Consumer Law & Policy Blog

John Oliver on the Equifax Breach

 

or click here. If you don't have time for the whole segment, here is a 34-second excerpt about the arbitration snafu.

Law360 Reports Trump Nominates Joseph Simons to Chair FTC and Rohit Chopra to Serve as Commissioner

by Jeff Sovern

Rohit Chopra, of the Consumer Federation of America, recently served at the CFPB and obviously has experience with consumer protection issues. Simons, who formerly served as director of the FTC's competition bureau, is currently at Paul Weiss. I don't know what experience, if any, he has on the types of consumer protection issues the FTC has jurisdiction over. The Law360 story is here. 

More Tough Talk in the Senate About the Equifax Data Breach; Will It Lead to Changes in the Law?

by Jeff Sovern

Yesterday the Senate Banking Committee held a hearing on consumer data security. The Hill covered it, in a report headlined Senators bear down on credit reporting industry over data security.  Here is an excerpt:

“If they lose my data as Equifax did, or if someone submits to them data that is an error that undermines my credit score, the bureaus have no obligation or interest right now to work with me to try to get the credit score correct,” [Louisiana's Senator John] Kennedy continued. 

Kennedy warned the industry that it needs to “step up” and propose specific reforms that would help better protect consumers in the event of future breaches. 

“Your clients need to step up to the plate here and suggest some meaningful reforms, or reforms are going to be suggested to them,” Kennedy said. “My advice to you would be to step up to the plate and offer specific things that you and your clients are going to do to improve the situation. Not platitudes, not bromides — specific suggestions.”

* * *

"Most of the adults in Louisiana had their data stolen," Kennedy said Tuesday. "They’ve had to go to a lot of trouble to freeze credit. Some of them are going to have their identity stolen. It’s just not right."

One of the things that makes Senator Kennedy's remarks especially interesting is that he is one of the Republican senators who has said he is undecided about the CFPB arbitration regulation. His statements above suggest he is not content with how the free market has handled at least the consumer protection problem of the Equifax data breach.

ABA Consumer Protection Announcement on Volunteer Opportunities for Law Students

We received the following announcement:

ABA Section of Antitrust Law Consumer Protection Committee

Volunteer Opportunities for Law Students

The Consumer Protection Committee is the ABA’s premier group for developments in the law of privacy
and data security, false advertising, deceptive marketing, and unfair trade practices, providing timely
updates on law enforcement, rulemakings, and business guidance from the FTC, DOJ, CFPB, other federal
agencies, state attorneys general, divisions of the Advertising Self-Regulatory Council (NAD, ERSP and
CARU), and their international counterparts.

There are many ways for law students to get involved with the Consumer Protection Committee
including these great opportunities to write and speak on consumer protection issues.

• Consumer Protection Newsletter: We are seeking contributors for the next edition of the Consumer
Protection Committee newsletter, What’s in Store. If you would like to write a short article, please
contact Svetlana Gans at sgans@ftc.gov. Check out the Summer 2016 edition written entirely by
law students!

• Consumer Protection Case Updates: Contribute to bi-weekly consumer protection updates on the
latest consumer protection cases. If you or a colleague would be interested in joining the updates
team, contact Dan Blynn at DSBlynn@Venable.com. Here’s a short example of a case brief:
The U.S. District Court for the Northern District of Illinois grants defendant Quaker Oats
Company’s request for entry of judgment in two separate lawsuits that had been filed
regarding claims against the labeling of its oatmeal products as “heart healthy” and
“natural.” Defendant based its motions on the fact that the court previously had granted a
motion to dismiss a consolidated action, Gibson v. Quaker Oats Company, which had
involved identical complaints and allegations as the current disputes. As discussed in the
Gibson dismissal opinion, the plaintiffs’ respective failure-to-warn claims were meritless due
to federal preemption and the plaintiffs failed to allege the omission of a material fact.
Further, in Gibson, the plaintiffs did not allege that a reasonable consumer would interpret
“natural” as eliminating all pesticides “down to the molecular level.” As such, the Court
determined that dismissing these analogues cases was appropriate. (Kinn v. Quaker Oats
Co., No. 16-cv-10833, 2017 WL 3922068 (N.D. Ill. Sept. 6, 2017); Panitch v. Quaker Oats
Co., No. 17-cv-03460, 2017 WL 3922149 (N.D. Ill Sept. 6, 2017)).

• Consumer Protection Legislation Monitoring Project: Beef up your knowledge of state consumer
protection laws by reviewing new state legislative proposals and writing a quick description for
dissemination. If interested in participating, please contact Anna Chehtova at
Anna.A.Chehtova@tsocorp.com.

CFPB student-loan ombudsman issues report on agency's enforcement activity

The Consumer Financial Protection Bureau's student-loan ombudsman has issued his annual report. It finds that while the agency has made progress in making the student-loan repayment process fairness, serious problems remain.

