1 

UNITED STATES OF AMERICA

FEDERAL TRADE COMMISSION

WASHINGTON, DC 20580 

Prepared Remarks of Chairman Joseph Simons1

Opening Remarks – Equifax Inc. Press Event

July 22, 2019 

 

Good morning. I am proud to announce a global settlement arising out of the massive 

data breach that Equifax revealed in September 2017. This settlement includes at least $575 

million—and up to $700 million—in monetary relief, as well as important conduct provisions. 

I am particularly pleased to be joined on the podium today by Kathy Kraninger, Director 

of the Consumer Financial Protection Bureau (“CFPB”), and Attorney General Brian Frosh of 

the State of Maryland. Their offices, and many others, were instrumental in achieving today’s 

historic settlement for consumers. 

The global settlement contains two main components. First, as I mentioned, it includes 

monetary relief. At least $300 million of this money will go directly to consumers, through a 

consumer fund that will be set up by a federal court. If these funds are used up, Equifax will pay 

up to $125 million more for consumers. The fund will be used to pay for at least four years of 

free credit monitoring for affected consumers, as well as to compensate consumers for their time 

and money spent recovering from the breach. We have created a dedicated website, 

www.ftc.gov/equifax, that will provide consumers with information. Equifax will also pay $275 

million in civil penalties to other agencies.

 

1 These remarks reflect my own views. They do not necessarily reflect the views of the Commission or any other 

individual Commissioner.
2

Second, the settlement includes strong conduct relief. Equifax must establish a 

comprehensive information security program that assesses and addresses not only general risks 

to consumers’ data, but also the specific practices that led to the 2017 breach. The company’s 

board of directors is required to oversee, review, and certify compliance with the program. 

Additionally, an independent third-party assessor will have extensive access to review, assess, 

and report on the company’s compliance. Moreover, the order gives the FTC robust tools to 

verify the company’s compliance through assessments, required reporting of security incidents, 

and the ability to seek more information from the company as needed.

I want to flag an important aspect of this settlement, and a key message for Congress. 

The CFPB and the states were able to obtain civil penalties for this massive breach by a major 

financial institution. The FTC could not, because we do not have civil penalty authority for 

initial violations of the FTC Act or for violations of the Gramm-Leach-Bliley Safeguards Rule. 

Fortunately, other agencies were able to fill in the gap—this time. But under different 

circumstances, future breaches might not always be subject to civil penalties, which sends 

absolutely the wrong signal regarding deterrence. For this reason, I renew my call for Congress 

to enact federal data security legislation that gives the FTC authority to seek civil penalties for 

first-time violations. 

But make no mistake. Even in the absence of new federal legislation, the FTC will 

continue its vigorous data security enforcement program. We will seek strong injunctive relief 

against law violators, to the fullest extent allowed under existing law. I have just described some 

examples of the relief we obtained against Equifax. 

Finally, I would like to highlight the extraordinary collaboration among state and federal 

agencies that resulted in today’s settlement. This global settlement exemplifies good 
3

government. When a broad, bipartisan coalition of federal and state law enforcers work together, 

we are able to hold companies accountable for their obligations to protect consumer data. When

sensitive personal information is exposed and misused, it can cause devastating harm to 

consumers. Companies must take seriously their duty to protect consumers’ information. And if 

they do not, the FTC, CFPB, and state Attorneys General stand ready to act. 

Before I give up the floor, I would like to thank the FTC staff responsible for helping to 

reach this settlement, most significantly Jacqueline Connor, Tiffany George, Molly Crawford, 

Ben Rossen, Cathlin Tully, Bob Schoshinski, and Maneesha Mithal. 

Now, I am happy to turn the podium over to Director Kraninger.