation to credit reference agency services you sign up to directly, such as services which allow you to view your own credit report and score. Section 2 and section 14 below provide links to where information can be found about each credit reference agency’s other products and services (including marketing services) and how they use and share other kinds of personal data.
• Consumers can obtain a copy of the information that each credit reference agency holds about them. Section 9 explains how this can be done.

1. WHO ARE THE CREDIT REFERENCE AGENCIES AND HOW CAN THEY BE CONTACTED?

There are three main credit reference agencies in the UK.

Each is regulated by the Financial Conduct Authority (“FCA”) and authorised to conduct business as a credit reference agency. The full names and contact details for each are set out below.

Equifax Limited
Post: Equifax Limited, Customer Service Centre PO Box 10036, Leicester, LE3 4FS
Email: UKDPO@equifax.com
Phone: 0333 321 4043 or 0800 014 2955

Experian Limited
Post: Experian, PO BOX 9000, Nottingham, NG80 7WP
Phone: 0344 481 0800 or 0800 013 8888

TransUnion International UK Limited
Post: TransUnion, One Park Lane, Leeds, West Yorkshire, LS3 1EP
Email: consumer@transunion.co.uk
Phone: 0330 024 7574

In this information notice, these three companies are referred to as Equifax, Experian and TransUnion respectively. Together they are referred to as credit reference agencies.

Controllers

Each credit reference agency is a controller of the credit reference data that it holds. This means that it has certain responsibilities under data protection law to make sure that the data is used fairly and lawfully.

Where a credit reference agency operates as part of a group of companies, it may share joint responsibility with the other members of that group when sharing data with them. You can contact the relevant credit reference agency using the details above if you want to enquire about any of those group companies or exercise any of your rights in respect of your personal data.

2. WHAT DO CREDIT REFERENCE AGENCIES USE CREDIT REFERENCE DATA FOR?

Credit reference agencies use credit reference data in products and services that they offer to their clients. The purposes for which those products and services are used are described below, but please note that different clients may use the products and services in different ways. Consumers should check the privacy policies of the organisations that they deal with for details about how they use any products and services provided by the credit reference agencies.

(a) Credit reporting and affordability checks

Each credit reference agency uses credit reference data to provide credit reporting services and affordability checks to its clients.

Credit reporting

Organisations use credit reporting services to see how people and businesses are managing payments in respect of their credit arrangements and how they have done so in the past. For example, if a person applies for a bank loan to buy a car, the bank may use credit reporting services to check whether that person has defaulted on any previous credit agreements. It will then use this information, together with information from other sources, to assess the risk of offering the loan.

Affordability checks

Organisations use affordability checks to help understand whether people or businesses applying for credit are likely to be able to afford the repayments. The information provided as part of the affordability checks may affect a person’s or business’s ability to obtain credit.

These activities help promote responsible lending, prevent people and businesses from getting into more debt than they can afford, and reduce the amount of unrecoverable debt and insolvencies.

(b) Checks to validate and verify data, and help prevent and detect fraud, money laundering and other criminal activity

The credit reference agencies use credit reference data to provide validation and verification services and other services to help prevent fraud, money laundering and other criminal activity.

Some examples of how credit reference agency clients use these services are as follows:

• When a person applies to an organisation for a product or service, the organisation might ask that person to answer questions about themselves, and then check the answers against the data held by the credit reference agencies to see if they match. For example, they may ask “What is your current address?” If the address provided does not exist on the credit reference agencies’ records (for example, because it is a fictitious address) or does not match the data held by the credit reference agencies (for example, there is no record of the person at the address provided), then this may be an indicator of a mistake or fraud.
• Where some products and services are only available to people of a certain age, organisations may check whether the person they are dealing with is eligible by looking at data held by the credit reference agencies. For example, if a person is signing up to join a gambling website which is only for people who are at least 18 years old, the organisation may check to see if the age provided by the person matches that held by the credit reference agencies.
• Government and quasi-government bodies may use credit reference agency services to check whether people are entitled to certain benefits and to help recover unpaid taxes, overpaid benefits and similar debts. For example, if a person is claiming single person discount for council tax, a local authority may check with the credit reference agencies to see if any other adults are living at the same address.
• The police may use data held by credit reference agencies to help in their investigations into criminal activity.

An indication of invalid or unverified information, fraud, money laundering or other criminal activity may affect the outcome of an application for (amongst other things) a product or service, a tenancy agreement or employment. If clients using the services identify potentially fraudulent activity they may also pass the applicant’s details to a fraud prevention agency such as Cifas and/or to the police.

