2017-2018 Bill 4383: Attorney General; Equifax Data Breach - South Carolina Legislature Online

1 South Carolina General Assembly 2 122nd Session, 2017-2018 3 4 H. 4383 5 6 STATUS INFORMATION 7 8 House Resolution 9 Sponsors: Reps. Gilliard and McEachern 10 Document Path: l:\council\bills\bbm\9701sa18.docx 11 12 Prefiled in the House on November 9, 2017 13 Currently residing in the House Committee on Invitations and Memorial Resolutions 14 15 Summary: Attorney General; Equifax data breach 16 17 18 HISTORY OF LEGISLATIVE ACTIONS 19 20 Date Body Action Description with journal page number 21 11/9/2017 House Prefiled 22 11/9/2017 House Referred to Committee on Invitations and Memorial Resolutions 23 24 View the latest legislative information at the website 25 26 27 VERSIONS OF THIS BILL 28 29 11/9/2017 30 1 2 3 4 5 6 7 8 9 A HOUSE RESOLUTION 10 11 TO URGE THE ATTORNEY GENERAL TO FILE A LAWSUIT 12 AGAINST EQUIFAX FOR THE DATA BREACH THAT 13 AFFECTED OVER TWO MILLION SOUTH CAROLINA 14 RESIDENTS. 15 16 Whereas, the data breach of Equifax potentially compromised the 17 personal data of one hundred fortythree million consumers, 18 including over two million in South Carolina. Equifax failed to 19 protect sensitive and personal information of consumers which 20 could be damaging in the future; and 21 22 Whereas, Equifax left private consumer information exposed to 23 hackers by relying on certain computer code that it knew or should 24 have known was vulnerable to exploitation without having in place 25 safeguards sufficient to prevent the consumer data it stored in its 26 system; and 27 28 Whereas, stillunknown third parties infiltrated Equifax’s computer 29 system through a page on its website that allows consumers to 30 submit information to initiate and support a formal dispute of 31 information in their credit reports; and 32 33 Whereas, once in, the unauthorized third parties were able to 34 access and likely stole consumer information from Equifax’s 35 network. The hackers were present in Equifax’s system from at 36 least May 2017 through the end of July 2017 without Equifax 37 detecting them; and 38 39 Whereas, although fixes for the computer code vulnerability were 40 available to Equifax and posted on at least one United States 41 Government website, the company failed to implement the 42 recommended fixes, or otherwise put in place other safeguards and

[4383] 2 1 security controls, such as encryption, that would sufficiently 2 protect consumers’ personal data; and 3 4 Whereas, Equifax is a credit reporting firm that businesses rely on 5 to make decisions about the credit worthiness of consumers, 6 therefore affecting whether consumers can buy a house, acquire a 7 loan, lease a vehicle, or even get a job. Consumers have little to no 8 control over the information that Equifax acquires about them; and 9 10 Whereas, the Attorney General should seek civil penalties, 11 disgorgement of profits, restitution, costs, and attorneys’ fees. The 12 Office of the Attorney General should also seek injunctive relief to 13 prevent harm to South Carolina residents resulting from the 14 company’s actions and inaction. Now, therefore, 15 16 Be it resolved by the House of Representatives: 17 18 That the members of the South Carolina House of Representatives, 19 by this resolution, urge the Attorney General to file a lawsuit 20 against Equifax for the data breach that affected over two million 21 South Carolina residents. 22 23 Be it further resolved that a copy of this resolution be presented to 24 the Attorney General. 25 XX 26

[4383] 3