Province must heed Equifax debacle
“As far as I’m concerned the provincial regulators have been absolutely negligent in this area.”
That’s Jim Aziz addressing Ontario regulations governing credit bureaus, specifically the information available to, and the protection of, consumers.
Of course we’re talking about Equifax, the giant credit bureau currently in a public-relations meltdown as the result of a web “vulnerability” that allowed for the criminal hacking of information of as many as 143 million consumers.
The hackers’ portal was a web application framework called Apache Struts. That’s bad news for Equifax.
“This vulnerability was patched on 7 March 2017, the same day it was announced,” the Apache Software Foundation said in a press release. Yet Equifax revealed that the unauthorized access started much later, in mid-May, and continued for weeks, into July.
The Apache release didn’t mince words: “The Equifax data compromise was due to their failure to install the security update provided in a timely manner.”
So chances are this story is going to go down in ways similar to the Wells Fargo debacle. The CEO of Equifax, Rick Smith, will appear before a congressional committee. The vulnerability of consumers, as opposed to software, will be lamented. The proceedings will become heated. There will be calls for Smith’s resignation.
For Jim Aziz, an international adviser on credit bureaus, the opportunity now is for the Ontario government to reexamine the ways in which its own governance of credit bureaus, by which I mean both Equifax and its competitor, TransUnion, fall short of international standards.
Consumers who have found themselves ensnared in unhappy experiences with the bureaus will not be surprised.
One reader, responding to Wednesday’s column on the data breach, complained that trying to set the record straight with Equifax over multiple credit cards on his credit report that were not his proved so exhausting that he just gave up. “It is a mess trying to deal with them,” he wrote.
The province’s Consumer Reporting Act does nothing to spur the bureaus into action when information is wrong. When a consumer disputes the accuracy of the information, the act stipulates that the reporting agency “within a reasonable time shall use its best endeavours to confirm or complete the information.” (The italics are mine.)
Back in the ’80s, Jim Aziz was the general manager of the Associated Credit Bureaus of Canada. These days he works with the International Monetary Fund and others setting up credit bureaus and credit agencies around the world.
He has worked in 36 countries (Kosovo, Sudan). Canada, he says, doesn’t cut it. “In my activities, with different countries, we regulate the number of days to resolve disputed information in periods of 15 to 30 days,” he says.
As it is, “there’s no incentive for the credit bureaus to be expedient in resolving consumer disputes.”
And yet, the only way to validate the accuracy of the information is for the consumer herself to look at the file. It’s standard too for bureaus to inform consumers that after apprising one bureau of an error they should then move on and start the process over again with its competitor. “That doesn’t do it,” Aziz insists. It is the credit bureaus that should bear the obligation of informing each other of errors. “Not all credit granters check both files. If you’ve gone to TransUnion and found an error in your file but it’s not corrected by Equifax, then you could be harmed by the fact that it isn’t corrected, and vice versa.”
Accessing one’s credit report in Canada is another reminder of how out of touch we are. In the U.S., the Fair Credit Reporting Act mandates that anyone can access, annually online, their credit report for free, and there’s a central website to help with that. There are three nationwide bureaus in the U.S., so the consumer can get all three at once, or spread them out throughout the year.
In Ontario, an Equifax credit report is free only if the consumer submits an application by mail or, impractically, in person. The fee for accessing the report online is $15.50.
“The government should step in and say, look, we’re here to protect consumers,” Aziz says. “That’s consumer information that’s in a lender’s database that’s being shared with both Equifax and TransUnion so they can make a profit. They make a lot of money using your data and my data and this is the kind of thing from a consumer standpoint that they shouldn’t be charging for. If the government is concerned about protecting consumers they should take away that 15 bucks.”
Enhancing access has other benefits — Aziz says research has shown that free credit reports lead to lower delinquency rates. Any initiatives that promote financial literacy, and increased financial smarts, are initiatives to the good. Ontario should join these modern times of which Aziz speaks. There is no downside. jenwells@thestar.ca