‘Equifax bill’ to aid consumers after a data breach advances in yet another state

The Oregon House of Representatives passed a bill Thursday that would provide new protections for consumers who have had their information stolen in incidents like the 2017 data breach of credit reporting agency Equifax that affected more than 145 million Americans.

The bill awaits the signature of Gov. Kate Brown, a Democrat, after a 58-1 vote through the House and unanimous passage through the Senate. Senate Bill 1551 would require companies to notify consumers within 45 days after discovering a data breach and also prohibit companies from charging for a credit freeze, also called a security freeze, for protecting against possible identity theft.

Earlier in the year, Democratic Rep. Paul Holvey, one of the bill’s sponsors, remarked that identity theft has “ruined peoples’ lives” — the kind of refrain common in the other state legislatures that have taken similar action.

“Let’s hope that this bill will help these sorts of issues from devastating consumers in the future, especially in Oregon, as we know this is a very difficult thing for consumers to deal with that can be time-consuming and sometimes expensive,” Holvey said Thursday.

The Equifax breach affected Americans across the country and released into the hands of attackers 1.7 million Social Security number of Oregon state residents, according to the Department of Justice. The breach prompted several class-action lawsuits, including one filed in a federal court in Oregon.

“Equifax knew and should have known that failure to maintain adequate technological safeguards would eventually result in a massive data breach,” the lawsuit reads. “Equifax could have and should have substantially increased the amount of money it spent to protect against cyber-attacks but chose not to.”

That Equifax and other credit reporting agencies were profiting from the incident as millions of Americans rushed to freeze their credit and secure their personal information soon became a major point of contention. Equifax offered free credit monitoring services to affected consumers but consumers that accepted the offer also submitted to a clause waiving the right to participate in a lawsuit connected to the breach.

If made law, Oregon would join Indiana, Maine, North Carolina and South Carolina, all states that allow residents affected by breaches to freeze and unfreeze credit and personal information without charge. Colorado, Maryland, New Jersey and New York allow residents to freeze their credit for free, but they may still be charged for removing the freeze, according to Consumers Union.