You Can’t Fire Equifax, but Your Employer Can | Hacker News Reader

You Can’t Fire Equifax, but Your Employer Can

nytimes.com

209 pointstysone87 comments

Here's an example of a report sold by The Work Number: https://www.theworknumber.com/samples/The-Work-Number-Employ...

Notice that one of the items they disclose about you is Workers' Comp. If you are injured at work you can get treatment for your injury through Workers' Compensation and this is usually much more generous than your regular health insurance: there are no co-pays or deductibles, for example. But be careful - when you interview for a new job, The Work Number may disclose this info to your prospective employer and they may consider this a red flag.

This happened to me. When I interviewed at a large software company the recruiter mentioned something about my using Workers Comp. Fortunately I had only used it a little and that was many years ago. She also thanked me for my honesty regarding my salary at my previous job. I found that appalling. Me voluntarily disclosing my salary is one thing, but some data purveyor selling my salary info to a prospective employer is a violation of my privacy, and it may depress the salary offered by the new employer. Unfortunately there are no laws preventing employers from disclosing your salary to such companies, and they often do.

> Me voluntarily disclosing my salary is one thing, but some data purveyor selling my salary info to a prospective employer is a violation of my privacy,

You consented to this disclosure during your application, or else Equifax violated its contracts.

Coerced consent isn't consent. A drunk person can't consent, and neither can someone who is presented with an impenetrable contract without a lawyer present.

Except you’re not drunk when signing the papers at the beginning of the job... So I fail to see the parallel.

Then consider not being able to get a job with a stable employer and pay off your loans. Being pedantic about whether or not you're forced is not constructive, when there obviously exists a power imbalance that is causing a massive rift in society.

Uninformed consent is not consent.

Uninformed consent is your fault. If you sign papers without reading them, that's on you.

"A person shouldn't have to have an advanced law degree to avoid being taken advantage of by a multi-billion-dollar company. You should be up front about what you're doing and allow people to opt out." - Ben, Parks and Recreation

Your rebuttal is to cite, of all things, Parks and Recreation?

Note that the company under discussion is not Equifax, but the potential employer. You give your explicit permission for them to consult The Work Number during the hiring process. If you're hired, you also grant explicit permission for them to send updates to The Work Number. You can 'opt out' by not applying at companies that use The Work Number.

Do those papers explicitly explain what your employer's various business partners and services will do with your information? Does your employment contract state that Equifax will sell your salary?

Yes. Take a look.

If you feel the need to "pad" your current salary for negotiation purposes, and suspect "the work number" is giving out actuals....

Talk about stock option awards or other non-payroll events. Theworknumber only has visibility to payroll type events.

I'd really like there to be a law that allows you to opt-out of credit reporting agencies. This would work similarly to the do-not-call list - I give them my social and they are instructed to disregard any data they receive that's associated with that number, and will destroy whatever information they currently have about it.

Doing this potentially locks you out of getting credit, but if you can do it on a per-agency basis, then it's a good way for individuals to punish bad actors like Equifax. If even 10% of Americans opted out after the breach, their business would be over, the remaining agencies would have proper motivation to improve their security standards, and it would open a gap in the market that a better run startup could move into.

I doubt this would work.

There are really only 3 vendors for this data, and most banks seem to have exclusive contracts by region for which data source they consult.

This, of course, goes hand in hand with the plummeting amount of national banks available in the US. We're really down to Wells Fargo, Citi, Chase, BOA, and one or two others.

In my experience, my two credit unions -- and credit unions kind of suck anyway -- are only set up with a single CRA.

So people have few choices of creditors and have very little negotiating power.

I think the right answer is for there to be exactly one CRA and for it to be a pseudo-public and very heavily regulated.

I would enjoy not having a credit score. However, I also don't take loans out.

