Reporting from the Financieele Dagblad reveals that the Personal Data Authority (AP) is taking enforcement action against credit reporting agencies such as Experian, Focum and EDR for structural violations of privacy laws. According to the regulator, there is no legitimate interest for the large-scale collection and processing of consumer data, which violates the General Data Protection Regulation (AVG).
The AP says credit reporting agencies cannot demonstrate a legitimate interest in collecting and processing consumer data on a large scale. This is a requirement under the General Data Protection Regulation (GDPR). The companies claim that their services are of social interest, such as preventing defaults and excessive debt, but the AP stresses that this is not enough to justify the breaches.
Experian previously received a multimillion-dollar fine, which could reach tens of millions of euros, according to FD sources. Focum also received a fine, described as "material" in its annual report. The AP found five privacy violations at Focum after a three-year investigation. EDR also reported problems with the regulator. Despite the enforcement, details of the penalties imposed remain largely anonymous due to court rulings aimed at preventing reputational damage.
The regulator is concerned that the current model, in which consumers are classified by creditworthiness, leads to social polarization. People with low scores may have difficulty obtaining basic needs such as rental housing, insurance or energy contracts. These consequences underscore the importance of strict enforcement, according to the AP.
In the FD, the Consumers' Association says it praises the AP's approach and stresses that the AVG is all about control over one's own data. According to them, the actions of the credit bureaus go against this core value. 'The essence of the AVG is that people retain control over their own data, and this entire sector is acting in violation of that principle,' said a spokesman for the Consumers' Association in response to the FD. 'It is very good that the AP is intervening. It is badly needed.
The companies involved stress the importance of their services to both consumers and businesses. They claim to use the data collected to comply with anti-money laundering laws and manage payment risks. At the same time, Experian and Focum are legally challenging the sanctions imposed.
According to the FD, many violations have long gone unnoticed due to a court order that kept the publication of fines and penalties anonymous. While this anonymity was intended to limit reputational damage, it also contributes to a lack of public transparency.
According to the FD, the AP's action puts pressure on the revenue model of credit reporting agencies. Payment behavior databases such as those of EDR, Experian and Focum are essential to their operations, but the legal battle and public criticism make the future of these practices uncertain.
You can read the full article in the Financieel Dagblad: 'Privacy watchdog hunts credit reporting agencies'.
