| Attorney General Maura Healey on Monday threw her support behind a bill she said made so much sense, people might have assumed it was already law.
The bill, a suite of consumer data protections and measures dealing with credit reports, was originally filed by Sen. Barbara L’Italien and Rep. Jennifer Benson in January in response to high-profile data breaches at Target and other retailers.
The lawmakers updated the bill with help from Healey, L’Italien said, after Equifax announced this month that the personal information of 143 million people had been jeopardized when criminals accessed the company’s files over a span of several weeks earlier this year.
Under the bill (S 130, H 134), which is scheduled for a committee hearing today, Massachusetts residents would be able to freeze their credits reports for free, and their credit reports and scores could not be used or accessed without their consent.
“From now on, if companies want access to your credit report or your credit score, they’re going to need to get your permission first,” Healey, whose office is charged with serving as an advocate for Massachusetts residents on consumer protection issues, said at a State House press conference. “If it sounds like this should have been the law all along, you’re right. It should have been the law all along. The truth is, this system definitely needs reforms. It needed reforms even before this latest hack … came to light, but right now this is a major step we can and must take to protect Massachusetts residents.”
The bill also would also require the encryption of credit report data and allow consumers to receive additional copies of their credit reports after a data breach. If a credit reporting agency were the target of the breach, it would have to provide five years of free credit reporting to all affected consumers.
Equifax announced on Sept. 7 that criminals had accessed files including the names, Social Security numbers, birth dates and addresses, and in some cases credit card numbers, driver’s license numbers and other personal information.
The company is now offering free identity theft protection and credit file monitoring, and will waive fees for placing and removing credit freezes through Nov. 21. Equifax is still investigating what it describes as a “cybersecurity incident” and said last week its chief information officer and chief security officer would retire.
Healey, who is suing Equifax over the breach, said the attack was “absolutely preventable.”
Asked if consumers should enter their Social Security numbers into Equifax’s website to see if their information is at risk and enroll in the company’s monitoring program, Healey described doing so as an individual decision.
“To be honest, as somebody who has been on with all three credit reporting agencies over the past week, finding myself frustrated with all the differences in navigating various websites, I think that my recommendation to people is as follows. First of all, everybody’s in a different position,” she said. “As I say, if you’re in the process of trying to [refinance] or get a car loan or get a student loan, think it through, talk to somebody about whether or not that makes sense for you right now, but I think what is important is that people take the opportunity right now to check out their credit report.”
Healey plans to testify in favor of the bill on Tuesday, when it is among two dozen bills on the agenda for a Consumer Protection and Professional Licensure Committee hearing at 1 p.m. L’Italien, an Andover Democrat, chairs the committee with Quincy Rep. Tackey Chan.
L’Italien said she hopes to see quick action on her bill because the Equifax breach gave it a new urgency.
“This is really the mother of all breaches, because this is the reporting agency that really should have been the keeper of the vault,” she said. “This information should absolutely have been paid attention to. There should never have been an opportunity by not updating a piece of software for this to happen.”
