Hacker News Reader

Comment by jedbrown | Hacker News Reader

This can be fixed by a small change to privacy liability law. Current law requires litigants to show actual economic harm. That is hard to do in cases of identity theft and privacy violations, which is why the OPM case was just dismissed [1]. If this was changed so that a privacy violation could be litigated, companies like Equifax would need to buy insurance against such actions. Alternatively, there could be a new law that any company storing SSN-type data owed some nominal amount (say, $10) to the owner of that data if it is compromised for any reason. Either way, companies that aggregate large amounts of such data would end up buying insurance.

No insurance company would sell such policies without due diligence -- they would establish security requirements and pen testing. Consumers are protected by the existence of an actuarially fair insurance policy. not by the (nominal) compensation. Note that Equifax's customers are (primarily) not consumers. Regulations (in the form of liability law reform or nominal compensation) may not be required in industries where companies only hold the data of their own customers, but such companies could cite their insurance policy to convince their customers that they take security seriously. (Now it's always empty words.)

[1] https://www.washingtonpost.com/news/powerpost/wp/2017/09/20/...

View on HN

This sounds like the most efficient solution to me. There is no need (and for many, no desire) for the government to take on the role of tracking citizens.

A minor but strategic change in liability law around privacy would shift incentives in the way you describe and suddenly it becomes in the best financial interests of the companies to protect the data. Indeed this is the only kind of incentive they will respond to.

Nationalizing the credit industry doesn't really solve any real problems as far as I can tell.

We already have this in the US for another industry: HIPAA for health records.

And it generally works pretty well. In the law, the government lays out rough things it wants to see (e.g. access restrictions, auditing logs, etc) + penalties (financial and otherwise) and then lets the industry find a way to meet them. Furthermore, there's a legal distinction between willful and accidental non-compliance.

It's absolutely added cost, but generally seems to accomplish its privacy intent.

No one I know who works with HIPAA would call it a 'good' solution.

http://www.medscape.com/viewarticle/810648

What specific components do you think are problematic?

I've worked as a developer with health care providers and insurance companies for 5 years, and other than it being annoying as "some regulation exists" no one I've talked to feels it's a bad solution to the problem.

Asking industries to be happy about privacy regulation seems an unreasonable goalpost.

By my quick reading, the majority of that article is spent dismantling the complaints of those at the beginning of the article. In summary, the complainers appear to be either overly cautious, or flat out misinterpret the law.

Besides, I’d be willing to bet that those at Equifax would have similar things to say about a comparable credit reporting law, just like how some medical practitioners don’t like HIPAA.

Unfortunately this link wants me to login.

https://www.google.com/search?q=Problems+with+HIPAA

I just googled it, and it was the first result

You and I have different meanings for the word, efficiency.

My definition: the most efficient has the least wasted effort and the maximum productivity.

I do not think having individuals & classes going off and suing everyone they can, every company buying piles of insurance against these suits (because how could they reasonably guarantee perfect privacy?) and having insurance providers coming to evaluate each institution...

This is only legally efficient, in that it requires the least amount of nuance in law.

There's a reason we have public infrastructure and services, and it is for efficiency.

Frankly speaking, if we're going to be tracked (and we are, lots and lots), I want the government as involved as possible, whether through strict regulations or through being the central repository for that information.

Maybe do it state-by-state, so long as each state follows some federal guidelines and each state provides a way to interoperate with the rest, and with private businesses that need access to that information, if the feds freak you out.

Why?

Because I can, in theory, have my say in how the government operates. I can vote, I can submit comments, I can go talk to elected officials, whatever. I have zero recourse when private companies schlep my data around and wreck my life. Voting with your vote is best, but I can't even vote with my dollar with Equifax.

Totally agree with you. I know people who refuse to vote, use doctors, etc, to "prevent the government getting data about them" - but are registered on Facebook, Google, carry a smartphone, etc. I don't understand how people can be so paranoid about the government, and simultaneously so trusting of large corporations.

I think people who have that view feel that corporations can't arrest you, can't seize your assets, can't restrict your travel, etc etc.

Let me tell them about two little companies called United Fruit and Standard Fruit... (now Chiquita and Dole respectively)

Like say, the East India Company?

The opposite condition also exists: I don't understand how some people can be so paranoid about large corporations, and so trusting of government. They are both merely human organizations with large powers, and subject to corruption. We should be wary of both of them.

