Experian Fined €2.7m For GDPR Breach in Netherlands

By Alessandro Mascellino for Infosecurity Magazine
Monday, October 20, 2025

• 529
• More

Experian’s creditworthiness reports included information such as payment behavior, outstanding debts and bankruptcies. These reports were used by clients to determine contract terms or deposit amounts. Individuals with lower scores often faced stricter conditions or additional costs.

Ilia Kolochenko, CEO at ImmuniWeb and a Fellow at the British Computer Society (BCS), said the number of affected people could be significant.

“While the total number of affected EU residents, whose personal data was processed by Experian, remains unknown in this specific incident, we are likely talking about many millions,” he said.

Kolochenko noted that in the UK, Experian “collected information about as many as 51 million British residents,” suggesting that a comparable scale in the EU “is easy to estimate.”

He added that “the personal data in question is highly sensitive, even if not expressly labeled as such by the blank ink of GDPR,” and that its misuse could “cause long-lasting and material damage.”

According to Kolochenko, “the Dutch DPA’s fine seems to be surprisingly mild and lenient,” and further legal action is likely, including “private lawsuits for both material and non-material damages.”

Experian acknowledged the violations and said it would not appeal the fine. The company has stopped operating in the Netherlands and plans to delete its entire database of personal information by the end of the year. Read Full Article