[Senate Hearing 115-132]
[From the U.S. Government Publishing Office]
S. Hrg. 115-132
CONSUMER DATA SECURITY AND THE CREDIT BUREAUS
=======================================================================
HEARING
before the
COMMITTEE ON
BANKING,HOUSING,AND URBAN AFFAIRS
UNITED STATES SENATE
ONE HUNDRED FIFTEENTH CONGRESS
FIRST SESSION
ON
EXAMINING THE PROTECTION OF CONSUMER DATA AT CREDIT BUREAUS IN THE WAKE
OF THE EQUIFAX DATA BREACH
__________
OCTOBER 17, 2017
__________
Printed for the use of the Committee on Banking, Housing, and Urban
Affairs
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available at: http: //www.govinfo.gov/
______
U.S. GOVERNMENT PUBLISHING OFFICE
28-249 PDF WASHINGTON : 2018
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800;
DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC,
Washington, DC 20402-0001
COMMITTEE ON BANKING, HOUSING, AND URBAN AFFAIRS
MIKE CRAPO, Idaho, Chairman
RICHARD C. SHELBY, Alabama SHERROD BROWN, Ohio
BOB CORKER, Tennessee JACK REED, Rhode Island
PATRICK J. TOOMEY, Pennsylvania ROBERT MENENDEZ, New Jersey
DEAN HELLER, Nevada JON TESTER, Montana
TIM SCOTT, South Carolina MARK R. WARNER, Virginia
BEN SASSE, Nebraska ELIZABETH WARREN, Massachusetts
TOM COTTON, Arkansas HEIDI HEITKAMP, North Dakota
MIKE ROUNDS, South Dakota JOE DONNELLY, Indiana
DAVID PERDUE, Georgia BRIAN SCHATZ, Hawaii
THOM TILLIS, North Carolina CHRIS VAN HOLLEN, Maryland
JOHN KENNEDY, Louisiana CATHERINE CORTEZ MASTO, Nevada
Gregg Richard, Staff Director
Mark Powden, Democratic Staff Director
Elad Roisman, Chief Counsel
Joe Carapiet, Senior Counsel
Kristine Johnson, Professional Staff Member
Elisha Tuku, Democratic Chief Counsel
Laura Swanson, Democratic Deputy Staff Director
Corey Frayer, Democratic Professional Staff Member
Phil Rudd, Democratic Professional Staff Member
Dawn Ratliff, Chief Clerk
Cameron Ricker, Deputy Clerk
James Guiliano, Hearing Clerk
Shelvin Simmons, IT Director
Jim Crowell, Editor
(ii)
C O N T E N T S
----------
TUESDAY, OCTOBER 17, 2017
Page
Opening statement of Chairman Crapo.............................. 1
Opening statements, comments, or prepared statements of:
Senator Brown................................................ 2
WITNESSES
Andrew M. Smith, Partner, Covington & Burling LLP, on behalf of
the Consumer Data Industry Association......................... 3
Prepared statement........................................... 38
Responses to written questions of:
Chairman Crapo........................................... 57
Senator Brown............................................ 58
Senator Schatz........................................... 64
Marc Rotenberg, President, Electronic Privacy Information Center. 5
Prepared statement........................................... 43
Responses to written questions of:
Chairman Crapo........................................... 68
Senator Brown............................................ 71
Chris Jaikaran, Analyst in Cybersecurity Policy, Congressional
Research Service............................................... 6
Prepared statement........................................... 52
Responses to written questions of:
Senator Brown............................................ 79
Senator Reed............................................. 82
Additional Material Supplied for the Record
Letter from Jim Nussle, President and Chief Executive Officer,
Credit Union National Association.............................. 84
Letter from John A. Koskinen, Commissioner, Internal Revenue
Service........................................................ 85
Letter from Carrie R. Hunt, Executive Vice President of
Government Affairs and General Counsel, the National
Association of Federally-Insured Credit Unions................. 87
(iii)
CONSUMER DATA SECURITY AND THE CREDIT BUREAUS
----------
TUESDAY, OCTOBER 17, 2017
U.S. Senate,
Committee on Banking, Housing, and Urban Affairs,
Washington, DC.
The Committee met at 10:03 a.m., in room SD-538, Dirksen
Senate Office Building, Hon. Mike Crapo, Chairman of the
Committee, presiding.
OPENING STATEMENT OF CHAIRMAN MIKE CRAPO
Chairman Crapo. This Committee will come to order.
As a follow-up to our hearing on the Equifax data breach,
today we will receive testimony on the protection of consumer
data at credit bureaus.
At the Equifax hearing, Members expressed interest in
better understanding how credit bureaus are regulated, how they
protect consumer data, and whether there are gaps that Congress
needs to fill.
I have long been concerned about the ever increasing
amounts of ``big data'' collected by companies and by the
Government. It is critical that personal data is protected,
consumer impact in the event of a breach is minimized, and
consumers' ability to access credit is not harmed.
Credit bureaus play a valuable role in our financial system
by helping financial institutions assess a consumer's ability
to meet financial obligations and also facilitating access to
beneficial financial products and services.
The inherent nature of the credit bureau business, as with
most businesses in this digital age, requires utmost data
security measures to ensure that sensitive consumer information
is safeguarded.
Two weeks ago, Equifax testified about the methods it uses
to protect its consumer data bases, such as encryption at rest
and tokenization. Former Equifax CEO Richard Smith noted that
while some of Equifax's data bases are encrypted at rest, the
dispute portal that was compromised was not.
Questions remain about the best ways to protect sensitive
data, including:
Are there data security industry standards and best
practices at credit bureaus?
Should tools like encryption at rest be employed to protect
all data containing sensitive consumer information?
What role do financial institutions and Federal agencies
play in data security at credit bureaus?
Given that credit bureaus are financial institutions under
the Gramm-Leach-Bliley Act, how does data security, testing,
and oversight by regulators compare to that of traditional
financial institutions?
I look forward to hearing from our witnesses about what
credit bureaus do to ensure security for the data they collect,
who oversees credit bureaus to ensure they have adequate
security measures in place, and what improvements could be made
to the oversight of data security at the credit bureaus.
There are also many concerns regarding company response to
data breaches. The Equifax breach has left more than 145
million consumers a little confused as to what can be done to
mitigate damage to their identities and credit.
We do know that starting in January, Equifax will offer all
customers the ability to lock or unlock their credit files for
free.
Additional products have also been offered from Equifax and
the other credit bureaus for consumers to monitor or freeze
their credit reports.
Many consumers remain confused about which options are best
for them, but this hearing will hopefully provide some
additional clarity. We have a shared interest on this Committee
in ensuring that credit bureaus take the necessary measures to
safeguard personal data and minimize risk of another massive
data breach.
Senator Brown.
OPENING STATEMENT OF SENATOR SHERROD BROWN
Senator Brown. Thank you, Chairman Crapo.
Under current law, whether we like it or not, companies
like Equifax can collect vast troves of personal information.
That includes information plucked from our work histories, our
social media profiles, from reward cards that track our
purchases at the grocery store, and even information from our
cell phones tracking our daily commutes.
Generally, these companies are free to combine and sell
that information to all sorts of financial institutions and
other data mining firms who use it to make decisions about us--
like what kind of car or job that we might get.
Corporations like Equifax rarely have to tell us exactly
why or how these decisions are made. They get to hide behind
proprietary models and trade secrets. It seems our laws protect
big corporations' use of people's data a lot better than they
actually protect people.
As the recent breach demonstrates, enhanced cybersecurity
measures at companies like Equifax might work perfectly yet
still do little to protect consumers' data. While 145 million
people have had their private data exposed, it does not appear
that any sensitive corporate data was accessed.
Because these businesses are not accountable to consumers,
and because consumers have no choice over who is collecting
their information, consumer protection is pretty much an
afterthought.
As we talk about the clearly inadequate protections for
consumer data at Equifax and those in place at the other
consumer reporting agencies today, we cannot forget that the
real victims of this hack are the 145 million people--5 million
in my State alone--who, through no fault of their own, have had
their personal information compromised.
I hope that at today's hearing we do not just talk about
how we strengthen cybersecurity. We do need to do that, of
course, but we also need to explore how to restore people's
control over their own information. We need to examine whether
the current credit bureau model makes sense for American
consumers.
We know the credit bureaus have a long history of consumer
complaints and inaccurate reporting that has long-term effects
on people's ability to get a job or get a house. Rather than
addressing these problems, the credit bureaus have spent
millions acquiring other data collection companies and
branching out into new lines of business.
Despite their continued failure--there is no other word to
use--their continued failure to provide accurate credit
reporting services or to protect all of the data that they
collect, their CEOs have been rewarded with enormous salaries
and bonuses. Sometimes they come in front of us and say they
are going to give up their bonus, as if that is a major
concession. Now, in an era of nonstop cyberthreats, it seems
like they have made consumers even more vulnerable.
Equifax made astounding amounts of money off of the
consumer data it collected; and unless things change, it looks
like it will hardly pay a price for its recklessness. It is
still collecting and storing our data, and in some cases we are
even giving it tax dollars to do it. I look forward to today's
witnesses' views on these matters.
Thank you.
Chairman Crapo. Thank you, Senator Brown. We will now turn
to our witnesses.
First, we will receive testimony from Mr. Andrew Smith,
partner at Covington & Burling, on behalf of the Consumer Data
Industry Association.
Then we will hear from Mr. Marc Rotenberg, president of the
Electronic Privacy Information Center.
And, finally, we will hear from Mr. Chris Jaikaran. Did I
pronounce that right?
Mr. Jaikaran. Jaikaran.
Chairman Crapo. Jaikaran. Thank you. Mr. Chris Jaikaran,
Analyst in Cybersecurity Policy at the Congressional Research
Service.
Each witness is recognized for 5 minutes of oral remarks,
and then we will proceed to questions. Mr. Smith, you may
proceed.
STATEMENT OF ANDREW M. SMITH, PARTNER, COVINGTON & BURLING LLP,
ON BEHALF OF THE CONSUMER DATA INDUSTRY ASSOCIATION
Mr. Smith. Thank you. Chairman Crapo, Ranking Member Brown,
and Members of the Committee, thank you for the opportunity to
appear before you. My name is Andrew Smith, and I am a partner
at the law firm Covington & Burling. I am appearing today on
behalf of the Consumer Data Industry Association, which is a
trade association of companies that provide businesses with the
information and analytical tools necessary to manage risk and
to protect consumers. CDIA's members include the three national
credit bureaus: Equifax, Experian, and TransUnion.
You have asked us to discuss how credit bureaus protect
consumer data, but first I wanted to mention the important role
played by the national credit reporting system in our economy.
More than two-thirds of our GDP comes from consumer spending,
fueled by consumer credit. It is the national credit reporting
system that allows consumers to quickly and effortlessly open a
bank account or purchase a cell phone. More than 40 percent of
consumers move every year, and the national credit reporting
system facilitates this mobility, in addition to providing
fast, fair, and impartial access to well-priced credit,
insurance, apartment rental, and other essential services.
Nearly 50 years ago, Congress enacted the Fair Credit
Reporting Act to ensure the fairness and impartiality of credit
reports, to protect consumer privacy, and to foster the
continued development and vitality of the national credit
reporting system.
The most recent revision to this comprehensive regulatory
scheme was the addition of the CFPB as a supervisory agency.
This is the first agency to directly supervise the national
credit reporting system, not just examining credit bureaus but
also examining the users of credit reports and the companies
that contribute information into the credit bureaus. The CFPB's
virtual continuous supervision of the credit reporting system
began in earnest in early 2012 and, according to the CFPB, has
produced, and I quote, ``a proactive approach to compliance
management'' that ``will reap benefits for consumers--and for
lenders--for many years to come.''
With respect to data security, credit bureaus are subject
to Federal and State laws requiring them to safeguard consumer
data, and because of the key role they play in the banking
system, they also are subject to very specific private data
security requirements, such as the payment card industry data
security standards.
To begin, credit bureaus are required by the FCRA to
maintain procedures to ensure that they only provide credit
reports to legitimate people for legitimate purposes. These
credentialing requirements go beyond contractual certifications
and include comprehensive due diligence of prospective
customers as well as continuous monitoring of existing
customers.
The FCRA also requires secure disposal of credit report
information. In addition, the FTC's Safeguards Rule, as
referred to by Chairman Crapo, under the Gramm-Leach-Bliley Act
requires financial institutions, including credit bureaus, to
develop and implement comprehensive information security
programs. The laws of at least 13 States similarly require
companies to implement and maintain reasonable procedures to
safeguard sensitive personal information. Furthermore, almost
every State requires that companies notify consumers when there
is unauthorized access to or acquisition of sensitive personal
information.
Because of their important role in the banking system,
credit bureaus are also subject to private contractual data
security requirements. For example, because the credit bureaus
handle credit card information, the card networks--Visa,
MasterCard, et cetera--require that they comply with the
payment card industry data security standards and validate such
compliance by obtaining an independent third-party audit of
their security procedures. In addition, because banks provide a
great deal of sensitive customer information to the national
credit bureaus, they are required by their prudential
regulators to conduct regular information security audits of
the credit bureaus. These audits can include onsite inspections
which might last for several days. Each of the three national
credit bureaus is subject to dozens of these bank reviews each
year.
CDIA shares with you the goal of ensuring that consumers
and businesses have confidence in the ability of the national
credit reporting system to keep consumer data safe.
Thank you for the opportunity to testify, and we look
forward to today's dialogue.
Chairman Crapo. Thank you.
Mr. Rotenberg.
STATEMENT OF MARC ROTENBERG, PRESIDENT, ELECTRONIC PRIVACY
INFORMATION CENTER
Mr. Rotenberg. Chairman Crapo, Ranking Member Brown,
Members of the Senate Banking Committee, thank you for the
opportunity to speak with you today. My name is Marc Rotenberg.
I am president of the Electronic Privacy Information Center. We
are an independent nonprofit research organization founded in
1994 to focus public attention on emerging privacy issues.
I would like to begin by saying that the Equifax data
breach is one of the most serious in our Nation's history, on
par with the 2015 data breach at the Office of Personnel
Management that impacted more than 22.5 million Federal
employees, their families, and friends. The Equifax breach
poses enormous challenges to the security of American families
and even to our Nation's security.
There is no simple solution, but in my testimony today I
will outline the steps that I believe Congress can take to
mitigate the risks that follow from the breach and reduce the
danger and likelihood of future data breaches.
I should also say that the Equifax breach is remarkable
because of its scope, the sensitivity of the data, and the
delay to fix a well-documented security flaw. More than 4
months passed from the time Equifax failed to install critical
software updates, and the data that was disclosed is precisely
the information that individuals rely upon to open bank
accounts, get car loans, seek employment, and buy cell phones.
The data included names, Social Security numbers, birth dates,
home addresses, and driver's license information. This is also
the data that criminals use to commit identity theft and
financial fraud.
Equifax is clearly responsible for this breach. The company
was notified in March by both the Apache Software Foundation
and U.S.-CERT of the need to make critical software changes.
But it is also worth emphasizing that Equifax chose to collect
this personal data on American consumers. Consumers did not
provide this information to Equifax. And the lax security
strategy that they followed meant that a single breach resulted
in the release of 145 million credit reports on American
consumers.
The breach will cause unprecedented harm. When hackers get
access to credit card numbers, consumers can cancel accounts
and change the credit card numbers. But it is not so easy to
change a Social Security number, and I do not think it is
possible to change your date of birth. Equifax's victims will
be exposed to the ongoing risk of identity theft and financial
fraud, which is already an enormous problem for American
consumers. The FTC reported almost 400,000 cases of identity
theft in the United States in 2016; 29 percent of those cases
involved tax fraud, and the Department of Justice estimates the
cost to the U.S. economy at over $15 billion per year.
The credit reporting industry is in urgent need of reform.
In my testimony I have outlined a number of steps that I
believe should be taken to establish accountability and
transparency. Most simply, consumers need to be given greater
control about the information about them that impacts their
financial future.
This means, for example, that we should have a nationwide
credit freeze, or to say a little bit more precisely, the
disclosure of credit reports should be on an opt-in basis. We
recognize the value of credit in the American economy, but it
is the consumer who should decide when it is in their interest
to disclose their information to a third party to obtain a car
loan. They should not have to jump through hoops to put in
blocks and freezes to restrict access by others. They should
make the affirmative decision.
Credit monitoring should also be freely available. You
should not have to pay to be told that there is a fraudulent
activity on your account, but that is the current problem with
credit monitoring services that require either a fee or limit
the access to credit monitoring for 90 days. This makes no
sense whatsoever. If there is a problem in the account, the
consumer should be notified.
We also think consumers should have more ready access to
the contents of the credit report so they know who is receiving
the information and the impact that the data might have.
I have several other suggestions in my testimony, which I
would be pleased to provide for the Committee.
Thank you.
Chairman Crapo. Thank you.
Mr. Jaikaran.
STATEMENT OF CHRIS JAIKARAN, ANALYST IN CYBERSECURITY POLICY,
CONGRESSIONAL RESEARCH SERVICE
Mr. Jaikaran. Chairman Crapo, Ranking Member Brown, and
Members of the Committee, thank you for the opportunity to
testify on consumer data security and the credit bureaus. My
name is Chris Jaikaran, and I am an Analyst in Cybersecurity
Policy at the Congressional Research Service. In this role, I
research and analyze cybersecurity issues and their policy
implications, including issues of data security, protection,
and management.
My written statement for the record goes into further
detail, but my testimony today will address data security as an
element of cybersecurity and risk management, cyberincident
response, and options for Congress to address data security.
An increasingly used catchphrase among industry analysts is
that today ``all companies are technology companies'' or ``all
companies are data companies.'' This concept reflects that
information technology and data play an important role in
enabling the modern business practices which allow companies to
compete and thrive in the marketplace. However, this reliance
on IT and data also creates risk for corporate leadership to
manage. Adequately controlling that risk is an objective of
cybersecurity.
Data security is an element of cybersecurity that involves
risk management. Absolute security is not obtainable, so
managing the risks which would impair security is the goal. In
order to evaluate risk, managers need to understand the threats
their enterprise may face, the vulnerabilities they have, and
the consequences of an incident.
Cybersecurity incident response describes activities to
confirm an attack, discover information about it, and mitigate
against it.
For incident response, staff is not limited to just IT
personnel. Communications staff that are able to craft messages
to both internal and external stakeholders, legal teams who can
help with reporting and compliance requirements, and management
and corporate boards who are accountable for the operations of
a corporation should all be included in response planning,
among others, depending on the entity.
There will be a delay between the discovery of an attack
and the public notification of that attack because analysis of
what transpired will need to be conducted. This analysis will
inform the entity of how they were breached and what data or
systems were compromised. This type of analysis may be
conducted by the entity itself, a business partner of the
entity, Government response teams, and law enforcement. With a
variety of potential forensic investigators, determining how
they will coordinate in their response and how they will share
information among one another is a factor which should be
determined during the planning and training phase. With
information on how the breach happened and the extent of the
breach, the entity can proceed to mitigate its effects. These
phases need not occur in succession, but may be able to occur
concurrently.
I will now briefly present three options Congress could
consider to address data security.
Congress could explicitly authorize a Federal regulator to
examine credit reporting agencies for their adherence to the
Safeguards Rule, as promulgated by the Federal Trade
Commission. The dialogue created by the Federal Government and
credit reporting agencies could lead to greater understand of
the cybersecurity risk faced by credit reporting agencies and
allow for those with deficiencies to correct their security
posture prior to referral for enforcement action.
Congress could regulate the collection, use, and retention
of data regardless of the type of entity that houses that data.
The European Union and Canada have such data laws.
Congress can establish requirements on what data may be
collected, how data must be stored, and the consumer's rights
to collection and use of data about them.
Congress could require credit reporting agencies, or any
entity that profits from consumer data, to identify and
disclose their data model to consumers. Elements such as where
data is acquired, how it is used, and what other data the
entity generates about the consumer will provide consumers with
additional information that may affect their decisions in the
marketplace.
Thank you for the opportunity to testify today, and I look
forward to your questions.
Chairman Crapo. Thank you very much.
Before I begin my questions, just to inform the Senators,
we have a vote at 10:30. Senator Brown and I have discussed it,
and we intend to keep the hearing running, so we will adjust
our attendance at the vote, and you can make your plans
accordingly. But the hearing will continue to proceed during
the vote.
The first question I have is for the whole panel, and I am
going to ask you to be concise. I only have 5 minutes in my
questioning, as does each of the other Senators. But this is
for each of the Members of the panel, if you have an opinion on
this.
There has been a lot of discussion surrounding the security
of the Social Security number and whether it should be used as
an identifier going forward. Do you think we need to get rid of
the Social Security number as a personal identifier? And if so,
what viable alternatives do we have? How would we ensure that
such an alternative does not suffer from the same drawbacks as
the Social Security number? Mr. Smith, do you want to start?
Mr. Smith. I think that if we eliminate the Social Security
number as a personal identifier, we are going to have to have
something, some other unique identifier that will allow
businesses, credit bureaus, others to know who precisely they
are dealing with. So my name is Andrew Smith. There are
thousands of me, perhaps tens of thousands of me. When you are
looking at a bankruptcy court record, if there is no identifier
on there, how do you know which Andrew Smith it is?
So Socials right now, and other identifiers, play a
critical role in the economy, just simple identification,
right? Not authentication, not verification, not that I truly
am who I say I am. From that perspective, Socials are terrible.
But as identifiers, Socials have had a role to play.
Whether we need another identifier, I think that we are
willing to work with you on that to try to get to the right
result for consumers.
Chairman Crapo. Mr. Rotenberg.
Mr. Rotenberg. Thank you for the question. I have spent
many years before many congressional committees urging that
limits be established on the use of the Social Security number,
but we have never argued for replacing the Social Security
number. The key point is that the SSN serves an important
purpose in the management of certain Government record systems.
That is what it was established for, and that is where the
legal authority exists.
The problem is that the SSN was adopted in the private
sector and used as an identifier for general purposes. This has
actually contributed to identity theft and financial fraud. It
is an imperfect identifier. It is used both as a password and
as an authenticator. It was intended really for neither. So
when we talk about the Social Security number, we would not say
replace the SSN. As I describe in my testimony, we would say
limit the use of the SSN. It should only be available in the
private sector for lawful purposes.
Chairman Crapo. Thank you.
Mr. Jaikaran.
Mr. Jaikaran. The Social Security number is a piece of
personally identifiable information, so limiting its use in the
private sector may lead to reduce consequences that impact if
there is a data breach. However, whatever replaces it would
likely still remain personally identifiable information that
would constitute some level of increased security posture
around that data in case there were a breach.
Chairman Crapo. Thank you. And this question is also just
for you, Mr. Jaikaran. Your testimony discusses encryption and
other tools that can be used in providing data security.
Equifax's former CEO mentioned that some of their data is
encrypted at rest while some of it is not. Are there certain
minimum data security tools or standards that should be
employed across the board for data sets containing personally
identifiable information? Are there measures that, if in place,
may have been able to prevent the Equifax breach or detected it
sooner?
Mr. Jaikaran. So in my testimony I discuss cybersecurity as
an element of risk management, understanding the entire risk
that an enterprise or a corporation may face in their conduct
of their business. There is Federal guidance that is created
for the implementation of encryption, and there are industry
best practices on the use of encryption for data at rest, data
in motion, or data in process. While these may exist, a lot
depends on how it is implemented and the use cases of each
individual company for where they apply that encryption, how
strictly they apply it, and how the keys are managed within
that enterprise to allow those with legitimate access to
continue to be able to conduct the business while still
restricting access to those that do not.
Chairman Crapo. All right. Thank you very much. And I just
have about 45 seconds left, so, Mr. Smith and Mr. Rotenberg,
very briefly, under the current legal framework, the FTC has
enforcement authority over its Safeguards Rule for data
security, but no regulatory agency currently examines or
supervises credit bureaus for data security, as is the case
with banks.
Do you think there is a gap in this framework? And do we
need an agency to be set up or authorized to examine for data
security?
Mr. Smith. So as you noted, the FTC has law enforcement
authority, and we feel as though we are not unsupervised with
respect to data security. We do, as I said earlier, have our
bank customers who are regularly auditing us. I would say,
however, that if there are gaps in supervision, we would be
happy to talk with you about that and to come up with the most
sensible result for consumers.
Chairman Crapo. All right. Thank you.
Mr. Rotenberg, very quickly.
Mr. Rotenberg. The FTC Safeguards Rule is an important data
security standard, but it only applies right now after the
fact. The FTC can only act against a credit reporting agency
once the breach occurs. We think they should have the ability
before the breach to inspect and determine compliance with
standards.
Chairman Crapo. Thank you.
Senator Brown.
Senator Brown. Thank you, Mr. Chairman.
Mr. Smith, in your testimony you stated the credit
reporting system ``provides critically important benefits,''
and you went on to say it is ``indispensable to the economy.''
I think we all agree with that, so my questions are this, and I
will start with you, Mr. Jaikaran, and please give a ``yes'' or
``no'' on this, if possible. Do you think that the breach or
failure of a nationwide credit reporting agency, whether it is
Equifax or TransUnion or Experian, do you think that a breach
or failure of one of those agencies could have a systematic--
or, I am sorry, could have a systemic impact on the U.S.
financial system?
Mr. Jaikaran. A breach of any agency is difficult to judge,
depending on the categorization of the agency itself, but it is
a possibility that it could have impacts on the financial
system.
Senator Brown. Mr. Rotenberg.
Mr. Rotenberg. I think the answer is clearly yes.
Senator Brown. Mr. Smith.
Mr. Smith. I think that with respect to the Equifax
incident, one of the things that we need to keep in mind is
that, according to the news reports, the credit reporting data
base was not, in fact, compromised. A compromise of a credit
reporting data base, I would have to think about whether it
would present----
Senator Brown. So you are the one that started off by
saying it provides critically important benefits, it is
indispensable to the economy, then a breach of 145 million you
do not think does have a systemic impact on the U.S. financial
system?
Mr. Smith. I think that the risk would be able to be
managed by banks, but I do think that it is going to be
something that would need to be actively managed, because what
it would present----
Senator Brown. Is that a ``yes'' or a ``no'' to systemic
impact? ``Could be managed.'' A lot of things could be managed.
Does that have a systemic impact on the financial system, as
the two gentlemen to your----
Mr. Smith. I am not prepared----
Senator Brown. ----left said yes.
Mr. Smith. I am not prepared to say that it would have a
systemic impact, but I would like to think that through.
Senator Brown. OK. Could you in the next week let me know
if that is a ``yes'' or ``no''?
Mr. Smith. Sure. How would you define ``systemic impact''?
Senator Brown. Well, I am asking you to.
Mr. Smith. OK.
Senator Brown. 145 million sounds systemic to me. A No.
One-fifth that does.
Mr. Rotenberg, most of us or our family members have faced
challenges for decades trying to fix inaccuracies in their
credit reports. These inaccuracies result in Equifax or
TransUnion or Experian being three of the most complained about
companies to the CFPB. Do you think it would make sense to
prevent these consumer reporting agencies from collecting new
personal data or providing other services until they have met
an accuracy metric in their consumer credit reporting? And
second question, related, should consumers be allowed access to
all the data held by these three companies?
Mr. Rotenberg. Senator, I think both suggestions are very
good. I think credit reporting agencies which provide personal
data to others should be held to an accuracy standard because,
of course, when they provide information that is inaccurate,
incomplete, or out of date, people are wrongfully denied
credit, they are wrongfully denied jobs, and that is certainly
a problem.
But also, to your second point, whatever information the
credit reporting agencies know about us, I think we should have
the right to know, particularly now when this information is
being made available for sale for data brokers and oftentimes
falls outside the protections of the Fair Credit Reporting Act.
I think we need to do much more to give consumers information
and control about their personal information held by others.
Senator Brown. Thank you.
Mr. Smith, consumer advocates have called for free security
freezes to be provided by Equifax and TransUnion and Experian.
Instead, the companies have announced that they are rolling out
what are called ``credit lock products,'' which appear to give
consumers fewer rights and less security than credit freezes.
Are CRAs offering credit locks so consumers have to sign
forced arbitration agreements just like they had to on
Equifax's first offer of credit monitoring products?
Mr. Smith. So can I respond really quickly to the issue of
access? I wanted to remind the Members of the Committee that
consumers do have access to all of the information on file
about them with consumer reporting agencies, and they have free
access to that through annualcreditreport.com as well as
through other mechanisms.
With respect to----
Senator Brown. Access and correcting are two different
phenomena, but go ahead.
Mr. Smith. Yeah, yeah, and they have----
Senator Brown. But answer the question I asked.
Mr. Smith. ----dispute and correct. And with respect to the
credit locks, I am not so familiar with the different features
of the credit locks, nor do I know whether they have an
arbitration clause----
Senator Brown. You do know they did, though, on the first
round of credit monitoring products that they, let us say,
quote-unquote, generously offered----
Mr. Smith. Right, I know----
Senator Brown. ----they included that, as you know.
Mr. Smith. Yes.
Senator Brown. They backed off it under public pressure, as
you also know.
Mr. Smith. That I know. I do not think that the impetus for
offering credit locks would be to obtain a mandatory
arbitration clause from consumers. I do think that these credit
locks may be useful to consumers. I think that freezes more
generally serve a specific need for a specific type of
consumer. There are a lot of other tools that consumers have
that can protect themselves in these situations, including
obtaining a free credit report, placing a fraud alert on their
credit report, obtaining credit monitoring. There is a lot of
free credit monitoring available. So I think consumers should
understand and appreciate that before they place a credit
freeze on their file. But credit freezes do have their place.
Senator Brown. I do not want to debate that, but I will
just close with on the forced arbitration agreement, you are
their lawyer. You represent them. They also rely on you for
advice. Are you willing to go back to them and say that there
is strong sentiment among the public and this Congress that
forced arbitration agreements should not be part of this credit
lock offered products?
Mr. Smith. Yes, I will convey that message. I do think that
there is a special--there is sort of an exigent circumstance
when we are talking about credit monitoring and other credit
report-related products, and there is a statute called the
``Credit Repair Organizations Act'' which imposes particularly
stringent penalties on companies, any company that is found to
be a credit repair organization. And so because of that--and I
think some Members of the Committee are probably familiar with
this. Because of that, arbitration clauses have a special role
to play with these products. But I will certainly convey the
message that----
Senator Brown. Would you share with the Committee exactly
what message you convey to them on forced arbitration?
Mr. Smith. I will share that.
Senator Brown [presiding]. Thank you.
Senator Rounds.
Senator Rounds. Thank you.
Gentlemen, regardless of what we put into law, regardless
of what rules are put in place, if they are not followed, the
possibilities of an additional breach continue. I am just
curious. With regard to Equifax, would it be fair to say that
the data that we have so far, the information that we have so
far, does it point to basically human error having been the
cause of the data breach? I would like just a quick response
from each.
Mr. Rotenberg. Senator, I think human error understates the
problem. We are talking about a breach that impacted 145
million records, a circumstance where the company was twice
notified by two leading authorities and left the breach exposed
over a 4-month period. I did not discuss it in my testimony
this morning, but even the response to the breach was not
helpful to consumers. So at almost every step, they did the
wrong thing by consumers.
