10 ms·

I never consented to have my information in their database, and I have no power to get it out of their database. They have roundly and repeatedly demonstrated

by yebyen 9y ago

I never consented to have my information in their database, and I have no power to get it out of their database. They have roundly and repeatedly demonstrated that they are not fit to hold and be trusted with maintaining the SSNs and other personal information of the entire country's worth of credit holders. Is there even a license that the Equifax company needs to have, in order to do this type of work, that can be revoked? It needs to be revoked! But I'm afraid they don't need any license, they just woke up like this. The right to covertly surveil and maintain dossiers on 50%+ of the citizens of this country should not be default-allow. Strongly disagree. People in power holding that kind of opinion, is exactly how we got here.

newscracker 9y ago
> I never consented to have my information in their database, Don't you think that somewhere in the T&Cs of a loan you took or a credit card that you got or a phone contract you signed up for (or many other things) are lines explaining that your information would be shared with credit reporting agencies? So legally, you would've consented to the sharing of information at those times. If that isn't true, then I'd assume that you should be able to sue the institution that shared your information with all these agencies.
- brango 9y ago
  Oh yeah, so you do have a choice if you want to live in a cave.
  - dmoy 9y ago
    What is a reasonable alternative to credit agencies? Most countries I know use similar (or sometimes the same, like the UK) agencies, though sometimes with a caveat that they only log defaults or other stuff you mess up.
    - yebyen 9y ago
      The alternative is the two other credit agencies that haven't (as far as we know) given up all of our personal information to hackers, and who haven't responded to the news of the breach by linking some of their customers to a parody/phishing site that was nearly indistinguishable from their own (very bad) breach response website. There is no way out of this (the cat is out of the bag) but we can go on about our lives without Equifax. They need to be unplugged.
      - dmoy 9y ago
        Ok sure but all of your objections above (https://news.ycombinator.com/item?id=15303289 https://news.ycombinator.com/item?id=15303289) can be applied to the other two agencies as well. They collect all your info also. I'm personally not super optimistic about their security.
        yebyen 9y ago
        Me either! That's absolutely a valid point. And I am terrified that this breach will ultimately result in the end of the credit system as we know it, but right now taking such a position is still scare-mongering. (Very reasonable scare mongering, mind you, but maybe cart before the horse.) We can't just unplug all three agencies and shut down the credit industry, but why can't we shut down Equifax? Take the drivers' license and the car keys away from the drunk driver. They are the ones that let the cat out of the bag, they should no longer be allowed to collect our personal information. There is no reasonable argument that can be made that Equifax in particular, should be allowed to go on making money off of our personal data with the negligent failure that they have created for us and admitted to, after what all has happened. Edit: When Sonny Vleisides plead guilty to Felony Mail Fraud in 2007, he was forbidden to engage in loan programs, gambling or gaming activities, telemarketing activities, investment programs or any other business involving the solicitation of funds. He went on to found the company called Butterfly Labs in 2010, a company that took pre-orders for Bitcoin mining equipment (in many cases soliciting funds for hardware that didn't exist, until it did). Many people argued that this model was a direct violation of the terms of his supervised release. He stood in front of a judge in 2014 that said there was a "strong smell" of fraud with respect to his company. Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. When does Equifax get their 14 months in jail followed by a supervised release? Never, apparently, they just go on about their business and no charges are filed. It's absolutely ridiculous in my humble opinion. Maybe I'm the one who is being unreasonable, expecting that the wheels of justice can turn more rapidly than one can reasonably expect. It's not exactly parallel, I'm stretching to draw parallels obviously, but there should be some parallels in the arena of legal action here. Has anyone argued that Equifax wasn't negligent in the circumstances leading up to the breach? What about in their actions since then? How much further does it have to go before we can get the FTC or US Marshals involved and shut the place down?
- yebyen 9y ago
