Consumer Law & Policy Blog

House Dems Also Seek Answers on Equifax Breach, Arbitration Clause

by Jeff Sovern

Brian posted earlier about a letter from senators on the Equifax breach. Not to be outdone, the two dozen Democrats on the House Energy and Commerce Committee have written their own letter to Equifax, raising numerous questions about the breach. Among them are queries about the Equifax's arbitration clause, security freeze, credit monitoring services, and how much money Equifax would make if the recipients of the free credit monitoring later extended that service.

Did Equifax execs engage in illegal insider sales of company stock before disclosing the hack of its data?

Read this article by Pete Schroeder. An excerpt:

Thirty-six U.S. senators on Tuesday called on federal authorities to probe the sale of nearly $2 million in shares of credit bureau Equifax Inc by company executives after a massive data breach this summer, and one compared their actions to insider trading. The lawmakers signed a letter asking the Justice Department, Securities and Exchange Commission and Federal Trade Commission to probe about $1.8 million in stock sales by three executives between the time the company learned about the hack and when they made it public. "If that happened, somebody needs to go to jail," Senator Heidi Heitkamp, a Democrat on the Senate Banking Committee, said at a credit union industry conference in Washington. "It's a problem when people can act with impunity with no consequences. How is that not insider trading?"

Some Comments on Recent Op-Eds Opposing the CFPB Arbitration Rule

by Jeff Sovern

I wanted to comment on a couple of op-eds opposing the CFPB arbitration rule.  One is Joseph Cioffi's piece in the American Banker, headlined CFPB arbitration rule will still pose costs to consumers.  Though Cioffi (Chair of the Insolvency, Creditors’ Rights & Financial Products Practice Group at Davis & Gilbert) sees the arbitration rule as having some positive aspects, he believes it will also be "an expensive proposition for banks and consumers alike." He writes:

The Trump administration and GOP-controlled Congress aim to weaken the CFPB’s enforcement powers as part of a larger deregulatory effort. If that occurs, plaintiffs may have a better chance of convincing courts that their class action, versus government action, is the superior method of prosecuting claims. Further, as banks self-regulate according to their own standards in a deregulated environment, market inconsistencies and consumer uncertainty may result in yet more litigation.

That paragraph left me confused.  Cioffi seems to be saying that a weaker CFPB may lead more courts to allow class action to proceed.  But as far as I know, courts shouldn't take the CFPB into account in deciding whether or not to certify a class.  In addition, it sounds as if Cioffi, an apparent opponent of the CFPB rule, is arguing that consumers should be left without any recourse when financial institutions misbehave, except for arbitration, which of course is ineffective as to small claims.  Finally, the last sentence suggests that self-regulation will lead to more litigation.  But self-regulation is essentially voluntary self-restraint; how can that lead to litigation?

Watch this excellent "Sunday Morning" segment on CFPB head Richard Cordray

Consumer Financial Protection Bureau head Richard Cordray was the subject of a story that aired yesterday on CBS's "Sunday Morning" news program. To view it, click here or on the embedded video below. The story depicts Cordray as indefatigable -- and "the best friend the consumer has ever had" -- in the face of constant harassment from congressional republicans. (For an added bonus, watch the video to see a short excerpt from Cordray's highly successful appearance on Jeopardy!)  And if you like to read, go here for the written version of the story.

 

Wells Fargo under the gun for new consumer abuses

Politico reports that, one after "regulators fined Wells Fargo $185 million for opening potentially millions of fake accounts, the bank is nowhere close to putting the scandal behind it. Congress is threatening new hearings, and some Democrats have called on regulators to remove the bank's board or for breaking up the lender entirely. In fact, consumer abuses there are just as fresh in lawmakers' minds as they were a year ago, with new revelations that the scope of the scandal was larger than originally thought and that the bank charged hundreds of thousands of customers for auto insurance they didn’t need. Another group of victims: military veterans."

Politico's full story is here.

