Following up on my last post concerning service provider terms of use, the recent Equifax data breach and its immediate aftermath provides yet another reminder of how important it can be to pay close attention to the contractual language that you often agree when using online services.
The Equifax data breach is, by some accounts, the most significant data breach of consumer personal information yet. Thus, it is unsurprising that media and consumer attention to this breach has been rapid and widespread.
In response to the breach, Equifax established a website that checked a user’s information against the breached data to determine whether the user was affected by the breach. Users can access the website, enter some personal data (ironically enough), and see whether their personal information was contained in the data accessed by the hackers.
At the bottom of Equifax’s website, like many other websites that offer online services, there is a link to “Terms of Use” for the website. When the website was first published, that link connected to Equifax’s global terms of use, available here. (It has since been redirected to a new set of Terms of Use made specifically for the new website, the reason for which will be clear momentarily).
Equifax’s general terms of use contain a binding arbitration clause, which provides that all claims raised by users of Equifax’s websites shall be subject to mandatory, binding arbitration. The clause also contains a waiver of the user’s right to participate in any arbitration or litigation on a class or representative basis, such as a class action lawsuit or arbitration.
The upshot of all of this is that, when the website was first published, individuals that went to check whether they were affected by the data breach were presumably waiving their right to bring lawsuits in state or federal court, or participate in class action lawsuits or arbitrations. Understandably, consumer rights advocates cried foul, and many, including New York State Attorney General Eric Schneiderman, publicly demanded that Equifax remove the clause.
In what is likely an effort to save some face in an impending PR nightmare, Equifax has since changed its Terms of Use for the website. The new Terms of Use do not contain any arbitration requirements or class action waivers. Nonetheless, this incident serves as a reminder that users of online services should do their best to understand the terms they agree to by availing themselves of those services.
