To Find the Equifax Culprit, Congress Must Probe Itself

The ongoing Congressional investigation of the Equifax data breach reminds me of a running joke my mother and I had about the old detective series, Murder She Wrote. What if the guilty party all along was the last person we expected, and Jessica Fletcher was really a serial killer who framed random strangers? Except that having our financial information written on a bathroom wall isn't a joke. And, as we shall see, Congress grandstanding about fixing it is a bad one.

Let's consider how the current hearings might instead prevent us from finding out what really happened and how to prevent it from happening again. It may have been fun to hear about the new Equifax CEO admitting that he doesn't know whether his company encrypts our personal information. At least he's being held accountable Gus! you say. But this is a hard problem, which he was only very recently brought in to address. More to the point,Congress effectively made itself the CEO of every credit bureau nearly fifty years ago when it passed the Fair Credit Reporting Act (FCRA).

Let's be kind and ask Congress only three questions about its tenure: (1) Through widespread reports we've known for nearly a decade that social security numbers are easy for criminals to guess. Why are we just now considering alternatives? (2) The U.S. Postal service, as a Cato Journal article pointed out a quarter century ago,is a major cause of credit reporting errors. Their government-granted monopoly on first-class mail remains intact. If this is how you respond to inaccuracies, why should we trust you with our new privacy concerns? (3) And if you consider yourself a "cop on the beat" to protect our reputations and our privacy, why is it that you keep expanding the range of "permissible purposes" for which a credit bureau can share our credit files without our consent under the FCRA? We'll ask a fourth question later, because I am not kind to meddlesome strangers.

Another report, authored by Jim Harper, then of the Cato Institute, noted that after forty years of Congressional oversight, credit reports remained inaccurate and hard to correct. Perhaps the pet regulatory octopus spawned by FCRA is to blame for making this sector generally sclerotic. Harper notes similarities between the credit bureaus and companies in other tightly-regulated industries. (A quick glance at customer reviews of any of the big three credit bureaus will confirm this: They read more like experiences at the DMV than with companies that must compete to survive.) Harper notes a "stagnant market for identity services," — and a thriving one for fraudulent "credit repair services" that game FCRA-mandated dispute processes. Then there's the demise of at least one promising alternative to the big three. Rapleaf, facing the prospect of onerous regulatory costs from being treated as a credit bureau under the FCRA, added language to its terms and conditions cautioning against using its data instead of a credit report. Congress has backed us into a corner with Social Security Numbers and no viable competitors to the likes of Equifax. And yet Congress is all over the new Equifax CEO while saying not a peep about repealing the FCRA.

But that's not all. On top of appointing itself to what it deemed a cushy job, and strangling free market alternatives, Congress hamstrung the legal system with FCRA, by preempting common law solutions to credit reporting disputes. If your bank reported incorrect loan balances, double-reported some loans and incorrectly complained that you had exceeded your credit limit, what legal recourse would you take? A lawsuit over negligence? Too bad. In 2013, the Seventh Circuit confirmed that Suzanne Aleshire could not do this, thanks to FCRA. Case law, as some proponents of FCRA correctly noted, takes time to develop. But FCRA hasdelayed such development for a half century now, while at the same time more than amply demonstrating that a top-down regulatory solution is not a viable alternative.

With Elizabeth Warren comparing bureaucrats to a "cop on the beat," it is hard not to reply, as Mark Calabria of the Cato Institute recently did, that, "It is long past time [they be] subjected to the same constraints and oversight as a 'cop on the beat'." That would be an improvement, but my final question is, "By what right does Congress dictate with whom I do business and how that business runs its own affairs?" Elizabeth Warren should be free to use arbitration to settle credit reporting and privacy disputes if she wishes, but we should be free to hold negligent parties responsible in court.