The difference is that governments are made up of people who are voted in

That's hardly the case.

Firstly, examples of governments that have any people voted in at all are cherry-picked. Around the world, there are governments that are not voted in, or are "voted" in by a sham process which only has the external appearances of democracy.

Secondly, in democracies, a fairly common pattern is that the government consists of some seats that are voted in (parliament) plus some that are appointed (senate). The power is divided accordingly. (A minor point is that it is not uncommon for the leader of the elected party to appoint people for the uppermost staff positions: a so-called "cabinet" or whatever.)

Thirdly, government in the broad sense includes not only the parliament and senate political structure but all of the institutions of the government that actually get various things done throughout the governed region, and all the levels of bureaucracy employing large numbers of people. All of that staff is not elected; they are just people hired into positions and they generally keep those positions across government changes. That bureaucracy has considerable power of its own; not every single decision they make which affects you goes through a parliamentarian that you elected!

For one, as kazinator said in the sibling comment, even in the best democracies this is only true of a small percentage of government jobs - there are many powerful agencies and influential staff positions that are not elected and therefore not subject to the oversight of the people over whom that power is exercised.

Two, yes, many of the highest profile, and most powerful, positions are elected. And in practice, over time, this means that these positions have selected for people who are 'electable' - which has itself over time come to mean people who can raise huge amounts of campaign money. This is a deeply corruptible situation, if indeed it is not already deeply corrupted.

I agree with the idea that open public oversight is a powerful corrective, and is a major difference between private organizations and public ones with effective means for perceiving and removing corrupt officials. I think it is highly questionable to what degree the latter describes our current situation in much even of the democratized West.

He's a nasty one - my wife got a big box in the mail from Enfamil last week. "Congratulations on your new baby, here's some stuff to get you started!"

One problem. She didn't know that she had been pregnant and suffered a near fatal (to her) complication and miscarriage 7.5 months ago. Only a few parties were aware of this: My family (not posted on Facebook), two health insurance companies, the hospital, two pharmacies and the Ob/Gyn practice. Last week would have been the due date.

One of more of those entities, who are all supposed to protecting her privacy failed to do so to extract a few more bucks.

> One of more of those entities, who are all supposed to protecting her privacy failed to do so to extract a few more bucks.

I would suggest that that is not "failing to protect" private data, but "actively exploiting".

The US government is already tracking the financials of its citizens. Even foreign financial institutions are required to report financial activities of all US citizens. Otherwise, they will face heavy sanctions and fines. IRS would not become any more invasive if they are also tasked with maintaining credit histories. They are already as invasive as it can get.

> any company storing SSN-type data owed some nominal amount (say, $10) to the owner of that data if it is compromised for any reason

I think a company should be able to avoid a fine if they disclose breaches immediately and are able to document that they followed best practices. From what I've read about the Equifax breach, they would definitely be found negligent.

No, it needs to be strict liability. If an entity is as responsible as possible and still accidentally causes millions of dollars of damage, they've still caused millions of dollars of damage. Some things cannot be done safely, and if entities want to do them anyway they should be prepared to bear the consequences.

It may be the case that once all the privacy related externalities are pushed back onto credit reporting agencies then their business model is no longer viable. I, for one, am fine with that outcome. If that's the case then credit reporting agencies were never a net good for society in the first place, and all the regulations are doing is exposing that truth.

No, not in that case (your hypothetical responsible bureau): it's the criminals who have caused millions of dollars of damage. The insurance proposal creates the right blend of incentives to promote responsible behavior and punish - significantly - incompetence (i.e. denied coverage).

To extend your thinking, consider air travel. Airlines act responsibly, even to the point of having government provide much of their security, yet occasionally terrorists manage to blow up aircraft. In that scenario, you'd have the airline be fully ('strictly') liable because of an external event they did everything to avoid. The harm is greater too - death is worse than ID theft.

Truth is, nothing can be done safely. Not travel, not business. There is always a tradeoff between risk and benefit.

Credit itself is an enabler for the economy. Credit bureaux facilitate comprehensible risk management, which allows for market forces to operate around interest rate setting reasonably effectively. Absent bureaux that same function needs to be performed, but it'll be done in a decentralized, ad hoc fashion by individual lenders which will impinge on their business models and ultimately drive up rates.

So you don't like the bureaux; well, nobody does really. But what is an alternative which allows lenders to compare applicants on a like-for-like basis with some degree of confidence?

