Your personal information belongs to you, and you have the right to determine who uses your personal information and how they use it. In certain instances, your information is used to meet regulatory obligations; for example, under the NCA, if your personal information is used unlawfully or in a manner that infringes your privacy, you may object to its processing.
· Experian carries out several types of data processing to help achieve the aims described above. These include loading data and connecting data together as well as testing, developing and building our products and services.
What is our legal basis for processing personal information?
Data protection law means that every organisation must have a lawful ground, or reason, for processing any personal information about a data subject.
There are a number of lawful bases available, but the majority of our activity is on the basis that:
- the processing is necessary to comply with an obligation imposed on credit bureaus by law, specifically the National Credit Act.
- processing is necessary to carry out actions for the conclusion or performance of an agreement to which you are a party to.
- you have consented to the processing.
- processing is necessary for the proper performance of a public law duty.
- the processing is necessary to pursue the legitimate interests of Experian, third parties (such as their clients), and those interests do not unduly prejudice your rights and freedoms.
We use the minimum data required
Often referred to in data protection regulation as "data minimisation", we ensure that only the minimum amount of personal information needed for processing purposes is collected by us.
We do this through measures such as:
- For consumer information, subscribing to an industry body and being regulated by the NCR who defines the format of any data sent to Experian, ensuring that only variables required for the processing are supplied by our data partners. Our internal processes will reject any data not supplied in the agreed format;
- Tightly defining the format of any business data sent to Experian, ensuring that only variables required for the processing are supplied by our data partners. Our internal processes will reject any data not supplied in the agreed format;
- When data is transferred externally to clients in bulk, only the minimum amount of data is transferred for the task. This data is anonymised, where personal data is not required for processing.
Data use under the NCA
Your personal information belongs to you, and you have the right to determine who uses your personal information and how they use it. In certain instances, your information is used to meet regulatory obligations; for example, under the National Credit Act and its Regulations (NCA), if your personal information is used unlawfully or in a manner that infringes your privacy, you may object to its processing.
Credit bureaus also use consumer credit information for marketing-related purposes, such as helping organisations to better direct their marketing, including by screening individuals out of advertising for credit products so that those products are not offered to people who would not be eligible for them. They may also use the data to build insights to predict information or characteristics about the population to help organisations identify to whom they want to market their products and services.
Credit bureaus also use the data in their databases for other activities. These include analytics and profiling, such as helping lenders build scorecards that lenders use in assessing credit applications.
Our function as a credit bureau and in processing your information for credit reporting purposes is governed by the NCA. The NCA promotes transparency and fairness in the access to credit. It also promotes responsible borrowing by consumers and the protection of consumers against reckless credit granting.
Why do we process your personal information?
We obtain and process personal information to create products and services that help our clients improve their decision-making process and manage their risk. We also use personal information to create products and services that help our clients improve their marketing, so you receive communications that are relevant and helpful. Personal information is further used to operate as a business (i.e. as part of the functional operations, for example, to employ staff, sign-up clients, pay our vendors, etc.).
Personal information held by Experian is used for the following purposes in its consumer and commercial bureau (as applicable) environment:
- Credit reporting and affordability checks
- Checks to validate and verify data and help prevent and detect fraud, money laundering and other criminal activity
- Customer management
- Setting a limit for services
- Tracing
- Tenant vetting
- Application for employment
- Debtor's book assessments
- Application for insurance
- Profiling, statistical analysis and anonymisation
- Data management activities
- New development and testing
- Compliance with laws
Personal information (mostly de-identified data) held by Experian is used for the following purposes in the marketing services business:
- Segments, models and profiling
- Building our marketing database
- Marketing data quality and suppression
- Marketing contact
- Connecting and matching data
- Marketing analytics
- Data Analysis Tools
Where personal data is processed, it is done with a lawful basis under POPIA (for example, with consent).
From time to time, we may use the personal information that we obtain for other purposes. These include:
- To analyse, develop, and improve the use, function, and performance of our products and services, including testing the quality of any new personal information from potential new contributors.
- To manage the security of our sites, networks, and systems, and to operate our business.
- To share with the Experian group of companies who manage some of the products and services we provide in South Africa or who provide services us in South Africa.
- To comply with applicable laws and regulations, industry investigations, or requests in dealing with public emergencies.