|
January 16, 2018 - Senators Mark Warner and Elizabeth Warren have introduced a new bill that would place heavy fines on consumer reporting agencies (CRAs) when the data they store is leaked in a data breach. The bill would subject these agencies to fines of as much as 75% of their gross revenue for the prior year when the data they store is stolen or leaked. While the threat of such hefty fines may sound good, it does nothing to address the circumstances that have led to the CRAs massive data bases of consumer information that are inviting targets for hackers. Without significant changes limiting the use of credit information, or restrictions on the way consumer information is stored, the proposal isn't likely to be effective.
The Warner-Warren bill was proposed in the wake of last year's Equifax data breach. If it had been in place at the time of the breach, Equifax could have been subject to fines of approximately $1.5 Billion.
A fine that high may make for good political theater, but it does nothing to address the problem. The CRAs - Equifax, Experian and TransUnion - store massive amounts of information on consumers in huge databases. These companies have effectively consolidated an industry that was made up of more than 2,200 independent credit bureaus thirty years ago.
Just as importantly, the CRAs have found that it is more profitable for them if data breaches continue to happen - whether those data breaches are their own or someone else's - than if they take action to stop them. That's because the threat of data breaches has turned the sale of so-called credit monitoring services (which are largely services offered by the CRAs themselves) into big business. Each of the CRAs make hundreds of millions of dollars each year by selling these services.
Keep in mind that the Fair Credit Reporting Act makes it a legal requirement for the CRAs to maintain "accurate" credit files on consumers. It also makes it their obligation to provide a means to consumers to easily and quickly correct any errors in their credit files. If they simply followed existing law, there would be no need for credit monitoring services for the vast majority of consumers.
While the proposed legislation may have the best of intentions, fines alone don't change the conditions of CRA data storage or services. To reduce the threat of data breaches at the CRAs themselves, they need to be force to change the way they store their data; perhaps by breaking them up in a manner that makes them less attractive targets. And they need to be forced to completely shutter - not sell or spin-off - their credit monitoring services. Additionally, they need to be forced to cover all of the costs associated with data breaches that they cause. Unfortunately, the Warner-Warren bill doesn't accomplish any of these things.
byJim Malmberg
Note: When posting a comment, please sign-in first if you want a response. If you are not registered, click here. Registration is easy and free.
Follow me on Twitter:
|
Politics & Politicians 
