To the extent GDPR applies to Experian’s processing of personal data. Under data protection law, every organisation processing personal data for its own purposes must have a lawful ground for processing any personal data relating to an individual.
Experian processes your personal data under a lawful ground known as the 'Legitimate Interests condition'.
By working closely with our data suppliers, we ensure individuals are provided with information about the processing of their personal data which will take place within Experian’s environment. This information will be provided in the privacy policies/collection notices of the supplier and through links to the material provided in these information pages by Experian.
We expect high standards of compliance with data protection requirements from our suppliers and monitor accordingly.
We apply high standards of overall data protection. As an organisation regulated by the bodies of ADMA, AFCA and the OAIC it is vital we do so to protect consumers against detriment. Among many other things, this involves Experian continuing to manage our data assets in accordance with the data protection principles, keeping comprehensive internal records of all our processing, and giving full effect to data subject rights.
Specifically, in relation to our marketing services, and to ensure as much transparency as possible, Experian makes these consumer information pages available, providing information about our processing of personal data within the marketing ecosystem.
We expect our clients to operate strong data protection in relation to their marketing activities, ensuring it is easy for data subjects to indicate they do not wish to receive further marketing from an organisation, and dealing swiftly and effectively with any such requests.
Tight controls are maintained over the types of organisations that can access our marketing services to ensure you are only contacted by brands and organisations we believe will be of interest to you. For example, we have a robust and consistent set of guidelines on the provision of products/services to specific industries which we consider could have an inappropriate or intrusive impact on individuals if our marketing products and services were used by these organisations to contact individuals.
Experian will not deal with organisations with a poor record of compliance, either at the level of the individual organisation or problem sectors.
Where clients have a direct and existing relationship with data subjects (i.e. where they are existing customers), we will expect clients to provide the right information to data subjects about the processing of personal data which will be undertaken in respect of any relevant marketing activity and establish the basis on which the processing will be lawful under GDPR.