Americans are outraged about the Equifax data breach that exposed the personal and financial data of 143 million people.
The hack leaves half of Americans extremely vulnerable to theft, fraud and a number of other crimes for years to come.
Now that many have taken immediate precautions to protect themselves—by requesting credit reports or monitoring and setting up credit freezes or fraud alerts—they're left wondering what they can do to hold Equifax accountable.
"How do we sue Equifax?" wrote a reader named Jan. "This is criminal behavior on their part, but we get punished?"
The exposure of this data—which included some credit card numbers but, more significantly, people's birthdays and Social Security numbers—coming from a company that profits from selling your confidential data should make Americans outraged, says Lauren Saunders, associate director of the National Consumer Law Center.
"People want justice," she says. But since filing a lawsuit will be a long road, they'll also need to push their legislators and regulators to hold Equifax accountable.
"The pendulum swinging against regulation and against protections for people, is not the right direction," she says. "We need stronger rules to protect us when there is a problem."
Did I Sign Away My Rights To Sue?
After the initial shock of the data breach, many consumers were further alarmed to learn that enrolling in the year-long credit protection service that Equifax offered could prevent them from suing because of a forced arbitration clause.
The company now says that's no longer the case.
But Saunders says that while Equifax backed away from its original arbitration clauses, that could change later. "It's impossible to predict what might happen years down the road in litigation after the public spotlight fades."
The Consumer Financial Protection Bureau announced regulations that would forbid these kinds of arbitration clauses in July. But the House has already voted to stop the new rules from going into effect.
But outrage over the Equifax breach could change things.
"It would be an outrage if Congress blocks it," says Saunders. "It should not be up to the wrongdoing company to decide if people get justice and access to the courts."
So Can I Still Sue Equifax?
There are already more than 50 class action lawsuits filed against Equifax as a result of the hack. If the response on Equifax's website was that your data was involved in the breach, you have standing in a case, according to Jim Francis, an attorney with Francis & Mailman in Philadelphia who filed a class action on behalf of a client.
"If a consumer's information was impermissibly provided to a third party or accessed without a lawful purpose, that is a violation of the law," says Francis. "They don't have to wait to find out that someone has taken it to the next level."
There is also the issue of negligence on the part of Equifax, says Francis. "They violated their duty to protect your data," he says. According to Equifax, the company had knowledge that there was a problem in July, but did not notify people until September. During that time, "they are allowing people to apply for credit. They are allowing them to access their website, all the while knowing that their information has been compromised and in the hands of other people."
It will likely be toward the end of the year when the many class actions come before a multi-district litigation panel and are moved into one proceeding, according to Francis. After that, the group can be certified as a class.
If you are part of the group that has experienced the same injury, you will be notified that you are part of the class. Usually, at that point, you can also opt out. Once a class is certified, you can track the suit at the class action database maintained by Consumer Action.