Path to Privacy Arriving Just in Time?

When our friends at Golden Frog invited the Digital Privacy Alliance to guest blog, we were watching the Equifax data breach story unfold. Timing, it seems, is still everything. That old cliché feels more true today than ever, with digitally enabled live streaming, on-demand consumption, just-in-time production, and same day delivery.

One of the costs to consumers for all of this digital convenience, however, has been the proliferation of Terms of Service (“ToS”) agreements–whether apparent or hidden–on websites we use every day. ToS are generally dense click-through contracts that, in most cases, condition transactions on waiver of our right to sue in court or join others in doing so. Use of this provision, often called a mandatory arbitration agreement, is top of mind now thanks to the recent Equifax data breach acknowledged publicly on September 8, 2017. This scandal was compounded by the company’s use of an arbitration clause applied to consumers enrolling in the Equifax free credit file monitoring and identity theft protection services. It appeared to many that people seeking to mitigate some of the harm Equifax caused them would first have to give up their rights to later sue individually or join a class of their aggrieved peers.

The problems posed to consumers by arbitration agreements predate the Equifax debacle. Congress directed the Consumer Financial Protection Bureau to study arbitration clauses like the Equifax term in 2010. The CFPB studied the issue for five years, concluded that arbitration agreements harm consumers, and published a rule generally prohibiting financial firms from imposing them. The rule is scheduled to take effect September 18, 2017, just ten days, it turns out, after one of the most notorious examples of arbitration excess. How’s that for timing?

Good timing also punctuates dramatic tension created elsewhere in the narrative. The plot thickens when we know that House Republicans voted in July to repeal the arbitration rule. Now, if 51 Senate Republicans agree, the bureau’s action will be nullified. Meanwhile, on September 11, Equifax issued the following statement on its website under tremendous public backlash:

“Enrolling in the free credit file monitoring and identity theft protection products that we are offering as part of this cybersecurity incident does not prohibit consumers from taking legal action. We have already removed that language from the Terms of Use on the site www.equifaxsecurity2017.com . . .

“Again, to be as clear as possible, we will not apply any arbitration clause or class action waiver against consumers for claims related to the free products offered in response to the cybersecurity incident or for claims related to the cybersecurity incident itself.”

Will this concession defuse the situation? Will it give Senate Republicans sufficient political cover to repeal the CFPB arbitration rule? This is a concern. Notwithstanding the public’s ability to collectively complain and alter outcomes on a case-by-case basis (like this one), the arbitration rule remains important. Why? Because law defines and protects rights in a systematic, substantive way in all cases, not just the most- obvious, outrageous, and tweeted ones. According to an extensive, 3-year Economic Policy Institute investigation, arbitration stacks the deck decisively against consumers:

“While the average consumer who wins a claim in arbitration recovers $5,389, this is not even close to a typical consumer outcome. Why? Consumers obtain relief regarding their claims in only 9 percent of disputes. On the other hand, when companies make claims or counterclaims, arbitrators grant them relief 93 percent of the time—meaning they order the consumer to pay. If you consider both sides of this equation, in arbitration, the average consumer is ordered to pay $7,725 to the bank or lender. That’s right: the average consumer ends up paying financial institutions in arbitration.”

These overwhelming statistics show that consumers rarely find a remedy in arbitration, and they reasonably suggest that arbitration eliminates a deterrent to bad corporate behavior. Tell Congress to let the CFPB arbitration rule stand, especially since the agency is merely finishing what Congress saw fit to start. Indeed, the arbitration rule is a beginning.

Perhaps it marks a larger shift. The Digital Privacy Alliance has strongly supported two pieces of watershed privacy legislation in Illinois that also approach consumer rights through ToS. The Illinois Right to Know Data Transparency and Privacy Protection Act and the Geolocation Privacy Protection Act (awaiting governor’s signature) create mandatory privacy disclosures informing users what sites collect and disclose and integrate them into the Terms of Service. Both bills provide that, “Any agreement that does not comply with the applicable provisions of this Act shall be void and unenforceable.” These bills essentially amend ToS by law in order to provide more consumer protection. The arbitration rule does something similar. Both the DPA and CFPB efforts illustrate that we don’t have to resign ourselves to unfair ToS, and that ToS can provide a path to better privacy and transparency.