A minor but strategic change in liability law around privacy would shift incentives in the way you describe and suddenly it becomes in the best financial interests of the companies to protect the data. Indeed this is the only kind of incentive they will respond to.

Nationalizing the credit industry doesn't really solve any real problems as far as I can tell.

And it generally works pretty well. In the law, the government lays out rough things it wants to see (e.g. access restrictions, auditing logs, etc) + penalties (financial and otherwise) and then lets the industry find a way to meet them. Furthermore, there's a legal distinction between willful and accidental non-compliance.

It's absolutely added cost, but generally seems to accomplish its privacy intent.

http://www.medscape.com/viewarticle/810648

I've worked as a developer with health care providers and insurance companies for 5 years, and other than it being annoying as "some regulation exists" no one I've talked to feels it's a bad solution to the problem.

Asking industries to be happy about privacy regulation seems an unreasonable goalpost.

Besides, I’d be willing to bet that those at Equifax would have similar things to say about a comparable credit reporting law, just like how some medical practitioners don’t like HIPAA.

I just googled it, and it was the first result

My definition: the most efficient has the least wasted effort and the maximum productivity.

I do not think having individuals & classes going off and suing everyone they can, every company buying piles of insurance against these suits (because how could they reasonably guarantee perfect privacy?) and having insurance providers coming to evaluate each institution...

This is only legally efficient, in that it requires the least amount of nuance in law.

There's a reason we have public infrastructure and services, and it is for efficiency.

Maybe do it state-by-state, so long as each state follows some federal guidelines and each state provides a way to interoperate with the rest, and with private businesses that need access to that information, if the feds freak you out.

Why?

Because I can, in theory, have my say in how the government operates. I can vote, I can submit comments, I can go talk to elected officials, whatever. I have zero recourse when private companies schlep my data around and wreck my life. Voting with your vote is best, but I can't even vote with my dollar with Equifax.

Firstly, examples of governments that have any people voted in at all are cherry-picked. Around the world, there are governments that are not voted in, or are "voted" in by a sham process which only has the external appearances of democracy.

Secondly, in democracies, a fairly common pattern is that the government consists of some seats that are voted in (parliament) plus some that are appointed (senate). The power is divided accordingly. (A minor point is that it is not uncommon for the leader of the elected party to appoint people for the uppermost staff positions: a so-called "cabinet" or whatever.)

Thirdly, government in the broad sense includes not only the parliament and senate political structure but all of the institutions of the government that actually get various things done throughout the governed region, and all the levels of bureaucracy employing large numbers of people. All of that staff is not elected; they are just people hired into positions and they generally keep those positions across government changes. That bureaucracy has considerable power of its own; not every single decision they make which affects you goes through a parliamentarian that you elected!

Two, yes, many of the highest profile, and most powerful, positions are elected. And in practice, over time, this means that these positions have selected for people who are 'electable' - which has itself over time come to mean people who can raise huge amounts of campaign money. This is a deeply corruptible situation, if indeed it is not already deeply corrupted.

I agree with the idea that open public oversight is a powerful corrective, and is a major difference between private organizations and public ones with effective means for perceiving and removing corrupt officials. I think it is highly questionable to what degree the latter describes our current situation in much even of the democratized West.

One problem. She didn't know that she had been pregnant and suffered a near fatal (to her) complication and miscarriage 7.5 months ago. Only a few parties were aware of this: My family (not posted on Facebook), two health insurance companies, the hospital, two pharmacies and the Ob/Gyn practice. Last week would have been the due date.

One of more of those entities, who are all supposed to protecting her privacy failed to do so to extract a few more bucks.

I would suggest that that is not "failing to protect" private data, but "actively exploiting".

I think a company should be able to avoid a fine if they disclose breaches immediately and are able to document that they followed best practices. From what I've read about the Equifax breach, they would definitely be found negligent.

It may be the case that once all the privacy related externalities are pushed back onto credit reporting agencies then their business model is no longer viable. I, for one, am fine with that outcome. If that's the case then credit reporting agencies were never a net good for society in the first place, and all the regulations are doing is exposing that truth.

