Equifax Fall Out

The fall out from the Equifax data breach is mounting. Frustrated consumers, who can’t access web sites or get a human being on the phone, are angry and bewildered, are left wondering: How can these companies have so much power with so little accountability?

The oversight of the credit reporting industry is fractured. The main law that governs the three major credit bureaus is the 1970 Fair Credit Reporting Act (FCRA), which established a number of rights for consumers, including:

• You must be told if information in your file has been used against you.
• You have the right to know what is in your file.
• You have the right to ask for a credit score.
• You have the right to dispute incomplete or inaccurate information.
• Consumer reporting agencies must correct or delete inaccurate, incomplete, or unverifiable information, usually within 30 days.
• Consumer reporting agencies may not report outdated negative information.
• Access to your file is limited. A consumer-reporting agency may provide information about you only to people with a valid need — usually to consider an application with a creditor, insurer, employer, landlord, or other business.
• You must give your consent for reports to be provided to employers
• You may limit “prescreened” offers of credit and insurance you get based on information in your credit report.
• You may seek damages from violators.
• Identity theft victims and active duty military personnel have additional rights.

All of this sounds dandy, except that the Federal Trade Commission (FTC), the main enforcer of the FCRA, has limited supervisory powers. When it does find shenanigans, it must take the bad actor to court to force corrections and in general, it does not impose big money fines.

The Consumer Financial Protection Bureau (CFPB), which was established in 2010 out of the Dodd Frank Reform Act, has stepped in to fill the void and has attempted to reign in the credit reporting companies. Earlier this year, CFPB found that two of the big three companies, Equifax and TransUnion, had deceived “consumers about the usefulness and actual cost of credit scores they sold” and had lured people “into costly recurring payments for credit-related products with false promises.” TransUnion and Equifax paid a total of more than $17.6 million in restitution to consumers, and fines totaling $5.5 million to the CFPB.

It’s worth noting that in June, house lawmakers passed the Financial Choice Act, which would allow the president to fire the head of the Consumer Financial Protection Bureau and give Congress power over the CFPB’s budget, which means that lawmakers could defund the agency entirely. (Here’s a list of the lawmakers who voted yes on the bill.) The bill’s sponsor, Representative Jeb Hensarling, told NPR “the Consumer Financial Protection Bureau has hurt consumers” and that the CFPB “is a rogue agency…I don’t know why anybody would defend this bureau.”

Meanwhile, Senator Elizabeth Warren, who helped create the CFPB before her current stint, said she has begun an investigation into l’affaire Equifax and, along with 11 other Democratic senators, has introduced a bill to give consumers the ability to freeze their credit for free. Concurrently, the FTC and at least six state attorneys general have also opened investigations.

On Friday, Equifax announced that its chief information officer and chief security officer are retiring. Separately, investors have dumped Equifax’s stock, driving it down by more than a third since the company disclosed the hack on September 7th.