Your Data Rights

Here at TransUnion we handle lots of different kinds of data. Where we hold personal data about you, we want to ensure that you can exercise your rights over that data as easily as possible. We’ve put this page together to help you do that.

WHAT DATA CAN I EXERCISE MY RIGHTS OVER?

You can exercise your rights in relation to any personal data that we hold about you.

The kinds of personal data that you may be interested in exercising your rights over include:

• consumer credit reference data (such as information on your credit file)
• consumer marketing data (such as your name and address on the open register)
• your employment file if you are a past or present TransUnion employee
• data we hold if you are a business contact at one of our clients, potential clients or suppliers
• data relating to the users of our products and services
• your correspondence with us (such as queries or complaints that you have raised)

If you just want to know what kinds of data we hold and how we use and share it, please refer to our Privacy Centre.

Sometimes we hold personal data on behalf of other organisations but don’t make decisions about how or why that data will be used. In these cases, you’ll need to contact the relevant organisation directly if you want to exercise your rights over that data.

WHAT RIGHTS DO I HAVE?

You have the following rights over the personal data that we handle.

Access

You have the right to know what data we hold about you, what we use it for, where we got it from, the kinds of organisations that we share it with and how long we keep it for.

At TransUnion there are two kinds of access request you can make:

• Limited subject access request: provides you with a copy of your credit file.
• Full subject access request: provides you with any other of your personal data that you specify.

If you’re just interested in seeing what’s on your credit file, you can do this online.

Rectification

If you believe that the data we hold about you is incorrect, inaccurate or needs to be brought up date, you can ask us to correct it.

Special rules apply where you ask us to correct something on your credit file. This is because of some separate legislation known as the Consumer Credit Act 1974. In these cases:

• The first step is to request a copy of your credit file.
• You can then let us know which entries on your file need to be corrected.
• We will mark the data as being under dispute and will investigate whether or not it’s correct. This will usually involve contacting the organisation that supplied the information to us.
• When we finish our investigation we will let you know the outcome. We have a 28 day deadline for doing this.
• If you’re not happy with the outcome you have a right to add an explanatory notice of up to 200 words onto your credit file.

Erasure (also known as the right to be forgotten)

This is a right to request that we delete some or all of the personal data that we hold about you.

It’s important to appreciate that this is not an absolute right. It only applies in certain situations and is subject to certain caveats. The circumstances in which it applies are explained on the Information Commissioner’s website, here.

We usually rely on the “legitimate interests” basis for processing your data. This is where it’s necessary for us to use your data in order to achieve certain aims that we and other organisations are pursuing, provided that those aims aren’t outweighed by the impact on your rights. In these cases, if you want us to erase your data you’ll normally need to object to us using it (see below) and give us information about how our use of your data is affecting you. Then we’ll weigh up the importance of the aims we are pursuing against the effect that we’re having on you. If your rights outweigh the need for us to use the data then we will erase it; otherwise, we’ll be entitled to keep it.

If you’re asking us to erase your credit file, you need to bear in mind that accurate credit reporting is extremely important to the UK financial services industry and the wider economy. That means that it’s relatively rare that we will find that a person’s rights and interests override those aims.

You should also bear in mind that if you are successful in having your credit history erased, this could well make it harder for you to obtain credit in the future.

Please note that we are entitled to keep a copy of data for certain specified purposes, such as enforcing or defending legal claims.

Restriction

In some circumstances you can ask us to put restrictions on the ways in which we use and share your personal data.

This only applies in limited circumstances, such as where you’re disputing the accuracy of the data. And it normally only lasts for a limited amount of time, such as however long it takes for us to verify the accuracy of the data.

When data is restricted we can only use it in ways that you agree we can, or for the purposes of legal claims, in order to protect the rights of another person or for reasons of important public interest.

If you dispute the accuracy of something on your credit file, we’ll mark it as under dispute but will normally still share it with other organisations (with the dispute marker attached). It’s important that we do this because otherwise individuals could (for example) hide adverse information such as loan defaults, CCJs and bankruptcies from their credit files. Continuing to share disputed data is our way of protecting the rights of:

• lenders (who need to be able to make appropriate lending decisions), and
• other consumers (who would have to bear the increased borrowing costs that would otherwise result).

Portability

This is a right to have personal data supplied to you in a machine-readable format so that you can more easily re-use it in other services. This right only applies to TransUnion in very limited circumstances. Please ask us if you need your data supplied in this way.

Withdrawal of consent / objection

Where we’re relying on your consent in order to use your personal data you have an absolute right to withdraw that consent at any time. This will mean that we’ll need to stop using your data unless we have some other legitimate basis for continuing to use it.

In most other situations, you can object to us using your personal data; this will mean that we need to assess whether we have compelling reasons to continue using it despite your objection.

You also have a right to object to us using your data for direct marketing purposes. If you do this we’ll stop using your data for those purposes as soon as possible.

ARE THERE ANY EXCEPTIONS FROM THESE RIGHTS?

Yes.

Some of the rights are inherently limited in scope. For example, the erasure and restriction rights only apply in specific circumstances and are subject to some exceptions – please see what we say above about these.

There are also some more general exemptions. For example, if you make a subject access request we’re generally not required to provide you with information about other people. This means that you’ll often see other people’s names and job titles redacted from the material we send you. We’re also allowed to withhold information that is protected by legal privilege (such as our internal legal advice), which may happen if we are in a dispute with you.

We are also not required to provide you with information which would reveal our trade secrets, such as details of how our algorithms work. For example, we will not provide specific details about how we calculate credit scores, although we can provide you with general information about factors that will often affect your credit score.

HOW DO I EXERCISE THESE RIGHTS?

If you just want to see your credit report, you can do this online.

For any other requests about your personal data, please contact our Consumer Services Team.

HOW LONG WILL IT TAKE?

Normally we should be able to get back to you with the outcome of your request within one month. If we aren’t able to do that then we’ll explain why.

Requests to correct information on your credit file have a shorter timescale of 28 days.