The Dutch Data Protection Authority (AP), the Dutch Data Protection Authority, has imposed a fine of 2.7 million euros on Experian Netherlands for multiple violations of the General Data Protection Regulation (GDPR).
According to the AP, the company – a member of the international Experian group that operates in more than 40 countries – used personal data from various sources (public and private) without sufficient information to individuals and without the required legal basis.
How the case arose
The Authority launched the investigation after complaints from individuals who found that, due to the credit rating provided by Experian to energy or telecommunications providers, they were asked for a high down payment. In some cases, the conclusion of a contract was not accepted.
The AP found that the company collected data from the Chamber of Commerce, companies and energy that sold customer information, and then created a broad database with information on “a significant number of people in the Netherlands.”
See also: Capita: £14m fine for 2023 data breach
During the period up to January 1, 2025, Experian provided its customers with credit scores based on factors such as negative payment behavior, outstanding debts or bankruptcies, but without adequately informing individuals about the collection of their data or securing consent or other valid legal basis.
The result was that many consumers had no idea that their rating affected the cost of services or their access to contracts — as Aleid Wolfsen, president of AP, noted: “Because people were not aware of credit checks, they could not check in a timely manner whether the information they were using was accurate.”
What it means for data technology
The incident clearly shows that credit rating is not just financial, but strongly involves the field of analytics data , big data and automated decision-making.
Experian, like many companies in the credit rating industry, uses datasets (public & private) to create models that allow third parties (banks, service providers, energy /telecommunications companies ) to decide whether and at what cost to work with someone.
However, the GDPR requires clear information to individuals, a lawful basis for processing (often consent or legitimate interest), and transparency — conditions that were not adequately met in this case.
See also: Singapore: Facebook threatened with fine for impersonation scams
Furthermore, the case highlights that technology is not “neutral”: how models are formed, what data is used, how much consumers can control the accuracy of their information — all of these have deep technological and ethical underpinnings.
What are the implications for businesses and the market?
For companies that base their services on data analysis and credit rating, the message is clear: non-compliance with GDPR can lead to fines and, most importantly, a blow to credibility.
This case shows that even big players with an international footprint are not above the rules. Experian acknowledged the illegality of its behavior and did not appeal.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
At the same time, the market should consider two critical points:
- The accuracy and updating of data for the individuals being assessed: the ability to check, correct or refuse processing is now becoming critical.
- Proof of legal basis for processing: companies must document why they collect data, for what purpose, and inform individuals — otherwise they face much higher fines.
According to figures, total GDPR fines to date have exceeded hundreds of millions of euros.
What's next – for consumers and regulation
For the consumer, the case translates into greater vigilance: if someone accepts a high advance payment or is rejected without a clear explanation, there is now a precedent to ask what data was used, who processed it and whether they have the right to correct or delete it.
For regulators and supervisors, the Experian case reinforces the position that rating models should be transparent, have human intervention where required, and not leave individuals “in the dark.”
The AP report states that Experian will delete entire database of personal data in the Netherlands before the end of the year and has stopped its activities regarding personal ratings.
See also: Microsoft avoids EU fine for Teams bundling
As assessment technology moves towards more automated solutions (AI, machine learning), companies must ensure that these models are compatible with the privacy framework — otherwise their technological advantage will become a legal and financial risk.
The Experian case in the Netherlands is a reminder that the collection and analysis of personal data — a technological activity with enormous potential — cannot be carried out without respect for the legal and ethical framework.
For technology sites and industry professionals, it marks a second generation of challenges: not just "making the technology work," but making it work properly, within the rules, with transparency and accountability.
Commitment to data protection is no longer a cost — it is a necessary condition for the reliability and sustainability of data-driven services.
Source: www.bleepingcomputer.com
