Credit reference agencies and baby club sample data in the UK: what is the link?

What did the ICO find about Bounty and Equifax?

On 12 April 2019 the BBC reported an ICO monetary penalty of £400,000 against Bounty (UK) Limited for sharing personal information belonging to more than 14 million people. The ICO’s later data-broking investigation report lists that April 2019 Bounty fine among four broker penalties issued under the Data Protection Act 1998.

The ICO said Bounty was known as a pregnancy club while few people knew it also supplied data to third parties for direct marketing, and that it had not been open about what would be done with the data. Hospital bedsides and pack claim cards were collection points, not a credit application.

Do credit-reference agencies still hold marketing files?

Yes, as a separate product from the statutory credit file. Which?’s May 2024 investigation found all three major UK CRAs — Experian, Equifax and TransUnion — still run some form of marketing service. TransUnion’s was the most limited (validation and identity matching). Equifax modelled a few extra characteristics. Experian held the broadest set of modelled “propensities” and segmentation brands (Mosaic and Financial Strategy Segments).

Which? is clear that credit information or transactions are not handed straight to marketing clients as a raw credit dump. Equifax and Experian take name and address from the credit side and derive household facts. Equifax told Which? it does not use that credit-derived data for direct marketing and does not sell email or telephone marketing lists. Experian treats CRA-origin name and address as “non-prospectable” for clients who do not already hold it.

The ICO’s 2020 CRA investigation, summarised in the same data-broking PDF, found invisible processing for marketing. Equifax and TransUnion changed products. Experian received an enforcement notice and later won parts of a tribunal appeal about how it tells the 51 million people on its Consumer Information Portal; the tribunal still required notice to about five million people whose data had come only from other sources such as the open electoral register.

Does a 2026 sample card still go to Equifax?

Not on the 2019 notice, and not unless a live privacy policy names a CRA as a recipient. Bounty told the BBC it had ended broker relationships after the penalty. MayTally has not seen a current UK baby-club notice that lists Equifax, Experian or TransUnion as a sample-pack destination. Absence from a notice is not a promise about every partner in a chain. It is a reason to read this year’s wording instead of repeating 2018.

Which? still warns that competitions, offer websites and “lifestyle clubs” are common sources for data brokers. A 2026 reward-site tick can feed a marketing file without ever touching a credit score. That is a different pipe from the historic Bounty-to-Equifax feed.

Official records show a 2017–18 Bounty sharing arrangement that included Equifax. Official records do not show that a sample signup you complete today is sent to Equifax unless that signup’s own notice says so.

How do I opt out of CRA marketing without touching my credit file?

1. 1
   Mark the CRA marketing file non-prospectable Which? (30 May 2024) lists Experian at experian.co.uk/cip, Equifax at equifax.co.uk/ein, and TransUnion via [email protected]. Those pages are for marketing services, not for freezing a credit report.
2. 2
   Take your name off the open electoral register The open register is sold for marketing. The full electoral register is not. GOV.UK’s register to vote service is the route Which? cites. Opting out of the open register does not affect the right to vote.
3. 3
   Object to direct marketing at the club that took the card The ICO’s right to object cannot be refused when the use is advertising or marketing aimed at you. Start with the club’s privacy contact, then a complaint to that organisation, then the ICO.
4. 4
   Ask for a copy if you want to see the marketing file A subject access request can show what a CRA holds for marketing. Which? found Equifax’s process slow and easy to abandon. That difficulty does not cancel the right.

In shortIn short: a sample card once sat next to a CRA marketing feed because Bounty sold membership files to Equifax. That is a closed enforcement case. CRA marketing files still exist. Opt out of those files and of the open register. Do not treat a 2026 nappy sample as proof that Equifax has a new copy of your baby’s date of birth.