Mr. Smith. I believe that Equifax has said publicly that it
was the result of human error with respect to the question
about human error. I would add, though, that the FTC and CFPB
are investigating the breach, and I would want to see what
their conclusions are before we draw any broader--before we
make any policy choices based on the fact of this breach.
Senator Rounds. Mr. Jaikaran.
Mr. Jaikaran. Based on the amount of information that we
have regarding this particular breach, it is difficult to judge
as to whether the breach came down to human error or some other
reason within the company. So it is difficult to judge at this
point based on the information we have.
Senator Rounds. Let us assume that there was human error
involved in this, recognizing the significant damage that has
been caused. If we have within our abilities the opportunity to
lay out a plan in which there is not just an auditable but a
review process that could be put in place with assurances of
the follow-through, we are still talking about the protections
that we put in place for a legal entity that has been breached
by thieves.
What more can we do or what more should we be doing to
prevent this break-in in the first place with regard to
protections and also the consequences for entities throughout
the world that actually cause these breaches, that are actually
overtly out trying to get their hands on the data? Do we need
to look at additional Federal authorizations or institutions
that would be literally for the cybercommunity, the same as the
FBI was when it came to stopping the bank robberies of the
1920s and 1930s? Do we need to be looking at something like
that on a worldwide basis?
Mr. Rotenberg. Senator, I think this is a very important
point. When the Fair Credit Reporting Act was passed in 1970,
the primary concern was about the possible misuse of consumer
data by the credit reporting agencies, and that was the problem
that Congress sought to address.
But here we are, almost 50 years later, living in a world
of constant cyberattack, and in my testimony this morning I
tried to explain that the Equifax breach needs to be understood
not just in terms of the misuse of personal data, but actually
the exploitation by foreign adversaries. And that is also the
reason, sir, why I think we need to update our privacy laws,
put more incentives on companies to protect this data, not just
from misuse but also from exploitation by foreign Governments.
Senator Rounds. Mr. Smith.
Mr. Smith. We think that, to the extent that there are gaps
in supervision of data security, that we are--that we want to
talk with you about that. We want to get to the right result.
With respect to Professor Rotenberg's point, there is no
doubt that this was a criminal hack, that it was from an
unknown source, that it may have been from a foreign actor, and
that is something that I think hopefully the FTC and CFPB and
the other continued investigations will reveal. And if there
are policy implications from that, hopefully we can have that
discussion then.
Senator Rounds. Mr. Jaikaran.
Mr. Jaikaran. So when we think about the Government
relationship with these agencies, there are kind of three
buckets that we could put them in: first is rulemaking, which
the Federal Trade Commission did with the Safeguards Rule; next
is examination; and the third is enforcement, which the FTC
retains.
In this space we could see that the examination space was
the one that we had the least Government involvement, so I
think there presents an opportunity for Congress to create
further guidance on how they want agencies to act with regard
to that.
Concerning the consequences side, to the best of my
knowledge, attribution still has not been placed for this
breach, and that would be a conversation to have with law
enforcement agencies and officials on what authorities they
think they need in order to go after the criminals here.
Senator Rounds. See, I think it is important that we
recognize that there is a standard of security which has to be
imposed, and we have got to be able to audit it, follow
through, and with consequences, but also with a continued
surveillance. But until we get down to the point where there
are actually consequences for the bad guys involved, we are not
going to make the major dent that we have to in terms of
cybertheft elsewhere. And I think we miss that sometimes. We
are focusing on the people who are trying to provide services.
We are not focusing on going after the guys who are actually
causing the problems for everybody else, not just in the United
States but elsewhere around the world as well.
Thank you, Mr. Chairman.
Senator Brown. Senator Reed.
Senator Reed. Thank you, Mr. Chairman.
Mr. Rotenberg, my sense from your testimony is that--and
you can confirm this--there are two points at which consumers
should have legal rights, and one is that they should have the
legal right to withhold or divulge their credit score, or they
should know the credit information that an agency has, and that
should be by law, not by deference of the agency. Is that your
view?
Mr. Rotenberg. Yes, that is correct, Senator. When the
information is being provided in the credit report, presumably
it is for the consumer's benefit. They are seeking the loan.
They want to buy the car. They need the mortgage. They should
know when that is happening, and they should know the
information that is contained in the report.
Senator Reed. And that should be by statute, not by
deference?
Mr. Rotenberg. Yes. Part of this is about changing the
default. Right now your credit report is freely available to
others within the stricture of the Fair Credit Reporting Act,
but you have very little control over that. We would say give
the consumer opt-in control.
Senator Reed. And Mr. Smith indicated that consumers once a
year have access to all the information that a credit bureau
has. Is that----
Mr. Rotenberg. Well, it is true. Once a year they can get a
free copy of their credit report. It is not all the information
they have. They do not know who has received the information.
And as I said, this is also a rapidly evolving industry. There
are a lot of related practices that are not covered by the
FCRA, and as a consequence, consumers do not have the full
picture.
Senator Reed. So, essentially, they could get the number,
whatever it is, 400 or 800, and----
Mr. Rotenberg. Yes.
Senator Reed. And supplemental information to that number.
But if, as Senator Brown suggested, the agency was also buying
cell phone information or something like that, that is not----
Mr. Rotenberg. That would fall outside of the credit
report.
Senator Reed. So that in order to give a citizen the full
benefits, all information the agency has on them should be
disclosable. Is that correct?
Mr. Rotenberg. Yes, Senator. That is why we recommended a
comprehensive approach based on a Federal baseline. It would
give consumers more information about them that is being
transferred to third parties.
Senator Reed. And I also presume that you would suggest
that they have the right to deny access to certain information.
Mr. Rotenberg. Absolutely.
Senator Reed. Or, in fact, even to require that information
be deleted from the credit bureau's files.
Mr. Rotenberg. I think many American consumers would
actually be surprised to know how many people, how many
businesses get access to their credit reports without their
knowledge. Those reports move very freely with very little
information being provided to consumers, and I think that
should change.
Senator Reed. In the description of what took place, it
appears that there was negligence on behalf of Equifax, you
know, being told by a Federal regulator to make a patch and not
making the patch for several months. Does anyone have the right
to sue or to enforce criminally or administratively?
Mr. Rotenberg. Well, I am sure there will be lawsuits
brought, and there are a variety of different theories. But as
others have already pointed out, almost immediately Equifax's
response was to try to deny consumers the opportunity to pursue
their legal remedies, and that cannot be the right response.
Senator Reed. But with respect to regulatory agencies, the
impression that I have from the discussion is that it is all
sort of retrospective, after the fact, that they can go in and
make a judgment. Could the FTC levy a fine based upon failure
to solve----
Mr. Rotenberg. Actually, no. Under the Safeguards Rule,
they can inspect and they can, I think, sanction. But I think a
fine would require a subsequent violation of the settlement or
order with the company, and the FTC under the Safeguards Rule
currently would not have the ability to inspect or prevent
prior to the breach occurring.
Senator Reed. So under existing law, is there any way for
an appropriate Federal agency to levy a fine or some type of
significant penalty on the company to deter or to----
Mr. Rotenberg. I think for the FTC to levy a fine, they
would have to find a breach under the Fair Credit Reporting
Act. Under Section 5 of the FTC Act, they have to have a
consent order and then a subsequent violation. It is not a very
effective enforcement regime.
Senator Reed. I concur. Thank you very much.
Senator Brown. Senator Scott.
Senator Scott. Thank you, sir. And good morning to the
panel. Thank you all for being here this morning.
The Equifax breach is still catastrophic for so many in
South Carolina. If you think about the numbers of individuals
impacted by the breach in my home State of South Carolina, 2.4
million South Carolinians had their personal information
exposed, stolen, through the Equifax breach. We only have about
5 million folks living in the State. That is about 48.76
percent of the State. That is the sixth highest number in the
country. When you account for the fact that there are about
500,000 South Carolinians under the age of 14, that means that
the number surges over 50 percent. So over half of the adult
population at least in the State had their information exposed.
Equifax's negligence has been devastating for my
constituents. But when you look at the geographic location of
that impact, the Southeast region seems to have been impacted
aggressively in high levels: Georgia, around 51.6 percent;
Virginia, around 48.8 percent; Florida, around 53.5 percent.
I asked Equifax why South Carolina and the Southeastern
region was so hard hit. I hope they find an answer soon. My
suspicion is that perhaps the location, the physical location
of Equifax may have played a role in that.
Mr. Jaikaran, why are the numbers so high so close to the
physical headquarters of Equifax?
Mr. Jaikaran. So that would be difficult to judge based on
publicly available information, but there might be some
business reasons why Equifax would have additional information
on people in the Southeast region of the Nation. They may have
more business partners with businesses near their headquarters,
so there is a greater opportunity for sharing of information.
It may be that the population of those States are prime targets
for credit, so just the population of the States, the sample
pool may be more amenable to a credit rating agency.
Senator Scott. Thank you. Things get complicated when a
company is headquartered in New Jersey, does business in South
Carolina, and is breached in Arkansas. These States have very
different laws on the books governing when and how companies
must notify the public of a data breach.
Back to you, Mr. Jaikaran. Is our current State-by-State
patchwork of regulatory approaches effective in protecting the
public?
Mr. Jaikaran. Thank you, Senator. I believe my colleagues
at the Government Accountability Office, or GAO, would be in a
better position to evaluate the State-by-State regulatory
regime we have today. However, as a broader data breach
notification policy, that does provide a level of certainty for
both businesses and consumers if there was a Federal rule or a
Federal law on the data breach notification that is expected
both for businesses to provide as well as what consumers can
expect to receive.
Something that must be considered when developing a data
breach notification rule, however, or law is what will
consumers be expected to do with that information. Do they just
get a letter in the mail saying that their data was compromised
and they are on their own? Or is there some recourse that the
business or the corporation that had the data and then had it
breached must provide to the consumer because the data was
compromised?
Senator Scott. So not simply a uniformity across the
Nation, but also some teeth as it relates to what happens next
once the consumer is informed.
Mr. Jaikaran. We see that across State laws now, where some
of them are just a simple notification and some of them are
some relationship that the corporation must have with the
breached consumer.
Senator Scott. Thank you.
Mr. Smith, despite the Federal Government also being
breached pretty frequently, unfortunately, some have suggested
that we nationalize the credit reporting agencies. Such a move
would kill innovation, the same innovation that is opening up
the market of 26 million credit-invisible Americans. I think
Fannie and Freddie should consider new credit reporting models
that take into account things like rent payment and utilities.
Who would benefit the most from such a change, Mr. Smith?
Mr. Smith. So use of information about rent and utility
payments by Fannie and Freddie could expand access to mortgage
credit for younger consumers, recent immigrants, consumers who
are new to credit, and others without a traditional credit
file. So the national credit bureaus are already able to
collect this information from landlords and utilities and have
built the systems necessary to do that. And as you know, the
credit bureaus over the last 50 years have been successful in
expanding access to credit to folks who previously may not have
had that access.
But I think ultimately it is going to be Fannie's and
Freddie's decision whether or not these utility and rent
payments are actually predictive of the risk of default that
they are trying to manage.
Senator Scott. We certainly understand that Freddie and
Fannie will have to make their own decisions, but the question
was who benefits from it, and it sounds like to me that the
population that benefits the most are those folks who are
disproportionately represented today in homeownership.
Mr. Smith. Yeah, well, folks who are creditworthy but we
cannot tell because they do not have traditional credit report
information, specifically people who are new to credit, I
think.
Senator Scott. So I think the number--Senator Brown, I know
you were thinking about South Carolina when I was talking
there. The number is about 16 percent of South Carolinians who
are today credit-invisible would become credit-visible and
would show the responsible pattern that would allow them to own
a home.
Thank you. Thank you, sir.
Senator Brown. Thanks, Senator Scott. And my State is 5
million out of 11.6 million, so it is mid- to high 40 percent
also.
Senator Scott. Thank you.
Senator Brown. Senator Cortez Masto.
Senator Cortez Masto. Thank you. Gentlemen, thank you so
much for the conversation.
Mr. Smith, I wanted to start with you. As you note in your
testimony, the CFPB's supervision of credit bureaus relates
primarily to the accurate furnishing and reporting of credit
data, and the CFPB does not generally provide for in-house
supervisors. However, in the wake of the Equifax breach,
Director Cordray has indicated that the CFPB supervision teams
may be assigned to reside at the Big Three nationwide consumer
reporting bureaus and monitor cybersecurity and data protection
practices. Wouldn't you agree that this is an important
development?
Mr. Smith. Well, so when you look at Director Cordray's
comments, I think you are talking about his CNBC, or something,
comments on television. He said initially that the CFPB does
not have authority over data security, and it seems as though
the folks on the panel agree with that. Whether there is an
appropriate role for a supervisor for data security at the
credit bureaus, we want to talk with you about that and come up
with the best result for consumers. It may be that if there is
such a role to be played, that the CFPB is not the best person
for the role, or it could very well be that they are.
Senator Cortez Masto. Thank you.
Mr. Rotenberg, do you think this would be helpful? And let
me put this in context because prior to my role here, I spent
the last 8 years as Attorney General of Nevada. Nevada had one
of the highest identity theft rates in the country, and I can
tell you the breach that happened with Equifax is not equal to
the breach that happened at a Target store or somewhere else.
What happened with Equifax is now there is the potential of
millions of Americans' identities being stolen. And if you have
ever been the victim of identity theft, the rest of your life
you are trying to reclaim your identity. And it is not just
clearing up your credit. It is addressing somebody who has
purchased a boat in your name, purchased a house in your name,
committed a crime in your name when you are showing up in court
and trying to identify that that person who committed a crime
has stolen your identity. This is lifelong, and it is going to
have a major impact on millions of Americans, and that is why
this is so egregious. And we have to do a better job of
protecting individuals' data and information because you are
collecting it without their approval, and then they have to
succumb to years of trying to clear up all of that data.
So my concern now is: How do we address it? How do we put
limits on the data we collect? I know we are talking about more
cybersecurity protection and making sure there is oversight
over the companies. But if there is human error, or whatever
occurred, it is going to happen again.
So is there some limit to the data that we should be
collecting besides all of the other discussion that we talked
about today? And so, Mr. Rotenberg, I am curious, your thoughts
on that.
Mr. Rotenberg. Well, Senator, to your first point, I think
it would be a step in the right direction to have supervisory
authority through CFPB at the credit reporting agencies. I
think that makes a lot of sense. But, of course, that is only
to prevent against future data breaches, and the question is
what to do now for American consumers who confront the reality
that others are in possession--we call these the
``authenticators.'' This is the information that is used to
establish your identity in commercial transactions. And this is
the reason that we think we need to change the default on
credit freezes. People should know from this point going
forward anytime anyone wants access to their credit report. And
people should know from this time going forward anytime there
is suspicious activity on their credit reporting account. They
should not have to select this service or pay for this service.
Senator Cortez Masto. And I absolutely agree.
Mr. Rotenberg. It should be built into the industry.
Senator Cortez Masto. And I am going to cut you off, and I
apologize because I only have so much time. I absolutely agree,
and because there has been talk about uses of the Social
Security number and limiting it in the private use, but I do
not know about you, but when you go to set up your house and
you set up your utilities, they ask for your Social Security
number. When you go to your doctor's office, they ask for your
Social Security number. This number has become so prevalent as
an identifier, I do not know how you pull it back from the
private sector. And, quite honestly, I do not know how you
protect against anybody having access to it, because I can tell
you a bad guy is going to be able to go online, and if it has
already been used and out there, they are going to find it.
So, more importantly for my purpose and I think all of our
purposes, really shouldn't it be now giving the consumer the
absolute right to control their information and how it is being
used?
Mr. Rotenberg. Absolutely, Senator, I think that is key.
But if I could say briefly on the Social Security number, we
have actually made some progress limiting its use. In fact,
with credit to Senator Collins and Senator McCaskill, the
Social Security number is now coming off the medical benefits
ID card because its use there was contributing to identity
theft among American seniors. We helped get the Social Security
number off the State driver's license. The Social Security
number is no longer published in the State voter rolls.
So this is an issue that can be addressed, but Congress
will have to get behind an initiative that says to the private
sector we have to limit the use of the SSN.
Senator Cortez Masto. Thank you. I appreciate the comments.
I notice my time is up. Thank you.
Chairman Crapo [presiding]. Senator Kennedy.
Senator Kennedy. Thank you, Mr. Chairman.
Gentlemen, I am sorry I missed your presentations. Why
should we not pass legislation that would establish that the
bureaus have a fiduciary obligation to the people whose data
they collect and earn a profit off of?
Mr. Rotenberg. Well, I think you should, Senator. I think
some of that legislation is already in place with the Gramm-
Leach-Bliley Act, but I think more needs to be done. And I
think your description of a fiduciary relationship is
absolutely correct.
Senator Kennedy. Do you think there is a fiduciary
relationship now?
Mr. Rotenberg. No, I do not. I do not think the companies
feel that they have an obligation to American consumers, and I
think----
Senator Kennedy. Do you gentlemen agree with that? I am
sorry to cut you off.
Mr. Smith. No, I disagree with that. No, I would not
characterize it----
Senator Kennedy. You disagree with that?
Mr. Smith. ----as a fiduciary duty.
Senator Kennedy. I am sorry. You disagree or agree?
Mr. Smith. I disagree. I would not----
Senator Kennedy. And you represent the bureaus----
Mr. Smith. We represent the industry. We are subject to a
pervasive regulatory scheme in this statute here, the Fair
Credit Reporting Act, that requires us to ensure the accuracy
of information in credit reports that requires us to----
Senator Kennedy. Were you and your clients attempting--when
the Equifax breach was made public, weren't you trying to pass
legislation that would lessen your clients' liability?
Mr. Smith. There was legislation that had been introduced
that would introduce a cap on potential liability for private
actions. That cap, though, would have been----
Senator Kennedy. Do you think that was a good idea?
Mr. Smith. The FCRA is unique among consumer credit
protection statutes in that it does not have a cap on class
action liability. So Truth in Lending, Equal Credit
Opportunity, Fair Debt Collection, EFTA--all of these have
caps. FCRA does not. The effort here----
Senator Kennedy. Do you still believe your client should
have caps, counselor?
Mr. Smith. As a trade association, we would continue to
argue for caps on----
Senator Kennedy. Is that a ``yes''?
Mr. Smith. That is a ``yes.''
Senator Kennedy. OK. Well, here is my problem. If the
bureaus do their jobs right, they facilitate commerce, because
when lenders loan money to people, the lenders want to get paid
back. And what your clients offer is one assessment of the risk
that the lenders are taking. It is just one assessment. There
are others who do not use online lending. Many online lenders
do not use your clients' product anymore. They think there are
other ways, better ways to assess risk. I am not saying they
are right or wrong. I am saying that your clients basically
take my data, personal information about me, without my
permission; and as a business model, they sell it to
businesses. I am not compensated.
Now, if they lose my data, as Equifax did, or if someone
submits to them data that is in error that undermines my credit
score, the bureaus have no obligation or interest right now to
work with me to try to get the credit score correct.
Have you ever had one of the bureaus get your credit score
wrong and you called and tried to get it fixed? Have any of
you?
Mr. Jaikaran. No, I have not, Senator.
Mr. Rotenberg. No, Senator.
Senator Kennedy. Well, it is not an easy process. And it
would seem to me that--I am not trying to undermine the
bureaus, but it seems to me, first of all, that you could
develop technology very easily that would allow people to go to
an app on their phone to put a credit freeze on and off free of
charge. That ought to be a minimum.
Number two, you need to explain to the American people how
you are protecting their data on which your clients are making
a profit. Most of the adults in Louisiana had their data stolen
by Equifax. And they had to go to a lot of trouble to go freeze
credit. Some of them are going to have their identities stolen.
And it is just not right. It is just not right. And we are
looking to you gentlemen to tell us what to do about it. And,
counselor, I do not mean to pick on you, and I understand you
are representing your clients, but your clients need to step up
to the plate here and suggest some meaningful reforms, or some
reforms are going to be suggested to them.
Mr. Smith. Right. Well----
Senator Kennedy. And my advice to you would be to step up
to the plate and offer specific things that you and your
clients are going to do to improve this situation, not
platitudes, not bromides, specific suggestions.
Mr. Smith. Right.
Senator Kennedy. Because a lot of Americans did not know
what a credit bureau was. They know now.
I went over. I am sorry, Mr. Chairman.
Chairman Crapo. Thank you.
Senator Warren.
Senator Warren. Thank you, Mr. Chairman.
So at the hearing 2 weeks ago with the former CEO of
Equifax, there was a lot of agreement between Democrats and
Republicans that consumers should be able to control their own
data, and without consumer control, credit reporting companies
really have no reason to treat us well. We are not their
customers. We are just their products. And it shows.
A 2012 study by the Federal Trade Commission found that one
out of every five people had an error in their credit reports.
Meanwhile, over last year the Consumer Financial Protection
Bureau has fielded hundreds of thousands of consumer
complaints. And the Big Three credit reporting agencies are now
the three most complained about companies in the entire
financial services industry.
You know, if you ran a restaurant and got your customers'
orders wrong 20 percent of the time and had the worst customer
service in town, you would be out of business in a week. But
credit reporting companies, not them. They are getting bigger,
they are getting richer, and they are getting more powerful.
This market is clearly broken, and fixing it starts with giving
customers more control over their own data.
So, Mr. Rotenberg, I have introduced the FREE Act with
Senator Schatz and more than a dozen other Senators. Our bill
would let every consumer freeze and unfreeze access to their
credit files for free.
So I want to ask: Do you think that would be a good idea to
give consumers more control over their data?
Mr. Rotenberg. Senator Warren, I think it is an excellent
proposal, and as you say, I think the key to this industry is
giving consumers greater control over the use of their personal
data. It begins by moving to an opt-in model, allowing the
consumer to decide in which circumstances it is in their
interest for their credit report to be released to someone
else.
Senator Warren. Thank you. You know, companies like Equifax
do more than issue credit reports. They also sell your
information to businesses that want to sell something in turn
back to the customer. Our bill also makes clear that no credit
reporting agency can sell your data if your credit file is
frozen. Other legislative proposals and the new lock that
Equifax is rolling out right now do not give customers that
right.
So let me ask this part: Do you think that consumers should
have the right to freeze the data so that it stops a credit
reporting agency from selling access to the consumer's data?
Mr. Rotenberg. Absolutely, Senator. The model does not work
unless consumers maintain control, and so many problems of the
industry result from the industry pushing the burdens back onto
the consumers to choose the freeze, to choose the monitoring
service, to inspect their credit reports. It is entirely upside
down, and it is the reason that we have record levels of
identity theft today in the U.S.
Senator Warren. Thank you. I think that is a powerful
point. You know, if companies like Equifax do not pay us to
sell our information to other people, then we should not have
to pay them to stop selling it.
According to your testimony, you were saying--and I think
you mentioned this earlier, Mr. Rotenberg--you would go even
further. You would make the default position that a consumer's
account is frozen until the credit reporting agency gets the
consumer's explicit permission to unfreeze the account to share
the data. In other words, consumers would have to opt into
sharing their data rather than opt out. What is the reason for
that?
Mr. Rotenberg. Senator, I think it is just common sense. No
one is objecting to the provision of credit to American
consumers. It is obviously critical for our economy, makes it
possible for people to purchase homes and cars and even cell
phones. But it is the consumer who is initiating the commercial
transaction; it is the consumer who is seeking the mortgage or
the loan. The consumer should decide when to release that
credit record information to others, and they should know, by
the way, what information is contained in the credit report.
They may be wrongfully denied a loan from a bank that the bank
would provide but for the fact that the credit reporting agency
has provided inaccurate information.
Senator Warren. All right. So powerfully important that we
be able to protect our own privacy, that we be able to make
sure that it is accurate. In your testimony, though, you raised
one more point. You say we need to fix the credit reporting
industry in order to protect our national security. I am about
out of time, but could you just say a word about that?
Mr. Rotenberg. Very briefly, Senator, I mentioned earlier
that when the Fair Credit Reporting Act was passed in 1970, the
concern was the misuse of personal data by the credit reporting
agency. That concern remains. But what has changed now almost
50 years later is that data is now the target of foreign
adversaries, and we have to realistically consider that the
people who get access to our personal data held by these
companies have interests adverse to our Nation. That is an
additional reason to strengthen these privacy laws.
Senator Warren. Thank you very much. You know, the credit
reporting agency is a threat to each of us personally, but it
is also a threat to our national security. We need to give
consumers more control over their data, need to reform this
industry, and that is what we are trying to do with the FREE
Act. Thank you very much.
Thank you, Mr. Chairman.
Chairman Crapo. Thank you.
Senator Tillis.
Senator Tillis. Thank you, Mr. Chairman. Gentlemen, thank
you for being here.
One question that I have, when you have something like the
breach at Equifax, Congress has never seen a legitimate problem
that needs to be dealt with, an opportunity to overreact. And
so one of the things that I am concerned with is when we have
this discussion--I want to start with something simple, and
then maybe I can build on things to the extent time allows. But
when we had the Equifax CEO in here, I tried to ask him the
question of the lock--they are calling it ``Lock for Life''--
versus delete.
Mr. Rotenberg, where are you on the option of the consumer
being able to delete any presence of their existence in any of
the Big Three credit reporting agencies? Do you think that is
something they should be entitled to do?
Mr. Rotenberg. Well, I do, Senator. In fact, this country
has a long tradition of expungement of financial records to
give people the opportunity to start over, even after
bankruptcy. So we have already recognized that people should be
given the opportunity to, you know, reapply for credit, even
after they have had those type of experiences.
Senator Tillis. So if they delete it and then later they
were seeking credit and they had no reliable sources for
showing creditworthiness, who is it on to provide all the
information that may be needed to underwrite a loan or get a
credit card or some other financial instrument? Anybody on the
panel is welcome to opine----
Mr. Rotenberg. Well, I would just say in those
circumstances, of course, the absence of the background
information could well be a factor in the credit determination.
But that is not a reason not to give the consumer the
opportunity to delete the data if the consumer chooses to do
so.
Senator Tillis. But at the end of the day, the consumer
needs to be fully aware it could be on them to actually produce
information that could be used as a basis to underwrite--the
absence of information would likely result in no credit being
extended.
Mr. Smith. Here is another concern, Senator. What happens
if the consumer selectively deletes information? So I have
three credit cards, and I have decided that I am not going to
pay one of them, and I delete that trade line from my file. How
will a bank be able to manage that credit risk if consumers can
delete accurate and relevant information?
And with respect to this fresh start idea, the FCRA already
allows for that. Any information that is derogatory in your
credit record comes off after 7 years.
Senator Tillis. I think one thing that--when we discussed
this with the breach, I think one thing that the credit
reporting agencies need to demonstrate is that they do not make
their problem the consumer's problem. In other words, if you
have a breach, then you should be treating that consumer like
you will move heaven and earth to clear up the problem. It
should not be something that requires months of paperwork and
hours of their time to clean up, if, in fact, you can point it
back to the breach, and that is something I will be interested
in seeing how Equifax handles it.
But I am concerned, Mr. Rotenberg, with the idea of just
the aggregation of data that is used to predict how cohorts
may, you know, behave in terms of creditworthiness, that if we
continue to reduce the base, do you think there is any threat
to the fact that we have less reliable information to move
capital or to provide resources to people who need it?
Mr. Rotenberg. I think it is important for businesses to
have access to relevant and accurate consumer data. I think
they should be accountable and transparent about how that data
is being used.
Senator Tillis. Would you consider then the selective
deletion of credit data as being accurate and relevant data for
the financial services industry?
Mr. Rotenberg. It may or may not be. I mean, the credit
decision is based on a wide variety of factors, many of which,
by the way, are not even known to consumers. So we do not know
how they are making determinations about us, yet they are
concerned if they do not know everything about us when they
make their decisions. And that just seems a little unfair.
Senator Tillis. One other in my remaining time. I was not
here, but I think someone else answered the question. But what
do you think is the--what technologies or maybe what processes
out there are we using to get away from Social Security numbers
as authentication methods and moving more to say what the card
industry has done with tokenization, trying to come up with
some sort of an identity that will actually eliminate or
substantially reduce what is a relatively easy thing to do, and
that is, to get somebody's indicative information and commit
fraud? I mean, what is out there that we should be looking at
and as a matter of public policy should be promoting? Go right
down the line, and my time is expired after this answer.
Mr. Jaikaran. I am sorry, Senator. I am not aware of any
particular token products that could be used. One point to know
with the use of technology, though, is that there may be people
in the sample size, citizens, consumers, that do not have
access to something like a cell phone, so they would be barred
from participating in the widespread use of technology, and
that is one consideration to make when establishing public
policy.
Mr. Rotenberg. I think as a general matter, if we have
distributed and contextualized identity, in other words, the
company learns only what it needs to learn to make a decision,
that is the best approach. Today we are at the opposite end of
the spectrum with an open-ended identifier that makes it
possible for companies to learn just about anything they want
to about an individual.
Mr. Smith. So I think that if we did not have the Social,
we would need to invent it. So if we take away the Social, we
will need to come up with another unique identifier.
As I said earlier, with a name like Andrew Smith, it is
critically important that people are able to distinguish
between the thousands or tens of thousands of individuals named
Andrew Smith just simply to identify which one are you--not
necessarily to authenticate that I am indeed who I say I am,
but just which one are you. And the Social plays a critical
role there. And if not the Social, then we need something else
to fill that role.
Senator Tillis. Thank you.
Chairman Crapo. Thank you.
Senator Schatz.
Senator Schatz. Thank you, Mr. Chairman.
Mr. Smith, after the Equifax breach, consumers learned that
the best way to protect themselves from identity theft and
fraud was to freeze their credit report. But when they went to
do that, they found a complicated process that required
contacting each of the three credit bureaus, generating and
remembering separate PINs for each and, most infuriating,
paying 10 bucks to each bureau to place the freeze, not to
mention the fees that they have to incur if they want to lift
the freeze later. Equifax's lapse in data security will be
rewarded by hundreds of millions of dollars in revenue to the
company that made the mistake.
And so my question for you is very simple: Explain to me
why Equifax, Experian, and TransUnion charge people to freeze
their credit report when there is a mistake that is their
fault.
Mr. Smith. Well, so there are a lot of ways for consumers
to protect themselves, and for certain consumers freezes are
the right choice. I personally----
Senator Schatz. And so in those--hold on.
Mr. Smith. OK.
Senator Schatz. In those instances why is it not free? If
the consumer----
Mr. Smith. Right now we have--as you know, right now we
have a patchwork of laws, and if we are to have a single
national standard, I think that, you know, we would be happy to
talk with you about how to get that result right for consumers.
But it----
Senator Schatz. Well, what has that got to do with--a
patchwork of laws, what has that got to do with anything? I am
asking----
Mr. Smith. Because the patchwork----
Senator Schatz. Hold on.
Mr. Smith. Right.
Senator Schatz. I am asking you when a mistake occurs and
144 million people are told to do a certain thing, that certain
thing should be free, shouldn't it?
Mr. Smith. I do not know that everyone was told to freeze
their credit report. Personally, I do not think it is the right
choice for everyone. I do think that the credit bureaus make
the freeze----
Senator Schatz. But it is the right choice for some number
of millions of Americans, is it not?