[C]omplaints by student loan borrowers have driven actions that have produced more than $750 million in relief for student loan borrowers and strengthened the student loan repayment process for millions more. These changes include automatic student loan interest-rate reductions for eligible service members, more protections around federal student loan repayment relief, and the elimination of surprise “auto defaults” from most new private student loan contracts. The report shows also that in the last year the CFPB received more than 20,000 complaints from student loan borrowers, who report that widespread student loan servicing problems persist.

FTC and state AGs to jointly combat student debt relief scams

The Washington Post reports that the Federal Trade and 12 state attorneys general have formed a task force to crack down on student debt relief scams.

"The federal-state initiative, dubbed Operation Game of Loans, is responsible for five cases against companies, such as Student Debt Doctor and American Student Loan Consolidators, accused of misleading borrowers about their ability to lower student-loan payments or illegally charging upfront fees before providing the service. The task force, which includes law enforcement in Maryland and the District, has frozen the assets of the accused and obtained temporary restraining orders to bring their operations to a halt."

The full article is here.

"The truth about the arbitration rule is it protects American consumers"

I don't post every article about the Consumer Financial Protection bureau rule barring financial services companies from using forced arbitration provisions to impose class-action bans on consumers. But I wanted to pass along this one by CFPB director Richard Cordray responding very directly to a couple of the rule's opponents.

CFPB enforcement chief leaving agency

That's a topic of this article by C. Ryan Barber (possibly behind a paywall). That the CFPB enforcement chief is quitting didn't itself strike me as critical news, but the article provided a nice overview of the main issues facing the agency.

Paper on How Firms Can Deliberately Induce Info Overload to Obscure Disclosures

Petra Persson of Stanford University; Research Institute of Industrial Economics has written Attention Manipulation and Information Overload. Here is the abstract:

Limits on consumer attention give firms incentives to manipulate prospective buyers' allocation of attention. This paper models such attention manipulation and shows that it limits the ability of disclosure regulation to improve consumer welfare. Competitive information supply, from firms competing for attention, can reduce consumers' knowledge by causing information overload. A single firm subjected to a disclosure mandate may deliberately induce such information overload to obfuscate financially relevant information, or engage in product complexification to bound consumers' financial literacy. Thus, disclosure rules that would improve welfare for agents without attention limitations can prove ineffective for consumers with limited attention. Obfuscation suggests a role for rules that mandate not only the content but also the format of disclosure; however, even rules that mandate "easy-to-understand" formats can be ineffective against complexification, which may call for regulation of product design.

The CFPB and Data Breaches, Plus WSJ: Equifax Hack Drives GOP Bill to Overhaul Credit Bureaus

by Jeff Sovern

The WSJ article is here.  Excerpt:

Rep. Patrick McHenry of North Carolina introduced a bill to require the three major credit firms—Equifax, Experian PLC and TransUnion—to submit to regular federal cybersecurity reviews for the first time. All three companies also would have to phase out their use of Social Security numbers to verify consumers’ identities by 2020.

* * * 

Separately, Sen. Mike Crapo (R., Idaho), chairman of the Senate Banking Committee, asked federal banking regulators if they needed more authority to supervise the credit-reporting firms to ensure they adequately protect consumer data. “I am concerned there may be a regulatory gap with respect to supervision of credit reporting agencies for data security standards,” Mr. Crapo wrote in a letter to the heads of the Federal Reserve, Office of the Comptroller of the Currency and Federal Deposit Insurance Corp.

On a related point, it looks as if the CFPB has very limited jurisdiction over the Equifax data breach, if it has any jurisdiction at all, as Ed Merizwinski pointed out in a comment earlier in the week (I had observed that critics had complained about the Bureau's failure to stop the Equifax breach, noting that "I haven't checked to verify that the Bureau has authority over data breaches at financial institutions, though others have argued that it does."). That conclusion comes from 15 USC 6801, which provides  (emphasis added):

(a) Privacy obligation policy

 

It is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers’ nonpublic personal information.

 

(b) Financial institutions safeguards

 

In furtherance of the policy in subsection (a), each agency or authority described in section 6805(a) of this title, other than the Bureau of Consumer Financial Protection, shall establish appropriate standards for the financial institutions subject to their jurisdiction relating to administrative, technical, and physical safeguards—

(1) to insure the security and confidentiality of customer records and information;

(2) to protect against any anticipated threats or hazards to the security or integrity of such records; and

(3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

 

 

Section 6804 gives the power to promulgate regulations in the area to the FTC.  I've seen claims that the Bureau could use its UDAAP powers against Equifax, so maybe there's something I'm missing, but I'm skeptical. Usually in statutory interpretation, the specific (here, the exclusion in section 6801) controls the general (the UDAAP powers). Going back to the WSJ article, it's interesting that Senator Crapo does not appear to have written to the FTC, though perhaps he did and the WSJ didn't report it.