When I fly, I'm aware that there are risks, and I choose to opt in when I buy a ticket. The risks are super obvious, and I'm the "customer". Not to mention airport security is pretty heavy handed and visible.

Data gathering is usually not opt-in and it's also intentionally non-obvious who your information is shared with in most cases. I'm also rarely the customer, which means there's very little chance that my interests are being represented. Security or lack thereof is pretty hidden as well.

I suspect we would find a way to fill the economic holes if every credit bureaux was phased out over the next 5 years.

IMO, the entire vertical needs to be more transparent.

You're entirely right on the first two points. But you do implicitly opt in by being a consumer of credit. I recognize that's a bit mealy-mouthed, since it's rather hard to exist in modern America without being on Equifax's radar, but nevertheless there is at least some illusory optionality. I completely agree with your final point about a need for greater transparency. But this is the situation we are in.

I think the much more interesting discussion is about how those economic holes are filled, and it's why I posed that question in my note above. Of all the corners of the internet where you might expect such a solution to be proposed, HN is surely the best. What does post-bureau creditworthiness attestation look like? Presumably it's decentralized, to minimize aggregate harm to people in the event of a hack. Presumably it's de facto (and de jure) verifiable and correctable by each individual. It must also have some sort of graduated 'need to know' disclosure mechanism, with crude aggregate scores available to low-ranked creditors (cellphone companies, for example), and much more detailed information available to senior stuff like mortgage lenders. And why wouldn't it also have a facility, which didn't disclose creditworthiness data, for authenticating users to various services?

But then why not go one step further. Why have this stuff in one place per consumer at all? Why not have lenders jus reach out over an API to every other lender to ask in effect "How good a debtor has scrumper, with SSN 01-234-5678, been for you? How long have you done business with her?" and get various answers back, all of which can be factored into some model which conforms minimally to a regulator-provided specification? The size or risk of the loan dictates the depth of that pan-industry query. Companies don't hold any more than they already hold, and there's no nexus for that data at all. And all the lender is allowed to keep is the model result, some sort of FICO equivalent, for a particular applicant.

At the risk of being trendy, I'd wager the credit bureaux 2.0 (3.0?) involves blockchain.

> it's the criminals who have caused millions of dollars of damage.

Yes, that's true. But as the poster above already said some things are simply not safe to do. If I wanted to warehouse explosives, I wouldn't be allowed to do it near a populated area, I'd have to put my warehouse far away from populates areas. But absent that prohibition, let's say I found a cheap space in town, and so I loaded it up with tons of explosive material. Then a homeless fellow breaks in one night and manages to start a fire, burns the place. He survives, but the explosives were set off and half the town blew up. You'd think it's okay if I shrugged my shoulders and pointed at the homeless fellow?

Credit reporting bureaus have free reign to screw up here because there's no oversight like the BATFE and no reasonable way for them to be sued into oblivion when they screw up so badly as Equifax has clearly done here.

>Credit bureaux facilitate comprehensible risk management,

How anyone can trust Equifax to do anything anymore is beyond me. There is still no corrective force here to cause these companies to become competent with data security. This is a farce.

We're all arguing under a parent post which wants to reform the industry to bring some externalities back onto the agencies' books.

If it's legal to operate an explosives warehouse in town at the time you do it, then unfortunately yes I have to answer that, provided you'd complied with applicable laws in securing your warehouse full of bombs, then you could shrug your shoulders. But you'd then be shrugging in the face of a barrage of lawsuits (as is happening now with Equifax). Soon after your homeless guy blew up the block the laws would be changed. And that's the situation we're in now: rubble everywhere, with a chance to make legislative changes to prevent a recurrence.

> consider air travel

With air travel the people bearing the risk are the direct customers. If I'm uncomfortable with the safety record of airlines I can simply not fly. How do I opt out of the risks imposed by a credit rating agency?

The closer analogy, I think, would be if cargo planes were routinely crashing in populated areas. The air freight company and its clients may well be completely comfortable with their loss rate, but the unaffiliated third parties living underneath would have a pretty justifiable reason to complain.

> Truth is, nothing can be done safely. Not travel, not business. There is always a tradeoff between risk and benefit.