(c) Customer management

Credit reference agencies use credit reference data to provide products and services for organisations to use for customer management purposes. Customer management is the ongoing maintenance of an organisation’s relationship with its customers. This could include activities designed to support:

• data accuracy: for example, to correct or update data held on the organisation’s records, such as correcting spelling mistakes or adding missing fields;
• ongoing relationship and account management activities: for example, to help organisations make decisions relating to credit limit adjustments, transaction authorisations, card reissue, inbound lending requests, and to identify and manage the accounts of customers including those at risk, in early stress, in arrears, or going through a debt collection process.

(d) Tracing and debt recovery

Credit reference agencies use credit reference data to provide products and services that allow organisations to trace people. This is typically needed where a person has moved address or changed their telephone number and has not provided their new contact details. The credit reference agencies help organisations locate customers they have lost contact with by providing them with updated addresses and other contact details.

The products and services are used to support organisations’ debt recovery and debtor tracing activity. For example, if a person owes money to an organisation and moves to a new house without telling the organisation where they have moved to, the organisation may use these services to help find that person to recover the money that is owed to them.

These products and services are also used to find people in order to let them know about assets that they may have forgotten about or not be aware of, such as old dormant savings accounts or pension funds, or to find people to let them know about assets of a deceased person which they have an interest in, such as administrators or beneficiaries of a deceased person’s estate.

Please also see section 2(h) below which describes how some of the credit reference agencies provide tracing services for marketing purposes.

(e) Tenant vetting

Credit reference agencies use credit reference data to provide products and services that allow landlords to verify some of the information provided by their prospective tenants, as well as confirming that they are who they say they are and that they are likely to be willing and able to pay their rent on time. Landlords can use this information to help decide whether to agree to the tenancy, or how much of a deposit they should ask for.

(f) Staff and job candidate vetting

Credit reference agencies use credit reference data to provide products and services that allow organisations to verify some of the information provided by their staff and job candidates and confirm that they are who they say they are. They also enable employers to assess whether the staff member or candidate has a history of managing their own financial commitments well, or whether they are financially compromised. This can be used to help them decide whether the person would be or will continue to be a suitable member of staff.

(g) Insurance risk assessments and pricing

Credit reference agencies use credit reference data to provide products and services for organisations to use to assess insurance risk. For example, an insurer may find that a person’s financial standing and history can be used to help predict how likely that person is to make a claim on an insurance policy, or how large that claim might be. This can help the insurer to decide (i) whether to provide insurance to a person, and (ii) how much the insurance premium should be, and (iii) whether to allow payment for insurance on a credit instalment basis.

(h) Marketing and marketing-related services

Overview

Each credit reference agency offers its clients marketing services. Some of these marketing services use credit reference data and some do not. For details about the marketing services offered and the personal data used by the credit reference agencies, please see the following links:

Experian: https://www.experian.co.uk/privacy/consumer-information-portal

Equifax: https://www.equifax.co.uk/ein.html

TransUnion: https://www.transunion.co.uk/legal/privacy-centre?#pc-marketing-services

As well as other rights, consumers have the right to object to the processing of their credit reference data for direct marketing purposes, including any profiling that is related to direct marketing. Section 11 sets out more details on how this right can be exercised.

If a credit reference agency provides marketing services, then they may use an individual’s title, name (including aliases), address, date of birth, gender and address links information (see section 4 for more detail), as well as limited information relating to their financial standing.

Screening out

Credit reference agencies use credit reference data to provide screening services to their clients. This means that they identify people who clients may wish to screen out of marketing lists. Screening is used to help ensure that individuals do not receive irrelevant or inappropriate marketing information.

For example, a client may want to screen out from its marketing list someone who is deceased, or who is under 18, or does not reside at the address they hold, or who may not be interested in a product or service or is unlikely to be accepted for it.