  You know the point I'm trying to make, and it's disingenuous to point at some line in some far-away terms and conditions, and say "that authorizes Equifax and two other companies to collect and maintain all information on you, in perpetuity, without any option to revoke this grant." Are they licensed to do this type of work? Shouldn't they need to be? Should that be revokable? What is the process for revoking that permission, and can we get it started already? It just came out that in their response to the breach, they've been linking their "customers" to a phishing site since September 9. It's time to revoke those grants.
  - rootlocus 9y ago
    > it's disingenuous to point at some line in some far-away terms and conditions, and say "that authorizes Equifax and two other companies to collect and maintain all information on you, in perpetuity, without any option to revoke this grant." To be fair, I'm pretty sure they can legally do that if this was actually the case.
    - yebyen 9y ago
      It's a finer point, but if I have authorized Chase Bank to share data with a credit reporting agency, does that mean I have also authorized the credit reporting agency to retain that data? I don't think it does. Absent any law that says exactly how they may and may not collect and retain such data, you're probably right that it is exactly what it means. The owners of the data (the banks) authorized them, so they are authorized to have the data. It does not change the fact that, if true, the law is an ass. I do not grant power-of-attorney to the credit-holders that I do business with. They are not authorized to sign documents in my name. They should not be able to authorize arbitrary agencies to hold my personal data in an irrevocable fashion. (And if I understand the difference in law between US and Europe, in Europe they would not be able to permanently retain my personal data without any recourse for me to shut it down. But in the US, they may be allowed to do this.)
      - rootlocus 9y ago
        > It's a finer point, but if I have authorized Chase Bank to share data with a credit reporting agency, does that mean I have also authorized the credit reporting agency to retain that data? I don't think it does. I think you're placing too many constraints on a hypothetical contract just to support your initial argument. Most likely the contract is carefully written in such a way that it's legal for them to do whatever they wanted to do with your data to begin with. It's pointless arguing over what ifs.
monochromatic 9y ago
You didn’t consent to let them collect publicly available information, and information that you voluntarily shared with their business partners?
- yebyen 9y ago
  No, I have no contract with Equifax. Does that mean I don't have any standing in this discussion? You're being obtuse.
  - monochromatic 9y ago
    I’m guessing that, in the contracts you agreed to with credit card companies and others, you did consent to information being shared with the credit bureaus.
    - yebyen 9y ago
      Yes. Conceded. That is different than consenting to the credit bureaus storing those data points in perpetuity. It is an agreement with my bank. That lets my bank off the hook, not the negligent credit reporting agency Equifax. I must still have some kind of rights when any kind of agency is legally allowed to store my SSN and personal information. If this was Europe, with their data privacy protections, I would be sure about that. The reality in this country is, I have no idea if "I must have" is a statement of fact or not. It should be my right to revoke this privilege that they have gained, however they came about it.
      - Frondo 9y ago
        Heh, that's a really interesting point. If I can go into Google and click a box to completely expunge my google history, why can't I do the same with a credit-reporting agency? I get that the thinking is, well, you could just expunge away bad credit choices... but, so what? Your blank credit history is now your red flag, as well as a bad one. But if you wanted to opt out, you could. What could possibly go wrong? (Hah, I didn't mean that as a jokey rhetorical question!)
protomyth 9y ago
> I never consented to have my information in their database Why yes, you did through your agreement with any vendor (e.g. bank, credit union, credit card company, rental) that you have dealt with. This is a standard clause, although some places don't actually do it (my landlord for instance as I found out when I went for a car loan). I hate this, but claiming you didn't consent is just not a credible answer without some additional legislation to force contracts to be explicit in whom a vendor may share information.
- yebyen 9y ago
  I disagree, you're citing an agreement between me and my bank. The bank may have authorized Equifax to store the data, but I did not. The bank was authorized to share the data (by me), and Equifax was authorized to store the data (by the bank), it is a fine point but it is a fact. So in all of this, the bank is the one who is not in the wrong. I can't say whether Equifax's agreement with the bank provides any clauses to allow for revocation of Equifax rights to store the information about me, but if it does not then I need to go out and find me a new bank with some better lawyers. (I'm saying that a scenario such as this whole series of negligent behavior and events, should trigger one of those clauses.)
  - protomyth 9y ago
    You are going with the assumption that your sharing agreement with the bank has limits that don't really exist. I doubt you will be able to file a case based on the idea that the entity you have allowed your bank to share data with cannot actually store that data. I doubt a court would go along with that.
    - yebyen 9y ago
      I'm not arguing that they weren't allowed to store the data. It would be less controversial apparently if I argued that Amazon grants a revokable license to consume the content on Prime Video and it is governed by the click-wrapped Terms of Service. Im not saying they never had a right to store the data, I'm simply saying that it should be revoked. Let's not give them more responsibility and more data, they've already proven repeatedly that they can't handle it.
g051051 9y ago
You don't have to provide consent to having a CRA host "your" data, because you're not the customer unless you buy a product from one of them. CRAs are regulated by the government, with things like GLBA, CFPB, FCRA, and other acronyms covering what they can and cannot do, what their responsibilities are, etc. The CRAs have all been fined for improper handling of data, failing to adequately vet data provided to customers, etc. CRAs get data from two places primarily: public records and CRA members (banks, credit card companies, retailers, etc.) The public records stuff is just that: public. Anyone can get it if they ask and are willing to pay the costs to gather it. Member data is provided by members to CRAs, and you absolutely grant the right to them to do so when you signed up to use them. When you get a bank account, or credit card, or sign up for a store card, or really agree to do business with any entity on a financial basis, you approved it with your signature. Your statement about "covert surveillance" is factually incorrect. You have a right under the law to view your entire credit file as held by all CRAs once per year. I also think (not sure) that you can get a copy if you're turned down for credit due to information on a credit report. So how is it "covert", if you not only know about it but can see it?
- yebyen 9y ago
  It's interesting that "your" data is in quotes. I understand what you mean by "your" data and it's a valid point. It's not my data, not in this country anyway, even when it identifies me personally. That's another subject. You have made a substantive comment and I don't have time to respond substantively to any more comments right now unfortunately. I'm not arguing that they didn't have the right to collect the data. I'm arguing that we have two other credit reporting agencies that appear to be functioning properly, and one that looks like it is in a continuing state of dysfunction. There appears to be no end to their ongoing dysfunctional behavior, and no possible remediation for affected parties on the horizon at all. I just want to know what other kind of business in America would still have any customers after the two weeks that Equifax has just had? Do you think that Equifax should now have the right to continue operating, all things considered?
  - g051051 9y ago
    > I'm arguing that we have two other credit reporting agencies that appear to be functioning properly, and one that looks like it is in a continuing state of dysfunction. I strongly suggest you do some research about that. You'll find that the other two CRAs have been equally "negligent" at different times. > I just want to know what other kind of business in America would still have any customers after the two weeks that Equifax has just had? Remember the Target data breach? Or the Home Depot breach? How about when Sony was distributing a rootkit on their music CDs? Or when Lenovo was distributing a malware package preinstalled on their laptops? Or when Best Buy was selling digital picture frames that had a virus? The list, sadly, goes on and on and on... > Do you think that Equifax should now have the right to continue operating, all things considered? Of course. Since you're here on Hacker News, I presume you must have some knowledge of computer security...do you really think it was negligence that caused all of this? Do you think that the other CRAs are in any way more secure or less negligent? Or banks? Or any business that uses, say Cisco switches (which have tons of vulnerabilities)? Or businesses that uses Microsoft Windows (too many viruses and worms to count)?