Mr. Smith. I believe that all three of the nationwide
credit bureaus make freezes available for free to individuals
who say that they are identity theft victims. I believe that
they also make freezes available for free to senior citizens
and to minors.
As far as a national freeze requirement, I think that we
would----
Senator Schatz. I am not asking you about a requirement. I
am asking you why you generate revenue off of the mistakes of
the organizations that you represent.
Mr. Smith. Well, the why is because freezes cost money, and
also the State laws----
Senator Schatz. But the locks are free, right?
Mr. Smith. ----permit a charge--locks, I do not know from,
I am afraid. I saw the testimony from the CEO of Equifax----
Senator Schatz. You are the counsel for this organization.
Mr. Smith. These are new products--I am a counsel for the
trade association, but I know that there are all kinds of new
products that credit bureaus and others are rolling out that
can take advantage of, for example, apps on a mobile device and
lock and unlock. But I do not know that those--any of those
products are necessarily in the market now.
Senator Schatz. I do not understand what you are saying,
and I do not think that it is because I do not understand this
area. I think it is because I do not understand what you are
saying because at a common-sense level--I want you to try to
explain to somebody you went to high school with--right?--who
says, ``Oh, you got a gig with the CRAs. Good for you. How is
that going? Let me ask you a question, Andrew. Why do I have to
pay for a freeze?'' And I do not think you answered that
question.
Mr. Smith. And the answer is because freezes cost money.
Freezes have to be implemented by the credit bureaus.
Senator Schatz. Then the question is: Why did the company
that made the mistake make a profit off of that mistake? Why
are you charging consumers? Even if the freezes cost money,
fine, you should eat it because that would create an incentive
to not screw up again.
Mr. Smith. I thought Equifax was providing freezes for
free.
Senator Schatz. But my question is: Why not all three, and
why not as a matter of course? And that only occurred after the
CEO quit and under great pressure.
Mr. Smith. I thought they offered freezes for free right up
front.
Senator Schatz. No. I want to ask you a couple of questions
related to a bill that I have introduced. Do you think it is a
good idea for credit bureaus to use tighter matching
requirements so that the trade lines on someone's credit report
are more likely to be their own information?
Mr. Smith. I think that matching algorithms are a really
tricky issue, as I am sure you have done some thinking about
it, and it is really a question of probabilities and
statistics, and I am not sure that we necessarily want to
legislate that. But matching is critically important for
accuracy.
Senator Schatz. And what is your error rate, roughly?
Mr. Smith. We believe that our error rate--so the FTC did a
study, of course, as you know, in 2012. We did a similar study,
and we believe that the error rate from our study is less than
1 percent. Looking at the FTC's study, we believe--and this is
in an appendix to the FTC's study. Based on the FTC's data, we
believe that the error rate is about 2 percent.
Now, error is an important concept here, though. It has to
be an error that moves the needle, that would have an effect on
the consumer. So they get my date of birth wrong. That is not
necessarily an error if it does not move the needle on my
credit score.
Senator Schatz. So you are talking about even at the low
end--even at the low end of the estimate, you are talking about
a million, 2 million individuals who have----
Mr. Smith. Absolutely, and that is not acceptable. And I
think that----
Senator Schatz. And whose responsibility is that?
Mr. Smith. Well, it is a lot of people's responsibility,
but it is to some extent the credit bureaus' responsibility.
And as far as accuracy is concerned, accuracy--Professor
Rotenberg in his written testimony said that, look, you are
never going to have perfect data security, there are always
going to be breaches; the best we can do is to try to control
them up front.
Accuracy is the same way. It is a process.
Senator Schatz. I am over time. I will just add that I
understand that you are going to make mistakes. The basic
question is: Who should incur the costs of those mistakes--you
guys or the rest of the country?
Thank you.
Chairman Crapo. Senator Perdue.
Senator Perdue. Thank you, Chair. Thank you, guys, for
being here. It is a very complicated conversation.
Let me start with something we are working on to codify
something across 47 States. Right now, if you want to, you have
to opt out, basically. In other words, I never gave permission
to anybody to get that data, although it does provide a service
so that I do not have to aggregate all my credit information
when I want to go borrow something. So I get that. But at the
Equifax breach hearing I think just 2 weeks ago, we asked
questions regarding the need for a national standard on credit
freezes, and I think Representative McHenry has already--he has
the PROTECT Act that you may be familiar with that they are
proposing. It creates a national standard for credit freezes,
harmonizing the current 47 State laws on the issue.
I would like to get all three of you to comment. Do you
agree that that would help allow the development of technology
such as apps that could freeze and unfreeze without having to
go through the process and so somebody could actually open up,
get the credit information they need, and then opt out easily,
without having to have a lot of instruction? Is that something
that might benefit us here?
Mr. Smith. So as I said earlier, freezes are not the right
choice for everybody necessarily, but they are the right choice
for some people, and, you know, the development of a national
standard is something that we would welcome.
With respect to this lock and unlock functionality, I would
ask you to consider that whenever we legislate something like
this, the questions that come up say, ``Well, what about the
people who do not have smartphones? What are we going to do
about them?''
``Well, OK, we are going to have a lock and unlock
functionality where you dial an 800 number. Well, what about
the people who do not have easy access to a telephone? Well, we
will have a mail-in.''
Senator Perdue. But they would not be--just so I am clear,
they would not be in the system--in other words, I could not
access their data unless they----
Mr. Smith. Flipped the switch.
Senator Perdue. Unless they were to come back and do
something like this, on an 800 number or whatever, when they
needed it.
Mr. Smith. Correct. But then you think to yourself, OK, let
us do an 800 number. Well, that is going to present a security
risk that someone else unlocks my credit when they are applying
for an auto loan on a Saturday afternoon. So that means a PIN.
So I do not know what my PIN is, I have forgotten it. Well,
then you are going to have to reset your PIN. And before you
know it, you are not going to get that new cell phone at the
Verizon store on a Saturday afternoon. You are going to have to
go reset your PIN. You are going to have to go back to the
Verizon store the next weekend, and hopefully it will work out.
But, see, there is a lot of friction in the system, and
these freezes and locks are difficult to administer, and that
is why they are not necessarily the right choice for everybody.
But for some people who are not credit active, who are not
buying cell phones or renting apartments.
Mr. Rotenberg. Senator, I actually think it is a good
proposal, and I think it is a step in the right direction. I
am, frankly, a little confused by Mr. Smith's comments. Most of
what he is describing are the difficulties that the industry
has created in giving consumers the ability to select the
freeze, to limit the access by others. And what the legislation
I think would accomplish is to simplify that process, make it
easier for people to make those decisions precisely so they can
have the credit record information available when they need it
to be made available.
Mr. Jaikaran. Regarding any congressional action in this
space, it is an interesting public policy question, because
there are these groups of data brokers who have this
information and they have their business relationships with
those that they acquire information from and those that they
sell the information to. However, the information is the
consumer's. And the relationship between the data broker and
the consumer is a little weaker compared to who they are
selling data to and who they are acquiring it from. The
weakness in that link is a space where Federal policy may be
able to bridge the gap between the rights of the consumer and
the rights of the data broker, or the right of the data broker
relative to the consumer of their own data.
Senator Perdue. All right. Thank you. Let us talk about
Social Security numbers for a minute, if I may. The same thing.
Adoption of Social Security numbers as a method goes back, I
think, to the 1960s. But in the last half-century, our
technology has moved fairly rapidly forward. Is there a better
way? The new technologies we have in front of us, isn't there a
better, more secure way to matching people with accounts such
as tokenization, or should all of these cyberattacks with--and
should all these cyberattacks be the impetus to start planning
out what transition to credit future without Social Security
numbers? Social Security numbers seem to me to be the Holy
Grail here that is the access beyond what any reasonable person
would want. Is that a reasonable direction?
Mr. Rotenberg. Senator, I think the key here is to limit
the use of the SSN but not replace it. In other words, it is
the weak link in the information industry. It is the target of
identity thieves. And if you are trying to make your industry
more resilient against those attacks, you have to reduce your
dependency on the SSN. But, you see, if you replace the SSN
with another general purpose identifier, that becomes the
target. So we need a more distributed approach to
identification, not a single point of failure. That is what the
SSN has become.
Senator Perdue. Well, it is pretty obvious to me we have
got to engage on this, but we do not have a common answer yet
to this security issue. Thank you. I am out of time.
Thank you, Mr. Chair.
Chairman Crapo. Senator Heitkamp.
Senator Heitkamp. Thank you, Mr. Chairman.
Not to extend the discussion on when you can put a credit
freeze on or put a lock on, it is interesting you said you
can--Mr. Smith, you said you can put a lock on after you have
been a victim of identity theft. That is kind of like saying,
you know, lock the door after the thief went in your house. I
mean, it is just not--it is not responsive to what we are
trying to get at here, which is we understand the benefit of an
aggregator of data that gives us easier access to credit. I
think no one is disagreeing with that.
The question is--and you were asked about fiduciary
obligations, and the question really is: What responsibility
does that aggregator have when something like this happens?
Now, when Mr. Smith was here, the previous Mr. Smith,
Equifax----
Mr. Smith. No relation.
Senator Heitkamp. Yeah, I figured that. He said, ``This
happens all the time. You know, we are hit all the time.'' And
I asked, ``Well, in light of that, then why did you seem so ill
prepared when you were actually breached? Why did it take you
so long to come up with a response to the breach?''
So I have got a series of questions on: How often does this
happen? And what is the general response that the industry has?
So as a general matter, how many times per year on average
would a company like Equifax, TransUnion, or Experian
experience--how often would you experience a breach that would
be reported to the FBI?
Mr. Smith. So, unfortunately, I do not have those figures.
We can find them. I would say that, based on my personal
knowledge, none of the credit bureaus themselves have been
breached. Now, the companies--in Equifax's case, it was
information that was outside of the consumer reporting agency
data base. We also know of a breach at Experian involving data
of T-Mobile. So there are breaches that occur, and we will come
up with a number for how frequently they occur. But to the best
of my knowledge, there has never been a security breach of a
consumer reporting agency data base.
Senator Heitkamp. And that is splitting a hair for the
consumers. I do not think there is any doubt about it.
Mr. Smith. Well, but it is an important policy point, I
think, because if the FTC and CFPB after their investigations
conclude that the consumer reporting agency data base was not
breached, after Equifax was subjected to this punishing attack,
that might inform our policy choices.
Senator Heitkamp. The next question I have is: Let us say
that you report it to the FBI. What is the typical guidelines
or strategies that any of these credit agencies, any of them
would basically go to? Do you have like a fire drill, in other
words? Do you have a system in place that will lock down and
protect data?
Mr. Smith. Right. So now, of course, I cannot speak for any
particular company, but the companies with which I am familiar
have incident response plans, and they have done the table--
they call it a ``tabletop exercise'' where, you know, all the
stakeholders are around the table and we run through, you know:
What is the public statement going to be? What are we going to
do with respect to our call centers? How do we inform law
enforcement? How are we going to do the consumer notifications?
That kind of stuff.
Senator Heitkamp. You know, but you would have to agree
that Equifax was pretty ill prepared.
Mr. Smith. I do not know. I think this was an unprecedented
breach. So I would rather not speak to----
Senator Heitkamp. Even if it is 10 people, the response
should be the same as if it were 140 million people.
Mr. Smith. Well, except think about your call center, for
example. So rather than ten calls--ten calls you can handle. A
hundred and forty million on 1 day?
Senator Heitkamp. Well, doesn't that beg the question of
why people here are upset? I mean, you had Senator Kennedy
basically say, look, this is not data that you own. You do not
have a relationship with the consumer other than an aggregator
that provides that service. If I say, ``I do not want your
service, I will aggregate my own data, I will take
responsibility,'' I have to pay you so that you are not
collecting my data. Correct?
Mr. Smith. Not collecting. This is a freeze, right? The
data is still there, but you have frozen it, and you have the
right to unfreeze it.
Senator Heitkamp. You know, in Europe, all across the EU,
there is a whole lot of privacy initiatives: the right to be
forgotten--you know, we are getting close to that here. We have
been a much more open economy as it relates to this kind of
data aggregation. The more we do not see a response, the closer
we are to that pendulum that Senator Tillis talked about, which
is the potential that you guys are going to be out of business
because every American is going to say, ``We do not want your
service.''
Mr. Smith. No; absolutely, we need to ensure that consumers
and businesses trust the national credit reporting system----
Senator Heitkamp. And I think you have a serious trust
problem today. And I think the lack of coming forth with
solutions and the adversarial kind of approach that we have
seen to this is not helping to solve the problem. So we look
forward to ongoing discussions.
Mr. Smith. As do we.
Senator Heitkamp. Thank you, Mr. Smith.
Chairman Crapo. Thank you.
Senator Donnelly.
Senator Donnelly. Thank you, Mr. Chairman. Thank you,
panelists.
Mr. Smith--or this is actually to all of you. In 2014, the
Department of Veterans Affairs created the Choice Program to
allow vets to receive medical care in non-VA facilities. It has
been helpful in increasing access. However, issues with the
implementation of the program led to delayed payments and
billing problems, which in turn resulted in some vets receiving
adverse actions on their credit reports from debt collection
efforts. Adverse credit actions make it more difficult and
expensive for them to get a mortgage, to buy a car, and it is
really troubling that our veterans have had their credit harmed
through no fault of their own.
Senator Rounds and I introduced the Protecting Veterans'
Credit Act to delay the reporting of VA-responsible medical
debt, to make it easier for this erroneous debt to be removed
from credit reports.
Mr. Smith, medical debt can obviously get expensive. What
damage can it do to the vet's credit when this is reported as
unpaid?
Mr. Smith. Well, look, we agree with you 100 percent that
veterans should not have their credit records tarnished by
backlogs and inefficiencies in VA's payment system, and we
understand that that is what is happening here, and we are
committed to working with you to solve that issue through the
national credit reporting system. I think institutionally we
believe that the folks who are best able to solve that issue
are the VA and the private medical service providers and the
debt collectors who are furnishing this essentially erroneous
information into the system. But we are committed to working
with you and your office.
Senator Donnelly. So I have your commitment on behalf of
the trade association, on behalf of the industry, that you will
work together with us to address these problems, to address the
difficulty of the reporting of VA-related medical debt that our
vets will not get dinged on their credit reports for this
occurring?
Mr. Smith. Right. For erroneous, right? What we are talking
about is where VA, because of VA's processing inefficiencies,
they just have not paid the bill----
Senator Donnelly. Well, it is not erroneous that my knee
got worked on. It is erroneous that the bill came to me as a
veteran, if I was a vet.
Mr. Smith. Correct, and VA should have paid it, and the
private medical service provider has not been paid and
furnishes the information, yeah, we need to fix that. And we
are committed to working with you to fix that.
Senator Donnelly. OK. Congress enacted the Fair Credit
Reporting Act in 1970 to set the rules of the road. Despite the
original act and the many subsequent amendments, we still do
not control our information contained in the files of the
credit bureaus. It is reported without any consumer permission,
as has been noted by many. It is often sold to third parties,
such as with pre-screened credit and insurance offers. And the
personal information may now be available to thieves on the
Dark Web after Equifax.
Mr. Smith, you are the representative for the association.
Should consumers have more control over their information?
Mr. Smith. Well, so we have talked a little bit about that
today, you know, the ability to remove yourself from the
system, the ability to selectively delete information. I think
both of those present issues for the national credit reporting
system. The selective deletion would allow a consumer to game
the system, to hide unpaid debts from potential creditors,
making it--presenting a real concern for the safety and
soundness.
Senator Donnelly. Well, that comes out if they apply for
something, right? If they want to get a mortgage, then the
mortgage company----
Mr. Smith. Well, I am talking about the selective deletion.
Now, the removal from the system, then the removal from the
system is great until you need to rent an apartment or buy a
cell phone or get a mortgage or get a car loan, and then there
is nothing----
Senator Donnelly. Then you can opt in, right?
Mr. Smith. Well, not if your information has been removed
from the system. If it is removed, it is removed.
Now, what you are talking about is perhaps a freeze, and I
think we are--we think that a freeze is the right choice for
some consumers, not for all consumers, and that we are willing
to work with----
Senator Donnelly. Well, isn't it appropriate that the
consumer ought to be able to make that decision? If it makes it
a little bit harder for them to get the apartment, that is a
decision they have made. Mr. Rotenberg.
Mr. Rotenberg. Absolutely, Senator, and I think it is
important to understand that if a consumer is making a
significant decision like renting an apartment or applying for
a home mortgage or a car loan, it makes sense to have them have
the ability to know what is in the credit report and make the
affirmative decision to decide who is going to get access to
that information. So that would be common sense.
Senator Donnelly. Thank you, Mr. Chairman.
Chairman Crapo. Thank you.
Senator Van Hollen.
Senator Van Hollen. Thank you, Mr. Chairman. And I thank
all of you for being here today.
It does seem, as reflected in a lot of the comments today
and from the earlier hearings we had, that the credit reporting
agency model is one that is in some ways uniquely stacked
against consumers when there has been either a data breach or
bad data put in. And my question goes beyond the issue of the
data breach to lots of complaints we have heard over the years
about credit reporting agencies collecting bad data that then
goes to lead to a denial of a loan or a mortgage payment. And
there has been a lot of discussion about how to sort of allow
that consumer to be made whole.
My question is on the front end in terms of creating
penalties or deterrents for those who are collecting all this
data without people's permission and then having the burden be
on the consumer on the other side.
So my question to all of you is: Is there some kind of
deterrent that we could put in place so that the burden and the
penalty for collecting and disseminating bad data, whether it
is through a breach or whether it is through denial of a credit
card can actually address this problem on the front end so that
there is more of a premium for a credit reporting agency to
prevent that from happening in the first place?
Mr. Smith. So I would like to start in responding to that.
So with respect to data accuracy, credit bureaus have
substantial duties with respect to data accuracy, and those are
up front to ensure that they have procedures in place to ensure
the maximum possible accuracy of the data. The companies that
furnish data into the credit bureaus are now required to have
written policies and procedures to ensure the accuracy of that
data. So that is up front. And the credit bureaus and the
people who furnish the data into the credit bureaus are all
supervised for adherence to those standards by the Consumer
Financial Protection Bureau right now. So I think that--so we
do have--I mean, we are not unregulated. We do have this
statute, and it gets longer every year. And there are more and
more duties added in for credit bureaus and furnishers----
Senator Van Hollen. So I guess my question is: What is the
current penalty in the event that bad data gets in? Despite all
of the systems that are put in place, is there a penalty that
has to be paid by the credit reporting agencies? I am not
talking about after the fact. In other words, in addition to
just bringing the consumer whole--because let us say you are a
consumer, right?
Mr. Smith. Right.
Senator Van Hollen. You know, you get denied a loan. Then
you have got to go through the incredible hassle of getting all
this straightened out. And at the end of the day, OK, maybe you
get your loan. But what can we do to put more of a deterrent up
front so that we never get to that point where thousands of
people are wrongfully denied a loan, and, you know, after a
whole lot of work and cost, maybe they get the loan? So I am
interested in your thoughts, and then I may come back----
Mr. Rotenberg. Let me say, Senator, right now I think it is
upside down. In other words, right now, when there is a
problem, the companies turn around and charge the consumers to
take advantage of the tools they need to correct the problem.
So that cannot be right. I think what we do need to do is
increase the incentives for the companies to do a better job on
data security and on privacy protection.
If I could make one more historical point, there is a deal
at the heart of the Fair Credit Reporting Act. When the FCRA
was passed by Congress in 1970, the ability for consumers to
bring suit in State tort law was preempted because it was their
information and some of this inaccurate, incomplete, is
disparaging and defamatory and causes commercial loss. Before
passage of the FCRA, people could bring lawsuits for those
harms. They cannot now under the FCRA, which means that
Congress has to strengthen the penalties to maintain the
incentives.
Senator Van Hollen. Right. So there is a good example,
right? If someone collects bad data that harms somebody, would
you agree, Mr. Smith, that they should be able to have recourse
through the courts?
Mr. Smith. Well, they do have recourse, and the recourse is
through this law. Now, remember that this law provides for
statutory penalties in private actions where the credit bureau
behaved willfully.
Senator Van Hollen. Let me ask you, because my time may be
running out here, your association has been lobbying against
the Consumer Financial Protection Bureau's provision that would
allow people to bring lawsuits. In other words, you have been
lobbying in favor of keeping mandatory arbitration. Isn't that
right?
Mr. Smith. That is my understanding, that, yes, we are
lobbying for that.
Senator Van Hollen. Doesn't that stack the deck against the
consumer? You mentioned 143 million people, right? If everybody
has got to go to mandatory arbitration as opposed to being able
to group together as consumers and bring a case, that
definitely stacks the deck in favor of the big guys and against
the person who has been harmed, doesn't it?
Mr. Smith. But with respect to the credit reporting system,
there is no opportunity--you have no contract with Equifax.
Senator Van Hollen. I understand.
Mr. Smith. So you have no mandatory arbitration clause with
Equifax. Correct?
Senator Van Hollen. But this is a separate issue actually
that was just raised by another witness. In other words, if
there is information in there that causes me damage--right?
Mr. Smith. Information in the credit report you can----
Senator Van Hollen. Yes, that causes me damage.
Mr. Smith. You can sue, and you can be a member of a class
because there is no mandatory arbitration clause in that
context. What we are talking about with arbitration is where
the consumer is purchasing a product from one of the credit
bureaus, like a credit monitoring product, for example, and----
Senator Van Hollen. But we did see in the case of Equifax,
at least initially, that as a condition of getting protection
from damaging information that Equifax breaches caused, that
they were originally requiring people to relinquish their
rights to go to court. In other words, they were insisting they
sign something for mandatory arbitration.
Mr. Smith. With respect to----
Senator Van Hollen. Now, they backed--no, but this is an
example----
Mr. Smith. Then they backed off, correct.
Senator Van Hollen. And there are other Equifax products
where there is a contractual relationship where they are
insisting on mandatory arbitration. Isn't that the case?
Mr. Smith. For credit monitoring and----
Senator Van Hollen. I mean, they testified here they have
lots of products where they insist on----
Mr. Smith. Yes, direct----
Senator Van Hollen. Doesn't that----
Mr. Smith. ----products sold to consumers, yes.
Senator Van Hollen. And if a consumer is wronged in that
process, doesn't it stack the deck against them to say they
have to go through mandatory arbitration?
Mr. Smith. Well, of course, I am going to disagree with
that. I mean, we think that arbitration can be effective. We
also think that given the statute called the ``Credit Repair
Organizations Act'' that there are special risks presented for
credit monitoring products that have stacked the deck against
the company.
Senator Van Hollen. I would just say, Mr. Chairman, I can
understand why Equifax would want to deny that particular kind
of recourse because it can be more successful in recovering
people's damages. Thank you.
Chairman Crapo. Thank you, Senator. And hold on 1 second.
[Pause.]
Chairman Crapo. I am going to wrap it up. I am going to
have to be very fast because there is a second vote that I am
going to have to get to.
So thank you very much for attending here today. I just
have one question, and I know that you are here as experts on
credit bureaus. I just want to know, if you know, whether there
is data that is required to be submitted by the credit bureaus
to the Federal Government. Does any Federal Government agency
require credit bureaus to submit data to them?
Mr. Smith. I do not believe that--so I know that data is
provided to the Federal Reserve Board and to the CFPB by credit
bureaus, and I believe that that data is purchased by those
agencies and that it is provided within the strictures of the
Fair Credit Reporting Act. And in the instances with which I am
familiar, it is provided in a deidentified and an aggregated
format.
Chairman Crapo. All right. That does it then. I want to
thank each----
Senator Brown. Could I ask some more questions? Thank you.
[Pause.]
Senator Brown [presiding]. Then I will wrap up, right? OK.
Thank you.
Mr. Rotenberg, let me start with you. If Americans could
make CRAs delete their credit files upon demand, like the law
requires for medical records--and I know you have some
interesting thoughts there, but do not go into so much the
medical records. But if they could delete their credit files
upon demand, would that create an additional business risk for
consumer reporting agencies?
Mr. Rotenberg. Well, I do not know if it would create a
risk for consumer reporting agencies. It would give consumers
more control of their personal information, and I think there
is a way to manage that. Certainly it is done currently with
bankruptcy and the FCRA.
Senator Brown. Would you say that consumer reporting
agencies would not want Americans to demand that their credit
files be deleted?
Mr. Rotenberg. I am certain or I expect that would be their
position. They try to get as much information about consumers
as they can, and, of course, consumers have very little
information about what is being gathered.
Senator Brown. Let me make sure I understand. So if CRAs
knew that Americans would request their data be deleted after a
cybersecurity breach like we just had, and they unsuccessfully
tried to do that following the Equifax breach, as we also know,
would that create an incentive for these agencies to pay more
attention to cybersecurity in the first place?
Mr. Rotenberg. I am sure it would, and I think to answer
your question directly, consumer reporting agencies have no
legal right to obtain the information of American consumers.
The businesses have evolved over time. They have collected a
lot of data. They are subject to regulation. But I do not think
the credit reporting agencies can claim that they have any
right to access our personal data, and so ultimately it would
be the consumer's decision whether or not any company has the
right to possess our data.
Senator Brown. So some at the CRAs claim that consumers
would game the system. Is that right?
Mr. Rotenberg. Well, it is possible. But, you know, of
course, right now I think the credit reporting agencies largely
game the system because consumers do not know the factors that
are used to make decisions about them for credit, for
employment, and even for cell phone purchases. So it is very
asymmetric, this industry, who has information about who and
how that information is used.
Senator Brown. Speaking of asymmetric, currently my
understanding is that rules for privacy are much stricter at
Government agencies than they are in the private sector. If
that is the case--and I think it is--should we consider a
single set of privacy standards for both public and private?
Mr. Rotenberg. I think that is the unfinished business of
privacy protection in the United States. We had a moment where
there was an opportunity to establish a comprehensive privacy
law in the private sector. Congress chose not to. There is a
comprehensive law for Federal agencies.
Europe took a different approach. They established
comprehensive privacy protection for the private sector, and I
think there has been some benefit. They do not face the same
levels of identity theft and financial fraud----
Senator Brown. Well, tell me more about Europe. My
understanding is European countries, as you have suggested,
have stricter data privacy laws; they, I assume, still have
functioning credit markets. Right?
Mr. Rotenberg. Yes, they do.
Senator Brown. Do these three agencies that Mr. Smith--and
Mr. Smith can certainly respond to this, too. These three
agencies that he represents, Equifax, TransUnion, and Experian,
do they do business in those countries?
Mr. Rotenberg. I do not know about those specific firms. I
do know that there is a vibrant credit market across the
European economy. The key is that they are held to a higher
standard. For example, in the area of breach notification,
Equifax took more than 6 weeks once they learned of the breach
to tell American consumers what had happened. Under the new
European Union privacy law, they have 72 hours when they
confront a problem like that. So you can still operate your
business. You are just held to a higher standard.
Senator Brown. Mr. Smith, the three agencies, let us talk
predominantly about those three because they clearly corner the
market, more or less. Are they profitable in Europe with a
different business model, one with stricter privacy laws?
Mr. Smith. I do not know whether they--I know that some
operate in the U.K. We have a different group of credit
reporting agencies in Europe, and it is not necessarily the
three that we are familiar with here. We know that Equifax is
in the U.K. I am not sure about continental Europe.
Senator Brown. Could you give to the Committee from those
three clients specifically what they do in Europe and their
profit--how big a presence they have, market share, like you
know in the U.S., and how they are doing in Europe in terms of
profitability and any public plans they have about continuing--
--
Mr. Smith. Sure, we can do that.
One thing that I would say about Europe, though--and
Professor Rotenberg may disagree with this--I do not believe
that there is a right to be forgotten with respect to credit
report information, that there is a balancing of legitimate
interests for collecting such information and a balancing with
this right to be forgotten. So there is guidance in the EU that
I believe would not permit consumers to just delete wholesale
information from credit reporting agencies because of the vital
role that they play in managing safety and soundness.
Mr. Rotenberg. Actually, if I may disagree, that is not
correct. The General Data Protection Regulation, the new
European Union law, speaks specifically of the right to
erasure. Credit reporting agencies are controllers and
processors of personal data; they are subject to that. Also
under the European law, consumers have the right to an
explanation of the basis of a decision. In other words, if a
company has an automated process to decide whether someone gets
a loan or gets a job, under the European law consumers get to
know what the factors were that were used to make that
determination.
I think we need to move toward that approach in the United
States. I think it would make the companies more accountable. I
think it would make the decisions about American consumers
fairer and more transparent.
Mr. Smith. By the way, we do that here, too. We do have
requirements that when you take adverse action based on
consumer report information, that you notify the consumer. And
in the case of where a credit score is used, you have to have
the key factors that affected that score.
Senator Brown. All right. Thank you. And I have one last
question. I apologize, and I know I committed to the Chair to
keep it as close to 5 minutes as I could. A last question for
Mr. Smith. If the FCRA bill that capped liabilities had passed,
how much would the 145 million Americans, 5 million in my
State, how much would those victims of the Equifax problem been
entitled to?
Mr. Smith. Well, first, you are assuming that there would
be a cause of action under the Fair Credit Reporting Act, and
right now, based on news reports, there would be no cause of
action under the Fair Credit Reporting Act because it was not
credit report--the consumer reporting data base that was
compromised. Were there to be a breach of a consumer reporting
data base, I believe that the figure was--a million? OK. The
cap was either $500,000 or $1 million, but it was consistent
with all of the other consumer credit protection statutes.
Senator Brown. OK. Sounds like we have a loophole to close.
Thank you all. Members of the Banking Committee may have
questions for you. We encourage them to get them in writing
quickly to each of you, within the next 7 days, and please
answer as quickly as you can, including some, Mr. Smith, I
asked you for.
I thank Chairman Crapo, and the meeting is adjourned.
[Whereupon, at 11:53 a.m., the hearing was adjourned.]
[Prepared statements, responses to written questions, and
additional material supplied for the record follow:]
PREPARED STATEMENT OF ANDREW M. SMITH
Partner, Covington & Burling LLP, On Behalf of the Consumer Data
Industry Association
October 17, 2017
Chairman Crapo, Ranking Member Brown, and Members of the Committee,
thank you for the opportunity to appear before you. My name is Andrew
Smith, and I am a partner at the law firm Covington & Burling LLP,
where I co-chair the Financial Institutions Practice Group. I also
serve as the Chair of the Consumer Financial Services Committee of the
American Bar Association, and I am a Fellow of the American College of
Consumer Financial Services Lawyers. Earlier in my career, I worked at
the Federal Trade Commission (FTC), where I was in charge of the FTC's
credit reporting program.
I am appearing today on behalf of the Consumer Data Industry
Association.
CDIA is an international trade association with over 140 corporate
members--including the three nationwide credit bureaus--that educates
policymakers, consumers, and others on the benefits of using consumer
data responsibly. CDIA members provide businesses with the information
and analytical tools necessary to manage risk and protect consumers.
CDIA member products are used in more than nine billion transactions
each year and expand consumers' access to financial services in a
manner that is innovative and focused on their needs. We commend you
for holding this hearing, and welcome the opportunity to share our
views.
Today, I want to focus on three key points:
The American credit reporting system provides critically
important benefits to consumers and is indispensable to the
economy.