This is absolutely true, but as currently constructed credit agencies get to reap the benefits while pushing the risk off onto the general public. If we regulate to internalize that risk and the agencies still think it's a good risk/reward tradeoff then that's fine. If they no longer think it's a good tradeoff that's fine too.

> So you don't like the bureaux; well, nobody does really. But what is an alternative which allows lenders to compare applicants on a like-for-like basis with some degree of confidence?

There's several suggestions elsewhere in the thread, but I'm going to go out on a limb and suggest: nothing.

On a macroeconomic level, easy availability of credit increases average growth but also increases total risk, and therefore volatility. It's not apparent to me that that's a good trade.

On a microeconomic level, the benefits I receive from being able to get credit easily have to be weighed against both the suboptimal personal accounting I have to engage in to keep my credit score up and against the long tail risk that a third party can open a line of credit in my name. It's not apparent to me that that's a good trade either.

Maybe lenders should be much more conservative with who they loan to. Maybe they should price in a much higher default rate. Maybe individuals should seek a single line of credit from their bank of choice instead of expecting expenses to be financed individually. I don't know, I'm just some guy with 2 semesters of college-level economics. What I do know is that the status quo isn't sacred and the arguments explicitly in support of it seem to boil down to "growth is good and change is scary", which seems like really weak rationale for giving someone most of us don't even have a business relationship with essentially unilateral control of millions of people's financial fates.

I thought this was an excellent comment with some very strong arguments, good food for thought.

So yes, the problem is one here the credit bureaux get to externalize their risk. I was arguing with your rejection of the 'insurance model' for bringing some of those externalities back in house. Your proposal of strict liability is really just a banning of the industry in disguise: without the possibility of insuring away those risks it's not viable to stay in business - an agency is going to get breached even if they are as careful as possible. I don't think the lobby (and it'd be bureaux and lenders lobbying on the same side) would permit that outcome, no matter how strong the political will. It's too far reaching.

My response is, insurance doesn't preclude elimination. Those bureaux aren't going anywhere tomorrow. Incremental reform along the lines proposed by whatever grandparent we are both under provides a path to improvement, better risk management for individuals, and it could perhaps ultimately lead to your desired end state of a completely restructured consumer credit market.

For the record, I'm not opposed to credit agencies buying data breach insurance on whatever terms they can negotiate. I'm just opposed to the idea that any amount of caution on their part should dissipate their (or their insurer's) legal liability in the event of a breach.

I do agree that would probably be a de facto ban on the industry, or at least a radical restructuring thereof. My suspicion is that the industry is actually not a profitable enterprise once all the externalities are properly accounted for. But I'd be happy to be proved wrong, and I'm more than willing to give the industry a chance to figure out a model that works.

Edit: Completely off topic, but this is the nicest internet argument I've had in a long time. Thanks, scrumper, for being an excellent debating partner!

> I'm just opposed to the idea that any amount of caution on their part should dissipate their (or their insurer's) legal liability in the event of a breach.

Oh then yes we totally agree. If they're prudent, their insurer pays. Otherwise they do.

You might be right about the credit reference industry being ultimately unprofitable as a standalone business, but I think there's a lot of arguing to be had about the magnitude of those externalities. That's why we need a law to provide some automatic, per-individual-leaked fine - the insurable risk from way up-thread.

Just saw your edit. Kind of you to say. Right back at ya vec :)

> So you don't like the bureaux; well, nobody does really. But what is an alternative which allows lenders to compare applicants on a like-for-like basis with some degree of confidence?

Ironically, even if I liked the bureaux (I don't) I couldn't do it any more. Their negligence self-defeated their mission.

With the leaked information, no credit report from Equifax is believable any more. If somebody slams it in my face I can shrug and say "Nope, that's not me: leaked information". Everybody in the Equifax data can do that. Everybody in the other companies' data which intersect with Equifax's can do it. All of a sudden, these companies are providing zero value.

If only. That's lying for financial gain though (or a job or whatever). Burden is on the consumer - you - to get Equifax to correct it. Credibility may destroy their business if competitors are better, but in the meantime you can't refute by default on a presumption of inaccuracy.( Not trying to sound lawyerish here, I'm talking generally.)

But I am not the consumer of Equifax. I have not paid them, nor asked them to do anything, nor indirectly getting a service from them [0]. The consumer is the bank or whoever paid for the information. So, on your logic being "the burden is on the consumer", why should the burden be on me?

