Financial Reform

This afternoon (Tuesday, 8 December), the U.S. House Financial Services Committee launches a massive attack on state privacy laws. Hidden inside a seemingly modest proposal to establish federal data breach notice requirements is a Trojan Horse provision designed to to take state consumer cops off the privacy beat, completely and forever. That's wrong, because the states have always been key first responders and leaders on privacy threats that Congress has ignored, from credit report accuracy and identity theft to data breaches and do-not-call lists.

Problems with privacy and data security are all over the news these days. We've got you covered, from releasing a new report and consumer tips on the security freeze today to testifying to Congress (last week) on payment card security and speaking on a panel at the FTC tomorrow on Internet lead generation (what's that?). Oh, and we're waiting for answers to our questions to the CFPB about the credit bureau Experian joining the ranks of the breached. We've been busy as we explain in this "roundup" blog entry.

Was it 4 million, 14 million or 18 million records breached (how many times) (likely) by Chinese hackers? Whose fault was it? The USOPM director says no one's. Really? Perhaps the worst data breach ever raises lots of questions, but I haven't heard any good answers. Federal employees, their families, their friends and their neighbors -- because all of them could be victims -- deserve better answers, just as they deserve better service than USOPM's credit monitoring provider is giving them.

Two big consumer stories so far this week offer hope to consumers victimized by credit bureau errors and, more generally, by an inability to take credit bureaus, credit card companies, banks or payday lenders to court when harmed. On Monday, New York's Attorney General Eric Schneiderman signed a groundbreaking agreement with the Big Three credit bureaus, Equifax, Trans Union and Experian. Then today, the CFPB released a report finding that consumer legal rights are infringed by small-print forced arbitration clauses in credit card and other contracts.  The CFPB will hold a webcast public hearing at 11am Eastern time today (Tuesday) to discuss the report's findings and next steps.

As if recent privacy breaches at the online tax preparer Turbotax and the health insurer Anthem weren't enough, it turns out that low-tech hacks can trick the vaunted Apple Pay system into giving up cash to thieves, too. Meanwhile, while the administration's blueprint for a Privacy Bill of Rights in 2012 was excellent, its new legislative draft from the Department of Commerce could have been written by the U.S. Chamber of Commerce. There is some good news on privacy, though.

UPDATED: Opposition to a controversial provision authored by Citibank forced House leaders to delay consideration of the "CRomnibus" appropriations package just hours before funding for the federal government expired at midnight Thursday. Eventually the bill passed narrowly with the Wall Street provision intact. Action now shifts to the Senate, which has a 48-hour window to pass the bill, but any one Senator can block it under Senate rules. The provision would again allow Wall Street banks to place risky bets with taxpayer-backed funds, and require taxpayers to bail them out if the bets fail, repealing a key protection added in the 2010 Wall Street reform law.