Nationwide credit reporting companies must comply with
robust data security standards, because of the direct
requirements of Federal and State law, but also because of
obligations imposed on credit reporting companies by their
customers, such as banks who are required by their prudential
regulators to audit the data security of their vendors.
Beyond these data security requirements, credit reporting
companies are subject to a pervasive regulatory and supervisory
scheme that effectively protects both consumers and the
economy, and has persisted for nearly 50 years.
The National Credit Reporting System
The national credit reporting system is vital to the health of the
economy and to maintaining consumer access to credit. More than two-
thirds of U.S. gross domestic product comes from consumer spending, a
fact that depends in large part on consumer access to affordable
credit. In turn, access to credit on reasonable terms makes it
affordable for consumers to make important purchases, such as a home or
a car, or even a smartphone.
The credit reporting system is so central to the modern American
economy that it can be easy to miss its benefits. For example, today we
would never imagine that a cross-country move might make it difficult
or even impossible to rent an apartment, get utilities connected, or
obtain a bank account. But before the development of the modern system,
moving to a new city potentially meant losing access to critical
services and benefits. Without ready access to a consumer report,
lenders, landlords, community banks, credit unions, insurance
companies, and others had no assurance that you were conscientious and
reliable, unless they knew you personally. As Consumer Financial
Protection Bureau (CFPB) Director Richard Cordray has stated,
Without credit reporting, consumers would not be able to get
credit except from those who have already had direct experience
with them, for example from local merchants who know whether or
not they regularly pay their bills. This was the case fifty or
a hundred years ago with ``store credit,'' or when consumers
really only had the option of going to their local bank. But
now, consumers can instantly access credit because lenders
everywhere can look to credit scores to provide a uniform
benchmark for assessing risk. \1\
---------------------------------------------------------------------------
\1\ Richard Cordray, CFPB, Prepared Remarks by Richard Cordray on
Credit Reporting (Jul. 16, 2012), https://www.consumerfinance.gov/
about-us/newsroom/prepared-remarks-by-richard-cordray-on-credit-
reporting/.
The modern credit reporting system has made it possible for many
middle-class consumers to get credit at rates that previously would
have been reserved for the wealthy. Now, even those of modest means who
have shown themselves to be diligent and conscientious with their money
can get affordable credit quickly and with a minimum of effort.
Furthermore, in recent years, many credit reporting companies have
developed tools to provide lenders with information on the unbanked and
other consumers without the type of records that typically make up a
traditional credit report. These tools allow more consumers to access
traditional loans and bank products.
Our credit reporting system today is the envy of the world. It is a
key reason why we have such a diverse base of lenders, in contrast to
the financial systems of other developed Nations. Our system also
provides a disproportionate benefit to smaller financial institutions
like community banks and credit unions, who have access to accurate and
complete data on par with what very large banks have access to. Our
financial system works because companies share critical information
across the system to benefit everyone.
Ultimately, credit reports tell the story of our good choices and
hard work. They speak for us as consumers when we apply for loans and
lenders don't know who we are or if we've paid our bills in the past.
Further, credit reports are a check on human bias and assumptions that
provide lenders with a foundation of facts that tell our story and
contribute to equitable treatment for consumers. CDIA members work to
act in the best interests of consumers--by ensuring the accuracy and
completeness of data in consumer reports, and by providing businesses
with the information that they need to ensure consumers are treated
fairly.
Data Security Requirements for Credit Reporting Companies
We understand that the Committee is particularly interested in
understanding the data security requirements and standards that apply
to credit reporting companies and the steps these companies take to
protect consumer data. Under Federal, State, and private contractual
frameworks, credit reporting companies are required to protect the
sensitive consumer information that they possess, such as by
developing, maintaining, and testing the effectiveness of comprehensive
information security programs. These existing frameworks combine to
form a robust and comprehensive set of cyberstandards that protect the
data collected, maintained, and transmitted by credit reporting
companies.
The Gramm-Leach-Bliley Act and FTC Safeguards Rule
Credit reporting companies are financial institutions subject to
the information security requirements of the Gramm-Leach-Bliley Act
(GLBA) and its implementing regulation, the Standards for Safeguarding
Customer Information (Safeguards Rule) promulgated by the FTC. \2\ The
Safeguards Rule imposes specific standards designed to (1) ensure the
security and confidentiality of customer records and information; (2)
protect against any anticipated threats or hazards to the security or
integrity of such records; and (3) protect against unauthorized access
to or use of such records or information which could result in
substantial harm or inconvenience to any consumer. \3\
---------------------------------------------------------------------------
\2\ 15 U.S.C. 6801; 16 CFR pt. 314. The Safeguards Rule applies
to financial institutions within the FTC's jurisdiction, which includes
credit reporting companies. The Federal prudential banking regulators--
i.e., the Federal Reserve, the Office of the Comptroller of the
Currency, and the Federal Deposit Insurance Corporation--have
promulgated similar information security guidance that applies to the
financial institutions under their supervision. See Interagency
Guidelines Establishing Information Security Standards, 12 CFR pt. 30,
App. B (interagency guidelines as promulgated by the OCC); 12 CFR pt.
208, App. D-2 (as promulgated by the Federal Reserve); 12 CFR pt. 364,
App. B (as promulgated by the FDIC).
\3\ 15 U.S.C. 6801(b); 16 CFR 314.4(b).
---------------------------------------------------------------------------
The Safeguards Rule requires financial institutions to ``develop,
implement, and maintain a comprehensive information security program''
that includes appropriate administrative, technical, and physical
safeguards to achieve these objectives. \4\ This program is required to
be tailored to the institution's size and complexity, the nature and
scope of its activities, and the sensitivity of any customer
information at issue. \5\
---------------------------------------------------------------------------
\4\ 16 CFR 314.3(a).
\5\ See id.
---------------------------------------------------------------------------
In addition, a financial institution must designate an employee to
coordinate the program; identify reasonably foreseeable risks to the
security of the information and assess the sufficiency of safeguards;
and design, implement, and regularly test safeguards to protect against
such risks. \6\ Finally, the Safeguards Rule obligates financial
institutions to oversee their service providers' cybersecurity
practices, both by taking reasonable steps to ensure the institutions
only deal with service providers that employ strong security practices,
and by entering into contracts with such providers that require them to
implement appropriate safeguards. \7\
---------------------------------------------------------------------------
\6\ 16 CFR 314.4.
\7\ 16 CFR 314.4(d).
---------------------------------------------------------------------------
The FTC Act
Credit reporting companies are also subject to jurisdiction over
cybersecurity matters asserted by the FTC under Section 5 of the FTC
Act. \8\ Pursuant to this statute, the FTC is empowered to take action
against any business that engages in ``unfair or deceptive acts or
practices'' (UDAP), which the agency has interpreted to include
inadequate data security practices. \9\
---------------------------------------------------------------------------
\8\ 15 U.S.C. 45.
\9\ See id.; see also Cong. Res. Serv., ``The Federal Trade
Commission's Regulation of Data Security Under Its Unfair or Deceptive
Acts or Practices (UDAP) Authority'' (Sept. 11, 2014), https://fas.org/
sgp/crs/misc/R43723.pdf.
---------------------------------------------------------------------------
The FTC requires that a company employ safeguards for data that are
``reasonable in light of the sensitivity and volume of consumer
information it holds, the size and complexity of its data operations,
and the cost of available tools to improve security and reduce
vulnerabilities.'' \10\ While specific cybersecurity requirements under
Section 5 are not codified, the FTC has issued detailed guidance that
explains what it considers to be reasonable cybersecurity safeguards.
These include practices such as encryption, use of firewalls, use of
breach detection systems, maintaining physical security of objects that
contain sensitive information, and training employees to protect such
information. \11\ In addition to issuing detailed guidance, the FTC
zealously enforces these standards, having brought over 60 cases since
2002 against businesses for putting consumer data at ``unreasonable
risk.'' \12\
---------------------------------------------------------------------------
\10\ Fed. Trade Comm'n, Data Security (accessed Dec. 15, 2016),
https://www.ftc.gov/datasecurity.
\11\ See, e.g., Fed. Trade Comm'n, ``Protecting Personal
Information: A Guide for Business'' (Oct. 2016), https://www.ftc.gov/
tips-advice/business-center/guidance/protecting-personal-information-
guide-business.
\12\ See Fed. Trade Comm'n, ``Privacy and Data Security Update--
2016'' (Jan. 2017), https://www.ftc.gov/reports/privacy-data-security-
update-2016.
---------------------------------------------------------------------------
Fair Credit Reporting Act: Credentialing and Disposal Requirements
The Fair Credit Reporting Act (FCRA) requires that credit reporting
companies only provide credit reports to people with a permissible
purpose to receive such reports, such as credit or insurance
underwriting. More importantly, the law requires that every credit
reporting company maintain reasonable procedures designed to ensure
that credit reports are provided only to legitimate people for
legitimate purposes. These procedures must require that prospective
users of credit reports identify themselves, certify the purposes for
which the information is sought, and certify that the information will
be used for no other purpose. The FTC has brought numerous actions over
the years seeking to enforce these provisions, most notably against
ChoicePoint, which was alleged to have unwittingly sold credit reports
to a ring of identity thieves. In the ChoicePoint case, the FTC
collected millions of dollars in consumer redress and civil penalties,
including a $10 million civil penalty in connection with the
unauthorized disclosure of ``nearly 10,000 credit reports,'' which were
allegedly sold by ChoicePoint to persons without a permissible purpose.
\13\
---------------------------------------------------------------------------
\13\ See Fed. Trade Comm'n., ``ChoicePoint Settles Data Security
Breach Charges; To Pay $10 Million in Civil Penalties, $5 Million for
Consumer Redress'' (Jan. 26, 2006), https://www.ftc.gov/news-events/
press-releases/2006/01/choicepoint-settles-data-security-breach-
charges-pay-10-million.
---------------------------------------------------------------------------
The nationwide credit bureaus, and credit reporting companies
generally, take these ``credentialing'' responsibilities very
seriously. In addition, the nationwide credit bureaus have been
examined by the CFPB with respect to the strength and resiliency of
their credentialing procedures. As a part of their credentialing
procedures, credit reporting companies maintain detailed written
procedures which take into account the risks presented by prospective
users and their proposed uses of data. These procedures routinely
include:
site visits to ensure the premises are consistent with the
stated business of the prospective customer;
review of public information sources and public filings to
confirm licensure and good standing;
review of company websites and other public-facing
materials;
checking financial references, including credit reports of
owners for certain types of companies, such as those that are
not publicly traded;
specific and detailed contractual representations and
warranties, as well as specific certifications, that credit
report information will be used only for specified purposes;
detailed customer on-boarding and training procedures; and
ongoing monitoring of customers--including transaction
testing--to ensure that customers are in fact using credit
reports for legitimate and permissible purposes.
In addition to these credentialing requirements, the FCRA prohibits
credit reporting companies--and anyone else handling credit report
information--from disposing of that information in a manner that is not
secure. \14\ More specifically, the FTC has made a rule providing that
a person who maintains or otherwise possesses credit report
information, or information derived from credit reports, must properly
dispose of such information by taking reasonable measures to protect
against the unauthorized access to or use of the information in
connection with its disposal. \15\
---------------------------------------------------------------------------
\14\ See FCRA 628.
\15\ See 16 CFR 682.3.
---------------------------------------------------------------------------
State Law--State Attorney General Enforcement and Breach Notification
In addition to these Federal regulatory frameworks, credit
reporting companies also have numerous data security obligations under
State law. First, credit reporting companies may be subject to data
security enforcement of State ``mini-FTC Acts'' that prohibit unfair or
deceptive acts or practices. \16\ Further, at least 13 States require
businesses that own, license, or maintain personal information to
implement and maintain reasonable security procedures and practices and
to protect personal information from unauthorized access, destruction,
use, modification, or disclosure. \17\ The majority of States require
businesses to dispose of sensitive personal information securely. \18\
---------------------------------------------------------------------------
\16\ See, e.g., Xavier Becerra, Attorney General, Cal. Dep't of
Justice, Target Settles Record $18.5 Million Credit Card Data Breach
Case (May 23, 2017), https://oag.ca.gov/news/press-releases/attorney-
general-becerra-target-settles-record-185-million-credit-card-data.
\17\ See Nat'l Conf. of State Legis., Data Security Laws--Private
Sector (Jan. 16, 2017), http://www.ncsl.org/research/
telecommunications-and-information-technology/data-security-laws.aspx.
\18\ See Nat'l Conf. of State Legis., Data Disposal Laws (Dec. 1,
2016), http://www.ncsl.org/research/telecommunications-and-information-
technology/data-disposal-laws.aspx. At the Federal level, the FTC's
Disposal Rule regulates the proper disposal of consumer report
information. See 16 CFR pt. 682.
---------------------------------------------------------------------------
Moreover, nearly every U.S. State, the District of Columbia, and
several U.S. territories have enacted laws requiring notification to
affected individuals following a breach of personal information. \19\
These laws typically exempt institutions that are supervised by the
Federal prudential regulators. In contrast, credit reporting
companies--which are not supervised by the prudential regulators--must
comply with the patchwork of more than four dozen breach notification
laws if a breach does occur.
---------------------------------------------------------------------------
\19\ See Nat'l Conf. of State Legis., Security Breach Notification
Laws (Apr. 12, 2017), http://www.ncsl.org/research/telecommunications-
and-information-technology/security-breach-notification-laws.aspx.
---------------------------------------------------------------------------
Contractual Obligations Imposed Due to Other Regulatory Frameworks
Even beyond these direct legal requirements, the three nationwide
credit bureaus--Experian, Equifax, and Transunion--are also subject to
substantial additional requirements that result from doing business
with other major financial institutions. The information security
programs at many credit bureau customers are supervised by Federal
prudential regulators, i.e., the Federal Reserve, the Office of the
Comptroller of the Currency, the Federal Deposit Insurance Corporation,
or the National Credit Union Administration. Under comprehensive and
detailed information security standards published by the Federal
Financial Institutions Council (FFIEC)--an interagency body of
financial regulators--these financial institutions must oversee the
information security programs of their third-party service providers.
\20\ Pursuant to these FFIEC requirements, financial institutions and
their auditors subject the nationwide credit bureaus to dozens of
information security audits each year, many of which include on-site
inspections or examinations, which may take place over a period of
several days.
---------------------------------------------------------------------------
\20\ See FFIEC, IT Examination Handbook Infobase, Information
Security: Oversight of Third-Party Service Providers, https://
ithandbook.ffiec.gov/it-booklets/information-security/ii-information-
security-program-management/iic-risk-mitigation/iic20-oversight-of-
third-party-service-providers.aspx.
---------------------------------------------------------------------------
The Payment Card Industry Data Security Standard
The three nationwide credit bureaus also comply with the Payment
Card Industry Data Security Standard (PCI DSS). The PCI DSS is a set of
cybersecurity requirements that are mandatory for all organizations
that store, process, and transmit sensitive payment card information of
the major credit card associations. \21\ The standard requires credit
reporting companies to take a number of specific steps to ensure the
security of certain data. For example, the PCI DSS requires members to
install and maintain firewalls, encrypt the transmission of cardholder
data, protect against malware and implement and update anti-virus
programs, restrict both digital and physical access to cardholder data,
regularly test security systems and processes, and maintain a detailed
information security policy for all personnel. \22\ The standard
imposes further detailed and specific technical requirements for the
protection of cardholder data, such as a restriction on service
providers' storage of personal identification or card verification
numbers after card authorization. \23\ In addition, the standard
requires a service provider to ensure that any third parties with whom
it shares data also comply with the PCI DSS. \24\
---------------------------------------------------------------------------
\21\ Payment Card Industry Security Standards Council,
``Requirements and Security Assessment Procedures'', Version 3.2 (Apr.
2016).
\22\ Id. at 5.
\23\ See, e.g., id. at 38-39.
\24\ Id. at 12.
---------------------------------------------------------------------------
All three of the nationwide credit bureaus have been certified by
the card networks as ``PCI DSS Validated Service Providers,'' meaning
that they are approved to store, process and transmit cardholder data.
Service providers that store, process, or transmit cardholder data must
be registered with the card networks and demonstrate PCI DSS
compliance. PCI DSS compliance validation is required every 12 months
for all service providers. As an example, all three nationwide credit
bureaus are included on the Visa Service Provider Registry, indicating
that they have successfully validated PCI DSS compliance with an on-
site assessment, based on the report of an independent Qualified
Security Assessor (QSA), and have met all applicable Visa program
requirements. \25\
---------------------------------------------------------------------------
\25\ See, e.g., Visa Global Registry of Service Providers, https:/
/www.visa.com/splisting/index.html.
---------------------------------------------------------------------------
The Fair Credit Reporting Act and CFPB Supervision
Finally, I want to discuss the consumer protection regime that
applies to credit reporting companies under the FCRA. This regime has
persisted for nearly 50 years, with occasional fine tuning and two
significant revisions, in 1996 and 2003. In addition, in 2012, the CFPB
began supervising the credit reporting companies for, among other
things, compliance with the FCRA.
When the credit reporting industry first began in the United
States, there was little standardization in the methods used and types
of data collected. In particular, there was no standard procedure for
consumers to find out what was in their credit report and to have
erroneous information corrected. In response to these concerns, in 1970
Congress passed the FCRA, which imposed duties on credit reporting
companies (referred to as ``consumer reporting agencies'' under the
statute). \26\ These duties included providing consumers transparency
by requiring lenders and other users of credit reports to notify
consumers when they take ``adverse action'' based on a credit report,
providing consumers with access to their file, and providing for a
mechanism for consumers to dispute and correct inaccurate or incomplete
information.
---------------------------------------------------------------------------
\26\ See ``Fair Credit Reporting Act: How It Functions for
Consumers and the Economy'', Hearing Before the Subcomm. on Financial
Institutions and Consumer Credit of the H. Comm. on Financial Services,
108th Cong. 129 (2003) (prepared statement of the Federal Trade
Commission).
---------------------------------------------------------------------------
Building on the core structure of the FCRA, Congress revised the
statute in 1996. One of the most important revisions was to impose a
set of duties, not just on the credit reporting companies themselves,
but on those businesses that furnished the information to the credit
bureaus in the first place. \27\ In 2003, again building on the FCRA's
core structure, Congress again modified the FCRA through the Fair and
Accurate Credit Transactions Act, which added certain consumer
protections such as free annual credit reports and new protections for
identity theft victims. \28\
---------------------------------------------------------------------------
\27\ See, e.g., ``Amending Fair Credit Reporting Act'', Sen. Comm.
on Banking, Housing, and Urban Aff's, S. Rept. 108-166 (Oct. 17, 2003).
\28\ See FCRA 609(e).
---------------------------------------------------------------------------
Under the FCRA, credit reporting companies are subject to a
comprehensive regulatory regime that provides many protections to
consumers. A number of these provisions are designed to protect
consumer privacy, such as the aforementioned permissible purpose and
credentialing requirements. The FCRA also includes criminal penalties
for people who obtain credit reports under false pretenses or credit
reporting companies that knowingly provide credit reports to persons
not authorized to receive them, for example, by selling consumers'
private information to a litigation opponent or an ex-spouse hoping to
find embarrassing information. To further ensure consumer privacy is
protected, as I discussed before, credit reporting companies must
``credential'' users of their consumer reports to confirm they in fact
have a permissible purpose to obtain the reports. \29\
---------------------------------------------------------------------------
\29\ See FCRA 607(a).
---------------------------------------------------------------------------
Many of the provisions also address the accuracy and completeness
of consumer reports. The most basic of these protections is the
consumer's right to know what is in his or her file. \30\ The 2003
amendments to the FCRA additionally required nationwide credit bureaus
and nationwide specialty credit bureaus to provide consumers with free
annual disclosures of the information in their file, including through
an official website, www.annualcreditreport.com. Further, when a user
of a consumer report takes ``adverse action'' against a consumer on the
basis of information in his or her credit report, that user must
provide the consumer with a notice that contains information about how
the consumer can obtain a copy of his or her credit report and can get
errors corrected. \31\ For example, if a lender denies a consumer's
application because of a low credit score, the lender must provide the
consumer with a notice of adverse action. In addition, consumers have
the right to dispute the contents of their file, and the credit
reporting company is obligated to conduct a reasonable investigation of
the dispute. \32\ Credit reporting companies must also independently
employ reasonable procedures to maintain the maximum possible accuracy
of the information in consumer files. \33\
---------------------------------------------------------------------------
\30\ See FCRA 609.
\31\ See FCRA 615(a).
\32\ See FCRA 611.
\33\ See FCRA 607(b).
---------------------------------------------------------------------------
Finally, in 2012, the CFPB became the first supervisor of the
national credit reporting system--the first regulator with examination
authority over the credit reporting companies, the users of credit
reports, and the companies that furnish information into the credit
reporting companies for incorporation into credit reports. \34\ Since
the CFPB formalized its supervisory authority in January 2012, the
nationwide credit bureaus have been subject to essentially continuous
examination cycles, where they have been examined for the adequacy of
their compliance management systems, their dispute handling procedures,
their procedures to ensure the maximum possible accuracy of credit
reports, their credentialing procedures, and other important and highly
regulated functions. In this supervisory role, the CFPB examines the
policies, procedures, controls, and practices of credit reporting
companies. The companies expend substantial resources responding to
examiner requests and must maintain transparency with their examiners.
If the examiners discover any areas in which a credit reporting company
is not living up to its obligations, the CFPB can resolve the issue
through the supervisory process, or, if the issue is sufficiently
serious, choose to bring a public enforcement action. The Bureau
recently opined on the success of this regime, concluding that it had
produced a ``proactive approach to compliance management'' that ``will
reap benefits for consumers--and the lenders that use consumer
reports--for many years to come.'' \35\
---------------------------------------------------------------------------
\34\ The CFPB has supervisory authority over ``larger
participants'' in the consumer reporting industry, which are defined in
12 CFR 1090.104.
\35\ See CFPB, Supervisory Highlights: Consumer Reporting Special
Edition, Winter 2017 3 (Mar. 2017), http://files.consumerfinance.gov/f/
documents/201703_cfpb_Supervisory-Highlights-Consumer-Reporting-
Special-Edition.pdf.
---------------------------------------------------------------------------
Thank you again for the opportunity to testify before you today. I
am happy to answer any questions.
______
PREPARED STATEMENT OF MARC ROTENBERG
President, Electronic Privacy Information Center
October 17, 2017
Mister Chairman and Members of the Committee, thank you for the
opportunity to testify today concerning consumer data security and the
credit bureaus. My name is Marc Rotenberg. I am President of the
Electronic Privacy Information Center (EPIC). EPIC is an independent
nonprofit research organization in Washington, DC, established in 1994
to focus public attention on emerging privacy and civil liberties
issues. I have also taught information privacy law at Georgetown
University Law Center since 1990 and I am the author of several leading
books on privacy law. \1\ I testified before this Committee in 2011
following the spate of data breaches in the financial services sector.
\2\ And in a recent article for the Harvard Business Review, I outlined
several steps that Congress could take in response to the Equifax data
breach. \3\
---------------------------------------------------------------------------
\1\ Anita Allen and Marc Rotenberg, ``Privacy Law an Society''
(West 2016); Marc Rotenberg, ``The Privacy Law Sourcebook: United
States Law'', International Law, and Recent Developments (Epic 2016);
Marc Rotenberg, Et al., ``Privacy and the Modern Age: The Search for
Solutions'' (The New Press 2015).
\2\ ``Cybersecurity and Data Protection in the Financial Services
Sector'', Hearing Before the S. Comm. on Banking, Housing, and Urban
Affairs, 112th Cong. (2011) (statement of Marc Rotenberg, Exec. Dir.,
EPIC), https://epic.org/privacy/testimony/
EPIC_Senate_Banking_Testimony%20_6_21_11.pdf.
\3\ Marc Rotenberg, ``Equifax, the Credit Reporting Industry, and
What Congress Should Do Next'', Harv. Bus. Rev. (Sept. 20, 2017),
https://hbr.org/2017/09/equifax-the-credit-reporting-industry-and-what-
congress-should-do-next.
---------------------------------------------------------------------------
I will say at the outset that the Equifax data breach is one of the
most serious in the Nation's history, on par with the breach at the
Office of Personnel Management in 2015 that impacted 22.5 million
Federal employees, their friends and family members. The Equifax breach
poses enormous challenges to the security of American families, as well
as our countries national security. Privacy, more precisely described
as ``data protection,'' is no longer simply about the concern that
large companies misuse personal data. Today our country is facing
cyberattacks from foreign adversaries and it is the personal data
stored by companies that is the target. When these companies engage in
lax security practices or freely disclose consumer data without
consent, they are placing not only consumers, but also our Nation at
risk.
There is no simple solution to these challenges, but in my
testimony today I will outline the steps that I believe Congress could
take to minimize the risk flowing from this breach and address the risk
of future breaches in the data broker industry. In brief, current laws
do not protect consumers. Legislation should (1) give consumers greater
control of their personal data held by others; (2) limit the use of the
Social Security Number in the private sector; (3) minimize the
collection of personally identifiable information; (4) improve breach
notification; and (5) change the defaults in the credit reporting
industry with (a) default credit ``freezes'' that give consumers opt-in
control over the release of their credit report, (b) free, routine
monitoring services, and (c) free access at any time for any purpose to
a consumer who wants to see the complete contents of a credit report or
other similar information product made available for sale.
I. The Implications of the Equifax Breach
A. This Breach Was Unprecedented in Scope
The Equifax data breach is one of the most significant in the
history of the United States. Over 145 million American consumers were
impacted. \4\ More than four months passed from the time the Equifax
failed to install critical software updates till the time the time the
problem was addressed. And the data that was disclosed is precisely the
information that individuals rely upon to open bank accounts, get car
loans, seek employment, buy cell phones, and even issue checks online.
The data included:
---------------------------------------------------------------------------
\4\ Equifax, ``Equifax Announces Cybersecurity Incident Involving
Consumer Information'' (Sept. 7, 2017), https://investor.equifax.com/
tools/viewpdf.aspx.
---------------------------------------------------------------------------
Names
Social Security Numbers
Birth Dates
Addresses, and
Driver's License Numbers. \5\
---------------------------------------------------------------------------
\5\ Id.
This data is a gold mine for identity thieves. The widespread
availability of this personal data poses an ongoing risk to American
families and creates problems for those who suffer identity theft that
will take months, if not years, to resolve.
The Equifax breach also has implications for U.S. trade relations.
According to the Canadian Broadcast Corporation, the data of 100,000
Canadians was seized in the breach. \6\ The British Broadcasting
Corporation reported that 400,000 U.K. consumers were affected by the
Equifax breach. \7\ Equifax has since stated that 15,200,000 million
U.K. consumers were impacted by the breach. \8\ And all of this at a
time when foreign Government are carefully scrutinizing U.S. data
protection to determine to determine whether it is safe to transfer
personal data to the United States. Equifax has given other countries
good reason to fear their data being entrusted to U.S. companies. That
could harm U.S. trade.
---------------------------------------------------------------------------
\6\ Matthew Braga, ``100,000 Canadian Victims: What We Know About
the Equifax Breach--And What We Don't'', CBC News (Sept. 19, 2017),
http://www.cbc.ca/news/technology/equifax-canada-breach-sin-
cybersecurity-what-we-know-1.4297532.
\7\ ``Equifax Says Almost 400,000 Britons Hit in Data Breach'',
BBC News (Sept. 15, 2017), http://www.bbc.com/news/technology-41286638.
\8\ Equifax, Equifax Ltd (U.K.): ``Update Regarding the Ongoing
Investigation Into Us Cybersecurity Incident'' (Oct. 10, 2017), https:/
/www.equifax.co.uk/about-equifax/press-releases/en_gb/-/blogs/equifax-
ltd-uk-update-regarding-the-ongoing-investigation-into-us-cyber-
security-incident.
---------------------------------------------------------------------------
B. Equifax Was at Fault
Equifax is clearly responsible this breach. The company was
notified of the vulnerability in its software but failed to make the
required fixes. Hackers accessed the Equifax database by exploiting a
known security vulnerability. \9\ The Apache Software Foundation issued
a statement in March announcing the vulnerability, and the patch was
made available the same day. \10\ The Department of Homeland Security
also contacted the three credit reporting agencies back in March to
notify them of the vulnerability. Yet Equifax left the vulnerability
unpatched until July 29. By that time the attackers had already seized
millions of records over several months.
---------------------------------------------------------------------------
\9\ The Apache Software Foundation Blog, ``MEDIA ALERT: The Apache
Software Foundation Confirms Equifax Data Breach Due to Failure to
Install Patches Provided for Apache' StrutsTM
Exploit'' (Sept. 14, 2017), https://blogs.apache.org/foundation/entry/
media-alert-the-apache-software.
\10\ Id.
---------------------------------------------------------------------------
It is also worth emphasizing that Equifax chose to collect this
data on American customers--American consumers did not choose to
provide their personal data to Equifax. Also, Equifax pursued a
security strategy that allowed a single point of failure to permit the
breach of more than half of the Nation's credit reports.
Equifax's response to the breach also demonstrated the company's
incompetence and indifference to data security. Equifax created a
separate domain--``equifaxsecurity2017.com''--where consumers were
required to enter their name and the last six digits of their social
security number to find out if their information was compromised. The
domain was not registered to Equifax and was running on WordPress,
causing many browsers to flag it as a phishing threat.
To demonstrate how easily this domain could be spoofed, a developer
bought the domain ``securityequifax2017.com'' and made it look exactly
like the real Equifax support page. \11\ The Equifax even tweeted a
link of the fraudulent website, thinking it was their own.
---------------------------------------------------------------------------
\11\ Alfred NG, ``Equifax Sends Breach Victims to Fake Support
Site'', CNET (Sept. 20, 2017), https://www.cnet.com/news/equifax-
twitter-fake-support-site-breach-victims/.
---------------------------------------------------------------------------
Security researchers later discovered that Equifax's website has
also been hacked, and contained false Adobe Flash download links that
trick users into downloading malware that displays unwanted ads online.
\12\ Furthermore, consumers who contacted Equifax to freeze their
credit were given PINs to use when they wanted to unfreeze their
credit. These pins were based on the time and date of the freeze,
making them easier to guess. \13\ These actions after the breach reveal
how poorly prepared the company was to assist consumers. The company's
efforts to mitigate damage caused by the breach have exposed millions
of Americans to even more risk.
---------------------------------------------------------------------------
\12\ Dan Goodin, ``Equifax Website Borked Again, This Time To
Redirect to Fake Flash Update'', ArsTechnica (Oct. 12, 2017), https://
arstechnica.com/information-technology/2017/10/equifax-website-hacked-
again-this-time-to-redirect-to-fake-flash-update/.
\13\ Ron Lieber, ``After Equifax, Here's Your Next Worry: Weak
PINs'', N.Y. Times (Sept. 10, 2017), https://www.nytimes.com/2017/09/
10/your-money/identity-theft/equifax-breach-credit-
freeze.html?rref=collection%2Fbyline%2Fron-lieber.
---------------------------------------------------------------------------
C. Equifax Breach Increases the Likelihood of Identity Theft in the
United States
The Equifax breach will cause unprecedented harm to consumers. When
hackers get access to credit card numbers they can rack up fraudulent
charges, but consumers are able to cancel their credit cards and get
new numbers. By contrast, consumers cannot change their social security
numbers or dates of birth. Equifax's victims are exposed to ongoing
identity theft and fraud, and the full effects of the damage will not
be known for years.
