united-states regulations settlement
How do I object to the FTC and Equifax settlement?
<p>The FTC has a press release with some court documents at <a href="https://www.ftc.gov/news-events/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related?utm_source=slider" rel="nofollow noreferrer">Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach</a>. The release includes the link to the document <a href="https://www.ftc.gov/system/files/documents/cases/172_3203_equifax_proposed_order_7-22-19.pdf" rel="nofollow noreferrer">proposed settlement</a>.</p>

<p>My field is data security and I have been studying data breaches for almost 20 years. In fact, I was an early contributor to the <a href="https://blog.datalossdb.org/about/" rel="nofollow noreferrer">DatalaossDB project</a>, which tracked breaches in the early years before they became popular in the press. My observations are lawyers and judges know nearly nothing about data security and identity theft, and they will agree to just about anything. This often leads to unfavorable terms for the victims, and re-victimizes them.</p>

<p>I find some of the terms of the settlement are ambiguous, and some of the terms settlement are obscene. I would like to object to the settlement, and state where some of the gaps are. Some of them are listed below as examples.</p>

<p>The settlement document does not appear to state how to object to the terms or how to offer suggestions for improvement.</p>

<p>How do I object to the FTC and Equifax settlement?</p>

<hr>

<p>The settlement does a good job at securing 10 years of credit monitoring. However, the settlement does not stipulate or require a "detailed report", and consumers will only receive a "summary report" which are the warez credit bureaus hock to consumers. I would like a quarterly detailed report.</p>

<p>As anther example, the selections of monitoring services also lack <a href="https://earlywarning.com/" rel="nofollow noreferrer">Early Warning</a>, which is one of the best fraud detection services available. Early Warning was created by the largest US banks and they share information on consumers in real-time, including anonymous account information (anonymous to avoid poaching of customers). I would like a quarterly detailed report from Early Warning.</p>

<p>As a final example, the traditional credit bureaus maintain VIP databases, which includes actors, politicians, judges, athletes and other influential people. Reports for VIPs are scrubbed for potential inaccuracies and negative entries so actors don't speak out for a cause and politicians don't write unfavorable legislation. I would like the same treatment for life, just like the VIPs.</p>

<hr>

<p>An example of <em>"... lawyers and judges know nearly nothing about data security ..."</em> is on page 15 from the settlement:</p>

<blockquote>
  <p>Implementing protections, such as encryption, tokenization, or other
  at least equivalent protections, for Personal Information collected,
  maintained, processed, or stored by Defendant, including in transit
  and at rest...</p>
</blockquote>

<p>In data security and risk management, we say <em>"complimentary security control"</em>, not <em>"at least equivalent protections"</em>. It is quite painful for me to watch the legal system stumble through the non-legal stuff.</p>

<p>You can either object to the terms of the settlement, or opt out of the settlement <a href="https://www.equifaxbreachsettlement.com/" rel="noreferrer">by filing papers with the appropriate court by the November 19, 2019 deadline</a>. </p>

<p>If you do not do so, you will be bound by the settlement ultimately approved, which is functionally a class action lawsuit, a form of lawsuit that can bind people who don't affirmatively sign up to be a part of it.</p>

<p>You can object by sending a letter to claims adminstrator, jnd or file something with the Court.  If you do object, but the settlement is approved, you are still entitled to what ever choice you made.  So you can take the monitoring or the $$ and still object. It's in the class notice. The link below outlines how to object.  I hope a lot of people object.</p>

<p><a href="https://www.equifaxbreachsettlement.com/" rel="nofollow noreferrer">https://www.equifaxbreachsettlement.com/</a> i</p>
