CRAIN Principles

Core Principles

1. Purpose - Article 13(1)(c) and 14(1)(c):
   1. In order to process your application and to provide ongoing credit services and or if we spot you have provided inaccurate data or suspect fraud, your personal data will be shared with CRAs;
   2. We share your data with CRAs when you apply for credit and monthly thereafter until the credit agreement comes to an end;
   3. Types of data shared: We share your personal identification and income data you provided us when you apply for credit. On a monthly basis we report your credit utilisation, delinquency history including any defaults and any special arrangements you may have in place and changes to your personal identifiable data such as change of address etc.
   4. Ways in which the data returned may be used: performing credit & affordability checks, credit scoring and other statistical model development identity checks, detecting and preventing fraud, financial crime.
2. Recipients / categories of recipients - Article 13(1)(e) and 14(1)(e):
   1. Data is sent to CRAs (as above);
   2. The CRAs will also share information about you with us: such credit, delinquency history and any special arrangements with other lenders, public records (bankruptcy, insolvency, deceased), Gone- Away markers for persons no longer living at the supplied address. The CRA may also share your personal information with other organisations.
   3. The CRA may also share your personal information with other organisations.
3. The CRA may also share your personal information with other organisations.
4. More information about CRAs and how they use personal information is available at Transunion; Equifax; Experian.

Notes

• These principles are intended to assist in providing fair processing information regarding data sharing with CRAs. Firms will need to ensure they provide the necessary information to cover all GDPR Article 13 requirements about their processing and processing grounds, including about their other processing and data sharing, for example with other fraud prevention agencies.
• In line with ICO Consent guidance lender FPNs should not suggest that consent will be the basis for processing, where this is not the case and data sharing with the CRAs will still take place, e.g. as necessary for the contract and for legitimate interests.
• A greater or lesser level of detail may be appropriate depending on corporate style, the medium of communication, type of customer, processing in scope, etc. Firms should have regard to ICO guidance on layered fair processing notices.
• Below are two examples:

Example 1:

In order to process your application we will supply your personal information to credit reference agencies (CRAs) and they will give us information about you, such as about your financial history. We do this to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity.

We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. Your data will also be linked to the data of your spouse, any joint applicants or other financial associates.

The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at Transunion; Equifax; Experian.

Example 2:

In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”). Where you take banking services from us we may also make periodic searches at CRAs to manage your account with us.

To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders. If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail at www.transunion.co.uk/crain. CRAIN is also accessible from each of the three CRAs – clicking on any of these three links will also take you to the same CRAIN document: Transunion; Equifax; Experian..