Other marketing-related activities

In addition, credit reference agencies may use credit reference data to offer some or all of the following marketing services:

• They may supply the open version of the electoral register (where people have not opted out from their electoral register data being used for marketing and other purposes) to organisations for marketing purposes. This can include identifying new potential customers, verifying that names, addresses and dates of birth collected from other sources are accurate and complete, and informing customers of any errors.
• They may identify when someone has moved away from an address so that marketing is not sent to them at that old address.
• They may help build insight using profiling techniques which will be used by organisations to help them identify people that they want to communicate with about particular products and services. This insight might predict, for example, age, marital status, household composition, length of residency at an address and gender. It can help give organisations insight into the likely characteristics of the UK population at an individual, household and postcode level. Credit reference data also helps credit reference agencies to validate the insight being created.
• In certain circumstances, insight might also be used to help clients predict the financial profile of a person so that they can personalise their interactions with them and make communications more relevant and suitable. For example, they could use the insight to select products or offers that they believe would be relevant to that person.
• Models and insight created by the credit reference agencies can be matched to clients’ own contact lists so that they can make better informed decisions about how they interact with individuals.
• They may confirm whether individuals are resident at the address that the credit reference agencies or their clients hold for them. This can be done by checking the credit reference data to see if there are any open credit accounts at an address and whether the accounts have recent activity, such as where a recent payment has been made. If they do, then it is likely that they have the correct address details. This will help ensure that an individual does not receive marketing for someone else and the credit reference agencies’ clients do not send marketing to the wrong address.
• They may trace individuals to a new address so that their marketing preferences (both opt- ins and opt-outs) collected at a previous address can continue to apply at their new address and so that marketing is not sent to them at their old address.
• The credit reference agencies may also use credit reference data to help keep their own marketing suppression lists (or those of their group companies) accurate and up to date. For example, if you have previously asked to be excluded from marketing activity and your credit reference data indicates that you have since moved or changed your name, that information can be used to make sure that you continue to be excluded from marketing activity at your new address or under your new name.

(i) Profiling, statistical analysis and anonymisation

Credit reference agencies use, and allow their clients to use, credit reference data to carry out profiling of consumers through statistical analysis. This includes the creation, validation and use of scorecards, models, and attributes in connection with the assessment of risks relating to credit, fraud, affordability and debt collection. It is also used in verifying identities, to monitor and predict market trends and to enable clients to refine lending and fraud strategies, and loss forecasting.

These practices profile consumers to help determine the likelihood that a consumer with certain characteristics will act in a way that will produce certain outcomes; for example, to repay credit, to be able to afford credit, to claim on an insurance policy, to commit fraud, to respond to certain collection strategies or to become insolvent.

The credit reference agencies may also convert personal data into statistical or aggregated form so that individuals are not identified or identifiable (thereby creating anonymized data). Anonymized data is not personal data and the credit reference agencies may use such data to conduct research and analysis, including to produce statistical research and reports or for any other purposes.

(j) Data management activities

Credit reference agencies use credit reference data to carry out certain processing activities to support their own business operations. This includes supporting the effectiveness, efficiency and security of their databases, products and services, both in the context of their credit reference activities and more widely. For example:

• Data loading: credit reference data is checked for integrity, validity, consistency, quality and age to help make sure it is accurate. These checks pick up issues such as irregular dates of birth, names, addresses, account start and default dates, and gaps in status history.
• Data matching: credit reference data is matched to the credit reference agencies’ existing databases to help make sure it is assigned to the right person, even when there are discrepancies like spelling mistakes or previous names or different versions of a person’s name. Credit reference agencies use credit reference data to create and confirm identities, which they use to underpin the services that they provide.
• Data linking: when credit reference agencies compile data into their databases, they create links between different pieces of data. For example, people who appear financially associated with each other may be linked together and a person can be linked with their previous and current addresses. Also, where someone has an alias, such as a maiden name and married name, these names will be linked.
• System maintenance and testing: credit reference data may be used when carrying out system maintenance, repair and testing, and security activity.

Each credit reference agency has its own processes and standards for data management activity.

(k) New development and testing

The credit reference agencies use credit reference data to help develop new products, services and technologies and to test them. Typically, credit reference agencies will anonymise credit reference data before it is used for these purposes.

(l) Compliance with laws

The credit reference agencies use and disclose credit reference data where required by law. For example, this can happen in response to a court order or a request from a regulator, or in order to comply with a request from a person (or by a third party acting on their behalf), to exercise their legal rights in respect of the credit reference data, such as by requesting a copy of it.

3. WHAT ARE THE CREDIT REFERENCE AGENCIES’ LEGAL GROUNDS FOR HANDLING CREDIT REFERENCE DATA?

Data protection law requires the credit reference agencies to always have what is referred to as a “lawful basis” (i.e. a reason or justification) for processing personal data. There are a number of lawful bases available, but the majority of credit reference agencies’ activity is on the basis that:

• the processing is necessary to pursue the legitimate interests of the credit reference agencies and third parties (such as their clients), and those interests do not unduly prejudice the rights and freedoms of individuals; or
• the processing is necessary to comply with a legal obligation binding on the credit reference agencies.

