Experian Netherlands has been fined €2.7m by the Dutch Data Protection Authority (AP) for breaching the General Data Protection Regulation (GDPR).
The regulator found that the credit reporting and analytics company collected and used personal data from public and private sources without properly informing individuals or obtaining their consent.
The AP launched its investigation after receiving complaints from consumers who said they faced unusually high deposits or were denied installment plans by service providers.
The agency determined that Experian’s credit scores, used by telecom companies, energy suppliers and online retailers, had played a role in those decisions.
According to the AP, Experian obtained data from multiple sources, including the Chamber of Commerce trade register and telecom and energy firms that sold customer information.
This data was compiled into an extensive database containing details about millions of Dutch residents.
The regulator concluded that Experian could not justify the scope of the information collected or the necessity of using it.
“Because people weren’t aware of the credit check, they couldn’t verify whether the information used was accurate,”said Aleid Wolfsen, chair of the AP.
Experian’s creditworthiness reports included information such as payment behavior, outstanding debts and bankruptcies. These reports were used by clients to determine contract terms or deposit amounts. Individuals with lower scores often faced stricter conditions or additional costs.
Ilia Kolochenko, CEO at ImmuniWeb and a Fellow at the British Computer Society (BCS), said the number of affected people could be significant.
“While the total number of affected EU residents, whose personal data was processed by Experian, remains unknown in this specific incident, we are likely talking about many millions,”he said.
Kolochenko noted that in the UK, Experian “collected information about as many as 51 million British residents,”suggesting that a comparable scale in the EU “is easy to estimate.”
He added that “the personal data in question is highly sensitive, even if not expressly labeled as such by the blank ink of GDPR,”and that its misuse could “cause long-lasting and material damage.”
According to Kolochenko, “the Dutch DPA’s fine seems to be surprisingly mild and lenient,”and further legal action is likely, including “private lawsuits for both material and non-material damages.”
Experian acknowledged the violations and said it would not appeal the fine. The company has stopped operating in the Netherlands and plans to delete its entire database of personal information by the end of the year.
The case adds to the ongoing scrutiny of major credit agencies in Europe, following enforcement actions by UK regulators concerning how consumer data is collected and used for marketing and risk assessment purposes.