Complain about a product or service

Credit Bureaus Adopt Unified "Data Protection" Standard

By Martin H. Bosworth
ConsumerAffairs.com

October 7, 2005
The three major credit agencies have been trumpeting a new "data protection standard" that they say is designed to ensure the safety of consumer information transmitted from lenders and "data furnishers," such as banks and utility providers, to the credit bureaus.

Data Theft • Bank Data Breach Threatens 248,000 in North Carolina • GPS Not Foolproof • Countrywide Warns Millions of Data Breach • Thieves Steal AT&T Laptop with Employee Data • Report: Data Breach Disclosure Laws Don't Affect Identity Theft • Patient Information Exposed in Data Breach at Walter Reed • Supermarket Chain Reports Data Breach • Report: Feds Still Not Doing Enough To Secure Data • Data Thieves Hit Georgetown University Students, Faculty • 800,000 Job Seekers At Risk In Gap Data Breach • TJX Data Breach Settlement Has Strings Attached • More ...

But what Equifax, Experian, and Trans Union haven't talked about in their press releases is the problem of inaccurate information in their databases.

Protecting data transmission between agencies means nothing if the data itself is inaccurate. Credit bureaus are often the biggest threat to a customer's identity, due to inconsistent data reporting, sloppy verification procedures, and difficulties in resolving disputed data.

In a joint press statement, the credit agencies said they "established an ongoing encryption task force to ensure the adopted standards reflect the continuing progress of technologies and methods." The move was hailed by Stuart Pratt, president of the Consumer Data Industry Association (CDIA), as an "important step for the credit reporting industry."

"These standards address the goals being advanced by the credit reporting industry of encryption use by all data furnishers and make the implementation of encryption a single straight-forward choice for all – from the largest financial institutions to the smallest market lenders," Pratt said.

The new data protection standard would employ 128-bit encryption "at a minimum" and several types of encrypted algorithms for ensuring safe data transmission.

Donald Girard, vice president of public affairs for Experian, calls the move necessary to preserve and protect consumer data.

"We are a giant warehouse of credit information…we have 215 million people on file. If you have credit, we have a file on you," he said.

"Thieves can steal peoples' identities, create new credit obligations, and leave people stuck with the default as a result. [Identity] thieves are growing bolder these days, and intercepting information transactions from data furnishers to the credit bureaus," Girard said in a ConsumerAffairs.com interview.

The CDIA is responsible for "E-OSCAR," the online application that processes credit report and information disputes.

All three major credit reporting agencies use E-OSCAR for their reporting needs. The online dispute system has come under fire for enabling complex disputes to be reduced to simple two-digit codes that do not explain any of the extenuating circumstances.

Furthermore, consumers are regularly told that credit bureaus do not communicate with each other, so the burden of fixing mistakes in a report is on the consumer or the provider of the data. Girard said that the bureaus are designed to compete by law.

"Each of us is different…we have slightly different credit scoring algorithms, different files, and so on," he said.

Girard stated that the credit bureaus do allow victims of fraud to contact one bureau, which will then transfer the fraud alert to the other two. But the responsibility of accuracy remains with the data providers themselves.

Disaster Victims

The need for improved communication and reporting between credit bureaus and furnishers is especially essential in the wake of Hurricanes Katrina and Rita.

Victims of the disaster will desperately require access to their old credit reports and scores in order to avoid higher financial and economic penalties from missed payments, which will lower their credit scores.

Experian and Equifax both flatly declined a request from several consumer groups to report hurricane victims' pre-disaster credit scores. Trans Union has yet to respond.

If the three major bureaus began sharing consumer data on a larger basis, Girard said there might be legal complications. Asked if the data protection standard could be employed to share the data, he said he was "unsure."

The compartmentalized, blame-shifting response of the credit bureaus infuriates many consumers.

As one comment on CNET's message board put it, "Why is it legal for the bureaus to report inaccurate information on a credit report? After all, the information is inaccurate and could cost you your livelihood, to include, a job, a car, a place to live. Who are they, what are they doing and who is going to step in and fix this?"

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Back to the top |