Why do organisations share my personal data?

Posted by Sam Griffin in Credit Reports on 4 February 2020

You may have seen recently that Lewisham and Greenwich NHS Trust has been sharing patient data with the Credit Reference Agency, Experian.

Many were initially surprised to find the Trust sharing data with a Credit Reference Agency, especially the patients who attend the Trust, and it raised a few questions. Experian has processed all information in accordance with strict industry guidelines, but going in for a routine check-up is a far cry from a mortgage application, so why do organisations share your personal data? What do they get out of it and are they allowed to do it without letting you know?

Why do organisations share data with the Credit Reference Agencies?

Every company will have its own unique reasons for sharing data. Often, it’s done by banks and lenders who have a Reciprocal Data Sharing agreement with the Credit Reference Agencies (CRAs). They’ll share their customers’ information with the CRAs, who in turn keep those individuals’ Credit Report information updated.

The purpose of these organisations sharing data is to allow them access to the Credit Reference Agencies’ vast databases. This ‘Reciprocal Data Sharing’ agreement means any organisation that shares customer account information with the CRAs can view prospective customers’ Credit Reports across the UK. Put simply, if you give account data to the CRAs, the CRAs will give you account data in return.

The main reason banks, lenders, mobile phone providers, and utility suppliers (to name just a few) want to access your Credit Report is straightforward: to assess your historic repayment behaviour so they can estimate your future repayment behaviour. These organisations will assess your Credit Report whenever you apply to them so they can understand your creditworthiness and ensure that their lending decision makes sense from both a profitable and responsible perspective. Importantly, they’ll also perform a credit check to establish that your identity is genuine.

But the fact that Lewisham and Greenwich Trust has been sharing patient information has surprised a number of its local residents. Many people weren’t aware that the Trust was sending their information off to any groups outside of the NHS and, even after finding out, still weren’t sure why it was done in the first place.

The Lewisham and Greenwich Trust is required by law only to provide free healthcare to legal residents of the UK. Anyone who isn’t a legal resident of the UK must be charged for healthcare provision, following a change in law by the coalition government in 2015. As such, the Trust felt it reasonable to share patient information with Experian to establish their identity and whether or not they qualify for free treatment.

What type of data is shared?

When banks and lenders have a Reciprocal Data Sharing agreement with a CRA, they will share a deep level of information between each other. This will include your name, date of birth, address, account repayment history, balance, and more besides. The account repayment history will detail all the payments you make towards the account, including any that are missed or late. This information then populates your Credit Report, giving you a financial picture of (usually) the last six years.

The type of data sharing that The Lewisham and Greenwich Trust engaged in wasn’t of the same level. It didn’t share repayment behaviour at all, which means patients won’t find an account from the Trust showing in the payment history section of their Credit Report. Equally, the Trust wasn’t performing a traditional credit check on patients. It wasn’t looking at repayment behaviour to decide whether or not to accept or turn away a patient. Whether the patient had a perfectly clean credit history or one riddled with late payments, defaults, and CCJs was of no consequence.

Instead, the NHS Trust shared name, address, date of birth, NHS number, and contact details with Experian. This resulted in a soft search entry being placed on the patients’ Experian Credit Report to reflect when the data was shared and the search was performed. Soft searches do not impact on people’s creditworthiness at all, as they do not reflect a credit application. Instead, it represents a search where only part of the individual’s Credit Report (usually public information, like Electoral Roll entries, insolvency records, County Court Judgments, etc.) was accessed, with depth of data much shallower than with regular credit checks.

How do organisations get my permission to share my data with Credit Reference Agencies?

Organisations don’t always need your permission to share data, providing they have a lawful basis for doing so and inform you of their intentions.

Banks, lenders, mobile phone providers and similar organisations often have permission anyway, as it’s a requirement found in many terms and conditions of products and services, especially credit cards and loans.

Nowadays there is an expectation that some form of credit check will be performed when you apply for finance, but having your data shared with a Credit Reference Agency isn’t at the forefront of many people’s minds when going in for a check-up.

