Equifax breach exposed driver's license data for almost 11 million. Elizabeth Keatinge (@elizkeatinge) has more.


Banks and retailers have real money at stake when a data breach allows criminals to get at customers’ credit card data. Under federal law and credit card policies, customers have zero liability for fraudulent charges. Instead, banks and retailers are on the hook for losses.

That’s probably why the credit card industry has strict compliance standards for protecting data.

But credit bureaus, such as Equifax, aren’t required to repay consumers for losses when precious personal data — such as Social Security numbers and birth dates — are exposed in breaches. Perhaps that’s why security was so lax at Equifax, where a massive breach discovered this summer gave hackers access to the data of nearly 60 percent of American adults.

Bad enough when credit bureaus are cavalier about protecting data. But the industry has also opposed the best tool to protect against fraud after data are exposed: a credit freeze, which prevents the opening of new accounts or loans in your name without your permission.

In the mid-2000s, as state legislators pushed to create this new tool, an industry lobbyist traveled the country fighting these pro-consumer measures. The Consumer Data Industry Association eventually lost the war, and freezes are now available in every state. But the powerful lobby won an important battle: Consumers must pay for freezes in all but seven states.

It’s easy to see why credit bureaus dislike freezes: Bureaus lose money when they are prevented from selling your information to others. 

Freezing and unfreezing should be free. And in the wake of the Equifax breach, several Senate and House Democrats have introduced a measure to do just that.

Even more urgent is federal action to prevent security breaches in the first place. In recent congressional hearings, forcibly retired Equifax CEO Richard Smith acknowledged that the personal data that were breached weren’t even encrypted, one of several disclosures that angered lawmakers. Rep. Greg Walden, R-Ore., remarked, “I don’t think we can pass a law that … fixes stupid.”

Perhaps. But Congress can do plenty to make it damaging and expensive for credit bureaus to act so stupidly. Among the best ways to accomplish that:

Strengthen federal standards to protect data and give the outgunned Federal Trade Commission the authority and manpower to enforce them. Better yet, get tech-savvy companies that deal with credit bureaus involved in creating minimum standards to secure data, similar to those required by the credit card industry.

Set uniform disclosure rules, mandating short deadlines to disclose breaches, written notification to consumers and a process in which state and federal agencies are notified. Currently, disclosure rules vary among states and are often loose. Georgia, home to Equifax, requires “expeditious notification,” a meaningless phrase.

Impose large fines for data breaches. Because companies have no money at stake for reimbursing consumers, there’s little incentive to spend money to secure data. At one hearing last week, Rep. Joe Barton, R-Texas, proposed a change to CEO Smith: “You might pay a little bit more attention to security if you had to pay everybody whose account got hacked, a couple thousand bucks.” Let’s see whether Republicans have the will to impose such an effective penalty.

With so much at stake, it’s unconscionable that the federal government has failed to get more involved in protecting private information. The executive branch’s own data have been breached all too frequently.

“We’re in a cyberwar, not just to commit financial crimes, but to commit political crimes,” says Gartner security analyst Avivah Litan. 

It’s time for the government to step up and provide expertise, incentives and laws to prevent these crimes. 

None of the major credit bureaus — not Equifax, Experian or TransUnion — would have a business if it weren’t for the data they vacuum up without permission from consumers or payment to them. If credit bureaus are going to use these data as a profit center, the least the bureaus can do is ensure that consumers aren’t left vulnerable to thieves.


Read or Share this story: