7 ms·

freeze your credit report with Equifax, and then if any company requests it, they'll be denied (because you have to request it be unfrozen for them to receive i

freeze your credit report with Equifax, and then if any company requests it, they'll be denied (because you have to request it be unfrozen for them to receive it). If any company uses Equifax, you'll then be denied credit or they'll ask you to unfreeze it.. either way, you can complain to them, and make it clear you won't work with Equifax. Of course, in practice, this will mean you'll get denied credit from any company that has a contract with Equifax.

djb_hackernews 9y ago
Doesn't this require you to trust Equifax to enforce and honor the freeze? I think the solution is "I don't want my report or any of my data in any sort of control or possession of Equifax". Where is that solution?
- munin 9y ago
  What is "your data" exactly? And in the limit, how far does this go? Here's a question: who owns your drivers license? Here's a hint: it isn't you. Can you "own" you mailing address? Copyright and trademark it, make everyone ask permission from you before they write it down? What about your salary? Should your employer have to ask every time they use your salary number in some way, say in aggregate statistics or reporting? What about information about how you interact with your credit card company? Who owns that, you, or the credit card company? Do the two of you have some kind of joint ownership? We've made some of these decisions about health data and it has far-reaching consequences, some of them undesirable. It's also been very difficult to enforce. Do you want to extend that kind of regime to every piece of information about a person? Society might grind to a halt, we would be inundated with virtual and physical pop-ups asking "your landlord wants access to your phone number to place a call to you, will you allow it?" And what process would mediate this access control anyway, and how would we trust it?
  - code_duck 9y ago
    As far as copyright, small snippets of information or sentence fragments are not copyrightable, but collections of data are. >Society might grind to a halt, we would be inundated with virtual and physical pop-ups asking "your landlord wants access to your phone number to place a call to you, will you allow it?" That is how messaging works on many newer systems like Facebook or Instagram, and people appear to find that level of control desirable, not annoying. The only reason the phone system works with public numeric IDs that anyone can dial is that whole thing is a relic from 50 years ago.
  - mattnewton 9y ago
    The issue is that I am responsible for people using this data, but don’t own it like you mentioned. If the banks were responsible for giving out fraudulent loans and there was an easier way to prove that they were fradualent without this PI, then I wouldn’t care. But I have to care right now.
  - pathseeker 9y ago
    >virtual and physical pop-ups asking "your landlord wants access to your phone number to place a call to you, will you allow it?" I would grant the landlord access to contact me while I still have a business relationship with her. This dire scenario you are trying to paint frankly doesn't sound that bad. I don't need a company to know my entire life's history to exploit my past to deliver a targeted ad.
  - mulmen 9y ago
    "My data" is data about me because without me it wouldn't exist.
    - nightski 9y ago
      You can essentially opt out. Just never apply for credit in your life. Good luck. At the end of the day you do consent to this through participating in the banking/credit system. While the data may not exist without you, you are not the one recording it. Why does it not make sense to assign ownership to the one recording/creating the data in the first place?
      - mulmen 9y ago
        Because I am the one carrying the risk, not the people collecting the data.
        deleted 9y ago
        [deleted]
      - Spivak 9y ago
        You consent to X when you do Y, where Y is not explicitly consenting to X, is not a valid argument.
        hacking_again 9y ago
        It's valid if X is having your picture taken and Y is being in public.
        Spivak 9y ago
        I agree that people make themselves vulnerable to someone taking their picture by going outside, but I strongly disagree that people consent to having their picture taken.
        9y ago
  - donogh 9y ago
