The Washington PostDemocracy Dies in Darkness

Opinion Virginia elected officials are pondering a response to the Equifax data breach

Credit reporting company Equifax’s  corporate offices in Atlanta. (Tami Chappell/Reuters)
Placeholder while article actions load

The Equifax data breach may have put the sensitive data of 143 million Americans, including more than 4 million Virginians, in jeopardy.

The breach was so big and the data stolen so sensitive (with more potential thefts being exposed nearly every day) that security and identity theft experts recommend consumers put freezes on their credit reports with the our main credit agencies.

The ability to freeze one’s credit is controlled by state law. Virginia’s law, adopted in 2008 in the wake of an earlier breach, allows residents to freeze and unfreeze their credit whenever they wish.

The catch is it costs $10 to institute a freeze at each of the credit reporting agencies. Those who are identity theft victims, and have a police report to back it up, can avoid the fee.

There are also certain exemptions built into the law. State and local agencies, law enforcement, courts and private debt collectors armed with a court order can still gain access to your credit report.

So, too, can any entity with which you have an existing relationship – for a home loan or a credit card, for example.

Also given a pass: “Any employer in connection with any application for employment with the employer.”

I asked Del. Kathy Byron, the chief patron of Virginia’s credit freeze law, about the fee, and the exemptions to it.

In a written statement, Byron said the law was passed as part of  “our effort to combat identity theft, which was emerging as a crime at that time.”

The bill easily passed the General Assembly and was signed by then-Gov. Tim Kaine (D).

But, Byron noted, lawmakers didn’t intend the law to be a cure-all for data breaches like the one that hit Equifax.

The law, she said, “was structured to fight against that crime and not as a remedy for wholesale data breaches.”

Byron said the exemptions placed in the law were “determined for practical reasons.”

“Law enforcement and state agencies sometimes need access to the information for investigations or to determine eligibility for state benefits.  The exemptions for landlords and employers were also for practical reasons, as such inquiries are standard in obtaining housing and employment.”

Regarding the $10 fee, Byron said it “was determined as a minimum compensation for the reporting agency’s action in having to respond to the consumer request.”

With the credit bureaus facing a crush of requests for credit freezes, they stand to make quite a bit of money from Equifax’s security blunders.

Byron said she “would expect a firm like Equifax to waive the fee under the circumstances, as the breach is ultimately their responsibility.”

Asked whether the General Assembly might review the state’s credit freeze law in the next session, Byron said, “incidents of this magnitude usually bring further attention to a review of current policies.

However, she said she is “not aware of any at the moment.”

Some states are taking a very pro-active approach to dealing with the Equifax breach. Massachusetts attorney general Maura Healey announced she was suing the company “over its failure to protect sensitive and personal information of up to nearly three million Massachusetts residents. “

I asked Virginia attorney general Mark Herring’s office whether it intended to follow Massachusetts in taking Equifax to court.

Herring press secretary Lara Sisselman told me, “we generally do not comment on any pending investigation, including whether to confirm if one exists or not, nor on potential litigation.”

Sisselman said “AG Herring did work with his fellow state AGs to clarify Equifax’s arbitration clause on its website and will continue to work with them to address the breach.”

And since it’s an election year, I reached out to Herring’s Republican challenger, John Adams, for comment to see if the credit breach was on his agenda and what he might do with the case were he to win in November.

Adams press spokesman Taylor Thornley Keeney said that former federal prosecutor Adams, “will protect Virginians by leading a highly effective team of lawyers that will prosecute those who break the law and harm consumers.”

“Under John’s watch, Virginia will be very inhospitable to those companies and individuals who attempt to harm our citizens.”

Which is another way of saying he won’t comment on whether he would sue Equifax.

Until the lawyers and lawmakers figure out how to respond, however, consider putting a freeze on your credit – even if it does set you back $10.