Equifax’s handling of its recent data breach has drawn significant criticism, and for good reason. Some of the criticism was aimed at three executives who dumped 1.8 million dollars’ worth of stock before Equifax publicly disclosed the breach. Equifax seems to be in the most hot water over its attempt to force harmed consumers to agree to arbitrate claims arising out of the security breach by sneaking it into the website that provided consumers with an answer to whether or not their personally identifiable information was compromised and when they signed up for credit monitoring.
Mandatory arbitration forces parties to the underlying agreement to resolve disputes privately with a third-party arbitrator, rather than in court with a judge or jury. Proponents applaud the benefits of arbitration as less costly and more procedurally flexible. Critics argue though that arbitration unduly benefits the party with more bargaining power, and therefore should not be enforced.
The party with the bargaining power in this case is Equifax. Equifax used their bargaining power to try to avoid litigation over the data breach. Initially following the disclosure of the breach, Equifax offered free credit monitoring to those affected for a year via TrustedID Premier. However, those who accepted the offer would have to give up their right to sue because of the arbitration clause. This caused massive outrage and Equifax has since rescinded their original position and released this statement.
While arbitration clauses are very common in employment and consumer contracts for example, Equifax in this case seemed to be taking even more advantage of the situation by initially including an arbitration provision in the credit-monitoring agreement that was offered (and has to be offered under Connecticut law in security breaches) to consumers. That seemed a little too slimy to consumers, like hitting a person when he is down. This article provides some good information on this issue, but seems a little proconsumer. We’ve written about arbitration before, here. Senator Al Franken is a staunch opponent of arbitration and was widely acknowledged for his fight on behalf of Jamie Leigh Jones who was forced to arbitrate sexual assault claims against her employer which happened to be a defense contractor. The battle led to a federal law that basically requires defense contractors to exclude certain claims from arbitration or lose federal funding.
The Equifax debacle not only raises the question of general enforceability of arbitration agreements, but also the validity of clicking "yes, I agree" or checking off a box or radio button as legal acceptance of terms and conditions. How many times have we all done that? Hundreds probably, with all the websites we visit. One company, a professional employer organization (which manage HR and payroll functions for businesses) requires assent to arbitration in order to access your payroll information if you are an employee of one of its customers. Who reads that stuff anyway? Even if you don't read it, you "manifest your assent" after being given an opportunity to review the terms and conditions. The basic rule is the company asking you on line to agree to arbitrate disputes must give you "sufficient notice" of the arbitration provision. A 2012 case from the Second Circuit Court of Appeals (which covers Connecticut) is a seminal case on the issue. Two people had made purchases on Priceline and another website, and as part of the purchase confirmation process were led to a promotion to sign up for membership to another unrelated site. Because this type of agreement to terms and conditions is "passive," (meaning just clicking something and not negotiating the term) the person accepting the term, not the one offering it, must be on either actual notice or inquiry notice of the term. "Inquiry notice" means basically you've got enough information that you better inquire further what this whole deal entails, e.g., arbitration. Actual notice is when you see the terms and conditions or have a chance to read them right then and there. The court said the consumers were not bound by the arbitration provision even though it was emailed to them immediately after the transaction. You see the email didn't alert them to the fact it contained terms and conditions to a "contract" they had just entered into. The company also had a hyperlink before enrollment that contained the actual arbitration clause. But their lawyers didn't argue for some reason that the hyperlink created actual notice of the clause, if they had, they probably would've won.
I wouldn’t be surprised if this Equifax arbitration scandal leads some congressman to propose arbitration legislation. After all, like the GEICO commercials, it’s what they do.
What businesses should do, however, is review their terms and conditions, and also review their online order confirmation process if you ask customers to agree to terms and conditions (which you should!). Your process might need some tweaks.