Second, why would the presumption of inaccuracy trump the presumption of accuracy? Who said Equifax is right? Especially since they have a track record of incompetence. As any debate on facts goes, the burden of the proof is on whomever is making a claim. Equifax is claiming something, i.e. that my credit score is X. I'm saying it is not.

I concede you that what you say is probably how the law and the system works right now. And I concede that mine was more like a desire than a real prediction. I know things won't change. But that doesn't change the fact that, after the hack, Equifax and similar are just selling hot air.

[0] If you want my credit score, you ask me for my statements, nor Equifax. If anything, Equifax is damaging me with their inaccurate information.

Except that'd be willfully lying in pursuit of financial gain, so no you can't really do that. The burden is on you to correct the record and defend against ID theft.

Sucks. I'm not defending it. This is how it is.

Well no, because under jedbrown's scheme the insurance is there to pay the claim.

Simple analogy: a homeowner still has to make a claim if their locked, alarmed house is ransacked while they're away. Insurance may subsequently deny the claim if it's shown that the homeowner failed to follow best practices, such as locking doors and windows. In other words, adherence to best practices is a condition of insurance.

Ok, I see it now and I agree.

I think negligence or fraud on the part of the company should multiply the penalty and it probably release the insurer from being responsible.

That documentation would already be available because they would have prepared it during the insurance underwriting process.

And suddenly there would be a much more litigious and powerful entity on the side of protecting consumer data, the insurance company that underwrote the policy. They deny the claim and Equifax suddenly has a lot more problems.

Bullshit. The way to stop this is to prohibit using and collecting personal information of citizens without their consent and against their will.

In non insane countries, a company doing that would be closed and the perpetrators would go to jail.

Credit reporting is always consensual. In the same way you agree on the interest rate, fees, payment schedule, etc., you agree to a credit pull at the beginning of a loan and reporting on your payments over time.

Maybe you feel entitled to be extended a loan without any credit reporting. I, personally, feel entitled to a loan without any interest. But neither of us are going to get what we want.

I am not American and not living in the USA. I am not subject to any of this contrary to what you think.

Tell me more about this magical country where there are no repetitional consequences or persistent records when you don't pay your debts.

I strongly suspect you are subject to all of this via a state-owned CRA or little to no borrowing activity (also an option in the US).

It wouldn't work. Suppose Equifax gets hacked and the data gets out. Would TransUnion then be liable because they also had that data? What if TransUnion subsequently got hacked? Would they be able to argue, "Sorry, your data was already in the public domain," and get out of the liability?

Why wouldn't they both be liable? The violation is the breach, not the existence of a pice of PII data outside of their firewall.

The bigger problem I see is it incentivizes them never to come forward, or to massively downplay an attack. I guess if the damage is small enough and the penalties for nondisclosure astronomical enough (or that pierce the corporate veil), it could still work though.

It could work. Just write the law to account for edge cases like that.

Why not establish a formula for theoretical damages from identity theft, and then allow that as a standing for damages?

Or you could just do what other countries do, regulate it and make it a government function.

So I am not one of those people that says that the government is bad and terrible and evil and can't be trusted to ever do anything. But a government agency that has all the info about all my accounts, and is a reputation agency which basically hands down major decision factors that will affect my life (can I get a car loan? a mortgage?) seems ripe for abuse. Think of how well no fly lists currently work: if your name is on that list, you are fucked. If you end up there by mistake, which apparently happens with some frequency, you have to prove that you aren't a terrorist. If your name matches the name of someone on that list, you can be fucked. I just don't have faith in a system like this.

I don't have a good solution for the recommendation system like this. Maybe we wouldn't need it in the first place if we didn't do so much debt financing of stuff. Or maybe it needs to be less centralized: applying for one loan, you need to show payment history on a few other loans, etc. But I just don't see a centralized government run agency as the solution.

> But a government agency that has all the info about all my accounts...

I'm quite happy with the approach that Switzerland has taken. Firstly, there are no credit scores or credit reports. Instead, there is a well-defined and regulated way to collect on overdue bills: The creditor requests debt collection from the state debt collection agency. At this point, collectees may decide to pay, to object to the prosecution or not to react. Objecting leads to a defined legal process where the creditor must prove the debt, and the collectee can defend themselves. In case of no reaction, authorities may proceed to seize assets.

