Skip to main content
Praxikon

Enforcement

Experian Netherlands fined 2.7 million euros for credit scoring without legal basis or information

Date
Status
final
Body
Autoriteit Persoonsgegevens
Reference
AP, beslissing op bezwaar Experian Nederland B.V. van 16 oktober 2025 (herroept boetebesluit van 6 december 2023; kenmerk vertrouwelijk)
Amount
€2,700,000

What it is about

Until 1 January 2025 Experian supplied credit reports with credit scores on individuals to clients such as telecom firms, web shops and landlords, using public and non public sources such as the trade register and telecom and energy companies. The Dutch DPA found processing without a valid legal basis (Article 5(1)(a) with Article 6(1)) and insufficient information to data subjects (Article 12(1) with Article 14(1) and (2)). On objection the DPA declared the objection well founded, revoked the primary decision of 6 December 2023 and set the fine at 2.7 million euros. Experian admits the breach, will not appeal, has stopped its Dutch activities and is deleting the database.

What this means in practice

Anyone building profiles from sources other than the data subject must actively inform those people (Article 14) and be able to explain why each type of data is needed. A legitimate interest basis fails where consequences for people are serious and the balancing was not done properly, especially when people cannot check the data used in time.

The GDPR articles concerned

Source: Autoriteit Persoonsgegevens, persbericht 17 oktober 2025 en beslissing op bezwaar 16 oktober 2025checked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 16

Guidelines8 of 13

Enforcement and fines8 of 13

Legislation in motion6 of 8