WASHINGTON – U.S. Sens. Mark R. Warner (D-VA) and Elizabeth Warren (D-MA), along with Reps. Elijah Cummings (D-MD) and Raja Krishnamoorthi (D-IL), reintroduced legislation today to hold large credit reporting agencies (CRAs) – including Equifax – accountable for data breaches involving sensitive consumer data. The Data Breach Prevention and Compensation Act will provide robust compensation to consumers for stolen data, impose mandatory penalties on CRAs for data breaches, and give the Federal Trade Commission (FTC) more direct supervisory authority over data security at CRAs.

“It’s been nearly two years since hackers accessed the personal information of more than 143 million Americans, yet thousands of individuals continue to grapple with the effects of this massive breach,” said Sen. Warner. “As personal data becomes more and more valuable in today’s information economy, and the scale and impact to consumers of mega-breaches increase, there needs to be increased consequences for companies like Equifax that mishandle or neglect to properly safeguard consumer data. By imposing strict penalties for data breaches and facilitating compensations for affected Americans, this legislation will increase accountability and help ensure that credit reporting agencies actively prioritize the security of sensitive consumer information.”

“It's been over a year and a half since Equifax opened to the doors to hackers who stole the personal data of more than half the adults in the country, and this new report shows that Equifax still has a long way to fix the problem it created,” said Sen. Warren. “Our bill, which would hold companies like Equifax accountable for failing to protect consumer data, would compensate consumers injured by these breaches and help ensure that they never happen again.”

In September 2017, Equifax announced that hackers had accessed and stolen sensitive personal information, including Social Security Numbers, birth dates, credit card numbers, driver's license numbers, and passport numbers, belonging to more than 143 million Americans – a number later revised up to 145.5 million people. The breach highlighted that CRAs like Equifax retain vast amounts of data on millions of Americans but often lack adequate safeguards against hackers. Since 2013, Equifax has reported at least four separate hacks in which sensitive personal information was compromised.

The Data Breach Prevention and Compensation Act would:

· Establish an Office of Cybersecurity at the FTC tasked with annual inspections and supervision of cybersecurity at CRAs.
· Impose mandatory, strict liability penalties for breaches involving consumer data, beginning with a base penalty of $100 for each consumer who had one piece of personal identifying information (PII) compromised and another $50 for each additional PII compromised per consumer. Under this bill, Equifax would have had to pay at least a $1.5 billion penalty for their failure to protect Americans' personal information.
· Ensure a robust recovery for affected consumers by requiring the FTC to use 50% of its penalty to compensate consumers.
· Increase penalties in cases of woefully inadequate cybersecurity or if a CRA fails to timely notify the FTC of a breach.
· Enhance FTC enforcement by giving the FTC civil penalty authority under the Gramm-Leach-Bliley Act.

Additionally, Sens. Warren and Warner, and Rep. Krishnamoorthi, in a new analysis of Consumer Financial Protection Bureau (CFPB) consumer complaints, revealed that consumers filed more than 52,000 complaints related to Equifax in the 18 months following the announcement of the Equifax breach – nearly double the number from the same period before the breach was announced. The report shows how Equifax continues to fail affected consumers by neglecting to provide adequate responses to consumer complaints, including by refusing to remove incorrect information from credit reports. The lawmakers also sent the report to the FTC and CFPB, requesting that the agencies take action.

The Data Breach Prevention and Compensation Act is supported by cybersecurity experts and consumer groups:

"This bill requires the FTC to provide much-needed oversight of the credit bureaus for data security. It also imposes real and meaningful penalties when the credit bureaus, who hold our most sensitive financial information, fail to adequately protect that information. I commend Senator Warren, Senator Warner, and Congressmen Cummings and Krishnamoorthi for their continuing efforts to prevent another massive security failure like the Equifax data breach," said National Consumer Law Center Staff Attorney, Chi Chi Wu.

"A concrete response to a serious problem facing American consumers. The ongoing risk of data breach and identity theft have reached epidemic proportions. We clearly need more expertise in the federal government to address this challenge. We hope the Senate will more forward this important and timely effort to safeguard American consumers and Internet users,” said Electronic Privacy Information Center President and Executive Director, Marc Rotenberg

“Equifax still hasn’t paid a price two years after losing the financial DNA of 150 million Americans. That’s why U.S. PIRG commends Senator Warner, Senator Warren, and Congressmen Cummings and Krishnamoorthi for reintroducing the Data Breach Prevention and Compensation Act. The bill provides strong oversight and meaningful financial penalties to incentivize the credit bureaus to protect our data,” said U.S. PIRG Consumer Campaign Director, Mike Litt.

"Making the companies that collect and sell consumers’ personal information liable when they fail to secure it is a necessary step in ensuring our privacy rights,” said Former Chief Technologist at the FTC, Ashkan Soltani.

More statements of support are available here. More information about this bill can be found here. For text of the bill, click here.

###