For information about any other lawful basis relied on by each credit reference agency, please review their individual information notices (see section 14).

Legitimate interests

The credit reference agencies use credit reference data to pursue their legitimate interests, those of their clients and those of individuals. The following table explains these legitimate interests. The credit reference agencies have carried out assessments and have concluded that these interests are not overridden by the interests or fundamental rights and freedoms of individuals.

• Promoting responsible lending and helping to prevent over-indebtedness
  Responsible lending means that lenders only sell products that are affordable and suitable for the borrowers’ circumstances. This is in the interests of borrowers so that they do not become burdened with debt that they cannot afford to repay, and the stress associated with that. It is also in the interests of lenders in that it reduces bad debt and collections activity.
  Credit reference agencies facilitate responsible lending by providing services that allow lenders to access information about a person (and anyone with whom they have a financial association, such as a joint account), including how they are managing current debt, have managed debt in the past and whether they have sufficient income to repay the debt.
• Helping prevent and detect fraud, money laundering and validate and verify identity
  Credit reference agencies provide identity, anti- fraud and anti-money laundering services to help clients meet legal and regulatory obligations. These services benefit individuals by facilitating prompt access to services through identity verification, and helping to protect them against fraud, and other criminal activity.
  Prevention and detection of fraud, money laundering and other criminal activity is in the legitimate interest of the credit reference agencies and their clients. It is also to the benefit of wider society and therefore in the public interest.
• Customer and data management activities for the benefit of consumers and businesses
  ‍Credit reference agencies provide services which help businesses maintain the quality of the data they hold and to make informed decisions about how they engage with their customers.
  It is in the legitimate interests of the credit reference agencies to offer these services to their clients but it is also in the legitimate interests of both the consumer and businesses by helping ensure that data held is accurate, comprehensive and up-to-date and that informed and responsible decisions can be made particularly in the context of lending decisions.
• Supporting tracing and debt recovery
  Credit reference agencies provide services that support tracing and collections where the client has a legitimate interest in conducting activity to find its customers and to recover debt, or to reunite, or confirm that an asset relates to the right person.
• Enabling landlords to check the suitability of their prospective tenants
  Credit reference agencies enable landlords to verify some of the information provided by their prospective tenants, as well as confirming that they are who they say they are and that they are likely to be willing and able to pay their rent on time. This helps the landlord to decide whether to agree to the tenancy, or how much of a deposit they should ask for; and it reduces the risk that the tenancy relationship will subsequently break down. It also helps tenants to avoid getting into legal difficulties where they have agreed to pay rent that they cannot afford.
• Enabling employers to check the suitability of their current and prospective staff
  Credit reference agencies enable employers to verify some of the information provided by their staff and job candidates and confirm that they are who they say they are. They also enable employers to assess whether the staff member or candidate has a history of managing their own financial commitments well, or whether they are financially compromised. This can help reduce the risk of fraud and can help the employer to decide whether the person is or would be a suitable member of its staff. All of which is in the legitimate interest of those employers.
• Enabling insurers to calculate and price risk more accurately
  Credit reference agencies enable insurers to consider certain kinds of credit reference data when they are assessing risk. This data can help the insurer decide whether to provide cover to a person, and how much the insurance premium should be. This enables them to better forecast their future liability and to price their insurance products more accurately and competitively. For consumers, it means that insurance policies are priced more fairly, with the lowest-risk individuals paying less for their insurance.
• Supporting compliance with legal and regulatory requirements
  Credit reference agencies’ services may be used by their clients to help them comply with their own regulatory obligations, for example, complying with anti-money laundering obligations and regulations set by the FCA which require lenders to assess the creditworthiness of individuals who apply for loans. This is in the legitimate interest of clients.
  Further, these regulatory obligations are in place in the interests of wider society, so facilitating compliance with them indirectly benefits society as a whole, which is in the public interest.
• Promoting responsible, efficient and informed marketing activities for the benefit of consumers and businesses
  Credit reference agencies provide services to support organisations in ensuring that their marketing strategies are responsible, informed and efficient. This helps them to reduce waste (driving costs down and increasing competition) and avoid sending communications to individuals who are less likely to be interested in receiving them or who should not receive them.
  More information is available from each credit reference agency about the legitimate interests relied on for their marketing services activities by visiting:
  Experian: https://www.experian.co.uk/privacy/consumer- information-portal
  Equifax: https://www.equifax.co.uk/ein.html
  TransUnion: https://www.transunion.co.uk/legal/privacy- centre?#pc-marketing-services
• Commercial interests
  It is in each of the credit reference agencies’ legitimate interests to provide the services described above to its clients to generate sales revenues.

