GAO Calls for Tougher Rules on Consumer Reporting Agencies

The 2017 data breach of Equifax “highlighted the data security risks associated with CRAs,” GAO states in its February report. “While companies in many industries have experienced data breaches, CRAs may present heightened risks because of the scope of sensitive information they possess and because consumers have very limited control over what information CRAs hold and how they protect it. These challenges underscore the importance of appropriate federal oversight of CRAs’ data security.”

There are hundreds of CRAs in the U.S., collecting and selling data used to make decisions like whether to grant credit or employment or whether an applicant qualifies for insurance.

The House Oversight and Reform Subcommittee on Economic and Consumer Policy, chaired by Rep. Raja Krishnamoorthi, D-Ill., is conducting a Tuesday hearing to examine GAO’s recommendations, as well as efforts by the FTC and the CFPB to oversee consumer reporting agencies’ handling of consumer data.

Warren and Chairman Cummings requested a previous GAO report, which was released last August. The reported, which reported specifics on the breach, found that in July 2017, Equifax system administrators discovered that attackers had gained unauthorized access via the Internet to the online dispute portal that maintained documents used to resolve consumer disputes, and that the Equifax breach resulted in the attackers accessing personal information of at least 145.5 million individuals.