Equifax hacking nightmare gets worse
After delay in revealing who was affected, consumers are infuriated about fine print that may bar lawsuits
After Equifax revealed that sensitive data on two of every five Americans was exposed in a cyberattack, thousands logged onto a company website to see if they were at risk. For many, the site didn’t work at first. But for those who got through, a nasty surprise was waiting.
If your data had been stolen, Equifax offered a free year of credit monitoring known as “TrustedID Premier.” But some fine print may also mean that consumers who agree would be giving up the right to sue over many types of damages related to the massive penetration.
The unprecedented breach, which occurred in July but was disclosed on Thursday, is among the largest in US history, affecting 143 million people. The hack revealed personal information such as social security numbers, addresses, driver’s licence data, and birth dates, putting millions at risk for identity theft. A proposed multibillion-dollar class action lawsuit was filed Thursday evening. All told, Equifax could be facing as much as $70 billion in claims, said Ben Meiselas, an attorney for Geragos & Geragos, one of the firms that filed the lawsuit.
For already panicked consumers, that fine print — an arbitration clause — has caused further frustration, prompting federal lawmakers and at least one state attorney general to condemn Equifax for appearing to force aggrieved consumers to give up their day in court. Social media was flooded with messages of concern, with some fearing that simply using an Equifax website to check whether their information was compromised bound them to arbitration — a private proceeding which consumer advocates and lawyers consider inherently biased in favour of companies.
“We are witnessing uncharted depths of corporate duplicity, as Equifax is now targeting its victims” by using “stealth arbitration agreements,” Meisalas said. Hopefully this “conduct will finally spur Congress to protect victims of identity theft by stopping corporations from using poison pill arbitration clauses to deprive victims of t heir day in court.”
On Friday, New York Attorney General Eric Schneiderman asked the company to remove the clause as he opened an investigation. (Earlier, it was also revealed that three senior Equifax officers had sold off $1.8 million in holdings after the intrusion was discovered in July. The company’s shares fell almost 14 per cent Friday.)
Equifax responded to the controversy by an addition to its “frequently asked questions” web page. The company wrote that the arbitration mandate applies only to “the free credit file monitoring and identity theft protection products, and not the cybersecurity incident.” Consumers can opt out of the arbitration provision, but to do so, they have to mail a letter to a post office box in Atlanta, where Equifax is based.
Late Friday, after a day of criticism, the company said consumers wouldn’t have to give up their right to pursue class actions related to damages stemming from the hacking incident. Equifax also said it tripled to more than 2,000 the number of agents on its call centre team to handle questions, and that the website allows consumers to quickly assess whether they were affected.
Earlier, consumer advocates and plaintiffs’ lawyers — who have a vested interest in preserving consumer rights to sue — expressed deep concerns about the arbitration clause. Equifax could divert from court lawsuits asserting damages as a result of negligence or invasion of privacy, said Lauren Saunders, associate director of the National Consumer Law Centre, and Jim Francis, an attorney at Francis & Mailman PC in Philadelphia. Mailman recently won a $60 million jury trial against TransUnion, another large credit reporting firm.
Whether the company’s statements late Friday will prevent it from asserting the arbitration clause in the future is unclear. The clause, buried in the company’s terms of use, obligates purchasers to individually resolve “any claim, dispute, or controversy” in arbitration proceedings. In such a hearing, one that is closed to the public and paid for by Equifax, a single person would hear arguments from the consumer and the company before making a final, binding decision.
The National Consumer Law Centre describes arbitration as “biased, secretive, and lawless,” in part because arbitrators are blocked from seeing the full extent of a company’s alleged wrongdoing. In a court proceeding, plaintiffs who overcome a motion to dismiss can demand pre-trial evidence from a defendant company, including internal files and witness depositions.
A 2015 study by the US Consumer Financial Protection Bureau, the federal agency created in the wake of the financial crisis, found that more than 75 per cent of consumers weren’t even aware they were subject to arbitration clauses. Fewer than 7 per cent knew that the clauses restricted their ability to sue, the consumer bureau said.
According to the terms of use for Equifax’s TrustedID Premier, “by consenting to submit your claims to arbitration, you will be forfeiting your right to bring or participate in any class action (whether as a named plaintiff or a class member) or to share in any class action awards, including class claims where a class has not yet been certified, even if the facts and circumstances upon which the claims are based already occurred or existed.”
A separate terms of use from Equifax states that all users of the company’s products are bound by a more expansive arbitration clause, said Saunders of the Consumer Law Centre, who argued that the company could have licence to block almost all lawsuits. Those terms of use state that claims against the company “shall have the broadest possible construction.”
The only exception are claims against the company in which consumers assert damages under the Fair Credit Reporting Act.
Francis, the plaintiffs’ attorney, said that the circumstances of the latest breach would probably make it difficult for Equifax to prevail in forcing aggrieved consumers into arbitration. But Imre Szalai, a professor at Loyola College of Law in New Orleans who has studied arbitration for 15 years, said the success of such efforts often depends on the personal leanings of judges who initially handle lawsuits filed by consumers. They will decide whether to send them back to Equifax, and arbitration.