    If you're curious about the future of privacy, while flawed in some ways, the GDPR (General Data Protection Regulation) comes into effect in the EU next May. Here's their definition of personal data [1]: "Personal data means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller. This can be a very wide definition depending on the circumstances." And then we have this: "Right to change or remove your details If you discover that a data controller has details about you that are not factually correct, you can ask them to change or, in some cases, remove these details. Similarly, if you feel that the organisation or person does not have a valid reason for holding your personal details or that they have taken these details in an unfair way, you can ask them to change or remove these details. In both cases, you can write to the organisation or person, explaining your concerns or outlining which details are incorrect. Within 40 days, the organisation must do as you ask or explain why they will not do so." It's true that enforcement is difficult -- I imagine it'll be more reactive than proactive. That said, a breach is handled quite well, assuming the law is enforced: https://www.dataprotection.ie/docs/Data-Security-Breach-Code-of-Practice/y/1082.htm https://www.dataprotection.ie/docs/Data-Security-Breach-Code... The GDPR is a solid step in the right direction, and a model for a better approach to privacy. [1] https://www.dataprotection.ie/docs/A-guide-to-your-rights-Plain-English-Version/r/858.htm https://www.dataprotection.ie/docs/A-guide-to-your-rights-Pl...
StanislavPetrov 9y ago
Unfortunately you have no way to protect your tax returns from Equifax, which now has a contract with the IRS thanks to the infinite wisdom of our government. http://fortune.com/2017/10/04/equifax-irs-contract-hackers/ http://fortune.com/2017/10/04/equifax-irs-contract-hackers/
- geofft 9y ago
  This contract is a renewal of a previous contract with Equifax (which is why it was a "critical service that couldn't lapse"), and it involves Equifax giving data to the IRS, not the IRS giving your tax returns to Equifax.
  - StanislavPetrov 9y ago
    The IRS is most certainly giving Equifax data or they wouldn't have sent inspectors there to verify the integrity of IRS data. >Chief information officer Girza said the IRS sent inspectors to make sure no IRS data was compromised in the Equifax breach http://www.snopes.com/2017/10/05/equifax-contract-irs/ http://www.snopes.com/2017/10/05/equifax-contract-irs/
    - geofft 9y ago
      That is nowhere close to evidence that Equifax had tax returns.
  - bloaf 9y ago
    So I wonder what would happen if the IRS attempted to Eminent Domain-ify the data they needed.
  - jlarocco 9y ago
    Meanwhile, thanks to Equifax's amazing security, everybody else can get the same data for free ;-)
- bogomipz 9y ago
  From your link: >"The Internal Revenue Service signed a $7.25 million contract with Equifax last month. The no-bid contract, first reported by Politico, is for Equifax to provide the IRS with taxpayer and personal identity verification services. The contract stated that Equifax (EFX, -1.34%) was the only company capable of providing these services to the IRS, and it was deemed a “critical” service that couldn’t lapse." The IRS in the US needs Equifax to provide tax payer and verification services? Seriously what does that even mean? The IRS bas no other way to verify citizens?
toomuchtodo 9y ago
I submitted a complaint to the CFPB requiring [1] Equifax to remove my credit record, due to their proven incompetence at protecting that data (citing their breech, several congresspeople grilling their CEO on CSPAN, etc). Its been 9 days and I haven't heard back from the CFPB yet (Equifax has 15 days to respond and up to 60 days to provide a final response), but Equifax has my complaint and even if it goes nowhere, it gives me something to hand over to Elizabeth Warren's office to show I have no control over my personal data and I have no control over having it removed regardless of how incompetent Equifax is. Fingers crossed someone with Equifax's data dump starts dumping the data of Equifax senior management. [1] Hat tip to patio11 on the language; don't use "I demand", professionals use "I require"
- simcop2387 9y ago
  Do you have more information on how to do this? I'm thinking that doing the same thing makes sense going forward.
  - toomuchtodo 9y ago
    https://www.consumerfinance.gov/complaint https://www.consumerfinance.gov/complaint Complaint was with Equifax, Inc. I specified I required my credit file be removed, as Equifax has had several egregious security breaches and is incapable of properly securing my PII [1]. They have 15 days to respond. [1] https://en.wikipedia.org/wiki/Personally_identifiable_information https://en.wikipedia.org/wiki/Personally_identifiable_inform...