Identity theft is an enormous problem for consumers. The Federal
Trade Commission reported 399,225 cases of identity theft in the United
States in 2016. \14\ Of that number, 29 percent involved the use of
personal data to commit tax fraud. More than 32 percent reported that
their data was used to commit credit card fraud, up sharply from 16
percent in 2015. A 2015 report from the Department of Justice found
that 86 percent of the victims of identity theft experienced the
fraudulent use of existing account information, such as credit card or
bank account information. \15\ The same report estimated the cost to
the U.S. economy at $15.4 billion.
---------------------------------------------------------------------------
\14\ Fed. Trade Comm'n, ``FTC Releases Annual Summary of Consumer
Complaints'' (March 3, 2017), https://www.ftc.gov/news-events/press-
releases/2017/03/ftc-releases-annual-summary-consumer-complaints.
\15\ Erika Harrell, ``Bureau of Justice Statistics, Victims of
Identity Theft'', 2014 (Sept. 27, 2015), https://www.bjs.gov/
index.cfm?ty=pbdetail&iid=5408.
---------------------------------------------------------------------------
Identity theft can completely derail a person's financial future.
Criminals who have gained access to others' personally identifiable
information can open bank accounts and credit cards, take out loans,
and conduct other financial activities using someone else's identity.
Identity theft has severe consequences for consumers, including: \16\
---------------------------------------------------------------------------
\16\ Identity Theft Resource Center, ``Identity Theft: The
Aftermath 2017'', http://www.idtheftcenter.org/images/page-docs/
Aftermath2017Finalv1.pdf.
---------------------------------------------------------------------------
Being denied of credit cards and loans
Being unable to rent an apartment or find housing
Paying increased interest rates on existing credit cards
Having greater difficulty getting a job
Suffering severe distress and anxiety
II. The Equifax Breach Underscores the Need for Reform
The credit reporting industry is in urgent need of reform. An
industry that collects the most sensitive data of Americans and has
such a great impact on the U.S. economy must use state of the art
security measures and must give consumer control over the personal
data. Instead, credit bureaus cut corners on security, capture the
upside value of selling credit reports, and transfer the risk to
consumers for breaches and errors. As companies increasingly rely on
complex consumer profiling techniques, credit bureaus have amassed vast
amounts of personal data. Without comprehensive legislation, the data
breach problem will only get worse.
A. Data Breaches Are an Epidemic in the United States
The scope of the data breach problem extends well beyond Equifax.
Data breaches are occurring more frequently across a number of
industries. According to the Identity Theft Resource Center, data
breaches in the United States increased by 40 percent in 2016 to a
record high of 1,093. \17\ As companies collect more data, the risk of
identity theft is almost certain to increase.
---------------------------------------------------------------------------
\17\ Identity Theft Resource Center, ``Data Breaches Increase 40
Percent in 2016, Finds New Report'' (Jan. 19, 2017), http://
www.idtheftcenter.org/2016databreaches.html.
The 2013 Yahoo breach, in which hackers stole names, birth
dates, phone numbers, and passwords, is now estimated to have
impacted all 3 billion users, making it the largest data breach
on record. \18\
---------------------------------------------------------------------------
\18\ Nicole Pelroth, ``All 3 Billion Yahoo Accounts Were Affected
by 2013 Attack'', New York Times (Oct. 3, 2017), https://
www.nytimes.com/2017/10/03/technology/yahoo-hack-3-billion-users.html.
In 2015, a data breach at the Office of Personnel
Management compromised the personal data, including biometric
identifiers, of more than 20 million people, many of them with
security clearances. \19\
---------------------------------------------------------------------------
\19\ Ellen Nakashima, ``Hacks of OPM Databases Compromised 22.1
Million People, Federal Authorities Say'', Wash. Post (Jul. 9, 2015),
https://www.washingtonpost.com/news/federal-eye/wp/2015/07/09/hack-of-
security-clearance-system-affected-21-5-million-people-federal-
authorities-say/.
Recent data breaches have affected Chipotle, Home Depot,
and Target, impacting over 100 million stolen credit card
numbers combined. \20\
---------------------------------------------------------------------------
\20\ Lisa Baertlein, ``Chipotle Says Hackers Hit Most Restaurants
In Data Breach'', Reuters (May 26, 2017), https://www.reuters.com/
article/us-chipotle-cyber/chipotle-says-hackers-hit-most-restaurants-
in-data-breach-idUSKBN18M2BY; Robin Sidel, ``Home Depot's 56 Million
Card Breach Bigger Than Target's'', Wall Street J. (Sep. 18, 2014),
https://www.wsj.com/articles/home-depot-breach-bigger-than-targets-
1411073571; ``Target: 40 Million Credit Cards Compromised'', CNN (Dec.
19, 2013), http://money.cnn.com/2013/12/18/news/companies/target-
credit-card/index.html.
Data breaches have also impacted large banks, educational
institutions, health care providers, and many other businesses.
\21\
---------------------------------------------------------------------------
\21\ Greg Farrell and Patricia Hurtado, ``JPMorgan's 2014 Hack
Tied to Largest Cyber Breach Ever'', Bloomberg (Nov. 10, 2015), https:/
/www.bloomberg.com/news/articles/2015-11-10/hackers-accused-by-u-s-of-
targeting-top-banks-mutual-funds; Brendan Pierson, ``Anthem To Pay
Record $115 Million To Settle U.S. Lawsuits Over Data Breach'', Reuters
(June 23, 2017), https://www.reuters.com/article/us-anthem-cyber-
settlement/anthem-to-pay-record-115-million-to-settle-u-s-lawsuits-
over-data-breach-idUSKBN19E2ML; UMD Data Breach, University of
Maryland, http://www.umd.edu.datasecurity/.
Data breaches in the credit reporting industry pose an enormous
threat to consumers. Credit reporting agencies maintain an
extraordinary amount of personal data, including Social Security
numbers, birthdates, home addresses, telephone numbers, and driver's
license records--information that is the holy grail for identity
thieves.
B. Consumers Lack Control Over Their Credit Reports
Despite these risks, consumers cannot protect themselves. The
relationship between the credit reporting industry and the consumer is
skewed. The industry was built to serve the companies that collect and
use consumer information and not the consumers themselves. Businesses
have easy access to credit reports while consumers do not. By law,
consumers are entitled to only one free credit report per year, and the
process of obtaining one is cumbersome. \22\ Consumers have no control
over what information credit reporting agencies collect. Information is
often out of date, incomplete, or inaccurate, and it is often
impossible for consumers to correct inaccurate information. \23\
Consumers are then wrongfully denied jobs, housing, and credit as a
result. In these circumstances, consumers are almost always left in the
dark about how their data was used.
---------------------------------------------------------------------------
\22\ Fed. Trade Comm'n., Free Credit Reports, March 2013, https://
www.consumer.ftc.gov/articles/0155-free-credit-reports.
\23\ Id.
---------------------------------------------------------------------------
Under current law and industry practices, when data breaches occur,
consumers bear the burden. Consumers only learn of the breach once the
company decides to notify the public, and then must take costly steps
to obtain a credit freeze or credit monitoring services. \24\ And
because consumers cannot choose which companies collect their data,
they have no control over how vulnerable their information is to
identity thieves. In sum, the current model is broken, and only
Congress can fix it. \25\
---------------------------------------------------------------------------
\24\ Fed. Trade Comm'n, Credit Freeze FAQs (2017), https://
www.consumer.ftc.gov/articles/0497-credit-freeze-faqs.
\25\ Bruce Schneier, ``Don't Waste Your Breath Complaining to
Equifax About Data Breach'', CNN, Sep. 11, 2017, http://www.cnn.com/
2017/09/11/opinions/dont-complain-to-equifax-demand-government-act-
opinion-schneier/index.html.
---------------------------------------------------------------------------
C. Consumer Profiling Is Growing More Complex and Lacks Transparency
An invisible system of consumer profiling has emerged. \26\ We now
face the specter of a ``scored society'' where consumers do not have
access to the most basic information about how they are evaluated. \27\
Data brokers now use secret algorithms to build profiles on every
American citizen whether they have allowed their personal data to be
collected or not. \28\ These secret algorithms can be used to determine
the interest rates on mortgages and credit cards, raise consumers'
insurance rates, or even deny people jobs. \29\ Data brokers even
scrape social media and score consumers based on factors such as their
political activity on Twitter. \30\
---------------------------------------------------------------------------
\26\ Id.
\27\ Danielle Keats Citron and Frank Pasquale, ``The Scored
Society: Due Process for Automated Predictions'', 89 Wash. L. Rev. 1
(2014).
\28\ Id.
\29\ ``Exploring the Fintech Landscape'', Hearing Before the S.
Comm. on Banking, Housing, and Urban Affairs, 115th Cong. 7 (2017)
(written testimony of Frank Pasquale, Professor of Law, University of
Maryland).
\30\ Id.
---------------------------------------------------------------------------
In one recent complaint to the Federal Trade Commission, EPIC
highlighted the practice of the secret scoring of young athletes. \31\
It may seem to odd to think that an activity such as high school
athletics is now being taken over by proprietary algorithms, but that
is in fact the case. Once you could say that a runner completed a mile
in 4:28, a high school basketball player shot 92 percent from the line,
or a softball player hit .352 for the season. Now it is the secret
scoring of young athletes that could determine their future.
---------------------------------------------------------------------------
\31\ EPIC, ``EPIC Asks FTC To Stop System for Secret Scoring of
Young Athletes'' (May 17, 2017), https://epic.org/2017/05/epic-asks-
ftc-to-stop-system-f.html.
---------------------------------------------------------------------------
Determinations about whether we get a job, a home, or an athletic
scholarship should not be left to the ``secret judgments of software,''
especially when this type of machine learning can lead to
discrimination. \32\ We not only lack knowledge of the methods being
used to score us, but we do not even know what underlying information
about us is being collected. For example, EPIC just filed an amicus
brief in a case involving a company that scrapes data from user
profiles on LinkedIn to create scores to evaluate ``flight risk.'' \33\
The consumer scoring industry--not just the credit reporting agencies--
needs oversight, accountability, and transparency. \34\
---------------------------------------------------------------------------
\32\ Frank Pasquale, The Black Box Society 8 (2015); Citron and
Pasquale, supra.
\33\ EPIC, hiQ Labs, Inc. v. LinkedIn Corp., https://epic.org/
amicus/cfaa/linkedin/.
\34\ Citron and Pasquale, supra, at 5.
---------------------------------------------------------------------------
III. Next Steps To Protect Consumers Following the Equifax Breach
In the wake of the Equifax breach, immediate action should be taken
to reform not only the credit reporting industry, but also to address
the broader problem of secret profiling and mishandling of consumers'
personal data. It is time to change the defaults and time to put
consumers back in control of both their credit reports and their
personal information. Consumers must have free and easy access to their
credit information, and control over when and how that information is
disclosed. Companies collecting consumers' personal data must establish
effective safeguards, including requirements for prompt disclosure of
any data breach. Congress should end the use of the social security
number as a general-purpose identifier. And Congress should promote the
use of innovative technology to minimize the collection of personal
data.
A. Reform the Industry by Giving Consumers Control Over Their Credit
Reports
The essential problem with the credit reporting industry is that it
does not work. Consumers have no control over the collection and use of
their credit reports and bear all the risk when credit reporting
agencies mishandle their personal information. Data brokers operate in
the shadows and consumers are left in the dark. That structure is
backward. Consumers should have free access to their credit information
and, by default, no credit report should be released to a third party
without the consumer's express authorization.
There are already several commonsense proposals that the Congress
should enact into law:
Free Credit ``Freezes'' and ``Thaws'' (Change the Default for
Report Disclosure to ``Opt-in'')
Credit reporting agencies should change the default on access to
credit reports by third parties. Instead of the current setting, which
allows virtually anyone to pull someone's credit report, credit
reporting agencies should establish a credit freeze for all
disclosures, with free and easy access for consumers who wish to
disclose their report for a specific purpose. A credit freeze is one of
the only mechanisms available to prevent ``new account identity theft''
before it happens. \35\ But only four States (Indiana, Maine, North
Carolina, and South Carolina) mandate free consumer access to credit
freezes and thaws, while four additional States ``provide free freezes
but charge for thaws.'' \36\ This means that ``[a]pproximately 158
million consumers between 18-65 in 42 States and D.C. must pay a fee to
get credit freezes.'' \37\
---------------------------------------------------------------------------
\35\ See U.S. PIRG, ``Security Freeze and Identity Theft Tips'',
http://uspirg.org/sites/pirg/files/resources/
Security%20Freeze%20and%20Identity%20Theft%20Tips.pdf.
\36\ U.S. PIRG, ``Interactive Map Shows Consumers in 42 States
Have No Access to Free Credit Freezes'' (Oct. 2, 2017), https://
uspirg.org/news/usp/interactive-map-shows-consumers-42-states-have-no-
access-free-credit-freezes.
\37\ Id.
---------------------------------------------------------------------------
Provide Free Monitoring and Easy Access to Credit History
Current laws allow consumers access to free credit reports, but the
process is cumbersome, and few consumers take advantage. A rationalized
market would help ensure that consumers have as much information as
possible about the use of their personal data by others. Instead,
Equifax and other credit reporting agencies profit from the very
problems they create. The Consumer Financial Protection Bureau also
fined Equifax and TransUnion earlier this year after finding that the
companies ``lured consumers into costly recurring payments for credit-
related products with false promises.'' \38\ Credit reporting agencies
should provide life-long credit monitoring services to consumers at no
cost. Some credit card companies already offer similar services for
free. \39\ The credit other reporting agencies should do so as well.
---------------------------------------------------------------------------
\38\ Consumer Fin. Prot. Bureau, ``CFPB Orders TransUnion and
Equifax to Pay for Deceiving Consumers in Marketing Credit Scores and
Credit Products'' (Jan. 3, 2017), https://www.consumerfinance.gov/
about-us/newsroom/cfpb-orders-transunion-and-equifax-pay-deceiving-
consumers-marketing-credit-scores-and-credit-products/.
\39\ See, e.g., Discover, Social Security Alerts (2017), https://
www.discover.com/credit-cards/member-benefits/security/ssn-newaccount-
alerts/.
---------------------------------------------------------------------------
Mandatory Disclosure of Secret Scores and Algorithms
Congress should move quickly to address the risks to consumers in
the credit reporting industry. But the problems in the credit reporting
industry arise in other industries. We face the specter of a ``scored
society'' where consumers don't have access to the most basic
information about how they are evaluated. \40\ ``Algorithmic
transparency'' is key to accountability. \41\ Absent rules requiring
the disclosure of these secret scores, lists, and the underlying data
and algorithms upon which they are based, consumers will have no way to
even know, let alone solve, these problems.
---------------------------------------------------------------------------
\40\ Id.
\41\ EPIC, ``Algorithmic Transparency'', https://epic.org/
algorithmic-transparency/.
---------------------------------------------------------------------------
B. Improve Breach Notification
The epidemic of data breaches, and failure of companies to be held
accountable, cannot continue. Identity theft has reached an
unprecedented level, yet the companies that amass troves of personal
data expect consumers to bear the costs of breaches. After a data
breach occurs, companies such as Equifax urge consumers to check a
website to find out whether they were affected. \42\ But even these
vague warnings come weeks or months after the breach has occurred. \43\
That is not a workable business response or sensible public policy.
---------------------------------------------------------------------------
\42\ These post-breach websites can also create new risks to
consumers. See, e.g., Merrit Kennedy, ``After Massive Data Breach,
Equifax Directed Customers to Fake Site'', NPR (Sept. 21, 2017), http:/
/www.npr.org/sections/thetwo-way/2017/09/21/552681357/after-massive-
data-breach-equifax-directed-customers-to-fake-site.
\43\ See, e.g., Michael Hiltzik, ``Here Are All The Ways The
Equifax Data Breach Is Worse Than You Can Imagine'', L.A. Times (Sept.
8, 2017), http://www.latimes.com/business/hiltzik/la-fi-hiltzik-
equifax-breach-20170908-story.html.
---------------------------------------------------------------------------
It has become clear that these companies cannot effectively police
themselves. Congress should set national, baseline standards to limit
the damage caused by data breaches.
Federal Baseline Data Breach Notification Standard
At a bare minimum, the Equifax breach underscores the need for a
baseline Federal data breach notification standard for all companies
that store personal information. \44\ The only Federal law with a
breach notification rule is the Health Insurance Portability and
Accountability Act, which only applies to protected health information.
\45\ Florida currently has one of the most comprehensive data breach
laws, providing a mandatory 30-day notification rule, a broad scope,
and proactive requirements for reasonable data protection measures.
\46\ A Federal baseline notification standard should go even further,
requiring immediate and efficient notification of impacted consumers,
regulators, and the public. \47\ Companies are increasingly interacting
with consumers on social media and via automated text and email
messages, so it is reasonable to expect that companies can notify
consumers within 48-72 hours of a breach.
---------------------------------------------------------------------------
\44\ There are currently breach notification laws in ``[f]orty-
eight States, the District of Columbia, Guam, Puerto Rico and the
Virgin Islands.'' Nat'l Conference of State Legislators, Security
Breach Notification Laws (Apr. 12, 2017), http://www.ncsl.org/research/
telecommunications-and-information-technology/security-breach-
notification-laws.aspx#1. See also Steptoe and Johnson LLP,
``Comparison of U.S. State and Federal Security Breach Notification
Laws'' (Sept. 1, 2017), https://www.steptoe.com/assets/htmldocuments/
SteptoeDataBreachNotification
Chart2017.pdf.
\45\ 45 CFR 164.400-414. See Steptoe, supra at 202-08. The
Gramm-Leach-Bliley Act ``Interagency Guidelines'' also discuss consumer
notice, but the rules do not contain a requirement that notice be given
within a specific time period. See 12 CFR pt. 224, app. F (Supp. A
2014); 70 FR 15,736 (2005).
\46\ EPIC, State Data Breach Notification Policy (2017), https://
epic.org/state-policy/data-breach/.
\47\ ``Discussion Draft of H.R.----, A Bill to Require Greater
Protection for Sensitive Consumer Data and Timely Notification in Case
of Breach'', Hearing before the Subcomm. on Commerce, Manufacturing,
and Trade of the H. Comm. on Energy and Commerce, 112th Cong.
(testimony and statement for the record of Marc Rotenberg, Exec. Dir.,
EPIC) https://epic.org/privacy/testimony/
EPIC_Testimony_House_Commerce_6-11_Final.pdf; see also ``H.R. 2221, the
Data Accountability and Trust Act and H.R. 1319, the Informed P2P User
Act'', Hearing before the Subcomm. on Commerce, Trade, and Consumer
Prot. of the H. Comm. on Energy and Commerce, 111th Cong. (2009)
(testimony and statement for the record of Marc Rotenberg, Exec. Dir.,
EPIC), https://epic.org/linkedfiles/rotenberg_house_ctcp2221_1319.pdf.
---------------------------------------------------------------------------
Reasonable Data Security Measures
Prompt breach notifications are necessary to ensure that consumers
and regulators can quickly deal with a data breach after it happens.
But more needs to be done to prevent these breaches from happening in
the first place. For example, the Florida Information Protection Act
requires that companies collecting consumer data ``take reasonable
measures to protect and secure data in electronic form containing
personal information.'' \48\ Companies that collect and store sensitive
consumer data are in the best position to prevent data breaches, and
they should be held liable when they fail to adopt reasonable security
measures. \49\ This is especially important because the Equifax hack
and other major data breaches caused by known vulnerabilities are
entirely preventable. \50\
---------------------------------------------------------------------------
\48\ Fla. Stat. 501.171(2) (2017). See EPIC, ``State Data Breach
Notification Policy'' (2017).
\49\ Brief of Amicus Curiae EPIC in Support of Appellants, Storm
v. Paytime, No. 15-3690, at 25-30 (3d Cir. filed Apr. 18, 2016),
https://epic.org/amicus/data-breach/storm/EPIC-Amicus-Storm-
Paytime.pdf.
\50\ See Lily Hay Newman, ``Equifax Officially Has No Excuse'',
Wired (Sept. 14, 2017), https://www.wired.com/story/equifax-breach-no-
excuse/.
---------------------------------------------------------------------------
Elimination of Consumer Arbitration Waivers
The most effective way to improve data security is to establish a
private right of action for consumers who have suffered a breach of
their personal data. This provides a specific remedy for a specific
harm. But Equifax did the exact opposite. In response to the data
breach, the company tried to trick consumer into an arbitration
agreement, guaranteeing that there would be few legal remedies for
consumers following the breach. \51\ The Consumer Financial Protection
Bureau (CFPB) recently banned arbitration clauses in consumer financial
contracts because class action waivers make it prohibitive for any
consumers to obtain relief. \52\ Credit reporting agencies and other
financial institutions should be prohibited from using these
arbitration agreements to block consumer actions for breach, improper
disclosure, or misuse of their personal data. And a breach of personal
data should be sufficient harm to provide a cause of action.
---------------------------------------------------------------------------
\51\ Equifax is the most recent, but not the only, company guilty
of forcing consumers into arbitration against their interests. See
David Lazarus, ``The Real Outrage Isn't Equifax's Arbitration Clause--
It's All The Others'', L.A. Times (Sept. 12, 2017), http://
www.latimes.com/business/lazarus/la-fi-lazarus-equifax-arbitration-
clauses-20170912-story.html.
\52\ 12 CFR 1040; Consumer Fin. Prot. Bureau, ``CFPB Study Finds
That Arbitration Agreements Limit Relief For Consumers'' (Mar. 10,
2015) https://www.consumerfinance.gov/about-us/newsroom/cfpb-study-
finds-that-arbitration-agreements-limit-relief-for-consumers/.
---------------------------------------------------------------------------
Expansion of Gramm-Leach-Bliley Security Rules
The existing data security requirements for consumer-facing
financial institutions should extend to credit reporting agencies and
other companies that sell consumer profiles. The Gramm-Leach-Bliley Act
already provides for oversight of financial institutions' privacy
practices by seven regulatory agencies, but the current regime fails to
address credit reporting agencies. \53\ Specifically, although the
Dodd-Frank Act transferred authority over certain privacy provisions to
the CFBP, the law did not transfer regulatory authority to establish
data security guidelines. \54\ As it stands, the CFPB can only bring
enforcement actions based on a company's affirmative misrepresentations
about data security practices. \55\ Given that credit reporting
agencies hold more sensitive personal data than many of the other
financial institutions combined, it makes little sense for those
companies to be exempt from the rules.
---------------------------------------------------------------------------
\53\ 15 U.S.C. 6801; see 79 FR 37166 (2014) (``Section 501(b) of
the Gramm-Leach-Bliley Act (GLB Act) [1] requires the Office of the
Comptroller of the Currency, Board of Governors of the Federal Reserve
System, Federal Deposit Insurance Corporation, and Office of Thrift
Supervision (the Agencies), as well as the National Credit Union, the
Securities and Exchange Commission, and the Federal Trade Commission,
to establish appropriate standards for the financial institutions
subject to their respective jurisdictions relating to the
administrative, technical, and physical safeguards for customer records
and information.'').
\54\ Id.
\55\ See, e.g., Consumer Financial Protection Bureau, ``CFPB Takes
Action Against Dwolla for Misrepresenting Data Security Practices''
(Mar. 2, 2016), https://www.consumerfinance.gov/about-us/newsroom/cfpb-
takes-action-against-dwolla-for-misrepresenting-data-security-pract/.
---------------------------------------------------------------------------
C. Limit the Use of the Social Security Number by Private Companies
Social security numbers have been asked to do too much. They were
never meant to be used as an all-purpose identifier. \56\ The
unregulated use of the social security number in the private sector has
contributed to record levels of identity theft and financial fraud.
\57\ The recent Equifax breach illustrates this problem, as the social
security numbers of nearly half of all Americans were stolen. The
solution is not, however, to replace the social security number with a
national biometric identifier that raises serious privacy and security
risks. \58\ Instead, we suggest that the best way to minimize the
problem of identity theft is to reduce the industry's reliance on the
social security number as a personal identifier. \59\ Congress should
prohibit the use of the social security number in the private sector
without explicit legal authorization.
---------------------------------------------------------------------------
\56\ Marc Rotenberg, ``The Use of the Social Security Number as a
National Identifier'', 22 Comp. & Soc'y nos. 2, 3, 4 (Oct. 1991).
\57\ Marc Rotenberg, Equifax, ``The Credit Reporting Industry, And
What Congress Should Do Next'', Harv. Bus. Rev., (Sep. 20, 2017).
\58\ EPIC, ``Identity Theft'', http://epic.org/privacy/idtheft/
(last visited October 13, 2017).
\59\ ``Cybersecurity and Data Protection in the Financial Services
Sector'', Hearing Before the H. Comm. on Fin. Servs., 112th Cong.
(2011) (statement of Marc Rotenberg, Exec. Dir., EPIC), https://
financialservices.house.gov/uploadedfiles/091411rotenberg.pdf.
---------------------------------------------------------------------------
D. Promote Innovative Technology To Minimize the Collection of Personal
Data
The focus should now turn to how companies can minimize the
collection of personal data and maximize consumer privacy and control.
There are already initiatives to improve privacy protections in the
field of data science, and these efforts could be adopted and further
developed by the companies responsible for protecting consumer data.
\60\
---------------------------------------------------------------------------
\60\ See, e.g., Comm. on Nat'l Statistics, Div. of Behavioral and
Social Sciences and Education, Nat'l Academies of Science, Engineering,
and Medicine, ``Combining Data Sources While Protecting Privacy''
(National Academies Press 2017); Cynthia Dwork and Aaron Roth, ``The
Algorithmic Foundations of Differential Privacy'', 9 Found. & Trends in
Theoretical Comp. Sci. 211 (2014).
---------------------------------------------------------------------------
The newly formed Commission on Evidence-Based Policymaking recently
issued a report that urged the adoption of privacy enhancement and
preservation techniques, including ``differential privacy'' algorithms
that can be used to glean information from data sets without revealing
personal information. \61\ We have also seen increasingly secure
methods of two-factor authentication that can minimize the risk of
phishing and other attempts to compromise personal data. \62\ Even the
consumer-facing financial companies are beginning to develop better
mechanisms to enable control and monitoring of accounts, including
dedicated applications to limit unauthorized debit card charges. \63\
These are the techniques that Equifax and other credit reporting
agencies should invest in to limit harm to consumers going forward.
---------------------------------------------------------------------------
\61\ Marc Rotenberg, ``Let's Use Government Data To Make Better
Policy'', Sci. Am. (Oct. 4, 2017), https://
blogs.scientificamerican.com/observations/let-rsquo-s-use-government-
data-to-make-better-policy/.
\62\ See Letter from Sen. Ron Wyden (D-Ore.), Ranking Member,
Comm. on Finance, to Acting Commissioner Nancy A. Berryhill, Social
Sec'y Admin. (Oct. 5, 2017) (recommending the use of Universal Second
Factor (U2F) tokens to secure social security accounts), https://
www.finance.senate.gov/imo/media/doc/100517%20RW%20to%20SSA%20U2F.pdf.
\63\ See, e.g., Ally Card Controls App (2017) (providing consumers
with a way to ``turn off'' their debit card whenever they are not using
it), https://www.ally.com/help/bank/card-controls-app.html. Debit cards
pose an acute risk to consumers because consumers are not as well
protected from fraudulent charges as they are with credit cards. See
U.S. PIRG, Debit Card Facts, http://www.pirg.org/consumer/banks/debit/
debitcards1.htm (last accessed Oct. 13, 2017).
---------------------------------------------------------------------------
E. Enact Baseline Privacy Legislation and Establish a Data Protection
Agency
We have urged for many years that the United States update its
privacy laws to address the challenges posed by new technologies and
new business practices. The United States was once a leader and
innovator in privacy protection, but we have now fallen behind many
other countries that are seeking to ensure that the rapid adoption of
new technologies does not leave them vulnerable to data breach,
identity theft, and cyberattack. Certainly, the United States needs to
do more.
A good starting point would be to enact the Consumer Privacy Bill
of Rights, baseline privacy legislation that would put the
responsibilities on companies that collect and use personal data to
protect the information they choose to collect. The Consumer Privacy
Bill of Rights follows the structure of many privacy laws in the United
States and elsewhere. That means it could both harmonize and simplify
compliance, and the CPBR could help resolve pending trade disputes with
Europe and others about the protections for transborder data flows.
The United States should also establish as Data Protection Agency
as has virtually every other advanced economy facing the challenges of
the digital age. The current agencies in the United States tasked with
protecting consumers and citizens lack the authority and even the
personnel to do what needs to be done.
I am aware that these are ambitious recommendations and reach
beyond the immediate concerns before this Committee. But U.S.
consumers, businesses, and the U.S. Government face a genuine threat
from the unbounded collection of personal data without adequate legal
and technical protections. This data is now the target of foreign
adversaries. Two years ago it was the OPM breach. Now it is the Equifax
breach. I am reluctant to imagine the consequences for the United
States of the next major breach.
Conclusion
We think it is time now to reform the credit reporting industry and
to end the practice of building massive, secretive, profiles on
American consumers that are sold to strangers and obtained by hackers,
yet are almost impossible for consumers to see or control.
EPIC supports legislation that will give consumers control over
their information and establish accountability for companies in the
personal data industry. EPIC also support techniques that minimize the
collection of personally identifiable information. And we urge the end
to the use of the SSN by private companies without legal authority.
It will come as no surprise that consumers across the country favor
reform of the credit reporting industry. But I want to end with a story
that may be surprising. Earlier this fall, I had the opportunity to
speak with leading CEOs from across the country about the Equifax
breach. After a brief exchange, the event moderator polled the CEOs.
Eighty-seven percent said ``the Equifax boss should go'' and 95 percent
``want stronger consumer privacy laws.'' \64\
---------------------------------------------------------------------------
\64\ CEO Summit, Chief Executive Leadership Institute, Yale School
of Management, Washington, DC (Sept. 9, 2017), http://som.yale.edu/
faculty-research-centers/centers-initiatives/chief-executive-
leadership-institute/programs/ceo-summit.
---------------------------------------------------------------------------
American consumers favor stronger consumer privacy laws. American
businesses favor stronger consumer privacy laws. Now it is time for
Congress to Act.
Thank you for the opportunity to testify today. I will be pleased
to answer your questions.
______
PREPARED STATEMENT OF CHRIS JAIKARAN
Analyst in Cybersecurity Policy, Congressional Research Service
October 17, 2017
Introduction
Chairman Crapo, Ranking Member Brown, and Members of the Committee,
thank you for the opportunity to testify on consumer data security and
the credit bureaus. My name is Chris Jaikaran and I am an Analyst in
Cybersecurity Policy at the Congressional Research Service. In this
role, I research and analyze cybersecurity issues and their policy
implications--including issues of data security, protection and
management.
My testimony today will include discussion of data security as an
element of cybersecurity and risk management, analysis and a case study
on how data breaches occur, a description of cyberincident response,
and possible options for Congress to address data security and data
protection. My testimony today is based solely on publicly available
information and CRS analysis.
