Consumers attempting to find out if they are among the 143 million people whose personal information has been compromised in the Equifax hack must first sign away some of their legal rights.
Equifax has come under fire for attempting to bind consumers to mandatory arbitration when signing up for the monitoring service – called TrustedID Premier – thereby forcing them to give up their right to join a class-action case.
Equifax, a company that provides credit scores, announced Thursday that its users’ personal information – names, Social Security numbers, birth dates, addresses, credit-card numbers – was compromised in a data breach that occurred between May and July.
Equifax has since added a clause to its terms of service allowing people to opt out of being bound by the arbitration provision, although consumers must notify Equifax by mail within 30 days of enrolling in the monitoring service.
New York Attorney General Eric Schneiderman, who on Friday launched an investigation into the Equifax breach, called the arbitration clause's language "unacceptable and unenforceable."
"My staff has already contacted @Equifax to demand that they remove it," Schneiderman wrote on Twitter.
Sen. Sherrod Brown of Ohio, the ranking Democrat on the Senate's Committee on Banking, Housing, and Urban Affairs, also urged the company to remove its mandatory arbitration clause from its terms of use agreement.
"It's shameful that Equifax would take advantage of victims by forcing people to sign over their rights in order to get credit monitoring services they wouldn't even need if Equifax hadn't put them at risk in the first place," Brown said in a statement.
At least one class-action suit has been filed against Equifax following the data breach.
While it's still unclear whether the arbitration clause applies only to the credit-monitoring service, or whether it could also prevent consumers from suing over the Equifax data breach as a whole, legal experts say the clause is "troublesome" in its broadness.
"If you just look at the terms of the arbitration agreement, there's an argument that it would cover the underlying data breach," Leah Nicholls, a staff attorney at the nonprofit law firm Public Justice, told Business Insider. "If Equifax is serious about this arbitration agreement not applying to its underlying data breach, it should rewrite its arbitration agreement or get rid of it."
Nicholls added that the clause's opt-out provision was likely "just a way for them to try to make themselves look a little better," and will probably do little to protect the legal rights of consumers who are unfamiliar with arbitration clauses, or unaware that the terms-of-service agreement contains one.
"Certainly I encourage everyone to opt out," she said. "But we're definitely not going to be able to reach everyone with that message."
Arbitration clauses have been a hot-button issue in recent months, after the Consumer Financial Protection Bureau moved to ban them entirely over the summer, a rule that won't take effect until later in September and won't affect contracts made before March 19, 2018, according to The Washington Post.
Yet House Republicans have already voted to repeal the ban, prompting renewed criticism on Friday.
"Instead of running to Congress to seek a 'get out of jail free' card to avoid accountability for its reckless handling of consumers' personal and financial information, Equifax and its counterparts in the credit reporting industry should focus on protecting information from identity thieves," Christine Hines, legislative director for the National Association of Consumer Advocates, said in a statement.
