Equifax, which yesterday announced a truly enormous breach, will not require affected consumers to forfeit their right to join a class action lawsuit against the company in order to receive credit protection. The company clarified the forced arbitration clause in its terms of service after outcry by consumer advocates, including New York Attorney General Eric Schneiderman, who called the requirement “unacceptable and unenforceable.”
The company added the following to its FAQ for the TrustedID Premier program it is offering to those affected by the breach:
Do the TrustedID Terms of Use limit my options related to the cyber security incident?
The arbitration clause and class action wavier [sic] included in the TrustedID Premier Terms of Use applies to the free credit file monitoring and identity theft protection products, and not the cybersecurity incident.
In other words, if you use the service, any dispute regarding the service itself (e.g. the protections fail to work) would be forced into arbitration — but legal action relating specifically to the breach is not affected. I’ve contacted Equifax for more specifics, but their press office is likely being bombarded right now so it may be a while before they respond.
If you want to be extra sure you won’t be bound by the arbitration clause, you can opt out by writing a snail mail letter to the company:
Timely written notice of opt out must be delivered to Equifax Consumer Services LLC, Attn.: Arbitration Opt-Out, P.O. Box 105496, Atlanta, GA 30348, and must include Your name, address, and Equifax User ID, as well as a clear statement that You do not wish to resolve disputes with Equifax through arbitration.
Don’t worry, you don’t get put on some kind of list. “Opting out of the arbitration provision will have no adverse effect on your relationship with Equifax or the delivery of Products to You by Equifax.”
Note: I am not a lawyer or financial advisor. Equifax may change these terms or interpret them differently (which is why I asked for more information). If you are at all unsure about this, wait and see and take actions of your own, such as notifying your bank, getting a free credit report and watching for suspicious transactions.
In the meantime, you may not even be missing out on much: a recent GAO investigation of these kinds of services found that “companies often offer consumers affected by a data breach complimentary identity theft services for reasons other than mitigating the risk of identity theft, such as avoiding liability or complying with state law.” And last week several members of the Committee on Energy and Commerce asked for a closer look at “whether private-sector and government entities have converged on suboptimal solutions for providing protection for consumers and whether better solutions ought to be pursued.”
The terms read in part:
By consenting to submit Your Claims to arbitration, You will be forfeiting Your right to bring or participate in any class action (whether as a named plaintiff or a class member) or to share in any class action awards, including class claims where a class has not yet been certified, even if the facts and circumstances upon which the Claims are based already occurred or existed.
Such forced arbitration clauses are common in service agreements, and have been held up repeatedly in court.
Instead of using the court system, consumers would have to take complaints or damages through an arbitration system under terms dictated by the company. Arbitration agreements may limit consumers’ ability to appeal, under what jurisdiction negotiations would take place, whether the process is public or secret, and so on. It’s possible that the process may be faster and simpler in some cases, but one cedes an immense amount of control to the company — which it is certain to exert for its own benefit.
There was no indication in the terms of service that this particular clause would apply only to certain disputes, and people naturally perceived it as an opportunistic attempt by the company to inoculate itself against legal action.
Comment