WASHINGTON — Senate Democrats' legislative bid to reform the credit reporting industry following the massive data breach at Equifax may have traction in the Republican-controlled Congress.
Introduced by Sens. Elizabeth Warren, D-Mass., and Brian Schatz, D-Hawaii, the bill is seen by analysts as tempered and balanced, which could help it pick up support.
Among other things, the bill would create a federal requirement for credit bureaus to offer free credit freezes to consumers affected by a data breach and prevent bureaus from selling consumer information while a freeze is in place.
“The bill … seems like a fairly rational, targeted response and something that could be done quickly,” said Carolyn Walsh, a partner at the law firm Steptoe & Johnson. Both Republicans and Democrats have expressed outrage over the Equifax breach, which exposed the personal information of 143 million consumers, she noted.
The bill might even pass soon if it were attached to a spending bill that Congress will have to address in December.
“Despite Elizabeth Warren's status as a leader of progressive Democrats, we could see this bill picking up bipartisan support” or it “could resurface in a broader bill that enjoys bipartisan support,” Jaret Seiberg, an analyst at Cowen Research, wrote in a note to clients.
However, others who favor reforming the industry said it may not be that easy.
“The economic incentives of credit bureaus to treat consumers fairly have always been warped,” said Aaron Klein, policy director of the center on regulation and markets at the Brookings Institute. “Reform of credit bureaus and credit reporting could increase economic growth, but would require serious political will.”
Isaac Boltansky, a policy analyst at Compass Point Research & Trading, said the Equifax case may be too difficult for Congress to wrap its arms around quickly.
“The Equifax breach will draw the attention of numerous committees in both chambers of Congress, and cause a considerable amount of hand-wringing among lawmakers, but we do not see a path to passage for data breach legislation as the politics of this issue remain far too nebulous,” Boltansky wrote in a client note.
Howard Tischler, co-founder at EverSafe, a technology company that protects seniors from fraud and identity theft, said that, while policymakers will likely focus on Equifax’s response to the data breach, more could be done to preemptively mitigate harm.
“There is probably more that can be done in terms of protecting the data upfront," he said. "But I am going to guess that the regulatory body will probably have a harder time pushing more things to do to protect the data upfront, because these databases are massive. To implement different technology upfront would take considerable time."
Tischler added that the industry could benefit from some creative thinking, such as having a credit freeze for newborns when they first receive a Social Security number and lifting it at an appropriate time later. He also said other measures could be taken to protect consumers.
“Why does the Social Security number have to be stored in so many places? It is a very sensitive piece of information," said Tischler, who added that
Warren’s bill would give consumers more control over their data, but implementing a credit freeze and lifting it isn’t as easy as flipping a switch. The primary difficulty is that all three credit bureaus have to communicate with each other.
“I am certainly supportive of technology that would make putting credit freezes on or taking credit freezes off easier,” Tischler said.
He also said while new reforms of the credit bureaus may have an impact, there are still other companies like Acxiom, which collects troves of personal data that might not include the precise financial data used by the credit bureaus, but is still expansive.
“Even if you put a credit freeze on at the three bureaus, your data is going to be sold out there for marketing purposes. It is just not going to be by the credit bureaus, so it solves part of the problem, but it doesn’t solve the entire problem,” Tischler said.
The credit reporting industry contends that Warren’s bill is tackling the wrong problem. Equifax was a cybersecurity event and not a breakdown of the Fair Credit Reporting Act.
“This is a data security problem, not an FCRA problem,” said Francis Creighton, president and chief executive of the Consumer Data Industry Association.
The industry argues that implementing new regulations on the credit reporting industry would impede the ease of access to credit that consumers enjoy and often need if they are in a financial bind. Preventing credit bureaus from selling consumer data while there is a credit freeze would also make it hard for a financial company to market products that might be beneficial to a consumer, like a credit card with a lower interest rate, the industry says.
But consumer advocates like the Center for Responsible Lending disagree, voicing support for Warren's bill.
“It gives consumers a lot more control over their financial data and giving them the tools to protect themselves,” said Melissa Stegman, a senior policy counsel at the center.
“We think it is a strong response to the Equifax data breach,” Stegman said. Roughly half the U.S. population was affected by the breach, she noted. “This transcends the differences between people and their politics.”
