Toronto Star

Province must heed Equifax debacle

- Jennifer Wells

“As far as I’m concerned the provincial regulators have been absolutely negligent in this area.”

That’s Jim Aziz addressing Ontario regulation­s governing credit bureaus, specifical­ly the informatio­n available to, and the protection of, consumers.

Of course we’re talking about Equifax, the giant credit bureau currently in a public-relations meltdown as the result of a web “vulnerabil­ity” that allowed for the criminal hacking of informatio­n of as many as 143 million consumers.

The hackers’ portal was a web applicatio­n framework called Apache Struts. That’s bad news for Equifax.

“This vulnerabil­ity was patched on 7 March 2017, the same day it was announced,” the Apache Software Foundation said in a press release. Yet Equifax revealed that the unauthoriz­ed access started much later, in mid-May, and continued for weeks, into July.

The Apache release didn’t mince words: “The Equifax data compromise was due to their failure to install the security update provided in a timely manner.”

So chances are this story is going to go down in ways similar to the Wells Fargo debacle. The CEO of Equifax, Rick Smith, will appear before a congressio­nal committee. The vulnerabil­ity of consumers, as opposed to software, will be lamented. The proceeding­s will become heated. There will be calls for Smith’s resignatio­n.

For Jim Aziz, an internatio­nal adviser on credit bureaus, the opportunit­y now is for the Ontario government to reexamine the ways in which its own governance of credit bureaus, by which I mean both Equifax and its competitor, TransUnion, fall short of internatio­nal standards.

Consumers who have found themselves ensnared in unhappy experience­s with the bureaus will not be surprised.

One reader, responding to Wednesday’s column on the data breach, complained that trying to set the record straight with Equifax over multiple credit cards on his credit report that were not his proved so exhausting that he just gave up. “It is a mess trying to deal with them,” he wrote.

The province’s Consumer Reporting Act does nothing to spur the bureaus into action when informatio­n is wrong. When a consumer disputes the accuracy of the informatio­n, the act stipulates that the reporting agency “within a reasonable time shall use its best endeavours to confirm or complete the informatio­n.” (The italics are mine.)

Back in the ’80s, Jim Aziz was the general manager of the Associated Credit Bureaus of Canada. These days he works with the Internatio­nal Monetary Fund and others setting up credit bureaus and credit agencies around the world.

He has worked in 36 countries (Kosovo, Sudan). Canada, he says, doesn’t cut it. “In my activities, with different countries, we regulate the number of days to resolve disputed informatio­n in periods of 15 to 30 days,” he says.

As it is, “there’s no incentive for the credit bureaus to be expedient in resolving consumer disputes.”

And yet, the only way to validate the accuracy of the informatio­n is for the consumer herself to look at the file. It’s standard too for bureaus to inform consumers that after apprising one bureau of an error they should then move on and start the process over again with its competitor. “That doesn’t do it,” Aziz insists. It is the credit bureaus that should bear the obligation of informing each other of errors. “Not all credit granters check both files. If you’ve gone to TransUnion and found an error in your file but it’s not corrected by Equifax, then you could be harmed by the fact that it isn’t corrected, and vice versa.”

Accessing one’s credit report in Canada is another reminder of how out of touch we are. In the U.S., the Fair Credit Reporting Act mandates that anyone can access, annually online, their credit report for free, and there’s a central website to help with that. There are three nationwide bureaus in the U.S., so the consumer can get all three at once, or spread them out throughout the year.

In Ontario, an Equifax credit report is free only if the consumer submits an applicatio­n by mail or, impractica­lly, in person. The fee for accessing the report online is $15.50.

“The government should step in and say, look, we’re here to protect consumers,” Aziz says. “That’s consumer informatio­n that’s in a lender’s database that’s being shared with both Equifax and TransUnion so they can make a profit. They make a lot of money using your data and my data and this is the kind of thing from a consumer standpoint that they shouldn’t be charging for. If the government is concerned about protecting consumers they should take away that 15 bucks.”

Enhancing access has other benefits — Aziz says research has shown that free credit reports lead to lower delinquenc­y rates. Any initiative­s that promote financial literacy, and increased financial smarts, are initiative­s to the good. Ontario should join these modern times of which Aziz speaks. There is no downside.

 ?? KEVIN D. LILES/THE NEW YORK TIMES ?? Equifax is currently in a public-relations meltdown over a web “vulnerabil­ity” that allowed for the criminal hacking of informatio­n of as many as 143 million consumers.
KEVIN D. LILES/THE NEW YORK TIMES Equifax is currently in a public-relations meltdown over a web “vulnerabil­ity” that allowed for the criminal hacking of informatio­n of as many as 143 million consumers.
 ??  ??

Newspapers in English

Newspapers from Canada