Lewisham and Greenwich Trust did have a notice on its website explaining that data will be shared with non-NHS groups, but much of the attention is directed at whether it counts as adequate notification – understandably most patients admitted for healthcare don’t scrutinise the hospital’s website beforehand.

The ICO (Information Commissioners Office) says that ‘when you share data, you must ensure it is reasonable and proportionate. You must ensure individuals know what is happening with their data unless an exemption or exception applies.’

As much of the concern focuses on the NHS’s lack of transparency, an independent investigation has been launched to look into Lewisham and Greenwich Trust’s conduct. Jim Lusby, director of integrated care at Lewisham and Greenwich Trust, is now looking to find another way of determining whether patients qualify for free treatment.

Experian has clarified the function it provided to the NHS: ‘The Trust submits lists of patient details in order for us to cross reference and check whether they are residents in the UK, and therefore eligible for services.’

‘The information used in this process is subject to strict industry guidelines, and it is not used for any other purpose than helping the NHS Trust identify potential overseas patients, who may be required to pay for treatment under NHS guidelines.’

How do I know if an organisation has shared my data with a Credit Reference Agency?

First off, if an organisation is sharing your data with a third party, it should inform you of this – but as we’ve seen, sometimes that’s not enough to ensure you’re fully aware.

When an organisation shares your data with a Credit Reference Agency, whether for credit application purposes, general enquiries like with the NHS Trust, or even when you use a Credit Report monitoring service, a search entry will be recorded on your Credit Report to reflect the access of the CRA’s records.

Why a ‘search’? The purpose of sharing information with a Credit Reference Agency (so in this case, patient name, date of birth, address, etc.) is to allow the organisation to access and search the CRA’s database. Lewisham and Greenwich Trust wanted access to Experian’s dataset so it could establish whether its patients have a financial history in the UK, and therefore likely to be eligible for free healthcare.

The most reliable way of seeing which organisations have shared your information (and thereby performed a search) with the Credit Reference Agencies is by checking the ‘Searches’ section of your Credit Report.

What do searches look like on my Credit Report?

There are three different types of searches that can be recorded on your Credit Report. Each search entry will have the type of search, the date it was performed, along with the organisation’s name that submitted the search (i.e. shared your information), as well as your name and address exactly as they were shared with the CRA.

The first two search types – Enquiry and Audit searches – are soft searches of your Credit Report that do not affect your creditworthiness in any way. Because they do not reflect applications for products or services, it is highly likely that the searches Lewisham and Greenwich Trust patients find on their Credit Reports from when the Trust shared their data will be soft searches. As a spokesman for the Trust confirmed ‘It is important to stress that Experian [did] not carry out a credit check’.

One of the main differences between an Enquiry and Audit search is that Audits are visible only to you (the data subject) and the Credit Reference Agency that holds the information. No other organisations checking your Credit Report will see Audit searches. Enquiries will be visible, but they are often of no consequence, usually reflecting where your existing lenders have checked your current status. Both types of soft search very often mean that only a portion of your Credit Report was made available to the searching organisation and your private data (account repayment history, most notably) remained unseen.

The third type of search is known as a Credit Application Search. As the name suggests, these are searches performed when you apply for finance or a product like a mobile phone. These are hard searches that show the organisation your full Credit Report, including account repayment history as it’s central to the credit checking process. Credit Application Searches can influence your creditworthiness, as too many in a short time can signal desperation for credit that prospective lenders may wish to avoid, or that multiple lenders are declining you, hence the multiple searches. As explained, patients of Lewisham and Greenwich Trust didn’t have these searches.

How do I check the data held by the Credit Reference Agencies?

You can check to see exactly what the Credit Reference Agencies are holding for you (along with all searches) by viewing your Credit Reports at each of them – Equifax, Experian, TransUnion, and Crediva. Thankfully checkmyfile makes this process quick and easy.

