Consumer Data Protection: Action Needed to Strengthen Oversight of Consumer Reporting Agencies
Released: 2019-03-26T00:00:00

Letter

Background

Oversight Agencies

FTC and, most recently, CFPB, are the federal agencies primarily responsible for overseeing CRAs. FTC has authority to investigate most organizations that maintain consumer data and to bring enforcement actions for violations of statutes and regulations that concern the security of data and consumer information. CFPB, created in 2010 by the Dodd- Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), has enforcement authority over all CRAs for violations of certain consumer financial protection laws. In general, it also has the authority to issue regulations and guidance for those laws. CFPB has supervisory authority over larger market participants in the consumer reporting market. In 2012, CFPB defined larger market participant CRAs as those with more than $7 million in annual receipts from consumer reporting. CFPB’s supervision of these companies includes monitoring, inspecting, and examining them for compliance with the requirements of certain federal consumer financial laws and regulations. As discussed below, these laws include most provisions of the Fair Credit Reporting Act (FCRA); several provisions of the Gramm-Leach-Bliley Act (GLBA); and provisions of the Dodd-Frank Act concerning unfair, deceptive, or abusive acts or practices.

Data Breaches and the Equifax Breach

Although there is no commonly agreed-upon definition of “data breach,” the term generally refers to an unauthorized or unintentional exposure, disclosure, or loss of sensitive information. This information can include personally identifiable information such as Social Security numbers, or financial information such as credit card numbers. A data breach can be inadvertent, such as from the loss of an electronic device; or deliberate, such as the theft of a device or a cyber-based attack by individuals or groups, including an organization’s own employees, foreign nationals, or terrorists. Data breaches have occurred at all types of organizations, including private, nonprofit, and federal and state entities.

In the Equifax data breach, Equifax system administrators discovered on July 29, 2017, that intruders had gained unauthorized access via the Internet to a server housing the company’s online dispute portal. The breach compromised the personally identifiable information of at least 145.5 million individuals, and included names, addresses, and birth dates; and credit card, driver’s license, and Social Security numbers. Equifax’s investigation of the breach identified the following factors that led to the breach: software vulnerabilities, failure to detect malicious traffic, failure to isolate databases from each other, and inadequately limiting access to sensitive information such as usernames and passwords. Equifax’s public filings after the breach noted that the company took steps to improve security and notify individuals about the breach. Our August 2018 report provides more information on the breach and Equifax’s response.

FTC Has Taken Enforcement Measures against CRAs but Lacks Civil Penalty Authority for GLBA Data Protection Provisions

FTC enforces compliance with consumer protection laws under authorities provided in FCRA, GLBA, and the FTC Act. As we reported in February 2019, according to FTC, in the last 10 years, it has brought 34 enforcement actions for FCRA violations, including 17 against CRAs. In addition, FTC said that it has taken 66 actions against companies (not just in the last 10 years), including CRAs, that allegedly engaged in unfair or deceptive practices relating to data protection.

In some circumstances, FTC enforcement authority can include civil money penalties—monetary fines imposed for a violation of a statute or regulation. However, FTC’s civil penalty authority does not extend to initial violations of GLBA’s privacy and safeguarding provisions. These provisions require administrative, physical, and technical safeguards with an emphasis on protection against anticipated threats and unauthorized access to customer records. For violations of GLBA provisions, FTC may seek an injunction to stop a company from violating these provisions and may seek redress (damages to compensate consumers for losses) or disgorgement (requirement for wrongdoers to give up profits or other gains illegally obtained).

Determining the appropriate amount of consumer compensation requires FTC to identify the consumers affected and the amount of monetary harm they suffered. In cases involving security or privacy violations resulting from data breaches, assessing monetary harm can be difficult. In addition, consumers may not be aware that their identities have been stolen as a result of a breach and or identity theft, and related harm may occur years in the future. It can also be difficult to trace instances of identity theft to specific data breaches. According to FTC staff, these factors can make it difficult for the agency to identify which individuals were victimized as a result of a particular breach and to what extent they were harmed and then obtain related restitution or disgorgement. Having civil penalty authority for GLBA provisions would allow FTC to fine a company for a violation such as a data breach without needing to prove the monetary harm to individual consumers. FTC staff noted that in the case of a data breach, each consumer record exposed could constitute a violation; as a result, a data breach that involved a large number of consumer records could result in substantial fines.

