Two months ago, shortly after news of a massive data breach at the credit monitoring agency Equifax, state Representative Randy Hunt asked his colleagues to act quickly, saying he hoped to vote on a related bill before lawmakers took their Thanksgiving break.
It didn’t happen.
Equifax disclosed in September that criminals had gained access to their files for a several-week period earlier in the year. The company originally reported that the personal information of 143 million people had been potentially exposed, and later updated that total to 145.5 million.
In response, Attorney General Maura Healey and Senator Barbara L’Italien teamed up to tout legislation that would require the encryption of credit report data and allow Massachusetts residents to freeze or unfreeze their credit reports for free. Security freezes restrict access to credit reports, so that new accounts cannot be opened.
“We need to set about passing this bill and passing it soon,” L’Italien said at the Sept. 26 hearing on her bill, which has also been filed in the House by Representative Jennifer Benson.
Despite widespread outrage over the Equifax breach, the legislation remains before the Consumer Protection and Professional Licensure Committee, which is chaired by L’Italien and Representative Tackey Chan.
Chan said in a recent interview that the committee is still studying the bill and “trying to figure out how it will actually work.”
“We’re getting a crash course in data security,” the Quincy Democrat said.
He said the panel is looking beyond just credit freezes to other tools that are available to consumers, how businesses request and access credit information, the experiences of people who have frozen their credit, and other situations where personal and financial data can be put at risk.
Chan has some personal experience with the issue — he said the credit card he uses when he travels overseas has been closed and reissued five times because of fraudulent activity, and his tax forms were compromised in a breach at SAG-AFTRA, the actors’ union of which he is a member.
“We’re looking at the whole picture from the beginning to the end, size-wise, because while there’s enormous focus on Equifax, we shouldn’t ignore so many other types of data collection theft, whether it be just stealing a magnetic card strip or getting my W-2s at SAG-AFTRA or as simple as somebody not properly disposing of paper materials,” Chan said. He said, “The focus is Equifax, but I don’t want to ignore everybody else.”
After announcing the breach, Equifax set up a website where consumers could check if they may have been affected and receive information about how to lock or freeze their Equifax credit report. The company is waiving the fee for freezes through January 31, 2018.
Consumers who wish to freeze their reports with Experian and TransUnion, the other two credit agencies, would still be subject to regular fees, which vary by state.
Experian, which does not charge identity theft victims for credit freezes, said the cost in Massachusetts is $5 to place a freeze and another $5 to lift it.
Hunt, who is also a certified public accountant, said he has advised many people to freeze their accounts and believes legislation to lift the fees is “as urgent today as it was the day I was testifying.”
“It sincerely bothers me that people are paying $5 to turn on a freeze,” Hunt said. “If you had just a small percentage of the people whose records were absconded, just 10 million of those people having to pay those same organizations like Equifax five bucks to flip on and off that freeze is $50 million every time that happens. It’s free money and it’s outrageous.”