Experian v ICO: limits on telling people about offline marketing data

Credit reference agencies hold data on almost every UK adult. After a two-year investigation into how Experian and two other agencies used that data for direct marketing, the ICO issued Experian with an enforcement notice. Experian appealed, and the regulator ended up winning only part of its case.

These are tribunal outcomes as the ICO reported them in its statement. Inth has not summarised the full reasoning; read the Upper Tribunal decision for that.

• The First-tier Tribunal "supported aspects" of the ICO’s decision but allowed Experian’s appeal in other areas.
• The Upper Tribunal dismissed the ICO’s appeal against that ruling. The ICO said the flaws the Upper Tribunal identified "did not extend to overturning" the First-tier judgment, but that it had gained "clarity" on several points.

The ICO describes the data as "screened, traded, profiled and enhanced to provide direct marketing services". Inth’s technical interpretation: this is back-office data processing by a broker that never met most of the people involved. There is no website, banner or tag at the centre of it.

1. October 2020ICO enforcement notice after a two-year investigation
2. 20 February 2023First-tier Tribunal ruling
3. 6 to 8 February 2024Upper Tribunal hearing
4. 24 April 2024Upper Tribunal dismisses the ICO’s appeal
5. 24 May 2024ICO confirms it will not seek permission to appeal further

The ICO’s order stands only to the extent the First-tier Tribunal upheld it. The case is final. There was no fine; an enforcement notice orders changes rather than imposing a penalty.

No fine. The cost was the changes the tribunal upheld and more than three years of litigation.

For most website owners, this case matters less than the others in the library. It concerns how far an offline data broker must go to tell people about processing they never saw, not how a site handles tags or cookies. It is useful mainly as a reminder that the ICO can lose, and that tribunals will test how far transparency duties reach.

Little of Inth applies here. Website audit and the Consent banner deal with what loads on your site, and this case involved no site. Code audit can map reviewed data ingestion and onward-sharing routes in your own code, which helps if you buy or sell marketing data, but it cannot tell you what a broker does with it.

In the repository

• List imports of third-party marketing data and where each one is used.

In the browser and network

• Not applicable to this case; it involved no website.

With the people responsible

• Ask suppliers of marketing lists how the people on them were told about the use.

• ICO statement on the Upper Tribunal ruling, updated 24 May 2024
• [Upper Tribunal decision, [2024] UKUT 105 (AAC)](https://www.gov.uk/administrative-appeals-tribunal-decisions/information-commissioner-v-experian-ltd-2024-ukut-105-aac)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not summarise the full tribunal reasoning or audit Experian’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: Bounty (UK), Easylife