Equifax seems to have been given data for a specific purpose of their client and then used it for another internal purpose. From a GDPR perspective this would

Equifax seems to have been given data for a specific purpose of their client and then used it for another internal purpose. From a GDPR perspective this would probably be seen as a massive violation exposing Equifax to serious fines. From a security certification perspective as this is now public knowledge and the company seems to be unrepentant Equifax clients can not claim their are entrusting their data to a company with proper security controls. Equifax should fail their next security certification audit for this.