To extend your thinking, consider air travel. Airlines act responsibly, even to the point of having government provide much of their security, yet occasionally terrorists manage to blow up aircraft. In that scenario, you'd have the airline be fully ('strictly') liable because of an external event they did everything to avoid. The harm is greater too - death is worse than ID theft.

Truth is, nothing can be done safely. Not travel, not business. There is always a tradeoff between risk and benefit.

Credit itself is an enabler for the economy. Credit bureaux facilitate comprehensible risk management, which allows for market forces to operate around interest rate setting reasonably effectively. Absent bureaux that same function needs to be performed, but it'll be done in a decentralized, ad hoc fashion by individual lenders which will impinge on their business models and ultimately drive up rates.

So you don't like the bureaux; well, nobody does really. But what is an alternative which allows lenders to compare applicants on a like-for-like basis with some degree of confidence?

Data gathering is usually not opt-in and it's also intentionally non-obvious who your information is shared with in most cases. I'm also rarely the customer, which means there's very little chance that my interests are being represented. Security or lack thereof is pretty hidden as well.

I suspect we would find a way to fill the economic holes if every credit bureaux was phased out over the next 5 years.

IMO, the entire vertical needs to be more transparent.

I think the much more interesting discussion is about how those economic holes are filled, and it's why I posed that question in my note above. Of all the corners of the internet where you might expect such a solution to be proposed, HN is surely the best. What does post-bureau creditworthiness attestation look like? Presumably it's decentralized, to minimize aggregate harm to people in the event of a hack. Presumably it's de facto (and de jure) verifiable and correctable by each individual. It must also have some sort of graduated 'need to know' disclosure mechanism, with crude aggregate scores available to low-ranked creditors (cellphone companies, for example), and much more detailed information available to senior stuff like mortgage lenders. And why wouldn't it also have a facility, which didn't disclose creditworthiness data, for authenticating users to various services?

But then why not go one step further. Why have this stuff in one place per consumer at all? Why not have lenders jus reach out over an API to every other lender to ask in effect "How good a debtor has scrumper, with SSN 01-234-5678, been for you? How long have you done business with her?" and get various answers back, all of which can be factored into some model which conforms minimally to a regulator-provided specification? The size or risk of the loan dictates the depth of that pan-industry query. Companies don't hold any more than they already hold, and there's no nexus for that data at all. And all the lender is allowed to keep is the model result, some sort of FICO equivalent, for a particular applicant.

Yes, that's true. But as the poster above already said some things are simply not safe to do. If I wanted to warehouse explosives, I wouldn't be allowed to do it near a populated area, I'd have to put my warehouse far away from populates areas. But absent that prohibition, let's say I found a cheap space in town, and so I loaded it up with tons of explosive material. Then a homeless fellow breaks in one night and manages to start a fire, burns the place. He survives, but the explosives were set off and half the town blew up. You'd think it's okay if I shrugged my shoulders and pointed at the homeless fellow?

Credit reporting bureaus have free reign to screw up here because there's no oversight like the BATFE and no reasonable way for them to be sued into oblivion when they screw up so badly as Equifax has clearly done here.

>Credit bureaux facilitate comprehensible risk management,

How anyone can trust Equifax to do anything anymore is beyond me. There is still no corrective force here to cause these companies to become competent with data security. This is a farce.

If it's legal to operate an explosives warehouse in town at the time you do it, then unfortunately yes I have to answer that, provided you'd complied with applicable laws in securing your warehouse full of bombs, then you could shrug your shoulders. But you'd then be shrugging in the face of a barrage of lawsuits (as is happening now with Equifax). Soon after your homeless guy blew up the block the laws would be changed. And that's the situation we're in now: rubble everywhere, with a chance to make legislative changes to prevent a recurrence.

With air travel the people bearing the risk are the direct customers. If I'm uncomfortable with the safety record of airlines I can simply not fly. How do I opt out of the risks imposed by a credit rating agency?

The closer analogy, I think, would be if cargo planes were routinely crashing in populated areas. The air freight company and its clients may well be completely comfortable with their loss rate, but the unaffiliated third parties living underneath would have a pretty justifiable reason to complain.