--EDIT Not sure why I get the down vote. Pretty neutral comment. I think the credit score is just a sham. If someone wants to get a loan I don't see how a single number has any bearing on reliability. It boils a multi variable question into one number. Further, the number could be quite misleading. Also I don't think any 3rd party should have this data without a written contract from the individual. Maybe that will get more down-votes, but I at least can see some disagreement in that. However, "I would enjoy not having a credit score" is just a statement...

I view loans negatively. If I can't save up for it. I don't need it. I am certainly not going to pay more for something thanks to that pesky interest. I also got rid of all my credit cards 5 years ago, and made certain to never take out any more debt. Not even for a house.

The only exception I could see is if I started a business as it allows for additional cash when needed. For example more orders than anticipated, and I don't get paid till the customer has the product. Either, customers suffer delays or infuse some extra cash to increase cash flow, but then immediately pay it back.

Loans can and should be used by individuals in two big ways: 1) spreading cash-flow over a long period (car loan) 2) investing in long-term gain (mortgage, education)

By saying you shouldn't ever take on debt, it's similar to saying no business should take on investment capital, and governments should not invest in emerging markets.

Determining how and where to take on liabilities, that is a more interesting discussion then simply saying debt is bad.

While I don’t think you deserved downvotes, as there was no “superior” attitude to your philosophy on loans, it’s just not realistic for a large variety of people (ther very vast majority).

How many people can buy a home, cash? Should everyone else be renters in perpetuity? All sorts of things people might miss out on, from pets, to country living etc, because they can’t lay down between $100,000 and $300,000+ to buy a home “without a loan”.

(I realize that there are a number of caveats to my statements, not everyone has to live in the most expensive part of the country, but not everyone can live in rural Iowa or Detroit, and not everyone has to have a pet, I’m just talking of how for very many people, the “no loans ever” attitude is not realistic).

> How many people can buy a home, cash? Should everyone else be renters in perpetuity?

Currently renting by choice vs. "buying". One might argue that when you "buy" a home with a mortgage, you very much still are a renter - you're just renting money. Potentially hundreds of thousands of dollars, for 15-30 years.

There is a vast difference between renting an apartment vs buying a home on credit.

When I rent, I can't do anything to the building without the landlord's approval. They may prohibit painting, but when I buy a house I can paint all I want. A landlord may limit what I can do with the ground around my "property", while "owning" a home means I can dig all I want. Having a home means I can have as many pets as I want without incurring extra rent, too. I can also choose my own parking situation, which is harder when renting.

So no. I reject the idea that having a mortgage is the same as renting. Owning a home, even while paying a mortgage, offers a lot more freedom, of course while still owing money to someone. But it is fundamentally different from renting.

Most importantly, for a home, your costs are mostly fixed, assuming a fixed rate mortgage. Taxes can change, but you get a voice in that.

A landlord can wake up and raise rent arbitrarily in the vast majority of the US. It make take up to a year for that to take effect, but it still can. Owning shields you from that. Or from the landlord moving in upstairs neighbors who have a young kid.

> Owning a home, even while paying a mortgage, offers a lot more freedom, of course while still owing money to someone.

Please explain this again. If you buy a home, you have a large illiquid asset, which makes it really difficult to relocate for jobs and downsize living situations if you lose your job all of a sudden. If I lost my job, I'd instantly move into a studio apartment and break the lease I currently have if I wasn't month to month.

Contrast that to owning a house, where if you lose your job, you have to sell your house and move, which takes longer than breaking a lease. Also, you'll have to pay brokers' fees and such. Also, you're stuck in your current job market. That might be ok for the Bay Area (and other places), because there are plenty of jobs here. But if you took a job at Anheuser Busch and decide you hate it, you're stuck with a large liability in a market that is not doing great, few other jobs, and a mortgage you still have to pay.

Plus housing prices can go down also. You're stuck with a monthly payment for something that's not even worth as much as you paid for it or even owe on it, and you cannot refinance.

But sure, you get to paint the walls whatever color you like, as long as it's not visible in the street and the HOA (if you have one) approves.

