by Jeff Sovern
Much has been made of the fact that the day the Equifax breach became public, Congress held a hearing on bills that would have limited damages credit bureaus would have to pay for misconduct. This past Tuesday, the Senate Banking Committee held a hearing titled Consumer Data Security and the Credit Bureaus (we posted a link to a report on the hearing from The Hill here). The witnesses included an attorney representing the industry trade group, the Consumer Data Industry Association: Andrew M. Smith, Partner, Covington & Burling LLP. Mr. Smith testified that the industry still seeks a cap on damages for liability under the Fair Credit Reporting Act. Some other interesting thing that came up in the hearing: some committee members support the idea of flipping the default on credit freezes, so that the default would be that credit bureaus would not be able to disclose consumer information without consumer consent, rather than the current system in which credit bureaus can disclose information unless consumers freeze their files. There seemed to be agreement that, as we reported earlier in the week, the CFPB generally lacks authority over data breaches–but the CFPB and FTC are both investigating the breach, so it appears the CFPB believes it may have some jurisdiction in the area (if any readers know the basis for its jurisdiction, I hope they will post about it in the comments below; maybe the Bureau's UDAAP powers?). Mr. Smith opposed congressional action on credit bureau security breaches until after the FTC and CFPB concluded their investigations. On another point, when it was pointed out that an FTC study in 2013 found that about a quarter of consumers had errors in their credit reports, Mr. Smith took the position that only 2% of consumers had credit report errors because he defined errors as errors affecting the consumer (e.g., errors that would lead to a lender charging a higher interest rate or declining a loan altogether). Another witness, Marc Rotenberg of the Electronic Privacy Information Center, argued that the credit bureau industry should provide freezes without charge because otherwise the industry profits from a harm that it itself makes possible. Many of the senators from both parties were critical of Equifax; I continue to wonder whether legislation will result or if this is merely political posturing.