  - astura 9y ago
    CFPB complaints are extremely easy to submit, you can do it right here: https://www.consumerfinance.gov/complaint/ https://www.consumerfinance.gov/complaint/
- KGIII 9y ago
  As for verbiage, you may want try the phrase you later used in a follow up post. It's not really your personal data. After all, it was data from an interaction with another entity which makes it their data as well. So, personally identifiable information (PII) is a less-debatable phrase and more legally defensible. In the first case, if you do business with a bank then the data from that belongs to the bank as much as it belongs to you. They are reporting their information, namely that you interacted with them. Thus, that information would belong to them. In the second case, it is personally identifiable information - which is something that's difficult to dispute. This also gives you interest in that data which is a stronger point to stand on. As mentioned before, I am not a lawyer and this is not legal advice. However, I have extensive experience with the justice system due to my career and have taken quite a few classes concerning the law. Also, the word 'shall' has stronger implications than 'will.' I am not sure why but it is handy to know. The defendant will comply vs. the defendant shall comply. Best of luck.
astura 9y ago
That's not quite how credit freezes work, if they pull Equifax and only that bureau is frozen then they will usually just pull from another credit bureau. People who churn credit cards use this to their advantage - they often freeze the report with the most recent inquiries (usually Experian) to spread out inquiries more evenly over the three bureaus. I've never heard of anyone getting flat out denied for credit (besides mortgages) because they had a single bureau frozen. Sometimes it requires a phone call but usually its just automatic. You also can't prevent them from reporting information about you to Equifax. Anyways, you aren't really hurting anyone by denying yourself the ability to get credit, you're only hurting yourself.
- rgbrenner 9y ago
  Remember, these companies are paying Equifax for your credit report. The point isnt to prevent any credit reporting.. but to prevent equifax specifically from earning money. And no one is "denying themselves the ability to get credit" by refusing to unfreeze an equifax report. If the lender doesn't want to use one of the other credit agencies, then most people can find another lender. Those businesses need to know they'll lose business as long as theyre loyal to equifax. It is unfortunate we don't have more leverage... this does leave a lot of avenues open for Equifax to continue making money. But every bit helps.
  - astura 9y ago
    > If the lender doesn't want to use one of the other credit agencies, then most people can find another lender. Those businesses need to know they'll lose business as long as theyre loyal to equifax lol, yeah, good luck with that when you go to get a mortgage. Mortgage lenders pull all 3 reports, not just one. There is a ton of laws around mortgage underwriting that need to be followed. They technically may be able to underwrite a mortgage with only two credit reports but I doubt any mortgage lender actually will or if they did they'd be charging outlandish interest rates. If you're hiding a report they will assume its because you're hiding something negative that's on the report. Things don't work like you would like in the real world, only in theory. You are delusional if you believe Chase having to pull Experian instead of Equifax once every million credit applications is going to somehow effect Equifax's bottom line. If your landlord uses a background checking service that uses Equifax and the background check service comes back with "frozen report" and you say "I demand you use a different background checking service that doesn't use Equifax" then your landlord is just going to say lol and rent to the person who isn't being extremely difficult, as its a sign you're going to be a difficult tenant.
nodesocket 9y ago
Freezing your credit can come back to bite you if you'd like to buy a house, lease an apartment, buy a car, or open a new credit card within the next 6 months.
- yorwba 9y ago
  Only if you aren't willing to save the money for that up front. Of course most people prefer to get the stuff they want when they want it instead of when they can afford it (and going from renter to owner paying a mortgage does tend to be cheaper), but if you really wanted to, you could live without credit.