Yeah, people have different situations. Sometimes renting is the best choice, sometimes buying is. Each comes with it's pros and cons. One person may value the freedom to do what they want with their home, another might value the other freedom of mobility more.

I own, and am in a situation where if I lost my job, I wouldn't have to sell the house. I love not having to ask permission for every change I make. I really love not stressing over the damage my dog does to the floors. The scratches add character as far as I'm concerned. A landlord would probably ding me for thousands to repair it all.

Also, the rent can never be raised on me. Nor can I be told I have to leave because the owner is going to sell the property.

The point is that owning property constrains freedom rather than enhances it.

If you take out debt you owe somebody something. You can't just do what you want.

It constrains some freedom, delivers others.

You gain other freedoms that you don’t have when you’re not the owner. You can build, paint, have messy pets, smoke weed, knock out a wall, be a landlord yourself, and rip out the carpet. You gain some freedoms in exchange for giving up others.

>Please explain this again.

I think you understood it right the first time. you're just deliberately choosing to miss the point.

To put it in your snarky-ass tone: Contrast owning a home to renting an apartment. Your landlord could double your rent, or choose to stop leasing. They can put off maintenance while forbidding you from working on it yourself. They can show you an awesome demo unit then give you something else with worse appliances and a terrible paint job and now you're stuck with it. You can have a noisy neighbor move in and the only thing separating you from them is one paper-thin wall. You can pay tons more more for dedicated parking or roll the dice and hope someone doesn't steal the last spot out front. You're completely at the mercy of the housing market: if the market goes up, no matter what you have to pay the new prices when your lease is up, since every place near your work will be raising rates too. And now you're paying double a mortgage for a shitty one-bedroom with a smoker living across the hall drifting the stink into your home.

But at sure, you can pay 3x your rent to break your lease and move to another state whenever you want, since normal people totally do that all the time.

That's funny, considering you're just setting up strawmen targets and knocking them down. The point was that renting gives you more freedom than buying.

> To put it in your snarky-ass tone

How was my tone snarky?

Also, it's all economics. If the rent is way higher than the mortgage, sure you go ahead and buy. If not, you rent.

Why do you compare "owning a home" to "renting an apartment"? Why don't you compare "renting a single family house" to "owning a home?" If you take away the obviously non-comparable "house" versus "apartment" aspect, it's a better comparison. You aren't comparing renting to owning, you are comparing apartments to houses.

Don't most landlords do a credit check for renters?

Affordability checks and references. Landlords are not providing credit.

Um, actually a landlord. And yes, we definitely do credit checks.

The lease is a loan for the term of the lease in the amount of the total rent, coupled with other grants and responsibilities.

Often times rent is more expensive than owning a home (through a 30-year mortgage, for instance). So, in the end, you end up with an (appreciating) asset vs just having somewhere to live for X years.

Of course, and this is a huge reason for some people, you're kinda stuck there, unless you want to do the buy/sell dance to move around.

This isn't exactly a rebuttal, but how much are housing prices inflated by the fact that everybody's getting loans? How much would those $300k houses be worth without the mortgage industry? It seems to me that the housing market is caught in a self-reinforcing cycle where mortgages inflate prices, and now nobody can get on the treadmill. That doesn't seem like a unassailably good thing, or something that should just be accepted as "the way it is." (It may be the best of all possible worlds, but I've seen no evidence of that personally.)

> If someone wants to get a loan I don't see how a single number has any bearing on reliability. It boils a multi variable question into one number.

That's the point! It's a way to aggregate a lot of complex things into a simple number that makes it easy for lenders to predict risk. It's not supposed to be perfect, and it doesn't need to be. It just needs to be predictive of risk for lenders. Clearly it is, or they would have stopped using it by now and moved on to another way of predicting risk -- probably another kind of numeric score, because of how useful they are.

Imagine what a pain it would be if you had to provide proof that you paid your bills on time for the past 7+ years in order to get a loan, because the lender can't just get a report from Equifax.

I think I should have that choice though. If you want the convenience go head give your data to the credit reporting agencies. I don't get loans. So I don't care.

