The Enforcement Notice follows a two-year investigation into the direct marketing activities of three credit reference agencies – Experian, Equifax and TransUnion (CRAs).

The CRAs act as data brokers, enhancing and enriching personal data held in vast databases of information about almost every adult within the UK and trading it for use by the CRAs’ customers. The ICO found that all three CRAs were offering products and services that trade, enrich and enhance people’s personal data without their knowledge. The processed personal data was then being utilised for direct marketing purposes by the CRAs’ customers.