Senators Rip Credit-Reporting Model in Wake of Equifax -- 2nd Update

Senators questioning Equifax Inc.'s former chief Wednesday attacked the business model of the credit-reporting industry, asking why consumers shouldn't have power over the data that the companies collect on them.

The hearing, one of a series this week, was as much about the control consumers have over their personal data as it was about the Equifax hack. Senators questioning former Equifax Chief Executive Richard Smith asked whether a large overhaul is needed for both private sector and government activities.

"Massive data collection is being undertaken across this country," Banking Committee Chairman Sen. Michael Crapo (R., Id.) said during Wednesday's hearing before his panel. He added that Congress needs to take action with personal identification being collected by government, the private sector and others.

In terms of the big credit-reporting companies -- which along with Equifax include Experian PLC and TransUnion -- a key point senators repeatedly raised was: Consumers don't choose to share their data with these firms, but much of their financial lives, including whether they can get approved for loans or rent an apartment, depends on the data the companies have and then sell to lenders and other companies.

Although Equifax has been the main focus of attention since disclosing its massive breach in early September, the credit-reporting industry has feared the breach will lead to more regulatory oversight and changes to the underpinnings of the consumer-finance economy.

Several senators called for just that. Sen. Sherrod Brown (D., Ohio) said consumers have more control over their personal medical data and questioned why similar standards shouldn't be applied to financial information.

Such comments raised questions about how the industry could be changed, and whether doing so would make it more difficult or more cumbersome for consumers to obtain credit. Consumers who don't have credit reports often can't get approved for loans.

At the same time, consumers don't give their permission to have their personal financial information collected, nor do they receive any compensation for it. Rather, the credit-reporting companies gather it and then sell it on to lenders.

The executive goes before another Senate panel Wednesday afternoon and another House committee on Thursday.

Equifax's quest to acquire ever more data on consumers under Mr. Smith's leadership came under attack. And further questions were raised about just when Equifax became aware of the severity of the breach and why Mr. Smith and other executives made public presentations without acknowledging that something was amiss.

Mr. Smith, who repeatedly apologized for the hack, responded that at those times, the company had yet to fully understand the size or scope of the breach.

Write to AnnaMaria Andriotis at annamaria.andriotis@wsj.com

The hearing before the Senate Banking Committee was as much about the control consumers have over their personal data as it was about the Equifax hack, which has affected potentially 145.5 million Americans. Senators questioning former Equifax Chief Executive Richard Smith, who is appearing before a series of congressional panels this week, asked whether a large overhaul is needed for both private sector and government activities.

"There is massive data collection being undertaken in this country," said Banking Committee Chairman Sen. Michael Crapo (R., Idaho) during Wednesday's hearing before his panel. Congress, he said, needs to address broader issues about "the collection and use and protection of personally identifiable information that is being collected by the government, by the private sector and others."

In terms of the big credit-reporting companies, which along with Equifax include Experian PLC and TransUnion, senators repeatedly raised a key point: Consumers don't choose to share their data with these firms nor do they receive compensation for it, even though companies like Equifax profit by gathering it and selling it to lenders and other companies.

"You have my information, you don't pay me for it, you don't have my permission," said Sen. John Kennedy (R., La.). "You can't run your business without me. My data is the product you sell."

But much of consumers' financial lives, including whether they can get approved for loans or rent an apartment, depends on the data these companies have.

Although Equifax has been the focus of attention since disclosing its massive breach in early September, the credit-reporting industry has feared it will lead to more regulatory oversight and changes to the underpinnings of the consumer-finance economy.

Several senators called for just that. Sen. Sherrod Brown (D., Ohio) noted that consumers have more control over their personal medical data, and questioned why similar standards shouldn't be applied to financial information. He asked Mr. Smith if consumers should be allowed to ask Equifax to delete their data. Mr. Smith replied that locking their credit was a better option.

"So that means no?" Sen. Brown asked.

"Correct," Mr. Smith replied.

Others asked why consumers don't have the option to "opt in" before companies like Equifax are allowed to access their data. "Maybe we ought to start thinking about opting in as opposed to opting out," said Sen. Heidi Heitkamp (D., N.D.). "I want my credit locked until I unlock it."

Such comments raised questions about how the industry could be changed, and whether doing so would make it more difficult or more cumbersome for consumers to obtain credit.

A shift in power away from the credit-reporting firms would have big implications for the U.S. consumer lending system. Banks and other financial institutions decide whether to approve applicants for credit cards and loans based in large part on the information in their credit reports. For decades, lenders and other firms have supplied information to the credit-reporting companies after consumers signed up for financing. Lenders also report whether borrowers are behind on their loan payments -- a red flag that other lenders use when determining whether to approve borrowers for loans.

Tinkering with this system could lead to a slowdown in new loan originations and extend the amount of time for loan approvals. There could also be an increase in banks' loan losses. A system in which consumers can choose whether or how much of their information winds up on credit reports would make it much harder for lenders to determine the risk level of loan applicants.

Sen. Thom Tillis (R., N.C.) cautioned that consumers deleting their personal data from the credit-reporting agencies could prevent them from getting loans -- a point Mr. Smith agreed with. "It's very important for people to understand the potential chilling effect that you could have if you erase your financial history from the system," Sen. Tillis said.

The broader industry focus didn't spare Mr. Smith and Equifax from another day of harsh criticism for missteps that allowed hackers to access consumers' data and the handling of the breach once it was disclosed. Further questions were raised about when Equifax became aware of the severity of the breach and whether executives who sold stock on Aug. 1 and 2 knew about it. The company has said the executives weren't aware of the problem.

Mr. Smith repeatedly apologized for the hack and said the company didn't initially understand its severity. He also apologized at a subsequent hearing Wednesday before a panel of the Senate Judiciary Committee.

Even so, Banking Committee members said Equifax might actually benefit financially from the hack: The company sells data-security products, and some consumers who froze their credit files immediately after the breach had to pay Equifax for it. The company later said it would refund those fees.

"The breach of your systems has actually created more business opportunities for you," Sen. Elizabeth Warren (D., Mass.) told Mr. Smith.

--Andrew Ackerman contributed to this article.

Write to AnnaMaria Andriotis at annamaria.andriotis@wsj.com, Michael Rapoport at Michael.Rapoport@wsj.com and Christina Rexrode at christina.rexrode@wsj.com

(END) Dow Jones Newswires

October 04, 2017 17:01 ET (21:01 GMT)