The problem would be all the data you _don't give_

You act like everyone is a good citizen, you may be, I may be, but people out there will cheat if left to their own reporting

Yep, and the downside of that is that so many people will lie that lenders will assume everyone is lying.

People with good credit who have nothing to hide would be worse off under a self-reporting regime because lenders won't believe them and will turn down their applications or demand an invasive level of financial information.

In the US you're overpaying by not making your purchases with a credit card that you pay off every month. There are so many rewards programs and vendors typically are required to have the same price for credit and cash purchases.

> vendors typically are required to have the same price for credit and cash purchases.

Tell that to pretty much every gas station out there and every little mom and pop restaurant that offers a "cash discount".

Isn’t that a valid reason for a chargeback?

So you want people who can't afford credit cards with nice rewards, to subsidize those who do?

Also, you are not privy to the contracts between merchants and card processors, so how would you know? And there may have been a law passed specifically forbidding card networks from forcing the same pricing.

Edit:. Cash and debit are allowed to be different price than credit:

https://www.nerdwallet.com/blog/credit-cards/credit-card-cha...

> So you want people who can't afford credit cards with nice rewards, to subsidize those who do?

Where did I say that?

> Also, you are not privy to the contracts between merchants and card processors, so how would you know?

That’s why I asked a question instead of stating something as fact. Why are you so defensive in your reply?

Sorry, I interpreted it as a sarcastic remark to screwed over a merchant offering a lower price for cash customers.

Here in Australia I looked in to a few of these reward programs on various cards and none of them were worth the annual fee unless you were spending over $10,000 a month.

Well, in the US, you can get capital one's 1.5% cash back credit card with no annual fee, and citi has a 2% card. That's basically free money for substituting that for your debit card and spending what you were going to spend anyway. Amex has a card that gives you 6% back on groceries on the first 6k with a (iirc) $95 fee; that's a solid win for most people with families and even couples that pay bay area grocery prices.

The cash comes out of some admixture of the people still using their debit cards, idiots who borrow money from the credit card companies at 20% annually, and the card companies merchant fees.

The credit "score" number is mostly for consumers. Each bank using the credit reference agency has more detailed criteria they use.

I'm thinking EU residents/citizens should be able to do so under the GDPR. The main concern is that the request would cascade to their 3rd parties (as data processors) and it might be difficult to anticipate the total reach of the request.

EU doesn't have Equifax.

Applies to any EU citizen data anywhere.

Applies to EU citizen data for companies that operate in the EU. You can't enforce laws against a company outside of your realm of jurisdiction.

GDPR has what is called extra-territorial applicability.

It may, but they'll play hell trying to enforce it worldwide, as if any countries would let them (some may).

If it’s outside their jurisdiction, they can claim whatever applicability they like: the law is simply not enforceable outside that jurisdiction.

Technically yes, laws only apply within sovereign borders, but this is where trade agreements come into effect. EU is a big enough market that most countries will likely agree to uphold the rules for European citizens. It has been a big focus for online retail in Australia lately, and for good reason.

The law can be enforced against people who are, or have assets, within the jurisdiction, whether or not the alleged violation occurred there.

You can also have some very weird legal definition of a nexus, like this bank that allegedly opened a nexus in the US because they used US dollars for a transaction between two non-Us countries.

And there is also the case that the US army just land in your country and arrest anyone they could not kill.

> And there is also the case that the US army just land in your country and arrest anyone they could not kill.

Unlikely; its a lot easier to kill people than arrest them, especially if you are the US army, which is optimized for the former over the latter.

Many eu countries have credit agencies though.

Sure it does: https://www.equifax.co.uk/ (or at least some EU countries do)

Unless you're willing to live without credit, legitimate interests will override. Section 6f. This is, in fact, called out as an example in the ICO guidance. That bit doesn't (imo) seem to have materially changed wrt the DPA / Data Protection Directive 95.

