Despite Equifax breach, Congress may boost credit bureaus

After hackers in 2017 breached credit bureau Equifax's (EFX) computers and stole confidential data belonging to more than 147 million Americans, consumers demanded that U.S. lawmakers take action to protect them through tighter regulations. Although a bill making its way through Congress purports to answer that call, the measure also includes some surprising wins for the credit-reporting industry. 

Th Senate bill, which aims to deregulate the banking industry, is being touted as a victory for consumers partly because of a provision that mandates free credit freezes and provides free credit monitoring for active-duty members of the military. Yet the credit-reporting agencies will also benefit from provisions that in some cases undermine the effectiveness of the consumer-friendly stipulations, consumer advocates said.

The push to require free credit freezes stems from last year's massive data breach at Equifax. Many of the Americans whose information was stolen were rankled to learn they were on the hook to pay $10 to each credit-reporting agency to freeze their accounts, which restricts access to credit reports and makes it harder for identity thieves to open new accounts in victims' names. 

Consumer advocates point to an amendment to the bill that would take away the right for active members of the military who receive free credit monitoring to sue the agencies. The bill could also supersede state laws about credit freezes, which in some cases are more stringent than what the bill would propose, said Mike Litt, a director at U.S. PIRG, a left-leaning advocacy group. 

"For all this talk about action after the Equifax data breach, Congress hasn't done anything for six months and now is moving to make things worse," Litt said. "This is the first time we're aware of that the law would take away a consumer's private right of action against the credit bureaus."

The bill includes another provision that would be positive for the three biggest credit-reporting bureaus, which include TransUnion (TRU) and Experian (EXPGY) as well as Equifax. 

A joint venture operated by the three called VantageScore could gain a foothold in the business of providing credit scores for homebuyers seeking mortgages. That's because the bill would force government-backed lenders Fannie Mae and Freddie Mac to consider scores beyond those assessed by FICO, which is the dominant player in the credit-scoring industry.

The trade group for the credit-reporting bureaus said that rather than profiting from the bill, the companies are losing money. 

"There's nowhere we are making money on this bill," said Francis Creighton, president and CEO of the Consumer Data Industry Association. "We lose all the revenue from granting credit freezes. We lose all the revenue from selling credit-monitoring products to active-duty service members. No one else is being asked to give away big chunks of their business."

Creighton said while active-duty service members would be barred from suing under the bill's amendment, federal agencies and state attorneys general could sue on their behalf. 

"It's not that anyone was taking away anything, because it was not that they had a right to it to begin with," he said.

The bill's measures have drawn fire from Senator Sherrod Brown (D-Ohio), who said he "cannot fathom" why provisions that would help Equifax are included in the bill.  

"Equifax -- a company that can't even safely store consumers' data, a company that spent nearly as much on executive salaries as on cybersecurity -- now wants in on the credit-scoring business," he said in a floor speech last week. 

The bill appears to reward Equifax after the massive data breach that will likely affect millions of consumers for years to come, said Amanda Werner, a campaign strategist at legal advocacy agency Public Justice. 

"This was the biggest data breach in human history that we shrugged off," Werner said. "Once your data is out there, your Social Security number is on the internet, that's for life. So we need to press Congress to do something substantive."

The banking bill isn't the only legislative move causing consternation among consumer advocates. A bill called the Data Acquisition and Technology Accountability and Security Act would require companies to alert consumers about a data breach only if there's a "reasonable risk" that it could result in identity theft, fraud or economic loss to the consumer. Yet the bill excludes financial companies from the requirement. 

"This is our information," Litt said. "We have a right to know as soon anything happens."