So I checked their site and lo and behold I'm in the estimated 44% of Americans affected by this.

Here's my question, how can we, as a massive group, get some type of recourse?

I'm not talking about suing for money necessarily, I don't need it (though if I suffered some financial loss I'd at least like to be made whole).

I don't get it, the only reason identity theft is valuable is because companies like Equifax have inserted themselves into the process.

They've turned what should be public information into information that has so much ability to cause harm to our records (that we may never have asked Equifax to keep on us in the first place) that now we have to fight to protect all this data, when we're not even the ones attempting to put value to it.

So then Equifax offers identity monitoring services at a price. Then they leak most of their data. Then they offer their monitoring services to us, because now they're more needed than ever. So I'm gonna let the drug addled burglar watch the dog for me when I leave town?

You can't really not play the game, but even if you try not to they're still using you as a pawn.

Wouldn't it make sense to treat identity theft as a crime where the lending institution was stolen from? Why couldn't I sue Equifax et al. for libel when they have incorrect records on me that they won't remove in a timely fashion?

Luckily for my I've got a guy that manages my finances to a degree, and part of it is keeping tabs on anything showing up in my credit profile- but now I'm a juicy target because all I did was pay back any money I've ever borrowed in a timely fashion like I said I would?

86% of all US credit card holders (of which there are only 167 million)

"only"

Out of 250 million adults that seems lower than I would of thought.

Many things add up here. 2/3 of millennials don't have a credit card. That's about 52 mil you take away there. Then you have about 3 million Muslims in the US, who depending on religious observance may not be using credit cards. Then you have all of the people whose income is low enough that credit cards aren't even a consideration.

IANAL, but this contract would not seem to be valid because it does not include consideration[1] for the users entering it. Why would you give up your right to sue for a data breach by enrolling for a service to protect yourself from it? That seems like a protection racket.

[1] http://www.nolo.com/legal-encyclopedia/consideration-every-c...

> That seems like a protection racket.

You mean sort of like having to pay a fee to lock your credit report with the same company that just leaked all your info? Yea...

Giving up your right to sue in exchange for Equifax providing you the monitoring service would seem like consideration to me.

Whether the term highlighted in the post is valid or not is another thing. Not sure about the US but in England I would hope that would be considered an unfair contract term in a consumer contract.

Yeah, sorry, IANAL either but that's total BS. The user has consideration in the form of being able to use the service.

For those who are unaware, contract law deals with a process of people exchanging things, usually in the form of promises -- "I will mow your lawn in exchange for $30" is a contract, even if it is never written down. There are a lot of interesting ways that this law works: for example you will see reasonably often something like "I'll give you $30 to mow my lawn" / "Deal!" / "What about $20?", where the one side seems to be assuming that there is no actual contract until they both say "Deal!" -- but actually the law believes that the first person implicitly consented simply by the form of the language of the "offer" above and if the sums were larger this could hypothetically be the sort of thing that a lawsuit begins over.

The "consideration" idea is about this word "exchange" that I started off the last paragraph with, it says that contract law explicitly does not apply with things that are just given away for free. If you say "Hey after I mow my lawn tomorrow I'll mow yours", and your neighbor says "great!", and then something comes up tomorrow so that you have to cut the job short only mowing your lawn and not your neighbor's lawn, the law says that was not a contract and your neighbor cannot sue you to mow their lawn for free. How do we know it wasn't a proper contract where things were exchanged? Because we can see that you don't get anything out of it. But "get anything out of it" might get into very abstract territory: for example if you are known among your neighborhood for collecting the dead grass you've mowed and turning it into expensive compost, and that's the reasonable expectation, that could be consideration. At some point -- possibly presently, I haven't reviewed them for this post -- the Creative Commons licenses said something like "to the extent that this is a contract, the consideration for me is that I'm getting to see my work used by other people who I don't know."

This exception to contract law obviously does not apply to the terms-of-service agreements for paid services. It might hold if you are not notified about the terms of service prior to making the agreement, but US law tends to be a bit lax about the details here and usually says "well if you used the service anyway after you found out about the terms of service then you agreed to be bound by those terms." See the cases on "shrinkwrap licenses" for details.