Breach notifications are new and interesting though. Equifax definitely would have been required by the gdpr to promptly disclose.

I don't specifically know if EU credit agencies are in the practice of widespread selling of credit data besides when a person has asked for credit. The gdpr will definitely allow opt-out of that (by default even!), but I think previous privacy laws may cover that. I'm not sure.

My personal opinion is the gdpr is probably the end of Acxiom style businesses, plus all the ancillary businesses the CRAs in the United States get up to besides plain credit reports. Eg marketing, wage tracking, outcomes estimation for colleges, etc.

I got it! We'll solve it with blockchain/crypto....

Www.civic.com

Should be under libel, severe penalties for incorrect and damaging info and you should be able to opt out of non-public info

libel protects against untrue information. there's nothing protecting private information that you willingly gave up.

I think the point is that when someone is a victim of identity fraud, their credit report contains entries which are untrue. Making credit reporting agencies liable for those untrue entries would force them to accept the pain of identity fraud themselves rather than pushing that pain onto the people covered by their reports.

If, when there are errors on a credit report, consumers were allowed to sue and collect damages rather than having to fight to have the fraudulent entires removed, this would naturally result in a class of "ambulance chaser" attorneys that ran TV commercials and took cases on contingency, but it would benefit consumers as well since errors on a credit report would be more quickly and profitably resolved. The situation would be short-lived, however, as credit reporting agencies would have to make drastic changes in how they verify identities or risk hemorrhaging money from the lawsuits.

But those changes are what needs to happen, so making them liable would be a means to an end.

It would be a minor change in wording for a credit reporting agency to say “a person claiming to be x did not pay back a debt” v “person x did not pay back a debt” in the case of identity theft. This would still be useful to the creditor, and ‘true’ to get around your liable idea.

Not so fast. Aggregating the actions of all these persons claiming to be X in a single number or report is a clear indication they are related and considered pertinent data when a person claiming to be X demands credit - but in fact they are not, and the lack of pertinence is the blame of the agregator.

Furthermore, this only affects the real X, since all impersonators can claim to be Y and get around the sloppy data gathering practices of the agencies.

Good to see. This is a great development hopefully others follow suit. It was telling in how Equifax announced their breach -- they stressed that "no customer information was impacted" very strongly, right at the top:

https://investor.equifax.com/news-and-events/news/2017/09-07...

Most of US population got exposed but hey our customers are safe, so no big deal. We'll just give everyone credit monitoring and they'll shut up.

The thing is looking back, Equifax wasn't really that impacted. Their stock is back to where it was last January. They'll have some lawsuits but it doesn't seem like they'll be going out of business like everyone expected (hoped even). The other terrible thing there is that it was a lesson for others in the industry. They are watching and learning, if Equifax didn't suffer that much why bother enhancing their security posture. Why spend money if even with such a huge breach the consequences are not that bad.

People are always surprised how banks or other institution have terrible security practices, this is why.

Yeah, it's surprising how little impact this had on Equifax so far.

I wish I could say I agreed with you.

In truth, it’s eminently unsurprising to me how little impact there has been.

Any time we see one of these “should be devastating” data breaches, people/ politicians shake their fist for about a week, but there’s little consequences. Sure, sometimes a company might be fined _five per cent_ of the _profit_ they made from the behavior that lead to the breach. Not sure that’s so much a slap on the wrist as a “tsk, tsk”.

That was a really big one at a company that has a lot of valuable start on almost every citizen. I can't think of many worse possible breaches. Maybe the IRS or Visa?

OPM.

https://www.opm.gov/cybersecurity/cybersecurity-incidents/

I would never work for a company that used this service.

> Lots of employers use it. Equifax claims that more than 5,500 have signed up, including over 75 percent of Fortune 500 companies and many federal agencies. The service works by setting up a sort of central line to your employer’s payroll operation, uploading your paycheck information each period. It also records your job title and tenure.

Are you sure yours does not? Most large tech firms use Equifax for The Work Number.

