Let Equifax and Friends Die

By R.

Bryce Covert writes in the New York Times:

Because of lax security at Equifax, one of the three major credit reporting companies, the private financial and personal details of as many as 143 million Americans have been exposed to hackers. We still don’t know what the full ramifications will be; the people who took this information — which includes birth dates, Social Security numbers and addresses — could hold on to it for as long as they want and deploy it in years to come.

Many consumers have scrambled to try to protect themselves. To anyone who tried to get through to Equifax customer service, though, it became clear: The company does not care about us. Months before the hack itself, Equifax could easily have patched the hole in its system that hackers exploited, but it simply didn’t.

That’s because we are not the customers of credit reporting companies, but the product. These private institutions hoover up our data, often without our knowledge and consent, and then sell it off to banks, landlords and even prospective employers. The companies rake in some $10 billion in revenue every year. They wield enormous power to ruin our lives — if not through a data breach, then through errors on our credit reports. One in four consumers has an error on his credit report that could affect his scores, yet it can be very difficult to correct the record.

It's difficult to find an American who has not had some sort of run-in with Equifax or one of the other credit reporting agencies. And Covert is right to point out that these generally negative experiences are ultimately the norm because we are not the customers. Instead we are the product.

But, as Dean Baker points out, these agencies couldn't exist if they were actually held liable for their abuses of the consumers whose data they peddle:

Covert tells us that one in four credit reports contain a major error. Suppose that leads to 100,000 people a year to suffer serious consequences, that would be less than 0.25 percent of the people with serious errors in their report. If the average damages come to $15,000 (including legal fees), this would run to $1.5 billion in annual damage payments. If 1.0 percent of the people with erroneous reports suffered consequences, it would come to $6 billion a year.

In terms of breaches, we don't know how much damage people will suffer from the most recent one but suppose we just give a nominal amount, say $100, to each of the 140 million victims. This would come to $14 billion. If people suffer serious damage in the form of stolen identities leading to phony credit charges and stolen assets, the damages would be hugely higher.

The revenue (not profits) of the three credit agencies is $10 billion a year, If these companies faced liability in accordance with the actual harm caused by preventable errors, it is difficult to see how they could stay in business. This raises the question of what sort of legal liability the credit agencies face.

As I understand the law (lawyers reading this are welcome to correct me), the credit rating agencies enjoy conditional privilege which exempts them from the same libel standards as the rest of us. If they mistakenly pass along information that keeps us from getting a job or a house, they don't face liability. They only become liable if we inform them of the mistake and they refuse to correct it.

This is important because it would imply that "nationalizing" this credit rating function might be less a case of big bad government stepping in than a situation that would follow from just taking away the special privileges enjoyed by these private businesses. If they were held accountable for the harm caused by passing along inaccurate information in the same way that others would be (suppose you wrongly claimed your doctor had performed surgery while drunk), they would probably not be able to stay in business.

This is one of those cases where ``the market'' exists because of special protections, not because of anything like divine will, and we would likely be a lot better off if we nationalized the credit reporting agencies and managed them democratically such that they are held accountable to consumers whose data they pass on to creditors. As Baker reminds us:

In all sorts of situations, the right likes to conceal the ways in which the government structures the market in ways that redistribute income upward...This is not true. Markets are not created by god: we have to establish rules that determine how and where they will exist. In this case, we structured the law in a way that allows companies to make lots of money by selling people's credit histories. We can structure the law differently so that this is not likely to be a profitable line of business. In that case, we would need a public entity to keep files of people's credit histories.