Consumer Law & Policy Blog

« August 2017 | Main | October 2017 »

Wednesday, September 20, 2017

Holding Equifax Accountable

Last week, in an opinion piece in the Washington Post, WashU law professor Danielle D'Onfro proposed one way to hold Equifax accountable: "some old-fashioned judge-made doctrine." According to D'Onfro, "the data economy has outgrown our consumer protection regulations and we are on our own." She refers to a "Swiss cheese system of regulations that carry sanctions that are far smaller than they look," and, because "[t]hose costs are predictable, . . . companies can treat sanctions for non-compliance as a cost of doing business." In D'Onfro's view, it may be time to "admit that our experiment with prospectively regulating consumer protection has failed and return consumer protection to judges." For historical reference, she points to the judge-made doctrine of strict products liability. For D'Onfro, a robust common law approach is especially needed in "under-regulated fields such as privacy."

I certainly wouldn't say that our statutory consumer protection regime has "failed," but I think many would agree that it's been too slow to address some emerging consumer protection issues, like privacy and data security. The question at the end of the day is, what's the best way to avoid another Equifax from happening? You can bet that companies would improve their data security practices if they knew that they'd be strictly liable for any harm resulting from a breach.

Courts are starting to see Equifax litigation. Apparently, more than 50 class action lawsuits have already been filed, and, as was noted on this blog yesterday, Massachusetts Attorney General Maura Healey filed the nation's first enforcement action. One of the first private class action complaints filed alleges a single claim of negligence under Oregon state law. Obviously, the litigation is just getting started, but we'll soon see how the common law responds to the Equifax breach.

Posted by Mike Landis on Wednesday, September 20, 2017 at 05:56 PM in Credit Reporting & Discrimination, Identity Theft, Privacy | Permalink | Comments (0)

Have the Arbitration Sharks Jumped the Shark?

by Jeff Sovern

On Saturday, I posted an entry, Kaplinsky & Levin Concede "Consumers rarely pursue individual arbitration" But Miss Mark on Why. Maybe it irritated Alan and Mark, because they then posted Professor Sovern Disagrees with Senator Warren and Concedes that Consumers Do Well in Arbitration But Raises Another Red Herring. I guess I should set the record straight in case anybody believed that headline (or cares what I think, something that I have learned from having teenage children not to expect).

First, while I am sure I disagree with Senator Warren about many things (she seems to root for the Patriots, for example), I absolutely agree with her about the value of the CFPB arbitration rule.  Second, I do not concede that consumers do well in arbitration.  As a general matter, I think consumers do better when they can bring class actions than when they unwittingly surrender their class action rights and are limited to arbitration. I would have thought Alan and Mark knew my views on this point, in part because they once wrote an op-ed, titled Consumers Fare Better with Arbitration, responding to an op-ed that I had written.  So I’m at a loss to know why they headlined their post the way they did. I wondered if maybe they were trying, in a tongue in cheek way, to suggest that they had not actually made the concession I said in my post that they had made--by claiming I had conceded something I didn’t concede.  But as their post doesn’t actually contradict my claim that they had conceded that consumers rarely pursue arbitration, I don’t think that was what was going on.

On to substance: Alan and Mark praise the CFPB complaint database in their post, asking “What do class actions accomplish for consumers that is better than this?”  I certainly agree that the complaint database is a positive for consumers. But I don’t think it’s a substitute for class actions. And even if I did, as members of Congress have called for barring public access to the complaints in the database, continued access to that database is far from guaranteed.

Posted by Jeff Sovern on Wednesday, September 20, 2017 at 03:48 PM in Arbitration, Class Actions, Consumer Financial Protection Bureau | Permalink | Comments (0)

Tuesday, September 19, 2017

CFPB sues Top Notch Funding for lying in loan offers to NFL players, Deepwater Horizon victims, and 9/11 first responders

The Consumer Financial Protection Bureau filed suit today against Top Notch Funding and two individuals associated with the company for lying in loan offerings to consumers who were awaiting payment from settlements in legal cases or from victim-compensation funds. These consumers included former National Football League players suffering from neurological disorders, victims of the Deepwater Horizon oil-rig disaster, and 9/11 first responders. In a complaint and proposed consent order filed in federal court, the CFPB is seeking to prevent Top Notch, its owner Rory Donadio, and his business associate John “Gene” Cavalli from offering or providing such products in the future, and to require them to pay $70,000 in civil money penalties.

Details are here.

