The ICO has taken enforcement action against Experian following a 2-year investigation into how Experian, Equifax and TransUnion use personal data for direct marketing within their data brokering businesses. The ICO has given Experian nine months to comply with the enforcement notice, or it will face financial penalties under the GDPR. An ICO investigation found Experian, Equifax and TransUnion were "trading, enriching and enhancing" personal data without consent. While Equifax and TransUnion enhanced their marketing practices, the ICO found Experian's efforts to be insufficient. Reuters reports Experian will appeal ICO order to change its handling of personal data, while The Register reports the same story but adds how companies fined by the ICO have a strong incentive to appeal.