Cybersecurity and Data Security
An increasingly used catch-phrase among industry analysts is that
today ``all companies are technology companies,'' or ``all companies
are data companies.'' \1\ This concept reflects the role that
information technology (IT) and data play in enabling the modern
business practices that allow companies to compete and thrive in the
marketplace. This reliance on IT and data also creates risk for
corporate leadership to manage. Adequately controlling that risk is an
objective of cybersecurity. \2\
---------------------------------------------------------------------------
\1\ Nathaniel Fink, ``Cybersecurity for a New America: What's Next
for the Cybersecurity Community'', conference keynote, March 20, 2017,
at https://youtu.be/wfMpUpxNPAg. Avi Gesser, Gabriel Rosenberg, and
Matt Kelly, ``Cybersecurity and Data Management'', webinar, Davis Polk
& Wardwell LLP, October 11, 2017.
\2\ Risk may be managed by avoiding the risk, controlling the
risk, transferring the risk, or accepting the risk. DHS Risk Steering
Committee, ``DHS Risk Lexicon'', report, September 2010, at https://
www.dhs.gov/sites/default/files/publications/dhs-risk-lexicon-
2010_0.pdf.
---------------------------------------------------------------------------
Data security is an element of cybersecurity. At the most basic
level, cybersecurity is the security of cyberspace, which includes not
just data, but the networks, hardware, software, services, and
infrastructure that data relies upon. It is also important to note that
data does not exist by itself, but is created, manipulated and used by
people. Consequently, cybersecurity is not just the security of data,
hardware, software, infrastructure, networks and services--but also the
human users of cyberspace.
Computer scientists view data security through three attributes:
Confidentiality: that the data is only known to authorized
parties. A data breach is an example of how confidentiality is
breached, while encryption is a tool used to ensure
confidentiality.
Integrity: that the data is known to the authorized parties
as intended. Data manipulation is an example of how integrity
is breached, while there are data checking technologies, such
as blockchain, to ensure that one can verify the integrity of
data.
Availability: that the data is available to authorized
parties when they choose. Ransomware attacks availability,
while backups are a tool that ensures availability of data.
Related to integrity is the concept of authentication, an attribute
that one can verify that data is from a trusted source. The Internet
was built using technologies that assumed the trust of its users, but
as the Internet has grown into a global network, anonymity and the
manipulation of data have proliferated. \3\
---------------------------------------------------------------------------
\3\ CRS In Focus IF10559, Cybersecurity: An Introduction, by Chris
Jaikaran.
---------------------------------------------------------------------------
As an element of cybersecurity, data security involves risk
management. Absolute security is not obtainable, so managing the risks
which would impair security is generally considered to be the goal. In
order to evaluate risk, managers need to understand the threats the
enterprises may face, the vulnerabilities the enterprise has, and the
consequences of an incident. \4\
---------------------------------------------------------------------------
\4\ Davis Hake, ``Threat, Vulnerability, Consequence'', interview
with The Cipher Brief, December 15, 2015, at https://
www.thecipherbrief.com/threat-vulnerability-consequence.
---------------------------------------------------------------------------
Threats are generally considered to be the gamut of potential human
attackers. Such attackers include Nation-State actors, criminals and
insiders to the network. Depending on the data an entity houses, and
the services it provides, the realm of attackers may change from one
day to the next, sometimes even driven by events in the news.
Vulnerabilities exist in software the moment it is shipped to
users. Adding additional software to a growing enterprise creates
complexities that can lead to further potential vulnerabilities. Some
software vulnerabilities are known the day they are shipped and are
catalogued in the Common Vulnerabilities and Exposures database with
risk assessments enumerated in the National Vulnerabilities Database.
\5\ Others are discovered later. Vulnerabilities that are discovered
but not disclosed to the vendor so they may be patched are called 0-
days (zero or ``oh'' days). However, 0-day vulnerabilities do not
necessarily create a large risk for enterprises. In addition to a
vulnerability being present on a system, it must be exploited to cause
some impact. The exploitation of a vulnerability may be so difficult
that an entity's risk of falling victim to that 0-day is low. Despite
0-days being a threat, most cybersecurity incidents occur through
attackers exploiting known vulnerabilities for which the entity has not
deployed a patch. \6\
---------------------------------------------------------------------------
\5\ https://cve.mitre.org.; https://nvd.nist.gov.
\6\ Jory Heckman, ``Hackers Not Yet Pulling Out Big Guns for Data
Breaches, NSA Official Warns'', Federal News Radio article, October 18,
2016, at https://federalnewsradio.com/technology/2016/10/hackers-not-
yet-pulling-big-guns-data-breaches-nsa-official-warns/.
---------------------------------------------------------------------------
Consequences may vary based on the business of an entity, the data
that entity houses, and the stakeholder community for the entity.
Consequences are also multi-dimensional. The loss of data may inhibit
business practices, but may also lead to reputational loss, enforcement
actions, payments to stakeholders, or other impacts.
An entity may be able to better predict consequences through
understanding the data in its possession. Using a data model or
framework can help an entity identify attributes of its data. Such
attributes include: where data is acquired; what other data the entity
generates from acquired data; what types (both descriptively and by
file type) of data is acquired or generated; how the entity will use
and access data; how the data will be shared with other parties; where
data is stored, accessed, and transmitted; and what policies exist for
data retention and data disposal. Such a data model is essentially an
architecture of the entity's data, similar to the network architecture
of their IT systems or the blueprints for their building.
The National Institute of Standards and Technology (NIST) Framework
for Improving Critical Infrastructure Cybersecurity (Framework)
provides functions, activities and categories in a common format to
assist entities in thinking through cybersecurity issues and
identifying resources to assist in completing activities. \7\ (Some of
these activities include asset management, data security, and detection
processes.) However, the Cybersecurity Framework is not the only
reference for organizations to consider using, or a document which they
can only use exclusively. The Center for Internet Security, the
International Standards Organization, and ISACA also publish
cybersecurity frameworks which an entity may use in conjunction with or
in replacement of the NIST Cybersecurity Framework. \8\
---------------------------------------------------------------------------
\7\ NIST, ``Cybersecurity Framework'', webpage, at https://
www.nist.gov/cyberframework.
\8\ Cybersecurity frameworks from these organizations can be found
at https://www.cisecurity.org/controls/; https://www.iso.org/standard/
54533.html; and http://www.isaca.org/cobit/pages/default.aspx. ISACA
was previously known as the Information Systems Audit and Control
Association, but now goes by its acronym only.
---------------------------------------------------------------------------
The Anatomy of a Breach
The recent breach of Equifax provides a timely case study on how
breaches occur. \9\ While a single command may be executed at a speed
fast enough for the computer to process it, full attacks are done by
humans, and as such, occur at human speed. Breaches can be understood
through an attack framework. \10\
---------------------------------------------------------------------------
\9\ Information on the Equifax breach is derived from testimony
provided by former CEO Richard Smith before the U.S. Senate Committee
on Banking, Housing, and Urban Affairs. Richard Smith, ``Prepared
Testimony of Richard Smith'', testimony, October 4, 2017, at https://
www.banking.senate.gov/public/--cache/files/da2d3277-d6f4-493a-ad88-
c809781f7011/F143CC8431E6CD31C86ADB64041FB31B.smith-testimony-10-4-
17.pdf.
\10\ The framework presented in this testimony is based on
previous analysis by CRS. Further case studies are available via CRS
Recorded Event WRE00157, ``Cybersecurity: Anatomy of a Breach'', by
Chris Jaikaran.
---------------------------------------------------------------------------
First, an attacker examines the target. Through this examination
the attacker learns about the target system. This examination is both
online and off. Business cards provide the naming convention for user
accounts on the system (in the form of email addresses), while digital
tools can provide information on services running on Internet-facing
services. In the case of Equifax, scans of their credit report dispute
website may discover that Apache Struts was an available service and
that it was running under a vulnerable version. \11\
---------------------------------------------------------------------------
\11\ Apache Struts is a developer framework which allows for
common programming languages, such as Java, to be used to develop user
facing web applications. It is open source software maintained by the
Apache Software Foundation, https://struts.apache.org/.
---------------------------------------------------------------------------
Second, an attacker exploits a vulnerability. This initial
exploitation provides the entryway for an attacker into the system or
network. As stated earlier, vulnerabilities themselves do not
necessarily create a significant risk scenario for an enterprise, but
an exploitation of that vulnerability may. In some cases, a single
vulnerability is required to gain access, while in others multiple
vulnerabilities may be used to create an effective exploit. In the case
of Equifax, a vulnerability in an earlier version of Apache Struts
allowed for remote code execution. \12\ NIST deemed this type of
vulnerability as critical, and the Apache Foundation patched it and
provided an additional work around. \13\ At the time it was patched, it
was also added to penetration testing software so that system
administrators could test to see if they were still vulnerable to
exploitation. \14\
---------------------------------------------------------------------------
\12\ CVE, ``CVE-2017-5638'', data base entry, at https://
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638.
\13\ NIST, ``CVE-201705638 Detail'', webpage, March 10, 2017, at
https://nvd.nist.gov/vuln/detail/CVE-2017-5638. Apache Foundation,
``S2-045,'' webpage, at https://struts.apache.org/docs/s2-045.html.
\14\ The exploitation of CVE-2017-5638 was added to the Metasploit
Framework. https://github.com/rapid7/metasploit-framework/issues/8064.
---------------------------------------------------------------------------
Third, after the initial exploitation, attackers entrench into the
system. By entrenching into a system, attackers are discovering more
about the network they have penetrated. In this phase, they gain access
to additional systems in that network, escalate their privileges so
that they have further access, and acquire additional credentials. In
the case of Equifax, how attackers entrenched into the system is
publicly unknown. However, many instances of Apache Struts run on web
servers with default administrative credentials, which may have
provided the next step for an attacker to entrench into the system.
\15\
---------------------------------------------------------------------------
\15\ Hector Monsegur, ``How To Fight Hackers, With Former Black-
Hat Hacker Hector Monsegur'', podcast, October 2, 2017, at https://
lifehacker.com/how-to-protect-yourself-from-hackers-with-hector-monse-
1819075906.
---------------------------------------------------------------------------
While he was the Chief of the National Security Agency's Tailored
Access Operations unit, current White House Cybersecurity Coordinator
Rob Joyce said that ``you know the things you intend to have in your
network, we look for the things that are actually in your network.''
\16\ This summarizes the relationship between defenders and attackers.
Defenders know what they acquired, deployed and intend to have on their
network, while attackers know the vulnerabilities and what else is
running on that network. Exploiting vulnerabilities and entrenching
into systems takes advantage of this asymmetric knowledge.
---------------------------------------------------------------------------
\16\ Rob Joyce, ``USENIX Enigma 2016--NSA TAO Chief on Disrupting
Nation State Hackers'', conference talk, January 28, 2016, at https://
www.youtube.com/watch?v=bDJb8WOJYdA.
---------------------------------------------------------------------------
Fourth, after gaining access, attackers can then execute steps to
achieve their objectives. These objectives could be to compromise the
confidentiality of the data by stealing it. Confidentiality is not only
compromised by theft, but also by access. This distinction is referred
to as exposure versus exfiltration. Data is exposed when an
unauthorized party may access it on an entity's network, but it is
exfiltrated when they take it off that network. This relationship is
akin to perusing books in a library but only checking out one. All the
books are exposed to a patron, but only the borrowed book is
exfiltrated. The integrity of data may be compromised by altering the
data in a system. Alternatively, the availability of the data may be
compromised by deleting it or otherwise making it unavailable (e.g.,
through encrypting data in a ransomware attack). In the case of
Equifax, it appears that over 145 million people had their data
exposed, while some had their dispute documents (which contain
personally identifiable information) and credit card information
exfiltrated.
Finally, the attackers would exit on their terms. After achieving
their objectives, the attackers would seek to leave the system so that
they may have access again at a later date, or to cover evidence of
their activities. Deleting log files, adding connections to network
whitelists and creating credentials are examples of activities an
attacker would undergo to exit the compromised system on their terms.
In the case of Equifax, it is unknown from publicly available sources
what attackers did in this phase.
By understanding how attacks occur through such a framework, system
defenders could develop defense-in-depth strategies to mitigate
breaches. Defense-in-depth is an approach which uses layered
countermeasures to defend against cybersecurity risks throughout a
network. \17\ Countermeasures could be layered to address each phase of
an attack so that defenders are quickly alerted to attacks and can take
actions to prevent further damage to their enterprise.
---------------------------------------------------------------------------
\17\ Industrial Control Systems Cyber Emergency Response Team,
``Recommended Practice: Improving Industrial Control System
Cybersecurity with Defense-in-Depth Strategies'', report, September
2016, at https://ics-cert.us-cert.gov/sites/default/files/
recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf.
---------------------------------------------------------------------------
Cybersecurity Incident Response
Cybersecurity incident response describes when system
administrators seek to confirm the attack, discover information about
it, and mitigate against it. The response as described below is from
the breached entity's perspective, and does not discuss Government
response options.
Incident response is not limited to the time immediately following
an attack, however. Before an attack, response planning, training, and
exercising can occur. Response planning helps an organization think
though its risks and how it will respond to those risks, train its
personnel on how to respond to attacks, and practice its response to
build confidence in staff and management as to the organization's
capability and capacity to manage incidents.
For incident response, staff is not limited to just IT personnel.
Response planning should also include, among others, communications
staff that are able to craft messages to both internal and external
stakeholders, legal teams who can help with reporting and compliance
requirements, and management and corporate boards who are accountable
for the operations of a corporation.
There will be a delay between the discovery of an attack and public
notification of that attack because analysis of what transpired will
need to be conducted. This analysis will inform the entity of how they
were breached and what data or systems were compromised. This type of
analysis may be conducted by the entity itself, a business partner of
the entity, Government response teams and law enforcement. With a
variety of potential forensic investigators, determining how they will
coordinate in their response and how they will share information among
one another is a factor that can be determined during the planning and
training phase. With information on how the breach happened and the
extent of the breach, the entity can proceed to mitigate its affects.
These two phases need not occur in succession, but may be able to occur
concurrently.
Finally, the organization can improve their data security and
response planning by learning from their efforts and applying insights
gained.
Potential Options for Congress
Three options for Congress are presented below to generate
discussion. They are not recommendations from CRS. Given time
constraints, these options are provided with limited policy discussion
and are not exhaustive.
Authorize a Federal Agency To Examine for Information Security
Congress can authorize a Federal agency to engage in supervisory
examinations of the credit reporting agencies (CRAs) for compliance
with the safeguards rule. \18\
---------------------------------------------------------------------------
\18\ 16 CFR 314
---------------------------------------------------------------------------
As an example, the Consumer Financial Protection Board (CFPB) has
broad authority to bring enforcement cases against corporations for
unfair and deceptive business practices. CRS research could not
identify an enforcement case or issued guidance where CFPB sought to
address information security. This may be because CFPB has an express
prohibition against issuing rules concerning information security and
bringing enforcement actions against an entity concerning information
security. Instead, the authority to issue a standard for the protection
of nonpublic personal information, and enforce that standard, is
retained by the Federal Trade Commission (FTC). \19\ The FTC issued the
safeguards rule in 2002 pursuant to the authority referenced above and
is currently seeking public comment on an update. \20\
---------------------------------------------------------------------------
\19\ 15 U.S.C. 6801, 6804, 6805.
\20\ 16 CFR 314. https://www.ftc.gov/enforcement/rules/
rulemaking-regulatory-reform-proceedings/safeguards-rule.
---------------------------------------------------------------------------
Instead of engaging with CRAs after a cybersecurity incident, CFPB
has the authority to supervise CRAs prior to an incident occurring.
\21\ Congress could explicitly authorize CFPB to examine CRAs for their
adherence to the safeguards rule, as promulgated by the FTC. The
dialogue created by CFPB and a CRA could lead to greater understanding
of the cybersecurity risk faced by the CRAs and allow CRAs with
deficiencies to correct their data security measures prior to referral
to FTC for enforcement action. As this is not an activity CFPB
currently engages in during an examination, a new program may need to
be established in the CFPB to recruit the talent to manage such a
technical examination. \22\
---------------------------------------------------------------------------
\21\ 12 U.S.C. 5514.
\22\ Current CFPB examination procedures may be found online at
https://www.consumerfinance.gov/policy-compliance/guidance/supervision-
examinations/.
---------------------------------------------------------------------------
Regulate Personal Data Collection and Use
Congress could regulate the collection, use, and retention of data
regardless of the type of entity housing that data. The European Union
has such a regulation known as the General Data Protection Regulation
(GDPR), and Canada is in the process of updating their Personal
Information Protection and Electronics Document Act (PIPEDA). \23\ In
proactively regulating data, Congress can establish data use
requirements. Some of those requirements may include what data may be
collected, how data must be stored (e.g., encryption, location, etc.),
the consumer's rights to collection and use of data about them, and
under which circumstances data may be shared with other parties. While
the United States does not have an overarching law governing data use,
U.S. agencies have promulgated guidance on data protection. \24\
---------------------------------------------------------------------------
\23\ http://www.eugdpr.org/; https://www.priv.gc.ca/en/privacy-
topics/privacy-laws-in-canada/the-personal-information-protection-and-
electronic-documents-act-pipeda/.
\24\ FTC, ``Protecting Personal Information'', guide, October
2016, at https://www.ftc.gov/system/files/documents/plain-language/pdf-
0136_proteting-personal-information.pdf.
---------------------------------------------------------------------------
Require Data Transparency
Congress could require CRAs, or any entity that profits from
consumer data, to identify and disclose their data model to consumers.
Disclosure of all elements of the model may not be necessary (i.e.,
where data is stored). However, some elements such as where data is
acquired, how it is used, and what other data the entity generates
about the consumer may provide consumers with additional information
and affect their decisions in the marketplace. For example, if a
consumer knew that a CRA acquired data from a company they have a
business relationship with, they may choose to limit their interactions
with that company or seek out an opt-out/opt-in form from that business
to limit how their data may be shared.
Conclusion
Thank you for the opportunity to testify today. I look forward to
your questions. If you require further analysis of these options, or
other policy issues before Congress, my colleagues and I at the CRS
stand ready to assist you.
RESPONSES TO WRITTEN QUESTIONS OF CHAIRMAN CRAPO
FROM ANDREW M. SMITH
Q.1. What is the most effective action a consumer can take to
protect against identity theft if the consumer's information
has been compromised? Please include a detailed description of
the differences between credit freezes, credit locks, and fraud
alerts, including how long each takes to activate and de-
activate and the relative benefits and drawbacks of each.
A.1. There are many ways for consumers to protect themselves if
they believe that they may be at risk of identity theft. The
first step is to check credit card statements and free credit
reports for charges and accounts that are unfamiliar. Consumers
should also consider placing an initial fraud alert, an
extended fraud alert and, if in the military, a military alert.
Consumers should also consider engaging a credit monitoring
service--there are a number of free services available.
Freezes are another option, though they may not be the best
choice for many consumers. Although credit freezes may seem
like a good idea in the abstract, for those who may become
credit active they could be a problem. Press stories \1\ have
recently noted that some with credit freezes have missed out on
opportunities because they had a credit freeze.
---------------------------------------------------------------------------
\1\ See, e.g.: http://appleinsider.com/articles/17/10/27/iphone-x-
orders-held-up-by-credit-freezes-put-in-place-after-equifax-hack and
http://sanfrancisco.cbslocal.com/2017/09/14/apple-iphone-x-equifax-
data-breach-credit-freeze/.
---------------------------------------------------------------------------
If a consumer nonetheless chooses a freeze, all three
national credit bureaus offer freezes to consumers regardless
of their place of residence. Freezes are free for victims of
identity theft and minors who have a credit file.
A lock is intended to work similarly to a credit freeze.
Consumers who place freezes do so in order to ensure that no
new credit can be offered without their explicit agreement, and
a lock will achieve that consumer goal, but will be much easier
for consumers to use, as it will be app-based and occur in real
time. By contrast, freezes are State-regulated and are
generally PIN-based systems.
Legally, there are important differences between locks and
freezes. Freezes are State-mandated products that are heavily
regulated. In many States PINs are mandated as authentication,
and if a consumer has the PIN, the freeze can be lifted almost
immediately. If the consumer has lost the PIN, however, it can
take days for a new PIN to be mailed to a consumer's address
and for the consumer to again contact the company.
Lock products, by contrast, are not State-mandated products
and require consumers to enter into a formal business
relationship with the company. This is an important distinction
between the two products.
For the consumer, the lock will deliver the same
functionality as a freeze, but do so in a less cumbersome
fashion.
Q.2. Are credit bureaus required to provide data to any Federal
agency? If so, is it mandated or at the request of the
regulator; what data is provided; what agency is it provided
to; and is the data sold or provided for free?
A.2. CRAs are only able to deliver data for permissible
purposes as defined in Section 604 of the Fair Credit Reporting
Act. There are a number of legitimate Government purposes for
obtaining credit reports, including benefit eligibility and
child support enforcement.
Some agencies of the U.S. Government purchase aggregated,
anonymized data from our companies for market monitoring and
research purposes. This information is not regulated under the
Fair Credit Reporting Act because it is not identifiable to any
specific individual.
Credit bureaus are required to provide credit report
information to Government agencies for counterterrorism
purposes and to the FBI for counterintelligence purposes, upon
an appropriate certification from the agency. These provisions
were added to the FCRA by the USA PATRIOT Act and 2001. We are
not aware of any other provisions requiring credit bureaus to
provide credit report information to Government agencies.
Q.3. Many States have laws requiring credit bureaus to provide
credit freezes. Can you describe what these laws generally
require and discuss whether it is appropriate for Congress to
create a Federal standard?
A.3. All 50 States have credit freeze laws and while there are
a number of similarities, there are enough variations among the
States that a Federal standard on credit freezes would equalize
treatment of these important products across the country,
offering certainty to a mobile population.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR BROWN
FROM ANDREW M. SMITH
Q.1. In your testimony, you claimed that consumer reporting
agencies charge for security freezes due to a ``patchwork of
laws.'' This statement seems to imply that State laws require
consumer reporting agencies to charge for security freezes. But
isn't it true that State laws generally cap the fees that
consumer reporting agencies can charge for security freezes
(i.e., they set a ceiling, not a floor)? Ohio law, for example,
provides that a consumer reporting agency ``may'' charge a fee
for placing, removing, or temporarily lifting a fee. See Ohio
Rev. Code 1349.52(I). Is it your position that Ohio's and
other States' laws nevertheless require consumer reporting
agencies to charge fees for security freezes?
A.1. It is not our position that the Ohio law requires consumer
reporting agencies to charge a fee for security freezes.
However, in most cases, the credit bureaus have good reason to
charge a fee, a fact that State legislators have recognized in
explicitly permitting the bureaus to charge such a fee. Credit
bureaus are not the breached entity in most cases \1\ and they
should not be forced to pay to absorb the costs of a breach
caused by someone else. In other cases, States do not require
service providers to pay for criminal activity unrelated to
their service, for example: States do not require a burglar
alarm company to give away services for thefts in a
neighborhood.
---------------------------------------------------------------------------
\1\ The largest breaches in history have been, in numerical order
of consumers affected, Yahoo!, Adult Friend Finder, eBay, Equifax,
Heartland Payment Systems, Target, TJX (TJ Maxx), JP Morgan, U.S.
Office of Personnel Management, and Sony's PlayStation Network. Taylor
Armeding, ``The 16 Biggest Data Breaches of the 21st Century'', CSO,
Oct. 11, 2017, https://www.csoonline.com/article/2130877/data-breach/
the-16-biggest-data-breaches-of-the-21st-century.html.
---------------------------------------------------------------------------
For victims of identity theft, consumers in every State are
entitled to free credit freezes. The freeze fee is low and
allows credit bureaus to recover some of the costs for
providing freezes. This service is not a profit center for any
company. The administrative fee instead helps to cover the
costs of providing the freeze service to consumers, including
the maintenance of the technology to implement the freeze
system.
Q.2. Although Equifax has offered a free security freeze in the
wake of the breach, other consumer reporting agencies have
refused to offer a free security freeze. Will Consumer Data
Industry Association (CDIA) members other than Equifax offer a
free security freeze or will they only do it if required by law
to do so?
A.2. The consumer reporting agencies that were not the subject
of a hack or a breach will continue to charge non-ID theft
victims for credit freezes as permitted by law. Identity theft
victims are entitled to free freezes. As noted, the
administrative fees for credit freezes help to cover the costs
of providing the freeze service to consumers, including the
development and maintenance of the technology to implement the
freeze system and the consumer counseling required to explain
the freeze and how to manage the freeze.
Q.3. To purchase products like credit monitoring from consumer
reporting agencies, consumers frequently must sign forced-
arbitration clauses in fine print. In your testimony, you
implied that these forced-arbitration clauses apply only to
disputes related to the products that consumers are purchasing.
But many consumer reporting agencies' forced-arbitration
clauses would appear to cover claims beyond just these
products. For example, Equifax's forced-arbitration clause
provides that ``[a]ny Claim . . . raised by either [the
consumer] or Equifax against the other shall be subject to
mandatory, binding arbitration.'' The clause defines ``Claim''
as meaning ``any claim, dispute, or controversy between [the
consumer] and [Equifax] relating in any way to [the consumer's]
relationship with Equifax.'' Likewise, one of Experian's
forced-arbitration clauses extends to ``all disputes and claims
between [the consumer and Experian], except any disputes or
claims which under governing law are not subject to
arbitration.'' TransUnion has a similarly broad forced-
arbitration clause, and all three companies deprive consumers
of their rights to band together in class actions. Is it your
legal opinion that these clauses nevertheless cover only
disputes related to the specific products that consumers are
purchasing?
A.3. A legal opinion on the specifics of the three nationwide
credit bureaus' arbitration clauses and the scope of those
clauses are best left to the companies offering those clauses.
Q.4. During the hearing, I asked you to tell the consumer
reporting agencies that you represent that there is strong
sentiment that they should not include forced-arbitration
clauses in their credit-lock products. What message did you
convey to them? If there is written correspondence, please
provide a copy of that correspondence for the record. Please
also provide any response by the consumer reporting agencies or
their representatives.
A.4. I have notified the U.S. General Counsel at Equifax,
Experian, and TransUnion that you have asked me to convey to
them your concerns regarding arbitration clauses. My message
was as follows: ``In the October 17 Senate Banking Committee
hearing on credit bureaus and data security, Senator Brown
asked me to convey to the three nationwide consumer reporting
agencies that ``there is strong sentiment'' that consumer
reporting agencies should not include forced arbitration
clauses in their credit lock products.'' They have confirmed
receipt of my message.
Q.5. In your testimony, you stated that forced-arbitration
clauses play a ``special role'' with respect to credit-
monitoring and other credit-report-related products because of
the ``exigent circumstance'' created by the Credit Repair
Organizations Act's ``stringent penalties.'' As you know,
Congress passed this Act after finding that certain business
practices of credit repair organizations had ``worked a
financial hardship upon consumers, particularly those of
limited economic means and who are inexperienced in credit
matters.'' Thus, ``to protect the public from unfair or
deceptive advertising and business practices'' by these
organizations, Congress allowed consumers to recover
compensation for harm caused by the organizations' deceptive
conduct. In your opinion, could any of the three national
consumer reporting agencies' use their force-arbitration
clauses to legally block consumers from banding together in
class actions to sue under the Credit Repair Organizations Act?
A.5. The Credit Repair Organizations Act (CROA) was never
intended to apply to credit bureaus, which are heavily
regulated by the FCRA, yet some courts have not correctly
interpreted CROA. This misapplication of law is why credit
bureaus feel compelled to provide arbitration clauses, and it
is why we have urged Congress to amend CROA. I have attached an
April 14, 2017, letter from CDIA to Chairman Crapo and Ranking
Member Brown where CDIA advocated for, among other things,
Congressional assistance to amend CROA.
In short, the broad definitions in CROA have labeled
traditional consumer reporting agencies as CROs, subjecting
consumer reporting agencies to CROA's strict liability
provisions when they seek to offer legitimate credit education
services to consumers.
Misinterpretation of CROA by the courts has stretched the
law beyond Congressional intent of combatting fraudulent credit
repair practices. Recent judicial decisions have even swept in
standard credit monitoring services and identity theft
protection services, as well as other credit education services
that consumers seek. \2\ This expansion has deterred trusted
companies from providing legitimate credit education products
to consumers, including innovative credit simulators that help
consumers understand personalized steps to improve their credit
scores. If CROA remains unchanged, consumers are effectively
prevented from accessing these tools.
---------------------------------------------------------------------------
\2\ See, Stout v. FreeScore, 743 F.3d 680 (9th Cir. 2014).
Q.6. In your testimony, you implied that if Americans had the
right to make consumer reporting agencies delete their data,
consumers would use this right to ``selectively delete''
negative but accurate information. Do any CDIA members operate
in countries whose laws provide for a ``right of erasure''
similar to the right that exists under the EU General Data
Protection Regulation (GDPR)? If so, please provide (1)
concrete, credible examples of instances where consumers have
exercised this right to selectively delete negative but
accurate credit information from CDIA members' files and (2)
the total number of such instances reported and confirmed in
2016 (by country). In each case, please include only those
instances for which you can confirm the accuracy of the
---------------------------------------------------------------------------
information that the consumer sought to delete.
A.6. When a consumer has the ability to selectively delete the
parts of their credit history that are accurate but derogatory,
the entire credit system suffers and safety and soundness of
the financial system is jeopardized. It is hard to imagine a
credit system where a consumer can delete late payments and
keep only on time payment history. Full file reporting is a
value supported by credit bureaus, lenders, and the prudential
regulators.
In 1999, several Federal banking regulators took note that
some national financial institutions were not fully reporting
data to consumer reporting agencies. In response to this
situation, the Comptroller of the Currency called this a
``particularly objectionable practice''. This ``[f]ailure to
report may not be explicitly illegal[, b]ut it can be readily
characterized as unfair; it may well be deceptive, and--in any
context--it's abusive.'' \3\
---------------------------------------------------------------------------
\3\ Remarks by John D. Hawke, Comptroller of the Currency, before
a conference sponsored by the Consumer Bankers Association, San
Francisco, California, June 7, 1999. See also, Federal Financial
Institutions Examination Council Advisory Letter to Chief Executive
Officers regarding Consumer Credit Reporting Practices, Jan. 18, 2000.
---------------------------------------------------------------------------
Similarly, under EU law, the ``right to be forgotten'' does
not actually grant consumers the power to selectively delete
information from their credit report. The ``right to be
forgotten'' will not over-ride the legitimate interest
financial entities and CRAs have to share a complete and
accurate credit file. In these respects, the credit reporting
systems in the EU work remarkably similarly to the credit
reporting system in the U.S. under the Fair Credit Reporting
Act. The GDPR recognizes that a fair, affordable and efficient
credit market demands accurate reporting of debts and payment
histories to and from CRAs. The tenets of legitimate interest
are balanced by providing transparency and access for consumers
with their right to challenge and correct inaccurate
information.
Although there may be some temporary confusion about how
the GDPR will work with respect to consumer consent for credit
reference agencies (CRAs) to collect information from lenders,
and the ``right to be forgotten'' or right of erasure, CDIA
members do not anticipate material changes to the way credit
reporting currently works in the majority of EU countries as a
result of GDPR.
