Equifax: Give Up Your Right to Sue, and Then We’ll Tell You if You Should

Equifax, one of the United States’ three major credit bureaus, acknowledged yesterday that it had been affected by the worst known data breach in US history. An ocean of personally identifiable information (PII) for 143 million people has been stolen by hackers, including social security numbers, addresses, hundreds of thousands of credit card numbers, and other sensitive details.

As we discussed earlier today, Equifax has set up a website that will (supposedly) inform you if your data has been stolen. The only problem is, use of the site also means you forfeit your right to sue the company and agree to mandatory and binding arbitration. The Terms of Use Equifax has specified include the following:

The ToS also states that you can opt out of arbitration, but that you must notify Equifax that you have done so within 30 days of signing up for the service. It is not clear that simply checking your data on the site actually constitutes signing up for the service, since no member information has been provided by the end user and no account appears to be created through this process at Equifax. But there’s still a problem here, even so: If you follow-up with Equifax to claim your identity protection offer, you will create an account — and that means you’ll be subject to these terms of service.

The New York State Attorney General, Eric Schneiderman, has already blasted this language and demanded its removal:

This language is unacceptable and unenforceable. My staff has already contacted @Equifax to demand that they remove it. https://t.co/vT0x7f5Xhc

— Eric Schneiderman (@AGSchneiderman) September 8, 2017

Some will undoubtedly argue that this is merely boilerplate language that slipped into the agreement, but that’s inaccurate. Equifax has been aware of this breach for over a month. They’ve had more than enough time to prepare their public response. Three of the company’s executives had enough time to dump the stock before the news was even public in a nifty bit of illegal insider trading. Furthermore, the Supreme Court has upheld the legality of these mandatory arbitration clauses in multiple cases, including one earlier this year.

With that said, what Equifax is trying to do may be legal, but it’s exceptionally bad optics. The company that just committed the worst data breach in US history believes you should have to waive your right to compensation or damages in a class action lawsuit if you want the identity protection services you only need because it screwed you. Companies like mandatory arbitration clauses because they force you to engage with the corporation in a setting where records are easily sealed, class action suits are impossible, and decisions tend to favor the corporation rather than the individual. Plenty of companies use them these days, but attempting to force them on users in a situation like this takes chutzpah (and explains why the New York State AG is investigating).

Stay classy, Equifax. Stay classy.