If you haven’t already, you can view your Multi Agency Credit Report with checkmyfile free for 30 days, then just £14.99 per month. Sign-up is quick and cancellation is easy online at any time, or by freephone or email.

You’ll have access to your complete information from Equifax, Experian, TransUnion, and Crediva, all in one easy-to-use format. You’ll see who’s been sharing information about you and with which CRAs. Our professionally qualified team of Credit Analysts is easily accessible by secure message or phone if you have any questions about your Credit Report.

Other names on my Credit Report

Your Credit Report is a detailed record of your financial history – one that is central to all sorts of major life events, like applying for a mortgage, a new car, or even a job. Unexpectedly finding another person’s name on your Credit Report can therefore understandably cause a bit of a shock.

Published on 19 Feb 2020 by Sam Griffin

Full Article

The Advantages of a Multi-Agency Credit Report

These days your Credit Report can be checked for any number of reasons throughout the year, including background checks during job applications, landlord checks and even from insurance or utility providers when you shop around for quotes.

Published on 14 Feb 2020 by Paul Anderson Riley

Full Article

Disputing a Late Payment or Arrears Marker on your Credit Report

Many of us have been there – we have too many things on our mind so we may have missed a payment on our credit card or loan. But what happens when you check your Credit Report and spot a late payment or case of arrears that you know aren’t correct? Where do you stand and what can you do to rectify the error?

Published on 7 Feb 2020 by Kirstie Brown

Full Article

Your Rights When Cancelling a New Credit Agreement

For most people applying for credit the main concern is whether or not they will actually get accepted. But occasionally a change in circumstances (or even just a little time to reflect on your purchase) means that a bigger concern might be whether you can change your mind and withdraw from a credit agreement (be it a credit card, personal loan or other credit facility) after it’s been granted, potentially preventing you from taking on additional financial responsibility that you no longer want or need.

Published on 3 Feb 2020 by Tom Magor

Full Article

Which Credit Reference Agency does my bank use?

Knowing which Credit Reference Agency (or agencies) your bank has a relationship with gives you a bit more insight into who it’s sharing your data with – as well as helping you know which of your Credit Reports will be inspected if you apply for another product with that bank.

Published on 28 Jan 2020 by Sam Griffin

Full Article

What the December 2019 election means for your Credit Report in 2020

The last few years have seen the UK perplexed by peculiar politics, with conversations dominated by polarising Brexit debates, Prime Ministers coming and going, and an increasingly tenuous state of Scotland. The only certainty seems to be the reliable and constant loom of total uncertainty.

Published on 13 Jan 2020 by Sam Griffin

Full Article

Arrangement to Pay markers

Have you seen an ‘AR’ mark on your Credit Report? Chances are you might glance at the letters and assume that they relate to payment arrears, but on Credit Reports an ‘AR’ appearing on the payment history means an Arrangement to Pay has been recorded on the account.

Published on 6 Jan 2020 by Ben Ryland

Full Article

How to Download and Print Your Credit Report

There are several different reasons you might need to print or share a copy of your Credit Report, such as assisting a mortgage advisor during an application, showing a specific entry to a lender, or even just to keep a physical copy for your personal records.

Published on 6 Jan 2020 by Paul Anderson-Riley

Full Article

How long is your credit information really held for

When applying for credit, most lenders will use the information held on your Credit Reports with the Credit Reference Agencies (CRAs) to determine whether they will be willing to lend to you. Any information obtained from the CRAs can then be used as part of the lender’s evaluation of your creditworthiness.

Published on 6 Jan 2020 by Tom Blandford

Full Article

What are address links and why are they on my file

The sheer amount of historic information held by Credit Reference Agencies (CRAs) can seem daunting when seen for the first time. This is certainly true for address links, which show current and historic addresses, as well as additional addresses that lenders think may be linked to you. But you can rest easy, because they're nothing to fear.

Published on 31 Dec 2019 by George Coburn

Full Article


We are rated number 1 for customer service on