The FTC has a press release with some court documents at Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach. The release includes the link to the document proposed settlement.

My field is data security and I have been studying data breaches for almost 20 years. In fact, I was an early contributor to the DatalaossDB project, which tracked breaches in the early years before they became popular in the press. My observations are lawyers and judges know nearly nothing about data security and identity theft, and they will agree to just about anything. This often leads to unfavorable terms for the victims, and re-victimizes them.

I find some of the terms of the settlement are ambiguous, and some of the terms settlement are obscene. I would like to object to the settlement, and state where some of the gaps are. Some of them are listed below as examples.

The settlement document does not appear to state how to object to the terms or how to offer suggestions for improvement.

How do I object to the FTC and Equifax settlement?

The settlement does a good job at securing 10 years of credit monitoring. However, the settlement does not stipulate or require a "detailed report", and consumers will only receive a "summary report" which are the warez credit bureaus hock to consumers. I would like a quarterly detailed report.

As anther example, the selections of monitoring services also lack Early Warning, which is one of the best fraud detection services available. Early Warning was created by the largest US banks and they share information on consumers in real-time, including anonymous account information (anonymous to avoid poaching of customers). I would like a quarterly detailed report from Early Warning.

As a final example, the traditional credit bureaus maintain VIP databases, which includes actors, politicians, judges, athletes and other influential people. Reports for VIPs are scrubbed for potential inaccuracies and negative entries so actors don't speak out for a cause and politicians don't write unfavorable legislation. I would like the same treatment for life, just like the VIPs.

An example of "... lawyers and judges know nearly nothing about data security ..." is on page 15 from the settlement:

Implementing protections, such as encryption, tokenization, or other at least equivalent protections, for Personal Information collected, maintained, processed, or stored by Defendant, including in transit and at rest...

In data security and risk management, we say "complimentary security control", not "at least equivalent protections". It is quite painful for me to watch the legal system stumble through the non-legal stuff.

  • 1
    Close voter: I disagree with your "Questions that clearly ask for specific legal advice are off-topic" reasoning. This is a matter of policies and procedures provided by law. This is not a matter of opinion or advice.
    – jww
    Jul 24, 2019 at 5:29
  • 2
    Does the proposed settlement document state anywhere that the settlement is contestable? I assume you're going to have to file to contest it. Are you party to the settlement? What are your bases to contest? Your expertise? Other expert witnesses? Jul 24, 2019 at 5:37
  • Thanks @BlueDog. I don't see any statements in the settlement about submitting objections or contesting the settlement. I also don't see any statements forbidding them. It is more like the authors omitted the details of submitting objections or contesting the settlement to get it pushed through with least resistance.
    – jww
    Jul 24, 2019 at 6:15
  • 1
    The default position is not "random uninvolved parties are free to submit objections", so I don't know why you would think their settlement needs to call it out. This case is between the FTC and Equifax. They don't care how you or anyone else feels about it. Jul 24, 2019 at 19:14
  • 1
    @jww: "I even claim every US citizen should be included because each citizen has to pay the $1.5 to $2.0 billion to fund the Stolen Identity Refund Fraud double payments." Not so. The US goverment has to pay it. As such, the US government might have standing to sue or demand compensation. That is not the same thing as saying that any individual taxpayer, or all taxpayers as a class, have standing. In general, the mere fact that an action costs tax dollars does not give taxpayers standing to sue over it. Aug 10, 2019 at 0:12

3 Answers 3


You can either object to the terms of the settlement, or opt out of the settlement by filing papers with the appropriate court by the November 19, 2019 deadline.

If you do not do so, you will be bound by the settlement ultimately approved, which is functionally a class action lawsuit, a form of lawsuit that can bind people who don't affirmatively sign up to be a part of it.


You can object by sending a letter to claims adminstrator, jnd or file something with the Court. If you do object, but the settlement is approved, you are still entitled to what ever choice you made. So you can take the monitoring or the $$ and still object. It's in the class notice. The link below outlines how to object. I hope a lot of people object.

https://www.equifaxbreachsettlement.com/ i


I'm no lawyer and nothing is legal advice - amicus curiae might allow you write your concern as "friend of the court" Or, you need to piggyback onto someone who objects with you as expert witness of some sort, so that your words are some sort of admissible expert opinion

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .