5 ms·

You know the point I'm trying to make, and it's disingenuous to point at some line in some far-away terms and conditions, and say "that authorizes Equifax and t

by yebyen 9y ago

You know the point I'm trying to make, and it's disingenuous to point at some line in some far-away terms and conditions, and say "that authorizes Equifax and two other companies to collect and maintain all information on you, in perpetuity, without any option to revoke this grant." Are they licensed to do this type of work? Shouldn't they need to be? Should that be revokable? What is the process for revoking that permission, and can we get it started already? It just came out that in their response to the breach, they've been linking their "customers" to a phishing site since September 9. It's time to revoke those grants.

rootlocus 9y ago
> it's disingenuous to point at some line in some far-away terms and conditions, and say "that authorizes Equifax and two other companies to collect and maintain all information on you, in perpetuity, without any option to revoke this grant." To be fair, I'm pretty sure they can legally do that if this was actually the case.
- yebyen 9y ago
  It's a finer point, but if I have authorized Chase Bank to share data with a credit reporting agency, does that mean I have also authorized the credit reporting agency to retain that data? I don't think it does. Absent any law that says exactly how they may and may not collect and retain such data, you're probably right that it is exactly what it means. The owners of the data (the banks) authorized them, so they are authorized to have the data. It does not change the fact that, if true, the law is an ass. I do not grant power-of-attorney to the credit-holders that I do business with. They are not authorized to sign documents in my name. They should not be able to authorize arbitrary agencies to hold my personal data in an irrevocable fashion. (And if I understand the difference in law between US and Europe, in Europe they would not be able to permanently retain my personal data without any recourse for me to shut it down. But in the US, they may be allowed to do this.)
  - rootlocus 9y ago
    > It's a finer point, but if I have authorized Chase Bank to share data with a credit reporting agency, does that mean I have also authorized the credit reporting agency to retain that data? I don't think it does. I think you're placing too many constraints on a hypothetical contract just to support your initial argument. Most likely the contract is carefully written in such a way that it's legal for them to do whatever they wanted to do with your data to begin with. It's pointless arguing over what ifs.
    - yebyen 9y ago
      Only in America. They could not store personal information about us without obtaining permission in Europe, and we would have the right to revoke it for any reason as well. This is not normal, it is dysfunctional. I'm not arguing that it's not legal, I'm arguing that they need to lose their license. (Never mind that no such licensing requirement exists. Like I said, it's a dysfunctional system, and I don't know why we don't have more than 3 credit reporting agencies. It sounds like a great gig!)
Frondo 9y ago
I know the point you're trying to make, and I'd say more to that point: we already recognize that you can't sign a contract that strips you of some basic human rights. You can't sign a contract that enslaves you, etc. With the amount of power these organizations and this information has over each of us, individually, I'd go so far as to say there is a human rights issue at stake. People's lives get fucked up through credit bureau mistakes, and what consequence is there for those bureaux? Pointing to a subclause in a contract to say "well, here's where you let them potentially fuck up your life with no recourse, and everything is legal" suggests to me that our thinking around the power these agencies, and around ownership of information about our lives, have needs revisiting.
- gglitch 9y ago
  Not to mention that the terms in the contract do not cover all retention and usage policies of the data. The terms are vague.
- yebyen 9y ago
  I hope that we can start having that conversation! Right now it seems unlikely. It would not be so controversial if I claimed that Amazon grants customers a revokable license to audio and video content hosted on Prime, but my social security number and credit history evidently is not afforded as much protection under the law.
- Consultant32452 9y ago
  What's really at stake here? Your ability to take on debt, which primarily benefits the banks. The bigger problem I think we have here is the cavalier nature in which people view debt. Debt is bad for you. Rather than bringing going into debt under the umbrella of "basic human rights" how about a cultural shift away from debt altogether?
  - yebyen 9y ago
    Now if we could just do something about those housing prices, that might even be possible. (What percent of homeowners do you suppose bought their homes without taking on some debt?) Paying rent is also bad for you.
newscracker 9y ago
I completely agree that there doesn't seem to be any kind of good oversight on the entities, what they do and how they do it. The entire process and chain of information sharing doesn't seem to be in the best interests of consumers.
closeparen 9y ago
>some far-away terms and conditions Are you claiming that people don't know what credit reporting is when they sign loans? If so, that's a failure of basic financial education on the part of parents and K12. If someone imagines they have the right to delete the records of debts they don't want to pay, that person has been tragically misled about the fundamental nature of adulthood. Knowing that lenders communicate with each other about your reputation, especially when you'd rather they wouldn't, is right up there with knowing what interest is.
- yebyen 9y ago
  I'm claiming that we should have the right to tell one of the three credit reporting agencies to get bent and delete our file if they're Equifax in October of 2017. That's not the same thing as "delete the record of debts I don't want to pay." That's completely disingenuous of you to suggest that's what I meant. There are three credit reporting agencies. Can you tell me why there aren't more? Because from everything I can tell, there is nothing short of purely criminal activity that could actually result in Equifax being required to go out of business. It seems that no amount of negligent behavior on their part can give me the right to say "cease and desist your retention of my record," while I've never so much as signed a document that came from Equifax. I have no direct relationship with them, and I have the right to get a restraining order if a malicious stalker is all up in my shit, so how is this situation any different? What makes them the authority? Because credit banks do business with them? That's nice... I want them out of business! In Europe, I would have this right. Nobody could maintain a file on me that I can't get a legal order for them to delete. I'm not talking about debt holders. I'm talking about this parasitic company that evidently has no security team, or has chronically underfunded it to the point that we get where we are now, or had simply disregarded their advice umpteen times _after_ it became clear that the situation was very dire. The struts vulnerability was disclosed months before they patched it. Any security researcher worth a dime could have told them it was a mistake to put up that equifaxsecurity2017 site that was literally (so much that their own Twitter account linked to it 9 times) indistinguishable from a phishing website and make the only way to know it was legit, a link from the front page of Equifax.com. How did they get such a great gift from the law, if such is true then sign me up to be a credit reporting agency! I know how to build crappy websites and persist database records, it seems I meet all of the non-existent licencing requirements to be a CRA.

by yebyen 9y ago

rootlocus 9y ago

> it's disingenuous to point at some line in some far-away terms and conditions, and say "that authorizes Equifax and two other companies to collect and maintain all information on you, in perpetuity, without any option to revoke this grant." To be fair, I'm pretty sure they can legally do that if this was actually the case.

yebyen 9y ago
It's a finer point, but if I have authorized Chase Bank to share data with a credit reporting agency, does that mean I have also authorized the credit reporting agency to retain that data? I don't think it does. Absent any law that says exactly how they may and may not collect and retain such data, you're probably right that it is exactly what it means. The owners of the data (the banks) authorized them, so they are authorized to have the data. It does not change the fact that, if true, the law is an ass. I do not grant power-of-attorney to the credit-holders that I do business with. They are not authorized to sign documents in my name. They should not be able to authorize arbitrary agencies to hold my personal data in an irrevocable fashion. (And if I understand the difference in law between US and Europe, in Europe they would not be able to permanently retain my personal data without any recourse for me to shut it down. But in the US, they may be allowed to do this.)
- rootlocus 9y ago
  > It's a finer point, but if I have authorized Chase Bank to share data with a credit reporting agency, does that mean I have also authorized the credit reporting agency to retain that data? I don't think it does. I think you're placing too many constraints on a hypothetical contract just to support your initial argument. Most likely the contract is carefully written in such a way that it's legal for them to do whatever they wanted to do with your data to begin with. It's pointless arguing over what ifs.
  - yebyen 9y ago
    Only in America. They could not store personal information about us without obtaining permission in Europe, and we would have the right to revoke it for any reason as well. This is not normal, it is dysfunctional. I'm not arguing that it's not legal, I'm arguing that they need to lose their license. (Never mind that no such licensing requirement exists. Like I said, it's a dysfunctional system, and I don't know why we don't have more than 3 credit reporting agencies. It sounds like a great gig!)

Frondo 9y ago

I know the point you're trying to make, and I'd say more to that point: we already recognize that you can't sign a contract that strips you of some basic human rights. You can't sign a contract that enslaves you, etc. With the amount of power these organizations and this information has over each of us, individually, I'd go so far as to say there is a human rights issue at stake. People's lives get fucked up through credit bureau mistakes, and what consequence is there for those bureaux? Pointing to a subclause in a contract to say "well, here's where you let them potentially fuck up your life with no recourse, and everything is legal" suggests to me that our thinking around the power these agencies, and around ownership of information about our lives, have needs revisiting.

gglitch 9y ago
Not to mention that the terms in the contract do not cover all retention and usage policies of the data. The terms are vague.
yebyen 9y ago
I hope that we can start having that conversation! Right now it seems unlikely. It would not be so controversial if I claimed that Amazon grants customers a revokable license to audio and video content hosted on Prime, but my social security number and credit history evidently is not afforded as much protection under the law.
Consultant32452 9y ago
What's really at stake here? Your ability to take on debt, which primarily benefits the banks. The bigger problem I think we have here is the cavalier nature in which people view debt. Debt is bad for you. Rather than bringing going into debt under the umbrella of "basic human rights" how about a cultural shift away from debt altogether?
- yebyen 9y ago
  Now if we could just do something about those housing prices, that might even be possible. (What percent of homeowners do you suppose bought their homes without taking on some debt?) Paying rent is also bad for you.

newscracker 9y ago

I completely agree that there doesn't seem to be any kind of good oversight on the entities, what they do and how they do it. The entire process and chain of information sharing doesn't seem to be in the best interests of consumers.

closeparen 9y ago

>some far-away terms and conditions Are you claiming that people don't know what credit reporting is when they sign loans? If so, that's a failure of basic financial education on the part of parents and K12. If someone imagines they have the right to delete the records of debts they don't want to pay, that person has been tragically misled about the fundamental nature of adulthood. Knowing that lenders communicate with each other about your reputation, especially when you'd rather they wouldn't, is right up there with knowing what interest is.

yebyen 9y ago
I'm claiming that we should have the right to tell one of the three credit reporting agencies to get bent and delete our file if they're Equifax in October of 2017. That's not the same thing as "delete the record of debts I don't want to pay." That's completely disingenuous of you to suggest that's what I meant. There are three credit reporting agencies. Can you tell me why there aren't more? Because from everything I can tell, there is nothing short of purely criminal activity that could actually result in Equifax being required to go out of business. It seems that no amount of negligent behavior on their part can give me the right to say "cease and desist your retention of my record," while I've never so much as signed a document that came from Equifax. I have no direct relationship with them, and I have the right to get a restraining order if a malicious stalker is all up in my shit, so how is this situation any different? What makes them the authority? Because credit banks do business with them? That's nice... I want them out of business! In Europe, I would have this right. Nobody could maintain a file on me that I can't get a legal order for them to delete. I'm not talking about debt holders. I'm talking about this parasitic company that evidently has no security team, or has chronically underfunded it to the point that we get where we are now, or had simply disregarded their advice umpteen times _after_ it became clear that the situation was very dire. The struts vulnerability was disclosed months before they patched it. Any security researcher worth a dime could have told them it was a mistake to put up that equifaxsecurity2017 site that was literally (so much that their own Twitter account linked to it 9 times) indistinguishable from a phishing website and make the only way to know it was legit, a link from the front page of Equifax.com. How did they get such a great gift from the law, if such is true then sign me up to be a credit reporting agency! I know how to build crappy websites and persist database records, it seems I meet all of the non-existent licencing requirements to be a CRA.