Posted by Allison Zieve on Tuesday, September 19, 2017 at 04:38 PM | Permalink | Comments (0)

CFPB acts against illegal student-loan debt-collection lawsuits

The Consumer Financial Protection Bureau yesterday took action against the National Collegiate Student Loan Trusts and their debt collector, Transworld Systems, Inc., for illegal student loan debt collection lawsuits. Consumers were sued for private student loan debt that the companies couldn’t prove was owed or was too old to sue over. These lawsuits relied on the filing of false or misleading legal documents. The proposed judgment requires an independent audit of all 800,000 student loans in the National Collegiate Student Loan Trusts’ portfolio. It prohibits the National Collegiate Student Loan Trusts, and any company they hire, from attempting to collect, reporting negative credit information, or filing lawsuits on any loan the audit shows is unverified or invalid. In addition, it requires the National Collegiate Student Loan Trusts to pay at least $19.1 million, which includes initial redress to harmed consumers, relinquished funds to the Treasury, and a civil money penalty. Under a separate consent order, Transworld Systems, Inc. is ordered to pay a $2.5 million civil money penalty.

The CFPB's full press release, along with links to the complaint and consent order, is here.

Posted by Allison Zieve on Tuesday, September 19, 2017 at 04:36 PM | Permalink | Comments (1)

"State, federal authorities proposing new rules on Equifax"

State and federal authorities are proposing tougher regulations against Equifax and the entire credit monitoring industry after the company announced that personal information like Social Security numbers of about 143 million Americans was exposed.

The Washington Post has the story, here.

Posted by Allison Zieve on Tuesday, September 19, 2017 at 04:32 PM | Permalink | Comments (0)

"Opponents Sharpen Knives Over Impending U.S. Payday Loan Rule"

The New York Times reports that "[l]obbyists and Republican lawmakers are gearing up for battle over a new U.S. regulation that is likely to dent profits in the $6 billion short-term, high-interest "payday" loan industry. The Consumer Financial Protection Bureau (CFPB) is expected in coming days to release a long-anticipated rule curbing payday lending, now that a final review by other regulatory agencies has concluded, three people familiar with the matter said. The rule pits the country's consumer financial watchdog against payday lenders who say the new regulation will wipe out much of their established industry, currently overseen by the states, and push poor and rural customers to use illegal loan sharks."

The full article is here.

Posted by Allison Zieve on Tuesday, September 19, 2017 at 04:30 PM | Permalink | Comments (0)

Massachusetts sues Equifax over the hack under its consumer-protection statute

As explained in this detailed press release, Massachusetts Attorney General Maura Healey today filed the nation’s first enforcement action against Equifax alleging that the company failed to protect the personal information of almost three million Massachusetts residents. Healey claims that “that Equifax knew about the vulnerabilities in its system for months, but utterly failed to keep the personal information of nearly three million Massachusetts residents safe from hackers.” “We are suing." she said, "because Equifax needs to pay for its mistakes, make our residents whole, and fix the problem so it never happens again.”

Read the complaint here. If you want details on how and why the data breach occurred, read paragraphs 21 through 49.

The complaint stresses that consumers don't consent to the acquisition and use of their information by credit reporting agencies and, for that reason, those agencies have a heightened duty to protect consumers:

Consumers do not choose to give their private information to Equifax, and they do 
not have any reasonable manner of preventing Equifax from collecting, processing, using, or 
disclosing it. Equifax largely controls how, when, and to whom the consumer data it stockpiles 
is disclosed. Likewise, consumers have no choice but to rely on Equifax to protect their most 
sensitive and personal data. Accordingly, it was and is incumbent on Equifax to implement and 
maintain the strongest safeguards to protect this data. Equifax has failed to do so.

Posted by Brian Wolfman on Tuesday, September 19, 2017 at 01:56 PM | Permalink | Comments (1)

Monday, September 18, 2017

More details on how the Equifax hack happened

This Wall Street Journal report gives more details on how the Equifax hack happened -- more for me, at least.

The report also includes this statement suggesting that Equifax's security is not so great:

Alex Holden, chief information security officer of identity-theft monitoring company Hold Security LLC, says Equifax has long been considered a target for identity thieves. Last week, Hold said it discovered it was possible to access an Equifax-operated employee portal in Argentina by using the easily guessed username and password combination “admin/admin.”

And then there's this passage quoting a speech given just last month by Equifax CEO Richard Smith:

Equifax began as a local firm that gathered and published information about the paying habits of retail store customers. It grew by buying rivals and became a nationwide company. When Mr. Smith, a General Electric Co. veteran, became CEO in 2005, Equifax was a staid company centered on the collection of credit data, according to comments he made last month at a University of Georgia event.Mr. Smith changed that. Equifax branched out to become a larger data provider, purchasing companies that had information about consumers’ bill-paying habits and salary information for employees at large companies. Equifax is now a “world-class, state-of-the-art” technology and data-analysis company, he said at the event last month. Every day, Equifax manages 1,200 times as much data as is in the Library of Congress, he added. “It’s been a fun journey, a journey that we’re all very, very proud of.” 