GDPR provides for six bases by which information can be
processed, consent being only one of them. In the context of
credit reporting, the relevant basis for information processing
is the ``legitimate interest'' of the data processor.
In the U.K., the Information Commissioners Office (ICO),
the Government agency that interprets and enforces GDPR in the
U.K., has already provided written guidance that consumer
consent is not needed for sharing of credit information with
CRAs. The ICO has said that both lenders and CRAs in the U.K.
can rely upon the basis of ``legitimate interest'' for the
sharing of credit data, and that the consent of the consumer is
not needed under GDPR.
Similarly, the ``right to be forgotten'' will not over-ride
the legitimate interest financial entities and CRAs have to
share a complete and accurate credit file. In these respects,
the credit reporting systems in the EU work similarly to the
credit reporting system in the U.S. under the Fair Credit
Reporting Act. The Europeans have learned of the importance of
a robust credit reporting system from the U.S. experience, and
the GDPR appropriately recognizes that a fair, affordable and
efficient credit market demands accurate reporting of debts and
payment histories to and from CRAs. The tenets of legitimate
interest are balanced by providing transparency and access for
consumers, as well as a right to challenge and correct
inaccurate information.
The inability of lenders to fully understand credit risk
associated with the extension of consumer loans would
negatively affect the price and availability of credit in the
EU and introduce systemic risk into the banking systems of
individual country and EU banking systems. Therefore, in the
context of credit reporting, the legitimate interests of
financial institutions to understand an individual's credit
risk outweighs an individual's right to be forgotten.
Q.7. For each of the three national consumer reporting
agencies, please provide a list of all EU countries (including
the United Kingdom) in which the company or any of its
affiliates operates. For each agency--country combination,
please list the applicable division or business unit's revenue,
operating income, and operating margin (each according to
generally accepted accounting principles). Additionally, for
each agency--country combination, please state whether the
agency intends to withdraw from the country when the new GDPR
(or its U.K. equivalent) goes into effect.
A.7. Based on information provided by the three nationwide
credit bureaus, we can relay the following information:
Trans Union does not operate any consumer credit reporting
businesses in any EU countries and does not realize any revenue
or income from consumer credit reporting activities in any EU
countries.
Experian Operates consumer credit bureaus in the following
EU countries:
----------------------------------------------------------------------------------------------------------------
Annual Revenues Operating Income Operating Margin
Country FY2017 FY2017 FY2017
----------------------------------------------------------------------------------------------------------------
United Kingdom & Ireland......................... $807,400,000 $245,900,000 30.55%
Other EU Countries: Italy, Spain, Denmark, $96,100,000 $20,900,000 25.04%
Netherlands.....................................
----------------------------------------------------------------------------------------------------------------
Equifax operates in the following EU countries:
----------------------------------------------------------------------------------------------------------------
Annual Revenues Operating Income Operating Margin
Country FY2017 FY2017 FY2017
----------------------------------------------------------------------------------------------------------------
United Kingdom................................... $156,200,000 $27,700,000 17.7%
Spain............................................ $42,500,000 $8,800,000 20.7%
Ireland.......................................... - ($2,000,000) N/A
Portugal......................................... $600,000 $0 -1.0%
----------------------------------------------------------------------------------------------------------------
Neither Experian nor Equifax intends to withdraw from any
country in which it operates consumer credit bureaus when the
new GDPR or its equivalent goes into effect in May 2018.
Q.8. Please describe, in concrete terms, the actions that CDIA
members operating in the European Union (including the United
Kingdom) are taking to comply with the GDPR (or its U.K.
equivalent), including how they plan to accommodate the right
of erasure.
A.8. For this answer, we have asked the three major credit
bureaus to respond directly.
Answer from Experian:
Experian is currently engaged to ensure they are in
compliance with the GDPR in each country in which they operate
at the time the GDPR becomes effective in May 2018. This effort
includes a review and, where necessary, changes to Experian's
guidelines, policies and practices relating to our credit
bureau operations in the EU.
Answer from Equifax:
Our current analysis indicates that Equifax's U.S.
operations do not process data that is subject to the
extraterritorial application of GDPR. As such, Equifax is
taking measures to comply with its contractual obligations
under data processing agreements with data controllers or
processors that have indicated that the data they provide to
Equifax for processing in the U.S. is subject to GDPR.
In the U.K., Equifax has been investing and working on its
GDPR compliance project since 2016, including following the 12
step approach as outlined and promoted by the U.K. data
protection regulator, the Information Commissioner's Office
(ICO).
These actions include reviewing and updating (as
appropriate) contractual arrangements with clients, suppliers
and processors with up-to-date GDPR contractual terms and
ensuring contractual terms include cooperation and assistance
provisions between the parties so that Data Subject Rights
(including the right of erasure) can be fulfilled where
appropriate and required.
In addition, regarding the right of erasure, Equifax is
working on a joint exercise with the other U.K. CRAs, the ICO
and key financial services clients to implement a standard U.K.
Credit Reference Agency Information Notice (CRAIN) that all
credit data sharers must utilize in their interactions with
their customers post-GDPR. This standard will ensure the
ongoing, lawful sharing and processing of credit report
information.
In Iberia, Equifax has also been working on its GDPR
compliance project since 2016. In common with the U.K., this
activity includes reviewing and updating (as appropriate)
contractual arrangements with clients, suppliers and processors
with up-to-date GDPR contractual terms. In addition to the
requirements of the GDPR, a forthcoming Spanish data protection
regulation will affect the business.
The review of operations includes the right of erasure in
respect of both `negative' (missed payments) and `positive'
bureau data, to which different procedures apply.
Equifax is taking the necessary steps toward achieving
compliance with GDPR on or before the May 2018 deadline.
Q.9. Would there be any benefits from consistency between U.S.
and EU privacy standards?
A.9. Each country's financial system is different, but the
framework laid out in the Fair Credit Reporting Act has led to
the most democratic and fair credit system in the world, and in
so far as this being a goal, we would urge adoption of U.S.
principles in Europe and across the world.
Q.10. In your testimony, you stated that consumers have access
to ``all of the information on file about them with consumer
reporting agencies.'' But isn't it true that consumer reporting
agencies or their affiliates often collect information that is
not contained in the free annual credit reports that consumers
can obtain? Please provide a list of all types of data
collected by the three national consumer reporting agencies and
their affiliates that is not contained in the free credit
report that consumers can obtain under FCRA.
A.10. Federal law requires that consumer reporting agencies
provide to consumers ``All information in the consumer's
file.'' \4\ The definition of a ``file'' is quite broad and
means ``all of the information on that consumer recorded and
retained by a consumer reporting agency regardless of how the
information is stored.'' \5\ under case law and FTC guidance,
these definitions have been broadly interpreted to include
information that might possibly be included in a consumer
report about the subject consumer; this includes the
identifying information on file with the credit bureau, a
history of their payments on various credit lines and loans,
and public record information, such as liens and judgements.
---------------------------------------------------------------------------
\4\ 15 U.S. Code 1681g.
\5\ 15 U.S. Code 1681a(g).
---------------------------------------------------------------------------
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR SCHATZ
FROM ANDREW M. SMITH
Q.1. What is the cost to consumer reporting agencies to place
security freezes on consumers' credit reports? Please compare
that to the cost of providing consumers with the ability to
``lock'' and ``unlock'' their credit reports.
A.1. It is difficult to precisely measure the costs of
providing security freezes, but the costs are certainly such
that the three nationwide credit bureaus do not make a profit
from their freeze obligations, even in those States where a fee
is permitted.
Costs arise from a number of sources. Generally, CDIA
members balance between limiting costs and investing in
innovation in this space. In addition, different States have
different requirements for placing security freezes on credit
files. These laws require companies to maintain certain
functionalities for consumers, including training and
maintaining call center employees. Other costs come from
operating secure web channels and maintaining PINs for
consumers. While most States allow for some cost recovery, as
noted above, none of the three nationwide credit bureaus
realize a profit on their security freeze obligations.
Furthermore, companies are investing significant resources
into their credit lock options for consumers. In addition to
significant development costs, there will be ongoing costs
related to maintaining and upgrading secure systems. Despite
the significant costs, we believe that the app-based systems
meet consumer demand for more simplified interaction when
setting and lifting a lock.
Q.2. Please explain how long it takes the consumer reporting
agencies to process a request to freeze or unfreeze their
credit report. Please explain how this length of time differs
from the credit lock products that they offer, which enable
consumers the ability to ``lock'' or ``unlock'' their credit
reports instantaneously.
A.2. It depends through which channel a consumer request
arrives. Most credit freeze laws require that a temporary lift
of a freeze be completed within three business days of the
request. Under most State freeze laws, if a consumer request
comes through the internet or by phone, a temporary lift can be
done within 15 minutes of the request, assuming the consumer
provide the correct PIN.
A lock product assumes that a consumer has already been
authenticated at the time an account was set up and therefore a
lock/unlock can occur very quickly after a request is made.
However, it is important to note that the account set-up will
take some time as a consumer has to go through a number of
steps to authenticate themselves to the CRA.
Q.3. Do you think consumers should be able to see the same
credit report information that their bank uses when the bank
makes a credit decision?
A.3. The information provided by a CRA to a lender under a
permissible purpose is essentially the same as the information
provided by a CRA to a consumer when the consumer requests his
or her report. That information, however, is presented in
different formats that are usable and understandable by each
party. The information provided to a lender is presented in a
computerized data feed not readable by a consumer, but the
underlying information is the same as in a consumer file
disclosure.
In addition, there might be differences due to the passage
of time, or the identifying information provided by the lender
to the consumer reporting agency to obtain a consumer report
about the subject individual. The ``same report'' issues were
studied by the FTC and the subject of a report to Congress in
2004 and what was true then remains true today. The FTC
concluded that a same report requirement
could impose substantial costs on both consumers and
industry as a whole. The potential costs to consumers
would include the privacy concerns raised by receiving
a report that could pertain to another person. Further,
if creditors were required to provide reports
automatically with an ``adverse action'' notice, this
could increase the volume of reports being sent and
thus raise identity theft concerns . . . To the extent
that a consumer wanted to verify the accuracy of
information currently in the file, the same report
requirement would be less helpful because the ``same
report'' would be somewhat out of date and perhaps
incomplete. In contrast, consumer disclosures currently
mandated under the FCRA provide all information about a
consumer in the CRA's files at the time the consumer
requests disclosure. A same report requirement could
thus indirectly impose additional costs on consumers
attempting to identify and correct information
currently contained in their reports. \7\
---------------------------------------------------------------------------
\7\ Report to Congress Under Sections 318 and 319 of the Fair and
Accurate Credit Transactions Act of 2003, Dec. 2004, v.
Q.4. Do you think consumers should be able to get a free credit
score each year along with their credit report since the score
is the most important piece of information used by lenders in
---------------------------------------------------------------------------
making credit decisions?
A.4. CDIA applauds its members and others for their market
solutions which make available to consumers unlimited access to
credit reports, credit scores, as well as providing additional
information which improves a consumer's financial literacy.
These market solutions, for example, push alerts to consumer's
smart phones when data has changed on their report and also
warn consumers when there is a risk of identity theft.
Under the risk-based pricing notice rule, consumers can see
the score used by the lender for any type of loan. In addition,
many credit card issuers and other providers of personal
financial management tools now make scores available for free
to consumers.
There is no need to create new score disclosure
requirements, as the market has clearly responded with a
variety of free options for consumers.
Furthermore, it is important to recognize that most credit
scores used in lending decisions are produced by score modeling
companies, and not consumer reporting agencies. In addition,
many different kinds of lenders use different kinds of scores:
a mortgage lender, for example, might prioritize different
kinds of information in their custom score than a credit card
issuer. Mandating that a credit bureau provide free credit
score only addresses a limited portion of the credit scoring
marketplace.
Q.5. Do you think the consumer dispute (system) could be
improved?
A.5. In a study that CDIA commissioned in 2011, an independent
research organization determined that 95 percent of all
consumers who participated in the dispute process were
satisfied with the outcome. \8\ However, we recognize that some
consumers have had issues with fixing inaccuracies on their
credit reports. We will work with you and others to address any
deficiencies in the system.
---------------------------------------------------------------------------
\8\ Turner, Michael A., Ph.D., Robin Varghese, Ph.D., Patrick D.
Walker, M.A., ``U.S. Consumer Credit Reports: Measuring Accuracy and
Dispute Impacts'', http://www.perc.net/wp-content/uploads/2013/09/
DQreport.pdf.
Q.6. Given the potentially catastrophic impact on a consumer
when there is a material error on their credit report and the
relatively small cost to the consumer reporting agencies to
provide better customer support, do you think the consumer
reporting agencies are doing the most they can do to prevent
---------------------------------------------------------------------------
and correct errors on credit reports?
A.6. Yes. First, CRAs work very hard to prevent errors from
appearing on credit reports at all. Aggressive monitoring of
the roughly 14,000 data furnishers and prompt investigations of
anomalous reporting help us ensure accuracy. And in fact, the
national CRAs have been examined annually by the CFPB, and
those examinations have not surfaced significant substantive or
systemic accuracy problems with any of the three companies,
despite the large numbers of complaints in the database. When a
consumer reports a problem, we work with the lender as quickly
as we can to resolve it. Often these relate to significant
disagreements between lender and customer. Other times, if a
mistake is discovered, we move as rapidly as possible to
correct it.
Q.7. In light of the massive data breach at Equifax and the
potential harm of identity theft that millions of Americans now
face, do you still believe that we should reduce the penalties
for consumer reporting agencies when they harm consumers?
A.7. CDIA has supported legislation to align the Fair Credit
Reporting Act with other financial consumer protection laws by
capping the amount of statutory damages allowed in class action
lawsuits at one percent of a defendant's net worth or $500,000,
whichever is less, and eliminating the possibility of punitive
damages. This would alleviate the uncertainty of the amount of
liability that businesses face in class action lawsuits and
provide economic stability for a wide range of impacted
businesses by reducing the potential for crippling and
catastrophic class action damage awards.
Other financial consumer protection statutes, such as the
Electronic Fund Transfer Act (EFTA), the Fair Debt Collection
Practices Act (FDCPA), the Equal Credit Opportunity Act (ECOA),
and the Truth in Lending Act (TILA) place similar caps on
damage amounts in class action litigation. When the FCRA was
enacted, it only permitted consumers to seek actual damages and
did not permit statutory or punitive damages in a private right
of action and, therefore, caps on damage awards were
unnecessary. As FCRA class action litigation has become more
prevalent, however, Congress should appropriately revisit the
liability structure of the FCRA.
Bringing the FCRA in line with other financial consumer
protection statutes is especially important in light of the
current trend of FCRA class action litigation against
employers. In recent years, FCRA class action lawsuits have
been filed against businesses from a variety of sectors
including fast food restaurants, grocers, retailers,
universities, and transportation companies. These employers are
particularly victimized by lawsuits where consumer harm is not
at issue but rather the allegations are highly technical
violations related to their use of consumer reports for
employment screening. With the possibility of unlimited damages
and grave reputational harm, employers and others often settle
instead of defending their practices in court.
Q.8. In CDIA's opinion, who should bear the financial liability
for fraud and identity theft that is linked to the Equifax data
breach?
A.8. In general, the type of fraud that might occur based on
stolen personal identifiers would be ``new account fraud,''
where a criminal would open an account in another person's name
in order to illegally benefit from the account. In these cases
consumers are held harmless as financial institutions absorb
the cost of the fraud and seek redress from there. These cases
are adjudicated in a number of settings and we believe that
each case should be settled based on the facts of the
individual case.
------
RESPONSES TO WRITTEN QUESTIONS OF CHAIRMAN CRAPO
FROM MARC ROTENBERG
Q.1. What is the most effective action a consumer can take to
protect against identity theft if the consumer's information
has been compromised? Please include a detailed description of
the differences between credit freezes, credit locks, and fraud
alerts, including how long each takes to activate and
deactivate and the relative benefits and drawbacks of each.
A.1. As I stated in my testimony, the central problem is that
consumers lack control over their credit reports. The only way
to fix this problem is to enact legislation that allows
consumers to affirmatively opt-in, i.e., a national credit
``freeze,'' before their credit reports are disclosed to
others. The current default settings are backwards. A
consumer's credit file is automatically available to anyone
unless the consumer takes costly and burdensome steps to
prevent access. This increases the risk of identity theft.
Credit reporting agencies are not incentivized to make it easy
for consumers to freeze or lock their credit because they
profit from selling consumer data. Therefore, legislation is
necessary protect consumers from identity theft. The market
does not solve this problem. With that said, here are the
current options that consumers have:
Credit freezes: A credit freeze is the most effective
action a consumer can take to protect against identity theft. A
credit freeze prevents the release of a consumer's credit
report unless the consumer chooses to affirmatively release the
report using a PIN number or passphrase, preventing hackers
from opening new lines of credit in the consumer's name. \1\
However, credit freezes are burdensome and costly. \2\
Consumers must contact all three credit bureaus and pay a fee
to each company each time they wish to freeze and unfreeze
their credit. \3\ Equifax has apparently offered free credit
freeze services after its breach, \4\ but this offer expires
January 31, 2018. \5\ And consumers must still contact Experian
and TransUnion and pay both companies a fee to freeze their
credit if they wish to protect themselves after the Equifax
breach. For most consumers, the cost is $5 to $10 per credit
reporting agency each to freeze or unfreeze their credit
report, depending on their State's laws. \6\ Currently, only
four States (Indiana, Maine, North Carolina, and South
Carolina) mandate free credit freezes and ``thaws,'' while four
other States mandate free credit freezes but allow companies to
charge for thaws. \7\
---------------------------------------------------------------------------
\1\ Lisa Weintraub Schifferle, ``Free Credit Freezes From
Equifax'', Fed. Trade Comm'n., (Sep. 19, 2017), https://
www.consumer.ftc.gov/blog/2017/09/free-credit-freezes-equifax.
\2\ Rohit Chopra, ``What Should I Do About the Massive Data Breach
at Equifax?'' Consumer Federation of America (Sep. 8, 2017), http://
www.idtheftinfo.org/index.php?option=com
content&view=article&id=126&Itemid=10.
\3\ Schifferle, supra, n. 1.
\4\ Ron Lieber, ``Equifax Calls for Free Credit Locks. Experian's
Reply? Nope.'', New York Times, (Oct. 4, 2017), https://
www.nytimes.com/2017/10/04/your-money/equifax-experian-credit-
locks.html
\5\ Lisa Weintraub Schifferle, ``Free credit freezes from
Equifax'', Fed. Trade Comm'n., (Sep. 19, 2017), https://
www.consumer.ftc.gov/blog/2017/09/free-credit-freezes-equifax.
\6\ Id.
\7\ U.S. PIRG, ``Interactive Map Shows Consumers in 42 States Have
No Access to Free Credit Freezes'' (Oct. 2, 2017), https://uspirg.org/
news/usp/interactive-map-shows-consumers-42-states-have-no-access-free-
credit-freezes.
---------------------------------------------------------------------------
Credit locks: Credit locks are relatively new products.
There is still a lot we don't know about credit lock products,
and even Andrew Smith admitted in his testimony that he was
unfamiliar with them. Based on what we do know, they are
similar to credit freezes, but are not as effective. First, a
credit lock is only temporary, while a credit freeze is
permanent. Equifax began offering ``free credit lock products''
after the date of the breach, but the Equifax product only
locks credit for 12 months. \8\ Equifax announced that it will
begin offering free lifetime credit locking services in 2018,
but we still do not know all the details about this service.
\9\
---------------------------------------------------------------------------
\8\ Id.
\9\ Rob Lieber, ``3 Weeks Later, Equifax Makes a Peace Offering'',
New York Times, (Sep. 27, 2017) https://www.nytimes.com/2017/09/27/
your-money/equifax-credit-freeze-lock-apology.html?_r=O.
---------------------------------------------------------------------------
A second reason why a credit freeze is more effective than
a lock is that a freeze requires a PIN number to ``thaw,'' or
release, one's credit report, whereas many credit locks can be
undone by just clicking a button on a website. \10\ Also, while
some credit lock products are free, TransUnion's product
requires consumers to agree to receive targeted advertisements
from third parties. \11\ Many credit lock products also require
consumers to sign forced arbitration clauses. \12\
---------------------------------------------------------------------------
\10\ Id.
\11\ Id.
\12\ Id.
---------------------------------------------------------------------------
Third, credit freezes are more effective because they are
established by State law. \13\ Credit reporting agencies began
offering credit freezes in the early 2000s after pressure from
State lawmakers and consumer advocates, and freezes are subject
to State regulation. \14\ Credit locks, on the other hand, have
only popped up recently, and these products are not subject to
State regulation. \15\ Because credit freezes are covered by
State law, consumers are protected from any financial liability
if their credit account is fraudulently accessed. \16\
---------------------------------------------------------------------------
\13\ Octavio Blanco, ``The Credit Bureaus Are Pushing Consumers To
Lock Their Credit Instead of Freeze It, But There Are Reasons To Be
Wary'', Consumer Reports, (Sep. 28, 2017), https://
www.consumerreports.org/credit-bureaus/why-credit-freeze-is-better-
than-credit-lock/.
\14\ Lieber, supra, n. 4; ``Public Hearing on Security Freeze'',
New York Senate Standing Committee on Consumer Protection and the
Assembly Standing Committee on Consumer Affairs and Protection (Nov.
21, 2015) (written testimony of the Electronic Privacy Information
Center), https://epic.org/privacy/idtheft/nystate11.21.05.html.
\15\ Lieber, supra, n. 4.
\16\ Blanco, supra, n. 13.
---------------------------------------------------------------------------
Credit bureaus have been pushing consumers into credit lock
products after the Equifax breach, citing their convenience:
activating and lifting a credit freeze typically takes 24 to 48
hours. \17\ However, credit locks still require a consumer to
purchase the service from all three credit bureaus in order to
be effective, and Equifax's credit lock also takes 24 to 48
hours to be processed. \18\
---------------------------------------------------------------------------
\17\ Id.
\18\ Id.
---------------------------------------------------------------------------
Fraud alerts: A fraud alert is the least protective option,
though it should still be freely available to all consumers.
Fraud alerts won't freeze the consumer's credit, but they will
tell anyone who runs the consumer's credit to notify the
consumer before opening a new account. \19\ Most fraud alerts
are free but they end after 90 days, however there are also
``extended'' 7-year fraud alerts, which require filing an
identity theft report. \20\ Fraud alerts are not the most
effective tool to prevent identity theft; because they do not
prevent a consumer's credit report from being pulled, a
criminal may still be able to improperly obtain credit in a
consumer's name. On the other hand, a fraud alert well help a
consumer identify suspicious activity.
---------------------------------------------------------------------------
\19\ EPIC, ``Identity Theft and Domestic Abuse'', https://
epic.org/privacy/dv/identity_theft.html.
\20\ Id.
Q.2. Many States have laws requiring credit bureaus to provide
credit freezes. Can you describe what these laws generally
require and discuss whether it is appropriate for Congress to
---------------------------------------------------------------------------
create a Federal standard?
A.2. State credit freeze laws give consumers the right to place
a security freeze on their credit reports. These laws set the
fees that credit bureaus are permitted to charge consumers to
place and to lift freezes on their credit reports. Generally,
there is no charge for identity theft victims and a fee for all
others. The fee is typically $10 but is less in some States.
Some States also mandate free credit freezes for protected
categories of consumers, such as: spouses of identity theft
victims, minors, consumers over 65 years of age, active duty
military members, and victims of domestic violence. \21\ Some
States (Maine, South Carolina, Indiana, and North Carolina)
have prohibited fees to both place and remove freezes for all
of their citizens. \22\ State laws also specify the length of
the freeze: it can either be permanent (until lifted by the
consumer) or it can expire after a certain period of time. In
three States, a freeze will automatically expire after 7 years.
\23\
---------------------------------------------------------------------------
\21\ ConsumersUnion, ``Consumers Union's Guide to Security Freeze
Protection'', http://consumersunion.org/research/consumers-unions-
guide-to-security-freeze-protection-2/.
\22\ Id.
\23\ Id.
---------------------------------------------------------------------------
Congress should enact Federal baseline legislation that
would make free credit freezes the default for all consumers.
Fees are more expensive than they appear. In order to be
effective, a consumer must place a freeze on her credit report
at all three bureaus: Equifax, TransUnion, and Experian. This
means that it typically costs consumers $30 to freeze their
credit and another $30 to remove the freeze later. A Federal
standard prohibiting the credit bureaus from charging consumers
for credit ``freezes'' and ``thaws'' would give consumers
greater control over their personal financial information and
prevent companies such as Equifax from profiting from their own
malfeasance. Additionally, any Federal standard should not
preempt State laws. States have long been the innovators for
consumer protection and many of the best Federal laws are
derived from earlier State experiments. California passed the
first data breach notification law in the U.S. in 2002, \24\
and now 47 more States, the District of Columbia, Guam, Puerto
Rico, and the Virgin Islands have all enacted similar
legislation. \25\ Federal preemption could have the perverse
effect of removing stronger State protections and then expose
consumers to higher levels of data breach and identity theft.
---------------------------------------------------------------------------
\24\ California S.B. 1386, http://www.leginfo.ca.gov/pub/O1-02/
bilUsen/sb_1351-1400/sb_1386_ bill_20020926_chaptered.pdf.
\25\ National Conference of State Legislatures, ``Security Breach
Notification Laws'' (Apr. 12, 2017), http://www.ncsl.org/research/
telecommunications-and-information-technology/security-breach-
notification-laws.aspx.
---------------------------------------------------------------------------
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR BROWN
FROM MARC ROTENBERG
Q.1. In his testimony, Andrew Smith implied that if Americans
had the right to make consumer reporting agencies delete their
data, consumers would use this right to ``selectively delete''
negative but accurate information. Do you believe this is a
significant risk? To the extent that it is a risk, are there
ways in which the law could mitigate the risk?
A.1. The right of individuals to limit access to true private
facts is well established in U.S. law. This is done in the
financial services sector to give individuals, even those who
have suffered bankruptcy, the chance to start over. \1\ This is
done in the criminal justice system to ensure that potentially
stigmatizing information does not create obstacles to
employment. \2\
---------------------------------------------------------------------------
\1\ The FCRA requires bankruptcies to be removed from credit
reports after 10 years. 15 U.S.C. 1681c.
\2\ See, e.g., EPIC, ``Expungement'', https://epic.org/privacy/
expungement/ (Forty-five States and the District of Columbia provide
for expungement for some ex-offenders or other similar relief.); G.D.
v. Kenny, 15 A. 3d 300,205 NJ 275, https://epic.org/amicus/
gd_v_kenny.html; See also, National Employment Law Center, ``Ban the
Box: U.S. Cities, Counties, and States Adopt Fair Hiring Practices'',
(Aug. 1, 2017), http://www.nelp.org/publication/ban-the-box-fair-
chance-hiring-state-and-local-guide/.
---------------------------------------------------------------------------
Data brokers do not have a ``right'' to obtain private
facts about American consumers. But consumers should certainly
have a right to know what information about them is collected
and sold by private businesses. At present, the data broker
industry is entirely upside down, recognizing little privacy
for consumers, but claiming great secrecy for itself.
Andrew Smith's statements made clear that credit bureaus
are concerned about not having every piece of financial
information about consumers, yet consumers do not have access
to all the data the credit bureaus have collected about them.
That is entirely backwards. Even more worrisome is that much of
the information that data brokers sell about consumers is
itself not accurate. That is where the real risk arises because
consumers are denied loans, job, and other opportunities
because of errors in credit reports provided by credit
reporting agencies.
To mitigate that risk, reform of the credit reporting
industry would begin by imposing an accuracy requirement on
data brokers.
Q.2. In his testimony, Andrew Smith stated that consumers have
access to ``all of the information on file about them with
consumer reporting agencies.'' Is that true? Please provide a
list of all types of data collected by the three national
consumer reporting agencies and their affiliates that is not
contained in the free credit report that consumers can obtain
under FCRA. How do the consumer reporting agencies collect this
data? Is there a risk that these data may be inaccurate or
vulnerable to a cybersecurity breach?
A.2. Andrew Smith's statement that consumers have access to
``all of the information on file about them with consumer
reporting agencies'' is false because the credit report that
consumers can obtain under FCRA does not contain all of the
information about the consumer in possession of the credit
reporting agency. The Work Number, an Equifax subsidiary, has a
database of 190 million employment and salary records covering
more than one-third of U.S. adults. \3\ The company collects
data from human resources departments that can include weekly
paystub information, unemployment claims, and information about
insurance and health care providers. \4\ This information is
not included in the credit reports consumers obtain under the
FCRA.
---------------------------------------------------------------------------
\3\ Bob Sullivan, ``Archive: Exclusive: Your Employer May Share
Your Salary, and Equifax Might Sell That Data'', (March 10, 2016),
https://bobsullivan.net/archive/archive-exclusive-your-employer-may-
share-your-salary-and-equifax-might-sell-that-data/.
\4\ Id.
---------------------------------------------------------------------------
Perhaps the most crucial type of data missing from free
credit reports that consumers can obtain under FCRA is credit
scores which is used to determine credit ratings. While FCRA
gives consumers the right to get their credit score from the
national credit reporting companies, companies charge for the
scores. \5\ Earlier this year the consumer reporting agencies
entered a consent agreement with the CFPB for advertising
credit scores to consumers as free or costing one dollar and
then charging for credit monitoring services. \6\ FICO has
disclosed the approximate weight of the categories but the
relative importance of the categories is not the same for all
consumers, particularly for those who have not been using
credit long. \7\ It currently costs a consumer $59.85 for a
report from FICO that contains the credit scores from all three
bureaus and a list of the ``top factors'' that affect their
personal FICO scores. \8\ FICO charges a $29.95 monthly
subscription fee for a product that allows consumers to track
changes in their credit scores. \9\ There are ways for
consumers to access their credit scores for free, such as
CreditKarma, but these services are not cost-free; they make
their money by collecting still more consumer data and
promoting loans and credit cards to consumers based on their
financial information. \10\ FICO scores are used by 90 percent
of top lenders. \11\ Consumers should not have to choose
between costly services and invasive profiling to obtain their
scores.
---------------------------------------------------------------------------
\5\ FTC, ``Credit Scores'', https://www.consumer.ftc.gov/articles/
0152-credit-scores.
\6\ Bob Sullivan, ``Equifax, Trans Union Will Pay Fines, Refunds
To Settle Charges They Deceptively Marketed Free Credit Scores and
Credit Reports'', (Jan. 3, 2017), https://bobsullivan.net/gotchas/
equifax-trans-union-will-pay-fines-refunds-to-settle-charges-it-
deceptively-marketed-free-credit-scores-and-credit-reports/.
\7\ myFICO, ``What's in My FICO Scores'', http://www.myfico.com/
credit-education/whats-in-your-credit-score/.
\8\ my FICO, https://www1.myfico.com/products/onetimereports.
\9\ my FICO, https://www1.myfico.com/products/fico-credit-
monitoring.
\10\ CreditKarma, ``About Us'', https://www.creditkarma.com/about.
\11\ myFICO, ``What Is a FICO Score?'', http://www.myfico.com/
credit-education/credit-report-credit-score-articles/.