by yebyen 9y ago

newscracker 9y ago

> I never consented to have my information in their database, Don't you think that somewhere in the T&Cs of a loan you took or a credit card that you got or a phone contract you signed up for (or many other things) are lines explaining that your information would be shared with credit reporting agencies? So legally, you would've consented to the sharing of information at those times. If that isn't true, then I'd assume that you should be able to sue the institution that shared your information with all these agencies.

brango 9y ago
Oh yeah, so you do have a choice if you want to live in a cave.
- dmoy 9y ago
  What is a reasonable alternative to credit agencies? Most countries I know use similar (or sometimes the same, like the UK) agencies, though sometimes with a caveat that they only log defaults or other stuff you mess up.
  - yebyen 9y ago
    The alternative is the two other credit agencies that haven't (as far as we know) given up all of our personal information to hackers, and who haven't responded to the news of the breach by linking some of their customers to a parody/phishing site that was nearly indistinguishable from their own (very bad) breach response website. There is no way out of this (the cat is out of the bag) but we can go on about our lives without Equifax. They need to be unplugged.
    - dmoy 9y ago
      Ok sure but all of your objections above (https://news.ycombinator.com/item?id=15303289 https://news.ycombinator.com/item?id=15303289) can be applied to the other two agencies as well. They collect all your info also. I'm personally not super optimistic about their security.
      - yebyen 9y ago
        Me either! That's absolutely a valid point. And I am terrified that this breach will ultimately result in the end of the credit system as we know it, but right now taking such a position is still scare-mongering. (Very reasonable scare mongering, mind you, but maybe cart before the horse.) We can't just unplug all three agencies and shut down the credit industry, but why can't we shut down Equifax? Take the drivers' license and the car keys away from the drunk driver. They are the ones that let the cat out of the bag, they should no longer be allowed to collect our personal information. There is no reasonable argument that can be made that Equifax in particular, should be allowed to go on making money off of our personal data with the negligent failure that they have created for us and admitted to, after what all has happened. Edit: When Sonny Vleisides plead guilty to Felony Mail Fraud in 2007, he was forbidden to engage in loan programs, gambling or gaming activities, telemarketing activities, investment programs or any other business involving the solicitation of funds. He went on to found the company called Butterfly Labs in 2010, a company that took pre-orders for Bitcoin mining equipment (in many cases soliciting funds for hardware that didn't exist, until it did). Many people argued that this model was a direct violation of the terms of his supervised release. He stood in front of a judge in 2014 that said there was a "strong smell" of fraud with respect to his company. Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. When does Equifax get their 14 months in jail followed by a supervised release? Never, apparently, they just go on about their business and no charges are filed. It's absolutely ridiculous in my humble opinion. Maybe I'm the one who is being unreasonable, expecting that the wheels of justice can turn more rapidly than one can reasonably expect. It's not exactly parallel, I'm stretching to draw parallels obviously, but there should be some parallels in the arena of legal action here. Has anyone argued that Equifax wasn't negligent in the circumstances leading up to the breach? What about in their actions since then? How much further does it have to go before we can get the FTC or US Marshals involved and shut the place down?
yebyen 9y ago
You know the point I'm trying to make, and it's disingenuous to point at some line in some far-away terms and conditions, and say "that authorizes Equifax and two other companies to collect and maintain all information on you, in perpetuity, without any option to revoke this grant." Are they licensed to do this type of work? Shouldn't they need to be? Should that be revokable? What is the process for revoking that permission, and can we get it started already? It just came out that in their response to the breach, they've been linking their "customers" to a phishing site since September 9. It's time to revoke those grants.
- rootlocus 9y ago
  > it's disingenuous to point at some line in some far-away terms and conditions, and say "that authorizes Equifax and two other companies to collect and maintain all information on you, in perpetuity, without any option to revoke this grant." To be fair, I'm pretty sure they can legally do that if this was actually the case.
  - yebyen 9y ago
    It's a finer point, but if I have authorized Chase Bank to share data with a credit reporting agency, does that mean I have also authorized the credit reporting agency to retain that data? I don't think it does. Absent any law that says exactly how they may and may not collect and retain such data, you're probably right that it is exactly what it means. The owners of the data (the banks) authorized them, so they are authorized to have the data. It does not change the fact that, if true, the law is an ass. I do not grant power-of-attorney to the credit-holders that I do business with. They are not authorized to sign documents in my name. They should not be able to authorize arbitrary agencies to hold my personal data in an irrevocable fashion. (And if I understand the difference in law between US and Europe, in Europe they would not be able to permanently retain my personal data without any recourse for me to shut it down. But in the US, they may be allowed to do this.)
    - rootlocus 9y ago
      > It's a finer point, but if I have authorized Chase Bank to share data with a credit reporting agency, does that mean I have also authorized the credit reporting agency to retain that data? I don't think it does. I think you're placing too many constraints on a hypothetical contract just to support your initial argument. Most likely the contract is carefully written in such a way that it's legal for them to do whatever they wanted to do with your data to begin with. It's pointless arguing over what ifs.

monochromatic 9y ago

You didn’t consent to let them collect publicly available information, and information that you voluntarily shared with their business partners?

yebyen 9y ago
No, I have no contract with Equifax. Does that mean I don't have any standing in this discussion? You're being obtuse.
- monochromatic 9y ago
  I’m guessing that, in the contracts you agreed to with credit card companies and others, you did consent to information being shared with the credit bureaus.
  - yebyen 9y ago
    Yes. Conceded. That is different than consenting to the credit bureaus storing those data points in perpetuity. It is an agreement with my bank. That lets my bank off the hook, not the negligent credit reporting agency Equifax. I must still have some kind of rights when any kind of agency is legally allowed to store my SSN and personal information. If this was Europe, with their data privacy protections, I would be sure about that. The reality in this country is, I have no idea if "I must have" is a statement of fact or not. It should be my right to revoke this privilege that they have gained, however they came about it.
    - Frondo 9y ago
      Heh, that's a really interesting point. If I can go into Google and click a box to completely expunge my google history, why can't I do the same with a credit-reporting agency? I get that the thinking is, well, you could just expunge away bad credit choices... but, so what? Your blank credit history is now your red flag, as well as a bad one. But if you wanted to opt out, you could. What could possibly go wrong? (Hah, I didn't mean that as a jokey rhetorical question!)

