After Equifax revealed earlier this year that it had been the victim of a data breach that exposed the personal information of 145.5 million U.S. consumers, the state of New York began moving to increase its oversight of credit reporting agencies.
Under the newly proposed rules, Equifax and other credit reporting agencies would have to register with state’s financial regulator, the New York Department of Financial Services, and be subject to NYDFS oversight.
But those new rules don’t go far enough, according to New York Gov. Andrew Cuomo. So, Cuomo is immediately enacting new rules for credit reporting agencies that will bring additional consumer protections.
Cuomo’s office announced Tuesday that Cuomo directed the New York Department of State to issue new regulations, which hold credit reporting agencies “accountable to the public.”
The regulations, where were adopted on an emergency basis and became effective immediately, require credit reporting agencies to respond within 10 days to requests made by the Department of State's Division of Consumer Protection on behalf of consumers.
The new rules also require credit reporting agencies to file with the state’s Division of Consumer Protection, and require the agencies to “plainly disclose to consumers all fees associated with the purchase or use of products and services marketed as identity theft protection products, including when those products are originally offered for ‘free.’”
According to details provided by Cuomo’s office, the new rules also:
- Require consumer credit reporting agencies to identify dedicated points of contact for the Division of Consumer Protection so the Division can obtain vital information necessary to assist New York consumers
- Require a timely response—within 10 days—by consumer credit reporting agencies to information requests made on behalf of consumers by the Division of Consumer Protection
- Require consumer credit reporting agencies to file with the Division of Consumer Protection a list and description of all business affiliations and contractual relationships they have with companies marketing credit monitoring and related products
“Consumer credit reporting agencies have a duty to deal fairly and honestly with all consumers, and here in New York, we will ensure the best protections are available to any victim of deceit,” Cuomo said in a statement. “The current status quo of allowing consumers to be penalized for having their data breached is unacceptable, and with the addition of these new protections, this administration will hold agencies accountable and help protect New Yorkers and their financial future.”
According to Cuomo’s office, the state’s Division of Consumer Protection also plans to issue a demand letter to Equifax for “vital information necessary to help the Division properly assess the damage and risk of identity theft to New York State consumers” as a result of the breach.
“We take very seriously our role to protect consumers from economic harm. The Department of State, Division of Consumer Protection will work tirelessly on behalf of affected New Yorkers to ensure they have the information they need to make informed choices about how to prevent identity theft resulting from this data breach,” New York Secretary of State Rossana Rosado said.
“These regulations also put in place a common-sense framework to help ensure consumers have access to timely assistance in the event of future breaches,” Rosado added.
