Mike Stewart/AP Photo
The credit reporting company Equifax in a 2017 data breach exposed the personal information of 147 million Americans.
The Federal Trade Commission (FTC) is facing criticism about the devious and underhanded practices of … itself.
The progressive group Demand Progress is working with other partners on a formal complaint against the FTC for deceptive advertising about its settlement with credit reporting company Equifax, for a data breach that exposed the personal information of 147 million Americans. The federal agency with jurisdiction over false advertising is the FTC.
Demand Progress has begun with a petition for its members, housed at a website called FailedTradeCommission.com. “We demand the Federal Trade Commission launch an immediate investigation into the Federal Trade Commission’s false and deceptive advertising surrounding its settlement with Equifax,” reads the petition. “In addition to a full investigation, we demand the FTC issue an immediate cease and desist to itself and prohibit itself from making future deceptive statements.” The petition will be delivered in the coming days.
At issue is the Equifax settlement over the 2017 data breach for $575 million, and potentially up to $700 million. Equifax was alleged to have failed to secure compromising personal information on its network, including dates of birth, addresses, and Social Security numbers.
Of the $700 million, $175 million went to the 48 states involved in the settlement, along with the District of Columbia and Puerto Rico. The Consumer Financial Protection Bureau took another $100 million as a civil penalty.
The final $300 million to $425 million is to be paid by Equifax into a fund that affected victims can access. Those with specific out-of-pocket expenses from fraud tied to the breach can file a claim of up to $20,000, including money for the time they spent dealing with an identity theft situation. For everyone else affected without a specific claim, the FTC offered two options: a cash payout, or a ten-year credit monitoring service. For some reason, Experian, a separate credit reporting company, is providing the credit monitoring and not Equifax, but presumably Equifax is paying to contract out the work.
Initially, the FTC highlighted an expected $125 value for the payout. An archived version of the FTC’s Equifax page from July 22 states that victims will receive “up to 10 years of free credit monitoring OR $125 if you decide not to enroll.”
When the claims process went live, millions opted for the $125, perhaps because credit monitoring isn't very valuable and numerous free sites offer it, like CreditKarma.com and Bankrate.com. All credit monitoring does is alert people after the fact if there are suspicious-looking changes to their credit report that would suggest fraudulent conduct. A credit freeze blocks any attempts to take out credit in someone’s name until it’s lifted. That’s the bulletproof way to protect credit, but that wasn’t offered, so a lot of people went for the $125.
Indeed, far too many went for it, according to the FTC. In a July 31 blog post titled “Equifax data breach – pick free credit monitoring,” FTC assistant director for the Division of Privacy and Identity Protection Robert Schoshinski explained that only $31 million of the settlement was earmarked for the cash payout. So if 31 million Americans take the cash, they’ll each get a dollar.
Schoshinski explained that everyone who took the cash payout will be re-contacted to ask if they want to switch to the credit monitoring. “Frankly, the free credit monitoring is worth a lot more,” Schoshinski wrote. “The market value would be hundreds of dollars a year.”
None of this is mentioned in the original July 22 explanation of the settlement. However, the latest version of that website has changed. “Previously, a cash payment was identified as an option, but there are limited funds available,” it reads, referring readers to a footnote that explains how nobody will get anything close to the $125. “The free credit monitoring provides a much better value,” the footnote argues, helpfully adding that victims can still take the cash, but they “will be disappointed” with the final amount.
Demand Progress contends that this is a bait-and-switch, akin to the kinds of bogus “special offer” deals from which the FTC is charged with protecting the public. “The FTC and Equifax let us think we were going to get a cash payout, when instead they intended claimants to sign up for credit monitoring services,” reads the petition. “The government is supposed to protect us from scams and deceptive advertising—but under the Trump administration they're in on the con.”
The FTC routinely investigates complaints of false advertising. Last month, it sent the latest of $21 million in refund checks to purchasers of Lights of America LED light bulbs, because the company misrepresented the light output and life expectancy of the product. A couple weeks later it refunded customers who signed up with Commerce Planet for a “free” online auction kit that ended up costing money.
Now, critics simply argue that the FTC should apply the same standards to its own conduct.
It goes without saying that the FTC is unlikely to investigate the FTC. (An attempt to contact the press office was not returned.) But the complaint highlights the dysfunction at the agency, particularly when it comes to powerful offenders. Just in the past month, the FTC took what suspiciously looks like a bribe from Facebook to shut down an investigation into the company’s privacy violations and prevent Mark Zuckerberg from having to testify. Now Equifax is “paying” for its abuses by giving people a product they can get elsewhere for free. The small fry feel the brunt of the FTC’s power; the big boys get a love tap.
Each accumulation of failure drives a sense that the FTC is a broken agency, unable because of either regulatory capture or wanton fear to fulfill its mission. If the FTC cannot be bothered to treat victims of privacy violations any better than crooked telemarketers or online hucksters do, one wonders why it should even exist.