---------------------------------------------------------------------------
Still, it is not possible for us to know the full extent of
the data collected by the consumer reporting agencies, because
the law only requires them to disclose credit reports, not the
complete dossiers they keep on consumers. A more comprehensive
data protection approach would allow consumers to know what
companies know about them.
Regarding data accuracy, much of the consumer data
maintained by the credit reporting agencies is inaccurate. In
2016, the Consumer Financial Protection Bureau received more
complaints about credit reports than about any other topic:
more than 43,000, or about 23 percent of the total 186,000
complaints. \12\ The majority of the complaints about credit
reports--about 74 percent--concerned reports of incorrect
information. \13\ There is a high rate of errors in credit
reports that consumers have a right to access under the FCRA.
It would stand to reason that errors are more prevalent in data
that consumers do not have a legal right to access or correct.
An FTC study found that of those consumers with disputed
information on their account, 50 percent planned to abandon
their dispute. \14\ This suggests that the credit bureaus make
it too difficult for consumers to correct misinformation on
their credit reports, causing many consumers to give up. \15\
Greater transparency in the industry is needed to know the
extent of these risks.
---------------------------------------------------------------------------
\12\ Maria Lamagna, ``Consumers' No. 1 Complaint: Errors on Their
Credit Reports'', MarketWatch (Jan. 11, 2017), https://
www.marketwatch.com/story/consumers-no-1-complaint-errors-on-their-
credit-reports-2017-01-10.
\13\ Id.
\14\ FTC, ``Report to Congress Under Section 319 of the Fair and
Accurate Credit Transactions Act of 2003'', (Jan. 2015), https://
www.ftc.gov/system/files/documents/reports/section-319-fair-accurate-
credit-transactions-act-2003-sixth-interim-final-report-federal-trade/
150121factareport.pdf.
\15\ Bob Sullivan, ``Frustrated by Red Tape When Fighting Credit
Report Errors, Many Consumers Just Give Up, FTC Study Suggests'' (Jan.
26, 2015),https://bobsullivan.net/gotchas/frustrated-by-red-tape-when-
fighting-credit-report-errors-many-consumers-just-give-up-ftc-study-
suggests/.
---------------------------------------------------------------------------
Regarding the risk of cyberattacks and data breach, the
Equifax breach is the latest and most egregious data breach by
a credit reporting agency, but the industry has a history of
poor cybersecurity practices. This September, Experian failed
to protect credit freeze pins. \16\ Two years ago Experian
exposed the records of 15 million T-Mobile customers, which
included names, addresses, SSNs, dates of birth, identification
numbers (passport, DL, military ID). \17\ Last year identity
thieves stole tax and salary data from more than 431,000 people
from Equifax. \18\ Equifax improperly disclosed credit reports
due to ``technical error'' in a separate incident. \19\
---------------------------------------------------------------------------
\16\ Brian Krebs, ``Experian Site Can Give Anyone Your Credit
Freeze PIN'', Krebs on Security (Sept. 21, 2017), https://
krebsonsecurity.com/2017/09/experian-site-can-give-anyone-your-credit-
freeze-pin/.
\17\ Brian Krebs, ``Experian Breach Affects 15 Million
Consumers'', Krebs on Security (Oct. 2, 2015), https://
krebsonsecurity.com/2015/10/experian-breach-affects-15-million-
consumers/; U.S. PIRG, ``Letter to CFPB and FTC on Experian/T-Mobile
Data Breach'' (Oct. 8, 2015), https://uspirg.org/resources/usp/letter-
cfpb-ftc-experiant-mobile-data-breach.
\18\ Brian Krebs, ``Crooks Grab W-2s From Credit Bureau Equifax'',
Krebs on Security (May 6, 2016), http://krebsonsecurity.com/2016/05/
crooks-grab-w-2s-from-credit-bureau-equifax/.
\19\ ``Equifax Discloses Data Breach Due to Technical Error During
Software Change'' (Apr. 9, 2015), https://www.databreaches.net/equifax-
discloses-data-breach-due-to-technical-error-during-software-change/.
---------------------------------------------------------------------------
TransUnion has suffered several breaches through
compromised client logins. \20\ These are only a few examples
of the data breach problem rampant at consumer reporting
agencies. \21\ Any information held by these agencies is
vulnerable to security breaches.
---------------------------------------------------------------------------
\20\ Privacy Rights Clearinghouse, ``TransUnion Data Breaches'',
https://www.privacyrights.org/data-breaches?title=transunion.
\21\ See, e.g., Privacy Rights Clearinghouse, ``Experian Data
Breaches'', https://www.privacyrights.org/data-breaches?title=experian;
DataBreaches.Net, ``Equifax Mistakenly Sends Woman 300 Other People's
Credit Reports'', (Mar. 20, 2015) https://www.databreaches.net/equifax-
mistakenly-sends-woman-300-other-peoples-credit-reports/; Jose
Pagliery, ``Your Personal Information Just Isn't Safe'', CNN (July 28,
2014), http://money.cnn.com/2014/07/25/technology/security/target-
experian/index.html (reporting an incident where an individual in
Vietnam purchased reports through subsidiary account and sold
consumers' information to criminals abroad); Graham Cluley, ``Equifax
and Transunion Say Hackers Stole Celebrity Credit Reports'', Naked
Security (Mar. 12, 2013), https://nakedsecurity.sophos.com/2013/03/12/
equifax-and-transunion-say-hackers-stole-celebrity-credit-reports/.
Q.3. In his testimony, Andrew Smith counseled against requiring
disclosure related to consumer reporting agencies' use of
algorithms, calling it a ``question of probabilities and
statistics.'' Is it possible that consumer reporting agencies
have used these ``probabilities and statistics'' to
discriminate on the basis of race, sex, sexual orientation,
gender identity, or otherwise (e.g., by using certain/actors as
---------------------------------------------------------------------------
a proxy for race)?
A.3. Evidence strongly suggests that consumer scoring
mechanisms have widespread discriminatory impacts. \22\
Algorithms reflect and reinforce the historical discrimination
that is present in the data sets they rely on, as well as the
human biases of the individuals who develop them. \23\ For
example, algorithms used in the criminal justice system to
predict recidivism rates are based on data sets that are
heavily skewed against black defendants. \24\ A 2016
investigation by ProPublica found that one particular scoring
system labeled black defendants as future criminals at almost
twice the rate of white defendants, and yet these scores were
unreliable in actually predicting future crime. \25\
---------------------------------------------------------------------------
\22\ See, Frank Pasquale, The Black Box Society 8 (2015); Danielle
Keats Citron and Frank Pasquale, ``The Scored Society: Due Process/or
Automated Predictions'', 89 Wash. L. Rev. 1 (2014).
\23\ Cathy O'Neil, Weapons of Math Destruction (2016).
\24\ EPIC, ``Algorithms in the Criminal Justice System'', https://
epic.org/algorithmic-transparency/crim-justice/.
\25\ Julia Angwin, Jeff Larson, Surya Mattu, and Lauren Kirchner,
``Machine Bias'', ProPublica, (May 23, 2016), https://
www.propublica.org/article/machine-bias-risk-assessments-in-criminal-
sentencing.
---------------------------------------------------------------------------
Algorithms have also allowed advertisers to engage in
racial targeting. Facebook's algorithms, for example, allowed
marketers for the film ``Straight Outta Compton'' to show
different advertisements to users based on their ``racial
affinity''. \26\ And there is evidence that Russian
interference in the 2016 election involved targeting specific
racial groups with racially charged political ads on Facebook.
\27\
---------------------------------------------------------------------------
\26\ Alex Hem, ``Facebook's `Ethnic Affinity' Advertising Sparks
Concerns of Racial Profiling'', The Guardian (Mar. 22, 2016), https://
www.theguardian.com/technology/2016/mar/22/facebooks-ethnic-affinity-
advertising-concerns-racial-profiling.
\27\ Adam Entous, Craig Timberg, and Elizabeth Dwoskin, ``Russian
Operatives Used Facebook Ads To Exploit America's Racial and Religious
Divisions'', Washington Post, (Sep. 25, 2017), https://
www.washingtonpost.com/business/technology/russian-operatives-used-
facebook-ads-to-exploit-divisions-over-black-political-activism-and-
muslims/2017/09/25/4a011242-a21b-11e7-adel-
76d06ld56efa_story.html?utm_term=.31a7889a3ca0.
---------------------------------------------------------------------------
Algorithms in the consumer lending context may also violate
the law. \28\ The Equal Credit Opportunity Act prohibits
lenders from basing credit decisions on factors that have a
discriminatory impact on protected groups and are unrelated to
creditworthiness. \29\ In the run-up to the housing crisis,
mortgage lenders engaged in widespread targeting of minority
borrowers for subprime loans. \30\ In subsequent lawsuits, Home
Mortgage Disclosure Act data revealed that brokers were basing
lending decisions on variables that, although facially race-
neutral, had significant discriminatory impacts on equally
creditworthy minority borrowers. \31\ After the housing bubble
burst, this discrimination had catastrophic impacts on minority
communities. \32\
---------------------------------------------------------------------------
\28\ Citron and Pasquale, supra, n. 47.
\29\ 15 U.S.C. 1601 et seq.
\30\ Consumer Fin. Prot. Bureau, ``CFPB Director Richard Cordray's
Prepared Lecture on Economic Rights as Civil Rights at Michigan State
University'', (Oct. 10, 2014), https://www.consumerfinance.gov/about-
us/newsroom/cfpb-director-richard-cordrays-prepared-lecture-on-
economic-rights-as-civil-rights-at-michigan-state-university/.
\31\ See, e.g., Miller v. Countrywide Bank, N.A., 571 F. Supp. 2d
251 (D. Mass 2008); Ramirez v. GreenPoint Mortg. Funding, Inc., 633 F.
Supp. 2d 922 (N.D. Cal. 2008).
\32\ CFPB, supra, n. 55.
---------------------------------------------------------------------------
If credit reporting agencies are permitted to score
consumers using secret, proprietary algorithms, then it is
impossible to know whether these algorithms violate the law.
Empirical evidence demonstrates that credit scores
statistically disadvantage protected groups. \33\ Numerous
studies have demonstrated that black and Latino communities
have lower credit scores as a group than whites. \34\ Credit
scores by their very nature ``bake in and perpetuate past
discrimination''; they judge consumers based on their histories
and consequently limit or expand their future ability to obtain
wealth-building assets such as a home, a small business loan,
or even a job. \35\ Evidence strongly links the current
disparity in assets between white and minority communities to
the disparity in credit scores. \36\
---------------------------------------------------------------------------
\33\ Citron and Pasquale, supra, n. 47.
\34\ See, e.g., Consumer Fin. Prot. Bureau, ``Analysis of
Differences Between Consumer- and Creditor-Purchased Credit Scores'',
(Sept. 18, 2012), http://files.consumerfinance.gov/f/
201209_Analysis_Differences_Consumer_Credit.pdf.
\35\ ``Past Imperfect: How Credit Scores and Other Analytics `Bake
In' and Perpetuate Past Discrimination'', National Consumer Law Center,
(May 2016), https://www.nclc.org/images/pdf/credit_discrimination/
Past_Imperfect050616.pdf.
\36\ Id.
---------------------------------------------------------------------------
Yet current law does not allow regulators or the courts to
scrutinize these scores to determine whether they violate ECOA.
\37\ Although consumers have the right to request their credit
scores, they do not have the right to know how this score is
determined. ECOA's Regulation B requires lenders to state the
``specific reasons'' for an adverse lending decision--such as a
low credit score--but it does not require the credit reporting
agencies to disclose how that credit score was calculated. \38\
This means that a credit score might include factors that
violate ECOA. And because the credit reporting agencies do not
directly interact with consumers, consumers have been unable to
maintain lawsuits against the CRAs for violating ECOA. \39\
Moreover, using credit scores in the employment context may
violate Title VII because there is no evidence to suggest that
credit history is a valid predictor of job performance. \40\
---------------------------------------------------------------------------
\37\ Citron and Pasquale, supra, n. 47.
\38\ 12 CFR Part 1002; Citron and Pasquale, supra, n. 47.
\39\ ECOA only permits borrowers to maintain actions against the
entities making the lending decisions. See, e.g., Arikat v. JPMorgan
Chase & Co., 430 F. Supp. 2d 1013 (N.D. Cal. 2006). HMDA data merely
reports the credit score of the borrower, allowing plaintiffs to
determine only whether minority borrowers with equal credit scores
received disparate treatment. See, e.g., Miller v. Countrywide, 571 F.
Supp. 2d at 254.
\40\ National Consumer Law Center, supra, n. 60.
---------------------------------------------------------------------------
``Algorithmic transparency'' is key to corporate
accountability in the data industry. \41\ Without legislation
requiring companies to disclose their scoring methods, we have
no way of knowing whether unlawful discrimination is built into
these algorithms that determine opportunities for credit,
employment, housing, and more.
---------------------------------------------------------------------------
\41\ EPIC, ``Algorithmic Transparency'', https://epic.org/
algorithmic-transparency/.
Q.4. The Privacy Act of 1974 imposes various restrictions on
Federal agencies' collection, maintenance, use, and
dissemination of information about individuals. Do these
restrictions generally protect individuals' data more than the
restrictions imposed on private enterprises? If so, does it
make sense that consumers enjoy these protections against the
---------------------------------------------------------------------------
Federal Government but not against private organizations?
A.4. As originally conceived, the Privacy Act of 1974 would
have provided privacy protections for databases in the both the
public sector and the private sector. However, negotiations
with the White House led to the removal of provisions to cover
the private sector. \42\ As a consequence, individuals in
United States generally enjoy stronger privacy protections on
data collected by the Federal Government than the private
sector, though it is worth noting that the Fair Credit
Reporting Act of 1970 preceded the Privacy Act and was viewed
at the time as the first modern privacy law, i.e., a response
to the growing automation of personal data, in the United
States.
---------------------------------------------------------------------------
\42\ EPIC, ``The Privacy Act of 1974, https://epic.org/privacy/
1974act/; Robert Ellis Smith, ``Gerald Ford: Privacy's Godfather'',
Forbes (Jan. 5, 2017), https://www.forbes.com/2007/01/04/privacy-
protection-ford-oped-cxresO105privacy.html
---------------------------------------------------------------------------
The Privacy Act is based on the Code of Fair Information
Practices. \43\ The FIPs serve as the starting point for modern
privacy law. The FIPs assign rights and responsibilities in the
collection and use of personal data. \44\ Since the data is
transferred from the individual to the organization, the
responsibilities are necessarily assigned to the organization,
such as the business or Government agency, and the rights are
given to the individual, as consumer or citizen.
---------------------------------------------------------------------------
\43\ ``The Code of Fair Information Practices'', EPIC, https://
epic.org/privacy/consumer/code_fair_info.html.
\44\ Marc Rotenberg, ``Fair Information Practices and the
Architecture of Privacy'', 2001 Stan. Tech. L. Rev. 1.
---------------------------------------------------------------------------
The FIPs appear in many privacy laws in the United States,
such as the Privacy Act of 1974. The FIPS are also found in
privacy laws and frameworks, such as the Organization for
Economic Cooperation and Development (OECD) Privacy Guidelines
\45\ and the European Commission's Data Protection Regulation.
\46\ Paradoxically, this common approach to privacy protection
helps enable international data transfer.
---------------------------------------------------------------------------
\45\ ``OECD Guidelines on the Protection of Privacy and Trans
border Flows of Personal Data'', available at http://www.oecd.org/
document/18/0,3343,en--2649_34255_1815186_1_1_1_
1,00.html.
\46\ Proposal for a Regulation of the European Parliament and the
Council on the protection of individuals with regard to the processing
of personal data and the free movement of such data (General Data
Protection Regulation), E.C. COM (2012) final, (Jan. 25, 2012),
available at http://ex.europa/eu/justice/data-protection/document/
review2012/com_2012_11_en.pdf.
---------------------------------------------------------------------------
The problem today in the U.S. is that technology and
business practices have outpaced our legal protection. That is
why we are experiencing rocketing levels of data breach,
identity theft, and financial fraud. That is also why our
trading partners are increasingly apprehensive about sending
the personal data of their citizens to the United States.
As the Equifax breach demonstrated, there is an urgent need
to update U.S. privacy laws.
Q.5. Would you recommend extending any of the principles
embodied in the Privacy Act of 1974, such as the ``no
disclosure without consent'' rule, to private organizations?
A.5. We would recommend extending all of the principles in the
Privacy Act to the private sector. The reasons are made clear
by the Findings section of the Act. As Congress explained:
1. the privacy of an individual is directly affected by the
collection, maintenance, use, and dissemination of
personal information by Federal agencies;
2. the increasing use of computers and sophisticated
information technology, while essential to the
efficient operations of the Government, has greatly
magnified the harm to individual privacy that can occur
from any collection, maintenance, use, or dissemination
of personal information;
3. the opportunities for an individual to secure employment,
insurance, and credit, and his right to due process,
and other legal protections are endangered by the
misuse of certain information systems;
4. the right to privacy is a personal and fundamental right
protected by the Constitution of the United States; and
5. in order to protect the privacy of individuals identified
in information systems maintained by Federal agencies,
it is necessary and proper for the Congress to regulate
the collection, maintenance, use, and dissemination of
information by such agencies. \47\
---------------------------------------------------------------------------
\47\ Privacy Act of 1974, 93 P.L. 579; 88 Stat. 1896.
The purposes of the Privacy Act, as set out by Congress in
---------------------------------------------------------------------------
1974, apply equally to private sector record systems:
b. The purpose of this Act * * * is to provide certain
safeguards for an individual against an invasion of
personal privacy by requiring Federal agencies, except
as otherwise provided by law, to--
1. permit an individual to determine what records pertaining
to him are collected, maintained, used, or disseminated
by such agencies;
2. permit an individual to prevent records pertaining to him
obtained by such agencies for a particular purpose from
being used or made available for another purpose
without his consent;
3. permit an individual to gain access to information
pertaining to him in Federal agency records, to have a
copy made of all or any portion thereof, and to correct
or amend such records;
4. collect, maintain, use, or disseminate any record of
identifiable personal information in a manner that
assures that such action is for a necessary and lawful
purpose, that the information is current and accurate
for its intended use, and that adequate safeguards are
provided to prevent misuse of such information;
5. permit exemptions from the requirements with respect to
records provided in this Act * * * and
6. be subject to civil suit for any damages which occur as a
result of willful or intentional action which violates
any individual's rights under this Act * * *. \48\
---------------------------------------------------------------------------
\48\ Id.
There are also innovative approaches to privacy protection
that should be adopted. EPIC recently made several
recommendations to the Commission on Evidence-based
Policymaking, including the adoption of privacy-enhancing
techniques (PETs) that minimize or eliminate Personally
Identifiable Information, and the use of schemes that leave
data with the custodial agencies instead of a central
repository. \49\ In brief, here are four key practices that
should apply to the public and private sectors.
---------------------------------------------------------------------------
\49\ Commission on Evidence-based Policymaking: Comments of the
Electronic Privacy Information Center (Nov. 14, 2016), https://
epic.org/apa/comments/EPIC-CEP-RFC.pdf.
---------------------------------------------------------------------------
First, when data is collected by Federal agencies, it is
generally for a specific purpose and its use is limited to that
purpose. When data is collected by private entities, however,
it is often sold to third-parties and used by many entities for
a multitude of purposes that differ vastly from the original
purpose for which it was collected. For example, information
originally collected by a student loan servicer will then
appear on a person's credit report, and it might then be sold
to employment agencies and can eventually serve as the basis to
deny that person a job. \50\ Regulations should limit the use
of data in the private sector to only the purpose for which it
was originally collected. Purpose specification and use
limitation should apply in both the public and private sector.
---------------------------------------------------------------------------
\50\ Cathy O'Neil, Weapons of Math Destruction (2016).
---------------------------------------------------------------------------
Second, private entities should be required to adopt
privacy-enhancing techniques such as data minimization to limit
the amount of personal data that the entity collects and the
length of time that the entity retains that data. Data should
also be anonymized or de-identified whenever possible. These
techniques help reduce the damage when data breaches occur.
Third, the Privacy Act prohibits the existence of secret
Government databases and requires Government agencies to show
an individual any records kept on him or her (with broad
exceptions for law enforcement activities). \51\ However,
credit reporting agencies rely on secret algorithms that make
it impossible for consumers to know what information is
collected about them and how it is used. In accordance with the
FIPs, consumers should have access to all the data that is
collected about them and should be entitled to know how that
data is--used, including the factors that determine a credit
scores.
---------------------------------------------------------------------------
\51\ EPIC, ``The Privacy Act'', https://epic.org/privacy/1974act/.
---------------------------------------------------------------------------
Fourth, one of the most important aspects of the Privacy
Act is that it restricts the sharing of information between
Government agencies. It does this by limiting ``matching
programs,'' which it defines as the computerized comparison of
databases in order to determine the status, rights, or benefits
of the individuals within those systems of records. In the
private sector, however, personal data is freely transferred
between entities without any regard to individual privacy. In
accordance with our recommendation for a national default
credit freeze, data brokers should not be permitted to sell or
disclose data to third parties without explicit opt-in consent
by the consumer.
The Fair Information Practices make equal sense in the
private sector as in the public sector. Data breaches have
impacted Government and private databases alike, and the more
personally identifiable information that exists across numerous
databases, the easier it is for hackers to commit identity
theft and financial fraud.
Finally, of great concern is the use of an identifier by
the private sector that was originally intended only for the
recording of pension contributions. As I emphasized in my
testimony, the Social Security number was never intended be
used as an all-purpose identifier or an authenticator. The
widespread use of the Social Security number in the private
sector has undoubtedly contributed to the unprecedented levels
of identity theft. That is why we recommend prohibiting the use
of the Social Security number in the private sector without
explicit legal authorization.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR BROWN
FROM CHRIS JAIKARAN
Q.1. Do consumer reporting agencies or their affiliates collect
any information that is not necessarily contained in consumers'
FCRA-guaranteed free credit reports? If so, what types of
information do they collect? Is there a risk that these data
may be inaccurate or vulnerable to a cybersecurity breach?
A.1. CRS was not able to identify in publicly available sources
a complete account of the furnishers of information to credit
reporting agencies, or the type of information that is
furnished. CRS was able to identify elements of a credit
report, and potential sources of the information contained in
those reports.
According to the Consumer Financial Protection Bureau,
information contained in a credit report includes the following
information: \1\
---------------------------------------------------------------------------
\1\ The Consumer Financial Protection Bureau, ``What Is a Credit
Report'', webpage, June 8, 2017, at https://www.consumerfinance.gov/
ask-cfpb/what-is-a-credit-report-en-309/.
Personally identifiable information such as a
person's name, names they have used in the past,
current and former addresses, birth date, Social
---------------------------------------------------------------------------
Security number and telephone numbers;
Credit history information such as current and
former credit accounts and types (e.g., mortgages,
credit cards, etc.), credit limits, account balances,
payment histories, dates accounts were opened and
closed, and information on the creditor;
Collections information such as an account that
currently is, or was, in a collections process;
Public records information such as liens,
foreclosures, bankruptcies, civil suits, or judgments
against a consumer; and
Credit reports may also contain a list of companies
that have sought inquires or accessed a credit report.
According to the Federal Reserve, however, the above data
is only contained in the report, and the credit reporting
company may have additional data on a consumer. The credit
reporting agencies receive credit information on consumers from
banks, credit unions, retailers, utility companies (e.g., oil,
gas, electricity, and water), medical companies and collections
agencies. Some of the information reported to credit reporting
agencies may include non-credit-related information. The
information reported to credit reporting agencies by the
furnishers may be incomplete. Credit reporting agencies may
also collect non-credit-related information from public records
or third parties who aggregate public record information. This
information assists in distinguishing a particular consumer
from another. For example, non-credit-related information
collected by the credit reporting agencies may include driver's
license numbers. Equifax reported that driver's license numbers
were among the accessed information in their data breach. \2\
---------------------------------------------------------------------------
\2\ Equifax, ``Equifax Announces Cybersecurity Incident Involving
Consumer Information'', webpage, September 7, 2017, at https://
www.equifaxsecurity2017.com/2017/09/07/equifax-announces-cybersecurity-
incident-involving-consumer-information/.
---------------------------------------------------------------------------
The data collected by these entities does come with a risk
that the data is inaccurate as the data is submitted to the
credit reporting agencies by the furnishers and may be
inaccurate upon submission or be made out of date soon after
submission. \3\
---------------------------------------------------------------------------
\3\ The Federal Reserve, ``An Overview of Consumer Data and Credit
Reporting'', The Federal Reserve Bulletin, February 2003, pp 47-73.
---------------------------------------------------------------------------
In addition to providing credit reports to consumers and
credit information to financial institutions, credit reporting
agencies may use additional, identifying information about
consumers to develop authentication services for companies
seeking to verify that a consumer is who they purport to be.
This form of authentication, also known as identity-proofing or
knowledge-based authentication, seeks to verify a consumer
through that consumer answering questions only the consumer
would have a high likelihood of knowing. Such information may
include date of birth, Social Security number, address where
the consumer has resided, and driver's license number.
Because the credit reporting agencies hold this data
digitally, the data is at risk of a cybersecurity breach. The
type and extent of that risk, and the ways the credit reporting
agencies may mitigate cybersecurity risks they face is
difficult to assess without fully understanding the credit
reporting agencies' system architecture and data model. The
system architecture will inform the entity of how they have
built their systems, what versions of hardware and software run
on their networks, and how their information technology
connects. The data model will inform the entity of what data
they have, how they acquire that data, what data they generate,
and where their data flows. Understanding those would help
develop a data-centric threat model to assess risks, develop
ways to address potential attacks against that data, and defend
against them.
Q.2. What kinds of technological solutions to the GDPR's
compliance requirements exist? More generally, how can
companies leverage technology to comply with privacy
regulations and protect consumers' personal information?
A.2. The General Data Protection Regulation (GDPR) was approved
by the European Union (EU) Parliament on April 14, 2016, and
will go into enforceable effect on May 25, 2018. The GDPR
establishes consumer rights to data and regulations for how
data shall be treated by companies. The GDPR establishes the
following requirements for data on entities using and
processing data on EU citizens: \4\
---------------------------------------------------------------------------
\4\ The European Union, ``GDPR Portal'', website, http://
www.eugdpr.org/eugdpr.org.html.
The regulation applies to data on EU citizens,
regardless of whether the entity processing that data
---------------------------------------------------------------------------
is in the EU or not;
Penalties for breaching the terms of the GDPR can
be up to 4 percent of the company's annual profit, or
20 million euros, whichever is greater;
Consumers must receive clear, plain language
consent agreements, and must be able to withdraw their
consent in a way that is as easy for them to give it;
and
Entities collecting and processing data on EU
citizens must consider privacy of that data by design,
rather than adding privacy protection onto built
systems.
EU citizens (who the GDPR calls ``data subjects'') also
have additional rights to their data, which include the
following: \5\
---------------------------------------------------------------------------
\5\ Ibid.
Data subjects must be informed if their data is
breached in a manner that is likely to result in a risk
that their rights and freedoms may be infringed within
72 hours of the entity first becoming aware of the
---------------------------------------------------------------------------
breach;
Data subjects have the right to access any data
that an entity has collected or created on them, free
of charge;
Data subjects have a right to have data about them,
that is hosted by an entity, be deleted, otherwise
known as the ``Right to be Forgotten''; and
Data subjects have a right to extract their data
from one entity and port it over to another in a
commonly used format.
Commercially available solutions for complying with GDPR
requirements exist today. The following are examples of such
solutions that may help an entity comply with GDPR
requirements:
Systems that can identify and manage data;
Systems to authenticate and manage access to data;
Encryption technology and key management systems to
limit unauthorized access to data;
Systems to track interactions with data subjects,
so they can provide consent, request review and edits
of their data, or deletion of their data; and
Software and hardware that sit on an entity's
network to monitor the network and computers for
security incidents so as to mitigate potential
incidents and alert security teams of incidents.
While the commercial market has solutions available to
entities so they may adhere to the GDPR, entities must evaluate
different technologies and determine which technologies are
most suitable for their individual practices. These evaluations
and determinations are entity-specific, but may be informed by
sector guidance (e.g., health care companies or financial
institutions). Additionally, some entities will have greater
resources to devote to the application of technology, while
others will be constrained. These evaluations may lead to an
entity opting not to collect or process certain data to ease
the entity's resource burden.
While technology is one aspect of privacy and protecting
consumer's personal information, an entity must also determine
their processes for data collection and use, understand their
business needs for data, and establish policies to govern data
within that entity. This exercise also helps an entity
understand the risks it faces, and how it may be able to
address those risks through processes, in addition to
technology.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR REED
FROM CHRIS JAIKARAN
Q.1. Given the major breaches that have exposed so many
Americans' personal information over the past few years,
haven't we learned by now that it's better for a company to
invest in cybersecurity before a breach, rather than scramble
to respond after the fact? Don't companies have more tools than
ever--like the NIST Cybersecurity Framework--to act responsibly
and improve their cybersecurity now?
A.1. The decision to invest in security measures, whether cyber
or physical, is one companies make upon considering various
risk factors. Not fully understanding their data model, the
threats the data they hold may face, the vulnerabilities in
their systems, and the consequences of a cybersecurity incident
may lead a company to under- or over-estimate their risks, or
the risk mitigation strategies the company currently has in
place.
However, going through the exercise of accurately assessing
risk allows companies to make cybersecurity decisions in a
cost-controlled environment. A company can apply the NIST
Framework for Improving Critical Infrastructure Cybersecurity
(Cybersecurity Framework) to their business to work through and
develop a cybersecurity strategy. \1\ The Center for Internet
Security, the International Standards Organization, and ISACA
also publish cybersecurity frameworks which an entity may use
in conjunction with, or in replacement of, the NIST
Cybersecurity Framework. \2\ Once an entity has developed a
cybersecurity strategy, they can then estimate the costs to
implement that strategy, and therefore implement that strategy
under known costs. However, after a security incident, the
costs of response and recovery may be unforeseen and may not be
able to be controlled. From a business operations perspective,
developing and implementing a cybersecurity strategy up front
provides certainty whereas cybersecurity indictment response
and recovery is uncertain.
---------------------------------------------------------------------------
\1\ NIST, ``Cybersecurity Framework'', webpage, at https://
www.nist.gov/cyberframework.
\2\ Cybersecurity frameworks from these organizations can be found
at https://www.cisecurity.org/controls/; https://www.iso.org/standard/
54533.html; and http://www.isaca.org/cobit/pages/default.aspx,
respectively. ISACA was previously known as the Information Systems
Audit and Control Association, but now goes by its acronym only.
Additional Material Supplied for the Record
LETTER FROM JIM NUSSLE, PRESIDENT AND CHIEF EXECUTIVE OFFICER, CREDIT
UNION NATIONAL ASSOCIATION
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
LETTER FROM JOHN A. KOSKINEN, COMMISSIONER, INTERNAL REVENUE SERVICE
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
LETTER FROM CARRIE R. HUNT, EXECUTIVE VICE PRESIDENT OF GOVERNMENT
AFFAIRS AND GENERAL COUNSEL, THE NATIONAL ASSOCIATION OF FEDERALLY-
INSURED CREDIT UNIONS
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]