 

Posted by Brian Wolfman on Monday, September 18, 2017 at 05:16 PM | Permalink | Comments (0)

Saturday, September 16, 2017

Kaplinsky & Levin Concede "Consumers rarely pursue individual arbitration" But Miss Mark on Why

by Jeff Sovern

Earlier this week, Senator Elizabeth Warren issued a press release about the responses she had received from Bank CEOs to her questions about the CFPB's arbitration rule, Responses from Bank CEOs Demonstrate Positive Impact of CFPB Arbitration Rule, Undermine Industry Case for Reversal.  The press release contains a lot of interesting information, but this post is about just a few sentences and the response it elicited. First, the sentences:

[C]onsumers rarely pursue individual arbitration. Of the tens of millions of consumers covered by mandatory arbitration agreements, consumers filed an average of only 616 arbitration cases a year. In contrast, over the five-year period studied by the CFPB, 34 million consumers were eligible to receive more than $1 billion in cash payments from class actions.

Alan Kaplinsky and Mark Levin, of the Ballard Spahr firm, responded with a blog post, Senator Warren’s Numbers Don’t Add Up,  which also included interesting information.  But here's the paragraph I found most intriguing:

Senator Warren’s press release states that “consumers rarely pursue individual arbitration.”  But that is because most consumers resolve disputes through the use of companies’ informal dispute resolution procedures and also through on-line complaint portals provided by federal and state agencies including the CFPB itself.  Moreover, although the CFPB has a Consumer Education and Engagement division and virtually unlimited resources, it did not spend a single dollar trying to educate consumers about arbitration. 

I interpret that as agreement with the statement in the press release about the infrequency of consumers bringing arbitration actions because Messrs. Kaplinsky and Levin have not exactly been shy elsewhere in their blog post about disagreeing with Senator Warren.  And it would be hard to disagree with the Senator's statement in light of the fact that the CFPB, the New York Times, and the Horton\Chandrasekher studies all found exactly the same thing. But what about the Kaplinsky/Levin explanation?  Is it true that informal dispute resolution has obviated consumer arbitration?  If so, why wouldn't that also be true for consumer class actions?  A more plausible explanation is that consumers simply don't bother filing arbitration claims or even complaining to customer service over small amounts. Empirical literature shows just that. See, e.g., Arthur Best & Alan R. Andreasen, Consumer Response to Unsatisfactory Purchases: A Survey of Perceiving Defects, Voicing Complaints, and Obtaining Redress, 11 LAv & Soc'Y REV. 701, (1977). In truth, that problem also bedevils class action claims because many consumers likewise don't file claims forms in the class action context when small amounts are at issue. But that problem goes away when damages are automatically deposited into consumer accounts. In addition, class actions also deter misconduct in a way that arbitration claims don't. In any event, I identified ten problems with the idea that customer service eliminates the need for class actions in a recent article. For a further example, there is no publicly available evidence indicating that consumers injured by Wells Fargo's unauthorized account scandal obtained redress until the regulators reached a consent decree with Wells and the class action settlement was agreed to (it still has not been finalized).  If informal dispute resolution was such an effective way of dealing with that problem, why haven't we heard about it? Wouldn't Wells, which has suffered a huge black eye because of that scandal, have wanted to publicize it?

As for the claim about education, I am not aware of any evidence that consumers can be usefully educated about arbitration.  Teaching people that they can make claims if they want to doesn't change their behavior if they conclude that their winnings won't be worth the effort it takes to get them. 

Finally, I notice that Messrs. Kaplinsky and Levin have not come forward with statistics showing how many consumers who are included in their clients' class action settlements complained to their clients' informal dispute resolvers, and how many never complained. If informal dispute resolution were a satisfactory alternative to class actions, wouldn't class members already have obtained what they were entitled to that way?  And wouldn't the overlap between class action claimants and consumers who used the informal dispute resolution mechanisms be an effective way to show that the class action didn't add value?  Sometimes, silence speaks loudly.

 

 

Posted by Jeff Sovern on Saturday, September 16, 2017 at 06:33 PM in Arbitration, Class Actions, Consumer Financial Protection Bureau | Permalink | Comments (0)

Helaine Olen: Equifax messed up. And yet we have to clean up the mess

Here, in the LA Times. Excerpt:

First, visit the company’s often crashing Web page to check if your information was compromised. Then decide whether to sign up for the one year of free credit monitoring, * * * Next, the personal finance experts said, freeze your credit reports, not just at Equifax, but at its two major competitors, TransUnion and Experian. * * * But that process costs time and money, and you might need to pay a new fee every time you open your report and secure it again.

* * *

Open Secrets reports that Equifax spends about $1 million annually on Washington lobbying, supporting regulation and legislation to reduce the already paltry responsibilities the credit bureaus have to the people whose data it collects. That sort of buck pays off: The morning Equifax announced the hack, the House Financial Services Committee held a hearing on a bill that would severely cut the amount of money a consumer could receive if she successfully filed suit against a credit bureau.

* * *

And it’s not as though Equifax — and the other credit bureaus — are doing their utmost to protect the people whose information it collects. They could do much, much more. * * * 

[M]ake Equifax and the other credit reporting companies do the bloody work. For once.

Posted by Jeff Sovern on Saturday, September 16, 2017 at 05:14 PM in Privacy | Permalink | Comments (0)

« More Recent | Older »