Equifax Leaked Your Personal Information – Now What?

On September 7, 2017, Equifax, one of the “big three” U.S. credit reporting agencies, reported that hackers had gained access to sensitive personal information of 143 million Americans contained within Equifax’s extensive consumer files. If Equifax has a credit file on you–as it does on most Americans–your chances of being affected by this data breach are more than 50%. Equifax has known about this hack since June 29, 2017.

Equifax keeps extensive dossiers of data about consumers and sells that data to prospective creditors, current creditors, and others who subscribe to Equifax’s services. While some news outlets have described the hack as affecting Equifax “customers,” this is not accurate. Equifax has a file on you regardless of whether you have ever consented to it, and it is allowed, subject to the constraints of the Fair Credit Reporting Act 15 U.S.C. § 1681 (“FCRA”), to disclose your information to its subscribers. In other words, you are its product, not its customer.

The data in Equifax’s file typically includes the person’s name, address history, social security number, telephone numbers, a detailed credit history–i.e., open and/or closed loans and credit accounts, amounts owed, amounts and dates of recent payments, and any history of late payments or defaults–and public record information like bankruptcies or judgments. Equifax’s credit file on a consumer typically contains sufficient information to enable an unscrupulous person to steal the consumer’s identify and open fraudulent credit accounts in his or her name. This type of identity theft can result in enormous disruption, including harassment by debt collectors seeking to collect the fraudulently incurred debt, closure or freezing of existing legitimate lines of credit, and inability to obtain new legitimate loans because of damage to the victim’s credit inflicted by failure to repay the fraudulent loans.

Equifax and its main competitors, Trans Union and Experian, are closely regulated by the FCRA and have a duty under the law to ensure “maximum possible accuracy” of consumer reports provided to third parties. Numerous class-action lawsuits have already been filed regarding the data breach, and chances are good that you may be deemed a member of one or more classes and may eventually be entitled to relief accordingly. However, the more immediate concern is potential identity theft and damage to consumers’ credit. If you do not already monitor your credit, now is a good time to start. Note that Equifax, Trans Union and Experian are required by law to provide each consumer with at least one full, free credit report annually. These bureaus provide free credit reports online at www.annualcreditreport.com. In addition, if you are ever denied credit on the basis of an Equifax, Experian, or Trans Union report, you have the legal right to receive a free copy of the report on which the credit denial was based. Exercise this right any time you are denied credit for any reason.

If you discover fraudulent accounts or inaccuracies in any or all of your credit reports, you have the right to dispute the reports and may be entitled to compensation under the FCRA. Westbrook Law PLLC is experienced in representing consumers affected by inaccurate and improper credit reporting, and can provide guidance if you discover credit reporting errors or fraud. Contact us for a consultation.

TJW

John Oliver, Consumer Advocate

As an attorney representing individuals in disputes with large corporations for nearly a decade, it has frequently occurred to me that most consumers are unaware of substantial legal rights they have, including laws that exist for the express purpose of protecting consumers from specific unfair business practices.  I have been surprised to find a kindred spirit in comedian John Oliver of HBO’s Last Week Tonight with John Oliver, whose concern with consumer affairs on the show has included major problems with credit reporting as well as debt collection and debt buying scams (caution: strong language).  I am pleased to see these troubling issues discussed in a popular forum, by a public figure with a genuine passion for consumer rights.

What Mr. Oliver does not explore in these entertaining and informative pieces are the legal frameworks available under the Fair Credit Reporting Act (“FCRA”) and Fair Debt Collection Practices Act (“FDCPA”), which encourage aggrieved consumers and their attorneys to act as “private attorneys general” to regulate the industries that abuse credit reports and those that resort to unfair and deceptive means of collecting seriously delinquent debts–some of which may even be time-barred, or not owed in the first place.  While these statutes and the numerous precedents that interpret them are not the stuff of late night television, they are major tools in the arsenal of consumer advocates such as myself, and can form the basis for significant recoveries for consumers themselves.

Spokeo v. Robins

Many laws designed to protect individuals from corporate abuses rely in part on the imposition of “statutory damages.”  This typically means that if the plaintiff can show a violation of the law, there is some minimum amount of money that must be awarded.  These are exceptions to the general rule that a plaintiff’s recovery is limited to the amount of actual damages proven.

Statutory damages are an important part of the enforcement mechanisms in the Fair Debt Collection Practices Act (“FDCPA”), Fair Credit Reporting Act (“FCRA”), Real Estate Settlement Procedures Act (“RESPA”), Truth in Lending Act (“TILA”) and many other consumer protection laws.  This is because the availability of statutory damages acts as a deterrent to violations of the law that are destructive, but whose economic impact on any individual may be difficult to prove or speculative.  For example, where a statute such as the FCRA or FDCPA gives a consumer the right to receive certain information, a company’s failure to comply might not give rise to any provable “actual” damages.  Enforcement of those rights then depends upon statutory damages.

The United States Supreme Court was presented with a  far-reaching challenge to statutory damages in the recent case Spokeo v. Robins.  In that case, the plaintiffs in a class action had alleged that a web site used for personal investigations and background checks had violated the Fair Credit Reporting Act by failing to maintain procedures to ensure accuracy of its reports.  The plaintiff class sought statutory damages under the FCRA.  The defendant argued that because the plaintiff had not shown any “actual damages,” he lacked “standing” to bring the lawsuit under Article III of the Constitution–even though the FCRA itself provides for a cause of action that seeks only statutory damages.  Without standing, the plaintiff’s case could not be maintained.

The Spokeo case was on appeal from the United States Court of Appeals for the Ninth Circuit, which had held that violation of the FCRA itself was enough of an “injury” to satisfy the Article III standing requirements.  The United States Supreme Court disagreed in part, finding that the Ninth Circuit had failed to correctly analyze whether a “concrete” injury had been adequately alleged by the plaintiff.  The Court remanded the case for a new determination of this issue.

On its face, the Spokeo decision might appear harmful to the interests of consumers, given that many important protections in the FCRA, FDCPA, RESPA and TILA are only effectively enforceable through statutory–not actual–damages.  However, within the Court’s opinion are indications that those protections remain viable.  For example, the opinion acknowledges that a consumer’s injury need not be “tangible” in order to provide a basis for Article III standing.  It also notes that “risk of real harm” can satisfy the injury requirement for standing.  This is an especially important note in the context of statutes giving consumers the right to accurate information, where the failure to provide that information creates a real risk of harm.

In the coming months and years, it is expected that many corporations will rely on and attempt to expand on Spokeo to constrain consumer rights.  Vigilant consumer advocates should be cognizant of this and work to ensure that the courthouse doors are not closed to their clients.