protomyth 9y ago

> I never consented to have my information in their database Why yes, you did through your agreement with any vendor (e.g. bank, credit union, credit card company, rental) that you have dealt with. This is a standard clause, although some places don't actually do it (my landlord for instance as I found out when I went for a car loan). I hate this, but claiming you didn't consent is just not a credible answer without some additional legislation to force contracts to be explicit in whom a vendor may share information.

yebyen 9y ago
I disagree, you're citing an agreement between me and my bank. The bank may have authorized Equifax to store the data, but I did not. The bank was authorized to share the data (by me), and Equifax was authorized to store the data (by the bank), it is a fine point but it is a fact. So in all of this, the bank is the one who is not in the wrong. I can't say whether Equifax's agreement with the bank provides any clauses to allow for revocation of Equifax rights to store the information about me, but if it does not then I need to go out and find me a new bank with some better lawyers. (I'm saying that a scenario such as this whole series of negligent behavior and events, should trigger one of those clauses.)
- protomyth 9y ago
  You are going with the assumption that your sharing agreement with the bank has limits that don't really exist. I doubt you will be able to file a case based on the idea that the entity you have allowed your bank to share data with cannot actually store that data. I doubt a court would go along with that.
  - yebyen 9y ago
    I'm not arguing that they weren't allowed to store the data. It would be less controversial apparently if I argued that Amazon grants a revokable license to consume the content on Prime Video and it is governed by the click-wrapped Terms of Service. Im not saying they never had a right to store the data, I'm simply saying that it should be revoked. Let's not give them more responsibility and more data, they've already proven repeatedly that they can't handle it.

g051051 9y ago

You don't have to provide consent to having a CRA host "your" data, because you're not the customer unless you buy a product from one of them. CRAs are regulated by the government, with things like GLBA, CFPB, FCRA, and other acronyms covering what they can and cannot do, what their responsibilities are, etc. The CRAs have all been fined for improper handling of data, failing to adequately vet data provided to customers, etc. CRAs get data from two places primarily: public records and CRA members (banks, credit card companies, retailers, etc.) The public records stuff is just that: public. Anyone can get it if they ask and are willing to pay the costs to gather it. Member data is provided by members to CRAs, and you absolutely grant the right to them to do so when you signed up to use them. When you get a bank account, or credit card, or sign up for a store card, or really agree to do business with any entity on a financial basis, you approved it with your signature. Your statement about "covert surveillance" is factually incorrect. You have a right under the law to view your entire credit file as held by all CRAs once per year. I also think (not sure) that you can get a copy if you're turned down for credit due to information on a credit report. So how is it "covert", if you not only know about it but can see it?

yebyen 9y ago
It's interesting that "your" data is in quotes. I understand what you mean by "your" data and it's a valid point. It's not my data, not in this country anyway, even when it identifies me personally. That's another subject. You have made a substantive comment and I don't have time to respond substantively to any more comments right now unfortunately. I'm not arguing that they didn't have the right to collect the data. I'm arguing that we have two other credit reporting agencies that appear to be functioning properly, and one that looks like it is in a continuing state of dysfunction. There appears to be no end to their ongoing dysfunctional behavior, and no possible remediation for affected parties on the horizon at all. I just want to know what other kind of business in America would still have any customers after the two weeks that Equifax has just had? Do you think that Equifax should now have the right to continue operating, all things considered?
- g051051 9y ago
  > I'm arguing that we have two other credit reporting agencies that appear to be functioning properly, and one that looks like it is in a continuing state of dysfunction. I strongly suggest you do some research about that. You'll find that the other two CRAs have been equally "negligent" at different times. > I just want to know what other kind of business in America would still have any customers after the two weeks that Equifax has just had? Remember the Target data breach? Or the Home Depot breach? How about when Sony was distributing a rootkit on their music CDs? Or when Lenovo was distributing a malware package preinstalled on their laptops? Or when Best Buy was selling digital picture frames that had a virus? The list, sadly, goes on and on and on... > Do you think that Equifax should now have the right to continue operating, all things considered? Of course. Since you're here on Hacker News, I presume you must have some knowledge of computer security...do you really think it was negligence that caused all of this? Do you think that the other CRAs are in any way more secure or less negligent? Or banks? Or any business that uses, say Cisco switches (which have tons of vulnerabilities)? Or businesses that uses Microsoft Windows (too many viruses and worms to count)?