Note also that most free-software copyright licenses and so forth are simply not contracts; that doesn't mean that they have no legal standing, but just that their legal standing isn't in contract law per se.

What can invalidate a contact though is conscionability.

If the consideration is unconscionable, a court could invalidate it. The classic example is selling a million dollar life preserver to a drowning man. Such a contract would be unconscionable.

In this case, Equifax has thrown us into the water, and is willing to give us the life preserver for free if we're willing to forget that they did it in the first place.

I haven't enrolled, but wouldn't you be able to argue that because their information was leaked you weren't the one who signed up?

This is not only a valid point, but a scary one :/ You can't prove who it was, if you could, then we wouldn't have this mess in the first place.

You waive your rights to sue TrustedID, not Equifax.

Edit: And yes, it's a subsidiary, but you absolutely retain the right to sue the parent company for an event that occurred before you agreed to these ToSes requiring arbitration for disputes with the subsidiary. You just now can't sue TrustedID if they fuck up their credit monitoring.

EDIT 2: Here are the actual terms, not a selective screengrab of a scary-looking bit from Twitter: https://trustedidpremier.com/static/terms

Current headline:

> If you enroll in Equifax's TrustedID you waive your rights to sue Equifax

Is something like that even legally possible in the US? I know in my country it isn't.

A) You can't waive certain rights, even if you say so in a contract.

B) A contract that is general purpose, and not individually compromised by both parties, has even stronger protection. If you can convincably argue that you would not have assumed a clause, it is not valid.

C) Rules defined by laws overwrite contracts. So a law saying you can sue overwrites a term in a contract saying you can't.

Triple protected. Even if the US is more "free" in that regard, some of that protection must exist as well, right?

Yes, it's legal, and increasingly popular for companies to require mandatory arbitration with no way to appeal to the courts, and to require a waiver of class action.

Arbitration started with the idea that there are two equal parties forming a contract, and both have an interest to come to a mutual agreement. This has spread even to consumer contracts.

For an example concerning customers of Well Fargo affected by fraud carried out by Wells Fargo, https://sites.duke.edu/thefinregblog/2016/11/23/how-wells-fa... .

> The scandal at Wells Fargo has placed big banks’ use of forced arbitration clauses under the microscope. When then Wells Fargo CEO John Stumpf testified in front of the Senate Banking Committee shortly after the scandal broke, he was asked by Senator Sherrod Brown (D-Ohio) whether his bank would continue to require customers to take all disputes with the bank to arbitration. Stumpf replied that he was “not an expert in that” and would therefore have to consult with his legal team. Brown made his views on the practice known during his opening remarks at the hearing, stating: “rather than letting fraud victims have their day in court, Wells Fargo forced customers to abide by the mandatory arbitration clauses in their real accounts. You heard that right – the bank invoked the fine print on a real account to block redress on a fake one which it had created.” The use of forced arbitration clauses even made its way to the presidential campaign trail, with Hillary Clinton pledging to “reign in that abuse.”

Your can't waive your right to seek remedy in the event of a breach of contract, but US courts have ruled that clauses requiring mandatory arbitration from a private arbitrator instead of going through the public court system are legal.

Theoretically, it's just as fair to be heard by a neutral third party, but the biggest difference is that if you agree to arbitration, there's no equivalent of a class-action complaint meaning each impacted individual would have to file an arbitration claim separately.

In Brazil, mandatory arbitration is valid only on non consumer contracts.

The title does not match the terms of service to which the tweet links. IOW, no, that's not what it says. But this about the sixth story that's cropped up on HN about waiving your rights, so getting the crowds to wipe the froth from their lips is probably a lost cause.

IANAL, but the document refers to TrustedID, Inc., a subsidiary of Equifax, not Equifax itself. I've seen arbitration clauses in many terms of use before, so I don't get the impression that this is nefarious. Again, IANAL.