In wake of Equifax, Democrats propose severe fines for credit bureau breaches

Democrats in the Senate and House proposed new legislation Tuesday that would impose substantial, mandatory fines for breaches at credit bureaus.

Driving the news: The bill — proposed by Sens. Elizabeth Warren (D-Mass.) and Mark Warner (D-Va.), and Reps. Elijah Cummings (D-Md.) and Raja Krishnamoorthi (D-Il.) — is a response to the massive 2017 Equifax breach. If it was in effect at the time of the breach, the proposed legislation would have fined Equifax at least $1.5 billion, by the lawmakers' tally.

Details: The Data Breach Prevention and Compensation Act would fine credit bureaus $100 for each person with at least one piece of private information stolen in a breach, and $50 for each additional piece.

• The definition of breach appears to be expansive, including any exposure of information to an unauthorized party.
• The bill would additionally open a cybersecurity office in the Federal Trade Commision and require prompt notification of the government of any breach.
• The bill would only apply to companies with revenues of $7 million a year or more, and fines would be limited to 50% of revenue.

Why it matters: Little has been done to impose cost on credit bureaus for cybersecurity negligence since the Equifax breach.

• Credit bureaus are unique: While it's ordinary citizens whose data get compiled by the companies, it's financial services firms — not the citizens — who are the bureaus' customers. Critics believe that means there's little financial incentive outside regulatory oversight for the bureaus to protect data.

The other side: Having credit bureaus may put data at risk, but not having credit bureaus may potentially be worse. Without credit bureaus, there's no quick objective test to determine who should get a mortgage or credit card. In the past, that's made it difficult for poor people and minorities to get those services.