The  breach compromised the personally identifiable information of at least  145.5 million individuals, and included names, addresses, and birth dates;  and credit card, driver’s license, and Social Security numbers. Specifically, under GLBA,  these federal regulators are directed to establish appropriate standards  for financial institutions under their jurisdiction to ensure the security and  confidentiality of customer records and information; protect against any  anticipated threats or hazards to the security or integrity of such records;  and protect against unauthorized access to or use of such records or  information that could result in substantial harm or inconvenience to any  customer. According to FTC, in the last 10 years, it has  brought 34 enforcement actions for FCRA violations, including 17 against  CRAs. FTC does not have civil penalty  authority for initial violations of the FTC Act but may obtain civil penalties  from companies for violations of FTC Act orders. However,  determining the appropriate amount of consumer compensation requires  FTC to identify the consumers affected and the amount of monetary harm  they suffered. According to CFPB staff,  CFPB cannot enforce data security standards under these statutory  provisions or the FTC’s implementing rules because CFPB does not have  authority to supervise for or enforce compliance with the GLBA’s  safeguards provision or FCRA’s red flags or records disposal  provisions. Since 2015, CFPB has had five public settlements with CRAs. Four of  these settlements included alleged violations of FCRA and three included  alleged violations of unfair, deceptive, or abusive practices provisions. CFPB supervises the larger market participant CRAs (those with more  than $7 million in annual receipts from consumer reporting, as defined by  CFPB) and has the authority to examine these CRAs for compliance with  federal consumer financial protection laws. Identifying additional sources of information on the population of larger  market participant CRAs—including those that are lesser-known, possibly  unknown to CFPB, and possibly in possession of large amounts of  sensitive consumer information—could help ensure that CFPB has more  comprehensive information for carrying out its supervisory  responsibilities. After the Equifax  breach, however, CFPB used its existing supervisory authority to develop  internal guidelines for examining data security, and conduct some CRA  data security examinations. In light of the Equifax  breach, as well as CFPB’s acknowledgment of the CRA market as a  higher-risk market for consumers, it is important for CFPB to routinely  consider factors that could inform the extent of CRA data security risk  such as the number of consumers that could be affected by a data  security incident and the nature of potential harm resulting from the loss  or exposure of information. By  including routine consideration of data security risks into its process for  prioritizing CRA examinations, CFPB can better ensure that its  supervision of CRAs proactively detects such risks and helps prevent the  further exposure or compromise of consumer information. Consumers whose data have been compromised in any data breach can  file a complaint with FTC or CFPB. However, consumers are limited in the direct actions they can take  against a CRA in the event of a data breach, for two primary reasons. As a result, it can be  difficult to link a breach by a CRA (or any other entity) to the harm a  consumer suffers from a particular incidence of identity theft, which may  make it challenging to prevail in a legal action. Second, unlike with many  other products and services, consumers generally cannot exercise choice  if they are dissatisfied with a CRA’s privacy or security practices. Specifically, consumers cannot choose which CRAs maintain information  about them. In addition, consumers do not have a legal right to delete  their records with CRAs, according to CFPB staff, and therefore cannot  choose to remove themselves entirely from the CRA market. These challenges underscore the importance of  appropriate federal oversight of CRAs’ data security. Using additional methods to obtain information,  such as requiring larger market participant CRAs to register with the  agency or leveraging state registration information, would help CFPB  ensure it is tracking all CRAs under its supervision and is providing  appropriate oversight. Matter for Congressional Consideration

Congress should consider providing the Federal Trade Commission with  civil penalty authority for the privacy and safeguarding provisions of the  Gramm-Leach-Bliley Act to help ensure that the agency has the tools it  needs to most effectively act against data privacy and security violations. CFPB neither agreed nor disagreed with our recommendations. Appendix I: Objectives, Scope, and Methodology

Our objectives were to examine (1) the federal laws and regulations  governing consumer reporting agencies’ (CRA) collection, use, and  protection of consumer information; (2) measures the Federal Trade  Commission (FTC) has taken to enforce CRA compliance with  requirements to protect consumer information; (3) measures the  Consumer Financial Protection Bureau(CFPB) has taken to ensure that  CRAs protect consumer information; and (4) FTC’s and CFPB’s roles in  assisting consumers following a data breach and actions consumers can  take following a data breach of a CRA.
Why GAO Did This Study

CRAs collect, maintain, and sell to third parties large amounts of sensitive data about consumers, including Social Security numbers and credit card numbers. Businesses and other entities commonly use these data to determine eligibility for credit, employment, and insurance. In 2017, Equifax, one of the largest CRAs, experienced a breach that compromised the records of at least 145.5 million consumers.
GAO was asked to examine issues related to federal oversight of CRAs. Among other things, this report discusses (1) measures FTC has taken to enforce CRA compliance with requirements to protect consumer information, (2) measures CFPB has taken to ensure CRA protection of consumer information, and (3) actions consumers can take after a breach. GAO reviewed relevant laws, documentation related to CRA examinations, and policies and practices of selected CRAs; and interviewed representatives of regulatory agencies, CRAs, consumer and industry groups, and Attorneys General from four states with consumer reporting requirements.

What GAO Found

Since 2008, the Federal Trade Commission (FTC) has settled 34 enforcement actions against various entities related to consumer reporting violations of the Fair Credit Reporting Act (FCRA), including 17 actions against consumer reporting agencies (CRA). Some of these settlements included civil penalties—fines for wrongdoing that do not require proof of harm—for FCRA violations or violations of consent orders. However, FTC does not have civil penalty authority for violations of requirements under the Gramm-Leach-Bliley Act (GLBA), which, unlike FCRA, includes a provision directing federal regulators and FTC to establish standards for financial institutions to protect against any anticipated threats or hazards to the security of customer records. To obtain monetary redress for these violations, FTC must identify affected consumers and any monetary harm they may have experienced. However, harm resulting from privacy and security violations can be difficult to measure and can occur years in the future, making it difficult to trace a particular harm to a specific breach. As a result, FTC lacks a practical enforcement tool for imposing civil money penalties that could help to deter companies, including CRAs, from violating data security provisions of GLBA and its implementing regulations.
Since 2015, the Consumer Financial Protection Bureau (CFPB) has had five public settlements with CRAs. Four of these settlements included alleged violations of FCRA; and three included alleged violations of unfair, deceptive, or abusive practices provisions. CFPB is also responsible for supervising larger CRAs (those with more than $7 million in annual receipts from consumer reporting) but lacks the data needed to ensure identification of all CRAs that meet this threshold. Identifying additional sources of information on these CRAs, such as by requiring them to register with the agency through a rulemaking or leveraging state registration information, could help CFPB ensure that it can comprehensively carry out its supervisory responsibilities. According to CFPB staff, the bureau does not have authority to examine for or enforce the GLBA’s safeguards provisions. After the Equifax breach, however, CFPB used its existing supervisory authority to examine the data security of certain CRAs. CFPB’s process for prioritizing which CRAs to examine does not routinely include an assessment of companies’ data security risks, but doing so could help CFPB better detect such risks and prevent the further exposure or compromise of consumer information.
If a CRA experiences a data breach, affected consumers can take actions to mitigate the risk of identity theft—such as implementing a fraud alert or credit freeze—and can file a complaint with FTC or CFPB. However, consumers are limited in the direct actions they can take against the CRA. Consumers generally cannot exercise choice in the consumer reporting market—such as by choosing which CRAs maintain their information—if they are dissatisfied with a CRA’s privacy or security practices. In addition, according to CFPB, consumers cannot remove themselves from the consumer reporting market entirely because they do not have a legal right to delete their records with CRAs. This limited control by consumers, coupled with the large amount and sensitive nature of the information CRAs possess, underscores the importance of appropriate federal oversight of CRAs’ data security.

What GAO Recommends

GAO recommends that Congress consider giving FTC civil penalty authority to enforce GLBA’s safeguarding provisions. GAO also recommends that CFPB (1) identify additional sources of information on larger CRAs, and (2) reassess its prioritization of examinations to address CRA data security. CFPB neither agreed nor disagreed with GAO’s recommendations.