How the Equifax data beach could change arbitration laws

The massive Equifax data breach that resulted in at the stolen information of more than 143 million people has ignited national conversations on the importance of cybersecurity -- but it's also raised vital questions about the legality of Equifax's decision to not immediately disclose the hack.

For months, groups have fought over the Consumer Financial Protection Bureau’s proposed arbitration rule, which would let more consumers team up to sue banks, credit card companies and other financial firms.

The U.S. House of Representatives in July voted to repeal the rule. But chances of the rule dying in the Senate may have shrunk.

Here’s a look at what could happen and how you can weigh in.

How the data breach fueled debates

Arbitration clauses are widely used by financial companies to require consumers to address common grievances behind closed doors or through small claims court. It has made class action lawsuits rare, allowing “companies to avoid accountability,” contends CFPB Director Richard Cordray.

Equifax’s own arbitration clause initially appeared to ban data breach victims from suing the company if they enrolled in the company’s credit monitoring service. Public outrage led Equifax to update its terms of service agreements to explicitly allow consumers to sue over the data breach.

Still, consumer protection groups slammed Equifax, citing the arbitration clauses as proof the CFPB’s rule was necessary. Critics of the rule, however, argued that the data breach wasn’t relevant to the debate over arbitration.

The CFPB rule is really about whether companies should have the right to include arbitration clauses in their contracts, says Norbert Michel, director of the center for data analysis at the Heritage Foundation. The Equifax data breach doesn’t involve contracts because breach victims never signed a contract with the credit bureau.

Equifax and the Consumer Data Industry Association, its lobbying group, have spent years trying to keep the CFPB arbitration rule from taking effect. The CDIA wrote a letter claiming that the rule shouldn’t apply to credit companies like Equifax. Class action lawsuits wouldn’t “serve the public interest or promote the public good” given the legal obligations of credit repair organizations under another law.

What the Senate might do

The Equifax hack could shift the odds in favor of CFPB supporters.

“Consumer concern regarding Equifax’s usage of mandatory arbitration agreements has weakened the congressional effort to reverse the CFPB’s mandatory arbitration rule,” wrote Isaac Boltansky, director of policy research at Compass Point Research & Trading, in a note for clients.

The Congressional Review Act lets lawmakers dump rules that seem harmful or unnecessary. A simple majority is needed to succeed. But with Democrats backing the CFPB proposal, Republicans are essentially one vote away from losing the chance to kill the arbitration rule.

“I would have bet before the events that came out in the news last week that they probably had the votes, but the margin is so close that any event like this (the Equifax breach) certainly could have an effect,” says Ramona Lampley, a professor at St. Mary’s University School of Law in San Antonio. “It really should not though. It hasn’t changed the nature of the issues, which is really a conversation about the merits of arbitration versus the merits of class action.”

What consumers should do

The CFPB’s arbitration rule went into effect Sept. 18. But the Senate may have until November to vote, according to the press office for Senate Majority Leader Mitch McConnell. So consumers have time to put in their two cents.

Amanda Werner, campaign manager with Americans for Financial Reform, suggests writing a letter or calling your senator. Consider discussing how mandatory arbitration could affect your ability to solve problems with the company supplying your savings account or credit card.

If you’re trying to avoid forced arbitration, carefully review contracts before signing them. Werner recommends searching for the word arbitration and any language limiting class action lawsuits. Look for an opt-out provision that can protect your legal rights and any group that may be involved in helping to resolve disputes.

“One might also want to search for AAA, which is the American Arbitration Association, and at least as consumer arbitration goes is the industry leader in having special rules designed to protect the consumer in the process,” Lampley says.