As for the reporting, the debt collection agency will only keep a file on people against whom a collection request has been filed, and only make it available to the person in question and entities with a qualified interest in it. In practice this means that when renting a flat or getting credit, you request your own (empty) record and submit it to the landlord/bank in question. The agency is also responsible to expunge entries from that record after a defined time. And since responsibility for collection lies with a state agency, there's very little risk of the kind of harrassment you hear of in horror stories from the states.

The implementation has room for improvement: records are kept locally, tied to the state you live in and there's no immediate way to get online confirmation. Those are details though, that could be fixed in a clean implementation of the same system.

Aren't we already sort of in a worst of both worlds situation here? The IDs we are using as primary keys are from the SSA. The FHA is involved in most American's mortgage decisions. The Stafford loan program in most of America's student loans.

But we also have giant for-profit companies aggregating giant databases with little to no oversight, and up until recently no ability to access your own data for free, and still today no straightforward, across-the-board, means to appeal bad data, or collect damages from it (or from leaks of it).

Even with the terrible things associated with the no-fly list there is a TSA appeals process and a court system to challenge it. Do you know how you correct mistakes in your Equifax-TransUnion-Experian composite credit score? You mostly don't, and you most likely can't take them to court, because they think you are bound to arbitration.

I don't know if there is a good solution here either, but at least a government-run solution would have to be accountable to the people as citizens/constituents (even if it would still likely be in the pocket of the banks).

> Do you know how you correct mistakes in your Equifax-TransUnion-Experian composite credit score? You mostly don't, and you most likely can't take them to court, because they think you are bound to arbitration.

Sorry, that's not true at all. I went to Experian late last week to set up a fraud alert because of the Equifax breach, they showed me my credit report and had a button to mark things that were factually incorrect. I did so and submitted it. They did some sort of investigation and removed the data because they couldn't verify that it was correct. It was as easy as filling out an online form. (Actually, I think I had to call about 1 particular item, but it was handled over the phone.)

I was being partly hyperbolic about the worst case. Keep in mind that fixing Experian doesn't fix TransUnion or Equifax, and there's no simple way to correct all three at once.

Yeah, not with the sovereign immunity to prosecution that the gov't has.

Governments get hacked all the time. We need a new philosophy: if you can't secure it, don't even collect or store it in the first place.

I'm interested in the methods and regulations. What countries maintain credit reporting as a government function?

"In at least 40 other countries — including Belgium, France, Germany, Italy and Spain — credit reporting can be done by a public credit registry. It is usually operated by a central bank that already oversees the financial institutions that feed information into the reports. These reports tend to be more accurate because the operators have a legal right to demand data from banks as well as a mandate to ensure it’s correct and that errors are fixed. Data on late payments and defaults are erased once a consumer has settled up."

From the article.

I confess that I didn't read the article. My bad, and thanks. I am going to hit up Google and see if I can learn about the mechanism and effectiveness.

It does look, from the snippet, like they aren't quite the same. I don't yet have an opinion on that, specifically the bit about data being erased after it has been settled. That's pretty different.

I shall see what I can find. It may change my opinion. Thanks again.

OPM recently demonstrated how well the government can protect the data it collects.

So did Equifax, and Target, and Home Depot, and...

I don't see the point you're trying to make. If we're going by "who has made the news for hacks lately", the private sector is by far the worse choice.

OPM can't be sued into oblivion. The federal government gets to decide if you even have standing to sue them. What are the odds that they'll react accordingly?

If "being sued into oblivion" is such an existential threat to these corporations, why does this keep happening? Nobody is getting sued into oblivion, so I don't see why that's part of the argument. It's not "suing to destroy a corporation" vs "trying to sue the government", it's "free credit reporting and a BS 'we are REALLY sorry' letter" on both sides.

Also, OPM does not get to decide if you have standing to sue them. That's up to parts of the government so far removed from OPM they might as well be a different entity entirely.

The sentiment that a more regulated or entirely governmental entity would mitigate the risk of compromise is baseless.

Privacy WRT contracts could also be improved. Why is my payment history shared with any credit company? Perhaps people will slowly choose companies similar to duckduckgo over google.

100% this. Allow consumers to opt-in or out of data sharing with credit bureaus. This at least would make room for alternate models of credit rating / risk that would not centralize this information in a couple of annoying locations.

You say "this can be fixed", but don't seem to have read the article. Your proposal only speaks to one of a myriad problems a firm like Equifax presents.

Reply on news.ycombinator.com