I have complained multiple times, their seemed to be listening, but it does not seem like the “urgency” reached the boiling point. Furthermore, adding more reg

I have complained multiple times, their seemed to be listening, but it does not seem like the “urgency” reached the boiling point. Furthermore, adding more regulations and more requirement fixes issue short term, but does not address it long term. Even if regulations you suggested are enacted, I am afraid that it won’t take long until they are misused, abused and misinterpret again. Rather than adding more requirements or stipulating more penalties and burdening regulators with defining right security protocols and mechanisms, it should be reworked into something that allows more competition and more control and forces bad actors fail fast and be replaced. Also it should be actionable at the consumer level. My ideas are: 1. CRA must explicitly get permission from a person to keep their financial history. 2. Consumer has a right to “be forgotten by an agency” and the agency must abide within, lets say, 30-60 days. Also a said agency is required to send the customer or another agency of consumer choosing an authenticated copy of existing credit history. Similar to phone number porting. 3. Collateral. CRA must maintain a collateral fund to be used to pay penalties to consumer in case their information gets stolen. The size of the fund is a function of number of consumers the agency is keeping history for. It does make it harder for new players to enter the market, but on the other hand: - they have something to risk - security evolves, and consumer pressures would make CRA evolve their system as well. If a CRA uses md5 to hash password, get hacked, first, they will loose money in their collateral fund, second, consumers will leave them and they essentially be out of business.