In 2006, we suggested that Congress consider providing FTC with civil penalty authority for its enforcement of GLBA’s privacy and safeguarding provisions. We noted that this authority would give FTC a practical tool to more effectively enforce provisions related to security of data and consumer information. Following the 2008 financial crisis, Congress introduced several bills related to data protection and identity theft, which included giving FTC civil penalty authority for its enforcement of GLBA. However, in the final adoption of these laws, Congress did not provide FTC with this authority. Since that time, data breaches at Equifax and other large organizations have highlighted the need to better protect sensitive personal information. Accordingly, we continue to believe FTC and consumers would benefit if FTC had such authority, and we recommended in our February 2019 report that Congress consider providing FTC with civil penalty authority for the privacy and safeguarding provisions of GLBA to help ensure that the agency has the tools it needs to most effectively act against data privacy and security violations.

CFPB Enforces and Examines CRAs for Compliance with Consumer Protection Laws but Does Not Fully Consider Data Security in Prioritizing Examinations

CFPB enforces compliance with most provisions of FCRA; several provisions of GLBA; and the prohibition of unfair, deceptive, or abusive acts or practices under the Dodd-Frank Act. In our February 2019 report, we noted that since 2015, CFPB has had five public settlements with CRAs. Four of these settlements included alleged violations of FCRA, and three included alleged violations of provisions related to unfair, deceptive, or abusive practices. CFPB also has an ongoing investigation of Equifax’s data breach.

Under its existing authority, CFPB has examined several larger market participant CRAs, but may not be identifying all CRAs that meet the $7 million threshold. CFPB staff told us that as of October 2018, they were tracking between 10 and 15 CRAs that might qualify as larger market participants. CFPB staff told us that they believe the CRA market is highly concentrated and there were not likely to be many larger market participants beyond the 10 to 15 they are tracking. However, CFPB staff said that the 10 to 15 CRAs may not comprise the entirety of larger market participants, because CRAs’ receipts form consumer reporting may vary from year to year, and CFPB has limited data to determine whether CRAs meet the threshold.

Our January 2009 report on reforming the U.S. financial regulatory structure noted that regulators should be able to identify institutions and products that pose risks to the financial system, and monitor similar institutions consistently. CFPB could identify CRAs that meet the larger market participant threshold by requiring such businesses to register with it, subject to a rulemaking process and cost-benefit analysis of the burden it could impose on the industry. Another method CFPB could use to identify CRAs subject to its oversight would be to leverage information collected by states. We recommended in February 2019 that CFPB identify additional sources of information, such as through registering CRAs or leveraging state information, that would help ensure the agency is tracking all CRAs subject to its authority. CFPB neither agreed nor disagreed with our recommendation.

Each year CFPB determines the institutions (for example, banks, credit unions, non-bank mortgage servicers, and CRAs) and the consumer product lines that pose the greatest risk to consumers, and prioritizes these for examinations. CFPB segments the consumer product market into institution product lines, or specific institutions’ offerings of consumer product lines. CFPB then assesses each institution product line’s risk to consumers at the market level and institutional level. To assess risk at the market level, CFPB considers market size and other factors that contribute to market risk. To assess risk at the institution level, CFPB considers an institution’s market share within a product line, as well as field and market intelligence. Field and market intelligence includes quantitative and qualitative information on an institution’s operations for a given product line, including the strength of its compliance management systems, the number of regulatory actions directed at the institution, findings from prior CFPB examinations, and the number and severity of consumer complaints CFPB has received about the institution.

CFPB then determines specific areas of compliance to assess by considering sources such as consumer complaints, public filings and reports, and past examination findings related to the same or similar products or institutions. Most recently, CFPB examinations of CRA’s consumer reporting have focused on issues such as data accuracy, dispute processes, compliance management, and permissible purposes.