The credit reference agencies’ use of credit reference data is subject to an extensive framework of safeguards that balance the legitimate interests set out above with the fundamental rights and freedoms of the people whose data the credit reference agencies use and share. The framework includes information given to people about how their personal data will be used and how they can exercise their rights to obtain their personal data, have it corrected, erased or restricted, object to it being processed, and complain if they are dissatisfied. It also includes extensive due diligence checks on clients, robust contractual arrangements and internal data management processes that the credit reference agencies have in place. These safeguards help sustain a fair and appropriate balance and to protect the rights and freedoms of individuals.

Legal obligations

In some circumstances the credit reference agencies are required by law to use or share personal data in particular ways. This happens, for example, when a court, law enforcement agency or regulator makes a legally binding request or order for disclosure of personal data. It also happens when individual consumers exercise their rights, for example by requesting a copy of their own personal data from a credit reference agency.

4. WHAT KINDS OF PERSONAL DATA DO CREDIT REFERENCE AGENCIES USE, AND WHERE DO THEY GET IT FROM?

Each credit reference agency obtains and uses personal data from different sources, so they often hold information that is different to some degree from that held by the others. However, most of the personal data they hold falls into the categories outlined below from the sources described.

• Identifiers
  Description: Credit reference agencies hold personal data that can be used to identify people, such as name, date of birth, and current and previous addresses. They may also hold business data including name, address and details of shareholders and directors.
  Source: This data is part of some of the other data sources mentioned below in this table. Data about UK postal addresses is obtained from commercial sources such as Royal Mail.
• Electoral register data
  Description: Credit reference agencies hold information from the electoral register (also known as the ‘Electoral Roll’). There are two versions of this. One is known as the open register (also known as the ‘Edited Electoral Roll’ or ‘EER’) and can be used for a variety of purposes including marketing. The other is the full register which the credit reference agencies can only use for limited purposes.
  Source: This data is supplied by local authorities across the UK and the Isle of Man.
  
• Credit account performance data
  Description: Credit reference agencies receive personal data about how people are managing to repay their credit commitments. The data includes the name of the lending organisation, the date the account was opened, the account number, the amount of debt outstanding (if any), any credit available (including overdraft limits) and the repayment history on the account, including late and missing payments.
  Source: This data is provided from banks, building societies and other financial services providers such as credit card companies, home credit suppliers, credit unions and hire purchase companies. It is also provided by utilities companies, mobile phone networks, retail and mail order companies and insurance companies.
  
• Rental related data
  Description: Some credit reference agencies receive personal data about whether people are managing to pay their rent on time. The data includes tenancy reference, start date, end date, rental amount, arrangement amount and outstanding balance.
  Source: This data is provided by social housing providers and private landlords.
  
• Bank account turnover data and application salary data
  Description: This data includes the name of the organisation providing current accounts, current account numbers, sort codes, the number of account holders, the transactions made on the current accounts (credits and in some cases debits), and a figure for credits on each current account. Application salary data consists of the salary declared by a person when they are applying for credit. It also includes whether that figure is net or gross, and whether the salary has been verified (e.g. with copies of salary slips). This data also includes the date that an application was made.
  Source: This data is provided from organisations which offer people current accounts, such as banks and building societies.
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  
• Electoral register data
  Description:
  ‍Source:
  

For information about any other lawful basis relied on by each credit reference agency, please review their individual information notices (see section 14).

Legitimate interests

The credit reference agencies use credit reference data to pursue their legitimate interests, those of their clients and those of individuals. The following table explains these legitimate interests. The credit reference agencies have carried out assessments and have concluded that these interests are not overridden by the interests or fundamental rights and freedoms of individuals.

