02 October 2018

Equifax breach of the Australian Consumer Law

Global credit referencing giant Equifax was cavalier about preventing and responding to a major data breach  last year- a mere 145 million or so people. With an estimated 85% market share of Australia's  consumer credit reporting market we might, naively, expect it to embody best practice and attract a higher level of regulatory scrutiny than a local minnow.

 It is in the news again, with the ACCC noting that the Federal Court, following joint submissions by Equifax and the ACCC, has ordered that Equifax Australia Information Services and Solutions Pty Ltd (Equifax's Australian arm) pay penalties totalling $3.5 million for misleading and deceptive conduct and unconscionable conduct in relation to credit report services.

The Court has ordered, by consent, that Equifax contribute $100,000 towards the ACCC’s legal costs.

The ACCC states
 Equifax admitted it breached the Australian Consumer Law (ACL) in 2016 and 2017, when its representatives made false or misleading representations to consumers during phone calls. 
Equifax told consumers that its paid credit reports were more comprehensive than free reports it had to provide under the law, when in fact they contained the same information. 
“Equifax’s conduct caused people to buy credit reporting services in situations when they did not have to. Consumers have the legal right to obtain a free credit report under the law,” ACCC Commissioner Sarah Court said. 
Equifax also admitted it told consumers they would be charged a single ‘one-off’ or ‘one-time’ payment, but failed to disclose that payments for its paid credit report packages would automatically renew unless consumers opted out. 
“We considered it unacceptable that consumers were denied the knowledge and proper opportunity to opt out of recurring charges from Equifax,” Ms Court said. 
Equifax also told consumers that the credit score provided in its paid credit reports was the same credit score used by credit providers when that was not always the case. 
In respect of three vulnerable consumers, Equifax also admitted that it acted unconscionably by using unfair sales tactics and making misleading representations during telephone calls. 
“It is appalling that Equifax used unfair sales tactics on consumers who were vulnerable,” Ms Court said. 
“Consumers have a right to receive accurate information from credit reporting companies when they seek advice or services.” 
“This result sends a strong message to businesses that making misrepresentations and acting unconscionably against consumers will not be tolerated,” Ms Court said. 
The court also ordered, by consent, that Equifax establish a consumer redress scheme which will allow affected consumers to seek refunds for a 180 day period.
The penalties ordered were based on admissions made by Equifax and joint submissions on penalty made by Equifax and the ACCC. 
Action by the ACCC was noted in March this year.

The Privacy Act 1988 (Cth) provides that consumers are entitled to access their credit reporting information for free once a year, or if they have applied for, and been refused, credit within the past 90 days, or where the request for access relates to a decision by a credit reporting body or a credit provider to correct information included in the credit report.