"Equifax Hack Exposes Regulatory Gaps, Leaving Consumers Vulnerable"

The New York Times reports:

Equifax warehouses the most intimate details of Americans’ financial lives, from the credit cards in their wallets to the size of their medical bills.

But the company doesn’t face the constant monitoring and auditing that help strengthen banks’ systems and data protections. Despite the wealth of sensitive information in its databases, Equifax, in essence, falls through the regulatory cracks.

The dangers of such lax oversight became apparent on Thursday when Equifax disclosed that hackers had compromised the personal and confidential information, including Social Security numbers, of nearly half of the American population.

The full story is here.

What is the worst that can happen because of the stolen Equifax data?

That's the topic of this article by David Goldman. The article is accompanied by a video that I found useful.

Why I'm Not Signing Up For Equifax's Free Credit Monitoring Service: The Arbitration Clause Still Worries Me

by Jeff Sovern

I'm still trying to make sense of the arbitration situation in connection with the Equifax breach.  Here is how I see it at the moment. Comments welcome.

Our story so far: after hackers invaded the Equifax database, Equifax set up a web site (that is the current version of the web site; it has been changed since yesterday) so consumers could determine whether their data had been hacked.  To do so, consumers had to enter their last name and the last six digits of their Social Security Number (this Times story implies that no matter what you type, you will be told you may have been affected though when I tried it, I was told my data was not affected so that appears not to be so). Equifax also offered free credit monitoring for a year.  The Equifax web site had at the bottom in small print the phrase "Terms of Service." Clicking that yesterday took you to a document running nearly 14,000 words and containing an arbitration clause. This led to an uproar as critics accused Equifax of imposing an arbitration clause on people who merely wanted to learn whether their data had been affected. At some point yesterday Equifax modified its breach landing page to say that its arbitration clause did not apply to people checking to see if their data had been compromised:

NO WAIVER OF RIGHTS FOR THIS CYBER SECURITY INCIDENT
In response to consumer inquiries, we have made it clear that the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident.

 Clicking on the Terms of Service link at the bottom of that page takes you to a page that does not include an arbitration clause. However, the terms of service as of yesterday when I checked did not contain that exclusion.

A separate Experian FAQ, as Scott reported, was also modified to include the following statement:

The arbitration clause and class action wavier included in the TrustedID Premier Terms of Use applies to the free credit file monitoring and identity theft protection products, and not the cybersecurity incident.

Based on that, you would agree to arbitration and the accompanying class action waiver if you accept the free credit monitoring. I can't tell for certain that the credit monitoring includes an arbitration clause because when I attempted to explore further, I was told I couldn't sign up for the free credit monitoring until 9/14; the page that told me so links to the TOS without the arbitration clause but that may not be the TOS that governs the free credit monitoring.  

Am Banker: Equifax breach may kill repeal of CFPB mandatory arbitration rule

Here . Excerpt:

The Equifax revelations come at exactly the wrong time for Republicans, who had been hoping as late as Thursday to rapidly push ahead next week on a vote to overturn the rule. * * *

* * *

The Equifax breach—and its controversial mandatory arbitration clause—could push some . . . Republicans to vote against any repeal.

* * *

One problem that moderate senators have is that any action under the Congressional Review Act would prevent the CFPB from writing another rule on mandatory arbitration clauses. That leaves lawmakers uneasy, and sets them up to take the blame in cases like Equifax.

Amanda Werner, campaign manager at the consumer group Americans for Financial Reform and the liberal watchdog group Public Citizen, said “it is pretty appalling that Equifax would exploit consumers need for identify theft protection in the wake of this crisis they created in order to avoid accountability.

Signing up for Equifax May Cost You Your Legal Rights.

Worried you may be affected by Equifax's massive data breach? The credit bureau has set up a site, equifaxsecurity2017.com, that allows you to check whether your personal information was exposed and sign up for credit monitoring. But regulators and lawyers are becoming concerned that the site could pose risks to consumers. As a result, you may want to think twice about using it. What's the risk--a hidden arbitration/class action waiver clause. Click here for more.