• Promoting responsible lending and helping to prevent over-indebtedness
  Responsible lending means that lenders only sell products that are affordable and suitable for the borrowers’ circumstances. This is in the interests of borrowers so that they do not become burdened with debt that they cannot afford to repay, and the stress associated with that. It is also in the interests of lenders in that it reduces bad debt and collections activity.
  Credit reference agencies facilitate responsible lending by providing services that allow lenders to access information about a person (and anyone with whom they have a financial association, such as a joint account), including how they are managing current debt, have managed debt in the past and whether they have sufficient income to repay the debt.
• Helping prevent and detect fraud, money laundering and validate and verify identity
  Credit reference agencies provide identity, anti- fraud and anti-money laundering services to help clients meet legal and regulatory obligations. These services benefit individuals by facilitating prompt access to services through identity verification, and helping to protect them against fraud, and other criminal activity.
  Prevention and detection of fraud, money laundering and other criminal activity is in the legitimate interest of the credit reference agencies and their clients. It is also to the benefit of wider society and therefore in the public interest.
• Customer and data management activities for the benefit of consumers and businesses
  ‍Credit reference agencies provide services which help businesses maintain the quality of the data they hold and to make informed decisions about how they engage with their customers.
  It is in the legitimate interests of the credit reference agencies to offer these services to their clients but it is also in the legitimate interests of both the consumer and businesses by helping ensure that data held is accurate, comprehensive and up-to-date and that informed and responsible decisions can be made particularly in the context of lending decisions.
• Supporting tracing and debt recovery
  Credit reference agencies provide services that support tracing and collections where the client has a legitimate interest in conducting activity to find its customers and to recover debt, or to reunite, or confirm that an asset relates to the right person.
• Enabling landlords to check the suitability of their prospective tenants
  Credit reference agencies enable landlords to verify some of the information provided by their prospective tenants, as well as confirming that they are who they say they are and that they are likely to be willing and able to pay their rent on time. This helps the landlord to decide whether to agree to the tenancy, or how much of a deposit they should ask for; and it reduces the risk that the tenancy relationship will subsequently break down. It also helps tenants to avoid getting into legal difficulties where they have agreed to pay rent that they cannot afford.
• Enabling employers to check the suitability of their current and prospective staff
  Credit reference agencies enable employers to verify some of the information provided by their staff and job candidates and confirm that they are who they say they are. They also enable employers to assess whether the staff member or candidate has a history of managing their own financial commitments well, or whether they are financially compromised. This can help reduce the risk of fraud and can help the employer to decide whether the person is or would be a suitable member of its staff. All of which is in the legitimate interest of those employers.
• Enabling insurers to calculate and price risk more accurately
  Credit reference agencies enable insurers to consider certain kinds of credit reference data when they are assessing risk. This data can help the insurer decide whether to provide cover to a person, and how much the insurance premium should be. This enables them to better forecast their future liability and to price their insurance products more accurately and competitively. For consumers, it means that insurance policies are priced more fairly, with the lowest-risk individuals paying less for their insurance.
• Supporting compliance with legal and regulatory requirements
  Credit reference agencies’ services may be used by their clients to help them comply with their own regulatory obligations, for example, complying with anti-money laundering obligations and regulations set by the FCA which require lenders to assess the creditworthiness of individuals who apply for loans. This is in the legitimate interest of clients.
  Further, these regulatory obligations are in place in the interests of wider society, so facilitating compliance with them indirectly benefits society as a whole, which is in the public interest.
• Promoting responsible, efficient and informed marketing activities for the benefit of consumers and businesses
  Credit reference agencies provide services to support organisations in ensuring that their marketing strategies are responsible, informed and efficient. This helps them to reduce waste (driving costs down and increasing competition) and avoid sending communications to individuals who are less likely to be interested in receiving them or who should not receive them.
  More information is available from each credit reference agency about the legitimate interests relied on for their marketing services activities by visiting:
  Experian: https://www.experian.co.uk/privacy/consumer- information-portal
  Equifax: https://www.equifax.co.uk/ein.html
  TransUnion: https://www.transunion.co.uk/legal/privacy- centre?#pc-marketing-services
• Commercial interests
  It is in each of the credit reference agencies’ legitimate interests to provide the services described above to its clients to generate sales revenues.

The credit reference agencies’ use of credit reference data is subject to an extensive framework of safeguards that balance the legitimate interests set out above with the fundamental rights and freedoms of the people whose data the credit reference agencies use and share. The framework includes information given to people about how their personal data will be used and how they can exercise their rights to obtain their personal data, have it corrected, erased or restricted, object to it being processed, and complain if they are dissatisfied. It also includes extensive due diligence checks on clients, robust contractual arrangements and internal data management processes that the credit reference agencies have in place. These safeguards help sustain a fair and appropriate balance and to protect the rights and freedoms of individuals.

Legal obligations

In some circumstances the credit reference agencies are required by law to use or share personal data in particular ways. This happens, for example, when a court, law enforcement agency or regulator makes a legally binding request or order for disclosure of personal data. It also happens when individual consumers exercise their rights, for example by requesting a copy of their own personal data from a credit reference agency.