Consumers Who Go to Equifax for Help After Data Breach May Lose Their Right to Sue

On Thursday credit bureau Equifax said a data breach put personal information of 143 million people at risk. Now its response is drawing more outrage, as lawmakers and others accuse it of encouraging consumers who come to it seeking answers to sign away their chance to seek recourse in the courts.

Following the breach, which compromised tens of millions of Social Security numbers and other valuable data, Equifax set up a website to help worried consumers determine whether or not their information was at risk. That website encouraged visitors to sign up for a program known as TrustedID Premier, the company's credit monitoring service, which provides automated alerts to credit changes and up to $1 million in ID theft insurance. That's where the trouble began.

TrustedID's terms of service include an arbitration clause, insisting that customers agree "all claims, disputes, or controversies...shall be finally settled by arbitration" rather than a court of law. Such clauses aren't unusual for credit monitoring services -- or indeed many other consumer products. But in this circumstance, it created the impression that Equifax was asking consumers it had harmed to surrender their legal rights -- including becoming part of a class-action law suit -- before it would agree to help them.

The Internet was quick to pounce:

A spokesman for Equifax, whom Money reached Friday, said the TrusteID Premier arbitration clause applied only to what consumers were signing up for, "the free credit file monitoring and identity theft protection products" and "not the cybersecurity incident."

This is also stated on Equifax's new website's FAQ page.

The deal with arbitration

The current scuffle over Equifax's terms of service should come as no surprise. It's a skirmish in a long-running battle that consumer advocates have been fighting against what they call "forced arbitration," nearly ubiquitous clauses in contracts for products ranging from cell phone plans to financial advice.

Arbitration, when two parties settle disputes in front of a mediator, rather than in court, isn't necessarily a bad thing. Advocates, including business groups, say it is faster and cheaper than going court. Still consumer advocates, including Warren's brain child the Consumer Financial Protection Bureau, complain proceedings are opaque and that arbitrators deciding cases may be biased in favor industry. The CFPB issued a rule over the summer that would have banned arbitration clauses from certain financial institutions, though it was later blocked by the House of Representatives.

One key legal avenue that arbitration clauses typically close off for consumers is the class-action lawsuit. That could be significant for Equifax -- at least on one proposed class-action lawsuit was already filed against the company late Thursday, according to Bloomberg.

Your options

Imre Szalai, a Loyola University New Orleans law professor who reviewed the TrustedID terms of service at the behest of Money on Friday, says consumers who might want to join a suit against Equifax should probably stay away from the program, despite the spokesman's assurances. That's because the language is broad enough Equifax's lawyers could conceivably argue it covers more than just any future incidents.

"If you look at their general terms of use, it just says that any claims involving their credit services are bound by arbitration, but it’s really silent as to timing," he says. "I think if you are representing Equifax you would say that the arbitration clause is so broad it applies to claims even before you sign up."

If you're worried about waiving your rights, the good news is there are plenty of other credit monitoring services out there. Credit Sesame and Credit Karma two popular options.

In the meantime, here are other steps you should take now if you think you may have been affected by the breach.