Although CFPB’s examination prioritization incorporates several important factors and sources, the process does not routinely include assessments of data security risk, such as how institutions detect and respond to cyber threats. CFPB staff said the bureau cannot examine for or enforce compliance with the data security standards in provisions of GLBA and FCRA or FTC’s implementing rules, even at larger participant CRAs. After the Equifax breach, however, CFPB used its existing supervisory authority to develop internal guidelines for examining data security, and conducted some CRA data security examinations. CFPB staff said that they do not routinely consider data security risks during their examination prioritization process and have not reassessed the process to determine how to incorporate such risks going forward.

Statute requires CFPB to consider risks posed to consumers in the relevant product and geographic markets in its risk-based supervision program. In addition, federal internal control standards state that agencies should identify, analyze, and respond to risks related to achieving defined objectives. This can entail considering all significant internal and external factors to identify risks and their significance, including magnitude of impact, likelihood of occurrence, nature of the risk, and appropriate response. In light of the Equifax breach, as well as CFPB’s acknowledgment of the CRA market as a higher-risk market for consumers, it is important for CFPB to routinely consider factors that could inform the extent of CRA data security risk such as the number of consumers that could be affected by a data security incident and the nature of potential harm resulting from the loss or exposure of information. In our February 2019 report, we recommended that CFPB assess whether its process for prioritizing CRA examinations sufficiently incorporates the data security risks CRAs pose to consumers, and take any needed steps identified by the assessment to more sufficiently incorporate these risks. CFPB neither agreed nor disagreed with our recommendation.

Regulators Inform Consumers about Protections Available and Consumers Can Take Some Actions after a CRA Data Breach

In our February 2019 report, we noted that FTC and CFPB provide educational information for consumers on ways to mitigate the risk of identity theft. In addition, after a breach, FTC and CFPB publish information specific to that breach. For example, shortly after Equifax’s announcement of the breach, FTC published information on when the breach occurred, the types of data compromised, and links to additional information on Equifax’s website. Similarly, CFPB released three blog posts and several social media posts that included information on ways that consumers could protect themselves in the wake of the breach and special protections and actions for service members.

At any time, consumers can take actions to help mitigate the risk of identity theft. For example, consumers can implement a credit freeze free of charge, which can help prevent new-account fraud by restricting potential creditors from accessing the consumer’s credit report. Similarly, implementing a free fraud alert with a credit bureau can help prevent fraud because it requires a business to verify a consumer’s identity before issuing credit. However, consumers are limited in the direct actions they can take against a CRA in the event of a data breach, for two primary reasons. First, consumers generally cannot determine the source of the data used to commit identity theft. As a result, it can be difficult to link a breach by a CRA (or any other entity) to the harm a consumer suffers from a particular incidence of identity theft, which makes it challenging to prevail in a legal action. Second, unlike with many other products and services, consumers generally cannot exercise choice if they are dissatisfied with a CRA’s privacy or security practices. Specifically, consumers cannot choose which CRAs maintain information on them. In addition, consumers do not have a legal right to delete their records with CRAs, according to CFPB staff, and therefore cannot choose to remove themselves entirely from the CRA market.

FTC and CFPB have noted that the level of consumer protection required can depend on the consumer’s ability to exercise choice in a marketplace. For example, when determining whether a practice constitutes an unfair practice, FTC considers whether the practice is one that consumers could choose to avoid. Similarly, according to CFPB staff, the consumer reporting market may pose higher risk to consumers because consumers cannot choose whether or which CRAs possess and sell their information.

Chairman Krishnamoorthi, Ranking Member Cloud, and Members of the Subcommittee, this concludes my prepared remarks. I would be happy to answer any questions that you may have.

GAO Contact and Staff Acknowledgment

If you or your staff have any questions about this statement, please contact Michael Clements at (202) 512-8678 or clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. In addition to the contact named above, John Forrester (Assistant Director), Winnie Tsen (Analyst-in-Charge), and Rachel Siegel made key contributions to the testimony. Other staff who made key contributions to the report cited in the testimony are identified in the source product.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.