Re:US Senate report on Equifax breach [pdf]
by danShumway on Saturday June 22, 2019 @04:10PM
(#20251487)
In the market's defense, from a certain perspective it was right.
There are no significant regulatory penalties coming at Equifax over this (the biggest change is that credit freezes are now free, which is great win but won't have a huge market impact).
Additionally, consumers can't choose not to participate in this process. I mean, if you're wealthy, you can choose not to buy anything on credit, and if you're tech savvy you can choose to freeze your credit with Equifax and force the majority of your traffic through other companies. But again, that's not the majority of the population and it's not going to have much of an effect.
Businesses aren't going to stop relying on social security numbers and background checks, because... well, for a lot of reasons, but partially because that system is really entrenched and it would take more than leaking half of the US population's data to make it change. That's going to be a very, very hard battle to win. In the meantime, that just means its even harder for consumers to avoid businesses that rely on Equifax for credit checks.
So, the market determined that consumers were not going to change their behaviors over this breach, in part because there aren't a lot of reasonable ways for consumers to do anything. It determined that Equifax wasn't likely to be harmed in the long term by the government, and it determined businesses weren't going to change their behavior around identity verification -- and it priced itself accordingly.
If you want the market to punish bad actors, you have to give consumers and people effected by the market agency to move their business or to choose not to participate in systems they don't like. Current credit systems just don't give ordinary consumers that kind of agency.
This also pops up in privacy debates sometimes where people say, "oh, people don't care." That's sometimes true, but it's generally really complicated -- and part of the reason it's complicated is because consumers have been taught over and over that there is no point to caring and nothing they do is going to stop companies from tracking them.
There are no significant regulatory penalties coming at Equifax over this (the biggest change is that credit freezes are now free, which is great win but won't have a huge market impact).
Additionally, consumers can't choose not to participate in this process. I mean, if you're wealthy, you can choose not to buy anything on credit, and if you're tech savvy you can choose to freeze your credit with Equifax and force the majority of your traffic through other companies. But again, that's not the majority of the population and it's not going to have much of an effect.
Businesses aren't going to stop relying on social security numbers and background checks, because... well, for a lot of reasons, but partially because that system is really entrenched and it would take more than leaking half of the US population's data to make it change. That's going to be a very, very hard battle to win. In the meantime, that just means its even harder for consumers to avoid businesses that rely on Equifax for credit checks.
So, the market determined that consumers were not going to change their behaviors over this breach, in part because there aren't a lot of reasonable ways for consumers to do anything. It determined that Equifax wasn't likely to be harmed in the long term by the government, and it determined businesses weren't going to change their behavior around identity verification -- and it priced itself accordingly.
If you want the market to punish bad actors, you have to give consumers and people effected by the market agency to move their business or to choose not to participate in systems they don't like. Current credit systems just don't give ordinary consumers that kind of agency.
This also pops up in privacy debates sometimes where people say, "oh, people don't care." That's sometimes true, but it's generally really complicated -- and part of the reason it's complicated is because consumers have been taught over and over that there is no point to caring and nothing they do is going to stop companies from tracking them.