> Truth is, nothing can be done safely. Not travel, not business. There is always a tradeoff between risk and benefit.

This is absolutely true, but as currently constructed credit agencies get to reap the benefits while pushing the risk off onto the general public. If we regulate to internalize that risk and the agencies still think it's a good risk/reward tradeoff then that's fine. If they no longer think it's a good tradeoff that's fine too.

> So you don't like the bureaux; well, nobody does really. But what is an alternative which allows lenders to compare applicants on a like-for-like basis with some degree of confidence?

There's several suggestions elsewhere in the thread, but I'm going to go out on a limb and suggest: nothing.

On a macroeconomic level, easy availability of credit increases average growth but also increases total risk, and therefore volatility. It's not apparent to me that that's a good trade.

On a microeconomic level, the benefits I receive from being able to get credit easily have to be weighed against both the suboptimal personal accounting I have to engage in to keep my credit score up and against the long tail risk that a third party can open a line of credit in my name. It's not apparent to me that that's a good trade either.

Maybe lenders should be much more conservative with who they loan to. Maybe they should price in a much higher default rate. Maybe individuals should seek a single line of credit from their bank of choice instead of expecting expenses to be financed individually. I don't know, I'm just some guy with 2 semesters of college-level economics. What I do know is that the status quo isn't sacred and the arguments explicitly in support of it seem to boil down to "growth is good and change is scary", which seems like really weak rationale for giving someone most of us don't even have a business relationship with essentially unilateral control of millions of people's financial fates.

So yes, the problem is one here the credit bureaux get to externalize their risk. I was arguing with your rejection of the 'insurance model' for bringing some of those externalities back in house. Your proposal of strict liability is really just a banning of the industry in disguise: without the possibility of insuring away those risks it's not viable to stay in business - an agency is going to get breached even if they are as careful as possible. I don't think the lobby (and it'd be bureaux and lenders lobbying on the same side) would permit that outcome, no matter how strong the political will. It's too far reaching.

My response is, insurance doesn't preclude elimination. Those bureaux aren't going anywhere tomorrow. Incremental reform along the lines proposed by whatever grandparent we are both under provides a path to improvement, better risk management for individuals, and it could perhaps ultimately lead to your desired end state of a completely restructured consumer credit market.

I do agree that would probably be a de facto ban on the industry, or at least a radical restructuring thereof. My suspicion is that the industry is actually not a profitable enterprise once all the externalities are properly accounted for. But I'd be happy to be proved wrong, and I'm more than willing to give the industry a chance to figure out a model that works.

Edit: Completely off topic, but this is the nicest internet argument I've had in a long time. Thanks, scrumper, for being an excellent debating partner!

Oh then yes we totally agree. If they're prudent, their insurer pays. Otherwise they do.

You might be right about the credit reference industry being ultimately unprofitable as a standalone business, but I think there's a lot of arguing to be had about the magnitude of those externalities. That's why we need a law to provide some automatic, per-individual-leaked fine - the insurable risk from way up-thread.

Ironically, even if I liked the bureaux (I don't) I couldn't do it any more. Their negligence self-defeated their mission.

With the leaked information, no credit report from Equifax is believable any more. If somebody slams it in my face I can shrug and say "Nope, that's not me: leaked information". Everybody in the Equifax data can do that. Everybody in the other companies' data which intersect with Equifax's can do it. All of a sudden, these companies are providing zero value.

Second, why would the presumption of inaccuracy trump the presumption of accuracy? Who said Equifax is right? Especially since they have a track record of incompetence. As any debate on facts goes, the burden of the proof is on whomever is making a claim. Equifax is claiming something, i.e. that my credit score is X. I'm saying it is not.

I concede you that what you say is probably how the law and the system works right now. And I concede that mine was more like a desire than a real prediction. I know things won't change. But that doesn't change the fact that, after the hack, Equifax and similar are just selling hot air.

[0] If you want my credit score, you ask me for my statements, nor Equifax. If anything, Equifax is damaging me with their inaccurate information.

Sucks. I'm not defending it. This is how it is.

Simple analogy: a homeowner still has to make a claim if their locked, alarmed house is ransacked while they're away. Insurance may subsequently deny the claim if it's shown that the homeowner failed to follow best practices, such as locking doors and windows. In other words, adherence to best practices is a condition of insurance.

I think negligence or fraud on the part of the company should multiply the penalty and it probably release the insurer from being responsible.

And suddenly there would be a much more litigious and powerful entity on the side of protecting consumer data, the insurance company that underwrote the policy. They deny the claim and Equifax suddenly has a lot more problems.

In non insane countries, a company doing that would be closed and the perpetrators would go to jail.

Maybe you feel entitled to be extended a loan without any credit reporting. I, personally, feel entitled to a loan without any interest. But neither of us are going to get what we want.

I strongly suspect you are subject to all of this via a state-owned CRA or little to no borrowing activity (also an option in the US).

I don't have a good solution for the recommendation system like this. Maybe we wouldn't need it in the first place if we didn't do so much debt financing of stuff. Or maybe it needs to be less centralized: applying for one loan, you need to show payment history on a few other loans, etc. But I just don't see a centralized government run agency as the solution.

I'm quite happy with the approach that Switzerland has taken. Firstly, there are no credit scores or credit reports. Instead, there is a well-defined and regulated way to collect on overdue bills: The creditor requests debt collection from the state debt collection agency. At this point, collectees may decide to pay, to object to the prosecution or not to react. Objecting leads to a defined legal process where the creditor must prove the debt, and the collectee can defend themselves. In case of no reaction, authorities may proceed to seize assets.

As for the reporting, the debt collection agency will only keep a file on people against whom a collection request has been filed, and only make it available to the person in question and entities with a qualified interest in it. In practice this means that when renting a flat or getting credit, you request your own (empty) record and submit it to the landlord/bank in question. The agency is also responsible to expunge entries from that record after a defined time. And since responsibility for collection lies with a state agency, there's very little risk of the kind of harrassment you hear of in horror stories from the states.

The implementation has room for improvement: records are kept locally, tied to the state you live in and there's no immediate way to get online confirmation. Those are details though, that could be fixed in a clean implementation of the same system.

But we also have giant for-profit companies aggregating giant databases with little to no oversight, and up until recently no ability to access your own data for free, and still today no straightforward, across-the-board, means to appeal bad data, or collect damages from it (or from leaks of it).

Even with the terrible things associated with the no-fly list there is a TSA appeals process and a court system to challenge it. Do you know how you correct mistakes in your Equifax-TransUnion-Experian composite credit score? You mostly don't, and you most likely can't take them to court, because they think you are bound to arbitration.

I don't know if there is a good solution here either, but at least a government-run solution would have to be accountable to the people as citizens/constituents (even if it would still likely be in the pocket of the banks).

Sorry, that's not true at all. I went to Experian late last week to set up a fraud alert because of the Equifax breach, they showed me my credit report and had a button to mark things that were factually incorrect. I did so and submitted it. They did some sort of investigation and removed the data because they couldn't verify that it was correct. It was as easy as filling out an online form. (Actually, I think I had to call about 1 particular item, but it was handled over the phone.)

From the article.

It does look, from the snippet, like they aren't quite the same. I don't yet have an opinion on that, specifically the bit about data being erased after it has been settled. That's pretty different.

I shall see what I can find. It may change my opinion. Thanks again.

I don't see the point you're trying to make. If we're going by "who has made the news for hacks lately", the private sector is by far the worse choice.

Also, OPM does not get to decide if you have standing to sue them. That's up to parts of the government so far removed from OPM they might as well be a different entity entirely.

I never asked Equifax to keep me in their database and send my information to creditors.

Under current law.

Since the Equifax break in, journalists have been demanding legislation to change that,

https://www.nytimes.com/2017/09/11/opinion/equifax-accountab...

https://www.emptywheel.net/2017/09/14/software-is-a-long-con...

>I never asked Equifax to keep me in their database and send my information to creditors.

It seems you can't be expected to take responsibility for reading the fine print in your loan agreements. Quite an interesting bit of cognitive dissonance you have there.