djb_hackernews 9y ago

Doesn't this require you to trust Equifax to enforce and honor the freeze? I think the solution is "I don't want my report or any of my data in any sort of control or possession of Equifax". Where is that solution?

munin 9y ago
What is "your data" exactly? And in the limit, how far does this go? Here's a question: who owns your drivers license? Here's a hint: it isn't you. Can you "own" you mailing address? Copyright and trademark it, make everyone ask permission from you before they write it down? What about your salary? Should your employer have to ask every time they use your salary number in some way, say in aggregate statistics or reporting? What about information about how you interact with your credit card company? Who owns that, you, or the credit card company? Do the two of you have some kind of joint ownership? We've made some of these decisions about health data and it has far-reaching consequences, some of them undesirable. It's also been very difficult to enforce. Do you want to extend that kind of regime to every piece of information about a person? Society might grind to a halt, we would be inundated with virtual and physical pop-ups asking "your landlord wants access to your phone number to place a call to you, will you allow it?" And what process would mediate this access control anyway, and how would we trust it?
- code_duck 9y ago
  As far as copyright, small snippets of information or sentence fragments are not copyrightable, but collections of data are. >Society might grind to a halt, we would be inundated with virtual and physical pop-ups asking "your landlord wants access to your phone number to place a call to you, will you allow it?" That is how messaging works on many newer systems like Facebook or Instagram, and people appear to find that level of control desirable, not annoying. The only reason the phone system works with public numeric IDs that anyone can dial is that whole thing is a relic from 50 years ago.
- mattnewton 9y ago
  The issue is that I am responsible for people using this data, but don’t own it like you mentioned. If the banks were responsible for giving out fraudulent loans and there was an easier way to prove that they were fradualent without this PI, then I wouldn’t care. But I have to care right now.
- pathseeker 9y ago
  >virtual and physical pop-ups asking "your landlord wants access to your phone number to place a call to you, will you allow it?" I would grant the landlord access to contact me while I still have a business relationship with her. This dire scenario you are trying to paint frankly doesn't sound that bad. I don't need a company to know my entire life's history to exploit my past to deliver a targeted ad.
- mulmen 9y ago
  "My data" is data about me because without me it wouldn't exist.
  - nightski 9y ago
    You can essentially opt out. Just never apply for credit in your life. Good luck. At the end of the day you do consent to this through participating in the banking/credit system. While the data may not exist without you, you are not the one recording it. Why does it not make sense to assign ownership to the one recording/creating the data in the first place?
    - mulmen 9y ago
      Because I am the one carrying the risk, not the people collecting the data.
      - deleted 9y ago
        [deleted]
    - Spivak 9y ago
      You consent to X when you do Y, where Y is not explicitly consenting to X, is not a valid argument.
      - hacking_again 9y ago
        It's valid if X is having your picture taken and Y is being in public.
        Spivak 9y ago
        I agree that people make themselves vulnerable to someone taking their picture by going outside, but I strongly disagree that people consent to having their picture taken.
        9y ago
- donogh 9y ago
  If you're curious about the future of privacy, while flawed in some ways, the GDPR (General Data Protection Regulation) comes into effect in the EU next May. Here's their definition of personal data [1]: "Personal data means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller. This can be a very wide definition depending on the circumstances." And then we have this: "Right to change or remove your details If you discover that a data controller has details about you that are not factually correct, you can ask them to change or, in some cases, remove these details. Similarly, if you feel that the organisation or person does not have a valid reason for holding your personal details or that they have taken these details in an unfair way, you can ask them to change or remove these details. In both cases, you can write to the organisation or person, explaining your concerns or outlining which details are incorrect. Within 40 days, the organisation must do as you ask or explain why they will not do so." It's true that enforcement is difficult -- I imagine it'll be more reactive than proactive. That said, a breach is handled quite well, assuming the law is enforced: https://www.dataprotection.ie/docs/Data-Security-Breach-Code-of-Practice/y/1082.htm https://www.dataprotection.ie/docs/Data-Security-Breach-Code... The GDPR is a solid step in the right direction, and a model for a better approach to privacy. [1] https://www.dataprotection.ie/docs/A-guide-to-your-rights-Plain-English-Version/r/858.htm https://www.dataprotection.ie/docs/A-guide-to-your-rights-Pl...

StanislavPetrov 9y ago

Unfortunately you have no way to protect your tax returns from Equifax, which now has a contract with the IRS thanks to the infinite wisdom of our government. http://fortune.com/2017/10/04/equifax-irs-contract-hackers/ http://fortune.com/2017/10/04/equifax-irs-contract-hackers/

geofft 9y ago
This contract is a renewal of a previous contract with Equifax (which is why it was a "critical service that couldn't lapse"), and it involves Equifax giving data to the IRS, not the IRS giving your tax returns to Equifax.
- StanislavPetrov 9y ago
  The IRS is most certainly giving Equifax data or they wouldn't have sent inspectors there to verify the integrity of IRS data. >Chief information officer Girza said the IRS sent inspectors to make sure no IRS data was compromised in the Equifax breach http://www.snopes.com/2017/10/05/equifax-contract-irs/ http://www.snopes.com/2017/10/05/equifax-contract-irs/
  - geofft 9y ago
    That is nowhere close to evidence that Equifax had tax returns.
- bloaf 9y ago
  So I wonder what would happen if the IRS attempted to Eminent Domain-ify the data they needed.
- jlarocco 9y ago
  Meanwhile, thanks to Equifax's amazing security, everybody else can get the same data for free ;-)
bogomipz 9y ago
From your link: >"The Internal Revenue Service signed a $7.25 million contract with Equifax last month. The no-bid contract, first reported by Politico, is for Equifax to provide the IRS with taxpayer and personal identity verification services. The contract stated that Equifax (EFX, -1.34%) was the only company capable of providing these services to the IRS, and it was deemed a “critical” service that couldn’t lapse." The IRS in the US needs Equifax to provide tax payer and verification services? Seriously what does that even mean? The IRS bas no other way to verify citizens?

