The FTC has a press release with some court documents at Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach. The release includes the link to the document proposed settlement.
My field is data security and I have been studying data breaches for almost 20 years. In fact, I was an early contributor to the DatalaossDB project, which tracked breaches in the early years before they became popular in the press. My observations are lawyers and judges know nearly nothing about data security and identity theft, and they will agree to just about anything. This often leads to unfavorable terms for the victims, and re-victimizes them.
I find some of the terms of the settlement are ambiguous, and some of the terms settlement are obscene. I would like to object to the settlement, and state where some of the gaps are. Some of them are listed below as examples.
The settlement document does not appear to state how to object to the terms or how to offer suggestions for improvement.
How do I object to the FTC and Equifax settlement?
The settlement does a good job at securing 10 years of credit monitoring. However, the settlement does not stipulate or require a "detailed report", and consumers will only receive a "summary report" which are the warez credit bureaus hock to consumers. I would like a quarterly detailed report.
As anther example, the selections of monitoring services also lack Early Warning, which is one of the best fraud detection services available. Early Warning was created by the largest US banks and they share information on consumers in real-time, including anonymous account information (anonymous to avoid poaching of customers). I would like a quarterly detailed report from Early Warning.
As a final example, the traditional credit bureaus maintain VIP databases, which includes actors, politicians, judges, athletes and other influential people. Reports for VIPs are scrubbed for potential inaccuracies and negative entries so actors don't speak out for a cause and politicians don't write unfavorable legislation. I would like the same treatment for life, just like the VIPs.
An example of "... lawyers and judges know nearly nothing about data security ..." is on page 15 from the settlement:
Implementing protections, such as encryption, tokenization, or other at least equivalent protections, for Personal Information collected, maintained, processed, or stored by Defendant, including in transit and at rest...
In data security and risk management, we say "complimentary security control", not "at least equivalent protections". It is quite painful for me to watch the legal system stumble through the non-legal stuff.