Equifax operates as a consumer reporting agency and data analytics company whose privacy statement discloses collection of financial and identifying data from furnishers, collection agencies, and public records, alongside standard web-tracking technologies (cookies, pixels, IP-based profiling) and third-party ad-network sharing disclosed via a CCPA "Do Not Sell" opt-out. Equifax Inc. is a publicly traded, NYSE-listed company (EFX) with a large, SEC-disclosed multinational subsidiary structure, but its regulatory record includes the 2017 breach of approximately 147 million consumers' data and subsequent multi-jurisdictional enforcement actions in the U.S. and U.K.
TRACK RECORD
4 ENFORCEMENT ACTIONS
[2023-10-13]
On October 13, 2023, the UK Financial Conduct Authority fined Equifax Ltd £11,164,400 for failing to properly manage its outsourcing arrangements with its US parent, Equifax Inc., which delayed identification and notification of UK individuals affected by the 2017 breach.
In September 2017, Equifax announced a data breach that the FTC later stated exposed the personal information of approximately 147 million consumers, including names, dates of birth, Social Security numbers, and addresses.
On July 22, 2019, Equifax agreed to a global settlement of at least $575 million (potentially up to $700 million) with the FTC, the CFPB, and 50 U.S. states and territories over allegations it failed to take reasonable steps to secure its network prior to the 2017 breach.
On September 19, 2018, the UK Information Commissioner's Office fined Equifax Limited £500,000, the maximum penalty available under the Data Protection Act 1998, finding the company had breached five of the UK's eight data protection principles and failed to protect the personal data of up to 15 million UK individuals in the 2017 breach.
Receipted federal filings: FEC campaign-finance records and LDA lobbying disclosures. A tie is a disclosed transaction or filing, not a claim of influence or wrongdoing.
EQUIFAX INC reported lobbying activity before the Senate on CSP-coded issues, where the official serves on the Senate Committee on Commerce, Science, and Transportation, per LDA Form LD-2.
EQUIFAX INC reported lobbying activity before the Senate on CSP-coded issues, where the official serves on the Senate Committee on Environment and Public Works, per LDA Form LD-2.
Equifax's Personal Data Management Policy for UK consumer credit reporting activities discloses that the company "collects personal data from various sources, including customers, collection agencies and public records."
Equifax's U.S. developer privacy policy states that certain Equifax affiliates are consumer reporting agencies under the Fair Credit Reporting Act and comply with FCRA requirements regarding the collection, use, and sharing of personal data used in consumer reports.
An Exhibit 21.1 filed with Equifax Inc.'s SEC Form 10-K publicly lists a multi-tiered structure of wholly- and partially-owned subsidiaries across numerous countries, including entities in the Netherlands, Mauritius, India, Luxembourg, the UK, and Russia.
Equifax Inc. is described in its investor relations materials as a Georgia corporation publicly traded on the New York Stock Exchange under the ticker EFX, headquartered in Atlanta with operations or investments in 24 countries.
Equifax's U.S. developer privacy policy includes a CCPA-mandated section providing a "Do Not Sell My Personal Information" opt-out mechanism for California residents, applicable to the sale of personal information as defined under the CCPA.
Equifax's historical U.S. online privacy policy stated that the company may disclose collected information to affiliates as well as to unaffiliated third parties, in addition to the affiliate categories described in the policy.
On September 19, 2018, the UK Information Commissioner's Office fined Equifax Limited £500,000, the maximum penalty available under the Data Protection Act 1998, finding the company had breached five of the UK's eight data protection principles and failed to protect the personal data of up to 15 million UK individuals in the 2017 breach.
On July 22, 2019, Equifax agreed to a global settlement of at least $575 million (potentially up to $700 million) with the FTC, the CFPB, and 50 U.S. states and territories over allegations it failed to take reasonable steps to secure its network prior to the 2017 breach.
In September 2017, Equifax announced a data breach that the FTC later stated exposed the personal information of approximately 147 million consumers, including names, dates of birth, Social Security numbers, and addresses.
On October 13, 2023, the UK Financial Conduct Authority fined Equifax Ltd £11,164,400 for failing to properly manage its outsourcing arrangements with its US parent, Equifax Inc., which delayed identification and notification of UK individuals affected by the 2017 breach.
An Equifax Workforce Solutions website, cookies, and consumer services privacy policy names specific third-party tracking technologies embedded on Equifax sites, including Google Analytics for tracking and reporting website traffic and Google's DoubleClick service for advertising campaigns.
Equifax's developer privacy policy discloses that it uses code on its websites to estimate financial and other attributes of visitors by correlating a visitor's IP address with a geographic location and general financial/economic information for that location.