toomuchtodo 9y ago

I submitted a complaint to the CFPB requiring [1] Equifax to remove my credit record, due to their proven incompetence at protecting that data (citing their breech, several congresspeople grilling their CEO on CSPAN, etc). Its been 9 days and I haven't heard back from the CFPB yet (Equifax has 15 days to respond and up to 60 days to provide a final response), but Equifax has my complaint and even if it goes nowhere, it gives me something to hand over to Elizabeth Warren's office to show I have no control over my personal data and I have no control over having it removed regardless of how incompetent Equifax is. Fingers crossed someone with Equifax's data dump starts dumping the data of Equifax senior management. [1] Hat tip to patio11 on the language; don't use "I demand", professionals use "I require"

simcop2387 9y ago
Do you have more information on how to do this? I'm thinking that doing the same thing makes sense going forward.
- toomuchtodo 9y ago
  https://www.consumerfinance.gov/complaint https://www.consumerfinance.gov/complaint Complaint was with Equifax, Inc. I specified I required my credit file be removed, as Equifax has had several egregious security breaches and is incapable of properly securing my PII [1]. They have 15 days to respond. [1] https://en.wikipedia.org/wiki/Personally_identifiable_information https://en.wikipedia.org/wiki/Personally_identifiable_inform...
- astura 9y ago
  CFPB complaints are extremely easy to submit, you can do it right here: https://www.consumerfinance.gov/complaint/ https://www.consumerfinance.gov/complaint/
KGIII 9y ago
As for verbiage, you may want try the phrase you later used in a follow up post. It's not really your personal data. After all, it was data from an interaction with another entity which makes it their data as well. So, personally identifiable information (PII) is a less-debatable phrase and more legally defensible. In the first case, if you do business with a bank then the data from that belongs to the bank as much as it belongs to you. They are reporting their information, namely that you interacted with them. Thus, that information would belong to them. In the second case, it is personally identifiable information - which is something that's difficult to dispute. This also gives you interest in that data which is a stronger point to stand on. As mentioned before, I am not a lawyer and this is not legal advice. However, I have extensive experience with the justice system due to my career and have taken quite a few classes concerning the law. Also, the word 'shall' has stronger implications than 'will.' I am not sure why but it is handy to know. The defendant will comply vs. the defendant shall comply. Best of luck.

astura 9y ago

That's not quite how credit freezes work, if they pull Equifax and only that bureau is frozen then they will usually just pull from another credit bureau. People who churn credit cards use this to their advantage - they often freeze the report with the most recent inquiries (usually Experian) to spread out inquiries more evenly over the three bureaus. I've never heard of anyone getting flat out denied for credit (besides mortgages) because they had a single bureau frozen. Sometimes it requires a phone call but usually its just automatic. You also can't prevent them from reporting information about you to Equifax. Anyways, you aren't really hurting anyone by denying yourself the ability to get credit, you're only hurting yourself.

rgbrenner 9y ago
Remember, these companies are paying Equifax for your credit report. The point isnt to prevent any credit reporting.. but to prevent equifax specifically from earning money. And no one is "denying themselves the ability to get credit" by refusing to unfreeze an equifax report. If the lender doesn't want to use one of the other credit agencies, then most people can find another lender. Those businesses need to know they'll lose business as long as theyre loyal to equifax. It is unfortunate we don't have more leverage... this does leave a lot of avenues open for Equifax to continue making money. But every bit helps.
- astura 9y ago
  > If the lender doesn't want to use one of the other credit agencies, then most people can find another lender. Those businesses need to know they'll lose business as long as theyre loyal to equifax lol, yeah, good luck with that when you go to get a mortgage. Mortgage lenders pull all 3 reports, not just one. There is a ton of laws around mortgage underwriting that need to be followed. They technically may be able to underwrite a mortgage with only two credit reports but I doubt any mortgage lender actually will or if they did they'd be charging outlandish interest rates. If you're hiding a report they will assume its because you're hiding something negative that's on the report. Things don't work like you would like in the real world, only in theory. You are delusional if you believe Chase having to pull Experian instead of Equifax once every million credit applications is going to somehow effect Equifax's bottom line. If your landlord uses a background checking service that uses Equifax and the background check service comes back with "frozen report" and you say "I demand you use a different background checking service that doesn't use Equifax" then your landlord is just going to say lol and rent to the person who isn't being extremely difficult, as its a sign you're going to be a difficult tenant.

nodesocket 9y ago

Freezing your credit can come back to bite you if you'd like to buy a house, lease an apartment, buy a car, or open a new credit card within the next 6 months.

yorwba 9y ago
Only if you aren't willing to save the money for that up front. Of course most people prefer to get the stuff they want when they want it instead of when they can afford it (and going from renter to owner paying a mortgage does tend to be cheaper), but if you really wanted to, you could live without credit.