How does this work? Does the employer have a clause in your contract, plus a deal with this company to feed them this data, in exchange for what? It wasn't clear to me from poking around their website. Does it buy the employer the ability to query this database about their new candidates?

I don't remember anything like this when last I worked fulltime for a bigco, in 2007.

> in exchange for what?

Guessing here but it could be in exchange to letting them use the data as well. By feeding data back into it, they might get some benefit like a discount for example.

People join and leave companies regularly and having access to the system allows them to low-ball people in salary negotiations thus saving them a considerable chunk of money.

Wonder how legal that is. It's obviously not completely illegal but it seems like it would be a gray area. Should the company be allowed to share a worker's salary information? Does that belong to the worker or the company? If it belongs to the worker the company could still just claim if you work here on page 95 of your contract you agreed to let us share this and it looks like you signed and agreed, so tough luck.

You can almost see some executive there realizing "Hey, I read in <whatever business journal> people are getting pretty good jumps in salaries just by moving jobs. Regular workers shouldn't be able to do those kinda things. It seems if we invent this new product we could fuck people over and make a good chunk of money for ourselves" (followed by maniacal evil laughter).

2007 was when Equifax bought The Work Number. It probably wasn't as prevalent then.

Voluntary forebearance is not a solution. Most companies are not The New York Times, and Equifax is providing powerful data for management to wield in relations with their workforce. Unless it becomes illegal (as it has in California), there will always be many, many companies who will not willingly give up such an advantage in information asymmetry.

Exactly. We are not their customers. Employers and lenders are, no more, no less, simple as that.

Even “fraud protection” / “credit monitoring”, ostensibly the closest we come to being customers, is in many senses “protect you from our customers and our fuckups” (forgive the language).

I've said this in every thread about these scummy companies, but it is entirely unconscionable that not only are we not allowed to constantly look at and correct the data about us that they have, we are forced to pay for it if we want to do it more than once a year. For them to profit off of us like that is completely and utterly immoral, especially when they clearly do not give a crap about keeping that sensitive data about us secure.

This looks like a service we could recreate, and sell to employers who don't want to be responsible for handing over their employees' data to a firm that risks creating embarrassing PR for them. There are obviously network advantages, but you could bootstrap it if you got even a single employer on board. Is there some other complexity I'm missing?

There are massive network effects, employers only sign up to learn information from other companies, and give up their own information as a condition for the former.

It's a business that bootstraps when you have an existing customer base of related services, dealing with employee and payroll management, credit ratings etc. and mine your existing data for a prototype product good enough until the network effects kick in.

Maybe you could make it bootstrap by making it very cheap or free, so that, even if employers don't usually get anything from you, they still remained enrolled for the rare instance when you deliver something that others lack, so that you can buildup your database in time. But then highly secure, easy to use and long term come at odds with free.

Interesting question of what happens to the trove of data they have if Equifax does go out of business. Sensible alternatives are either regulators will have to step in or they are in too big to fail boat. Less sensible would be to do nothing and hope data does not end up in bad hands.

Somebody will buy the data. Equifax won't just disappear one day.

Actually it seems possible. The demand for their service won't disappear, but with their unpopularity and poor security practices someone who can might just decide to burn them to the ground. Their only assets are data. I'm sure they have offline backups, but a patient enough attack would bork the backups too. They'd probably try to continue doing business, because YOLO, but eventually enough erstwhile 850s would get their Audi leases rejected that the lawsuits would really pile up. About that time some pissed-off employees would start talking to reporters, and that would end the whole thing.

A company based around the mission of extracting wealth through exacerbating negotiating power imbalance is already just about the worst hands possible!

Even though USG's surveillance databases have steep outcomes (eg prison/murder), they're at least targeted at an idea of discrete criminals. Commercial surveillance is an attack against literally everybody.

What about the crazy idea of nationalizing this? If it's a cartel and very hard to open to competition, and reap the benefits of centralization and not only the disadvantages.

Reply on news.ycombinator.com