After a data breach, federal law gives a consumer tools whether or not anyone files a lawsuit. A consumer may freeze credit files, place a fraud alert and dispute fraudulent accounts with the credit bureaus. Whether a breach and what followed it give rise to a legal claim depends on the facts. A data breach lawyer handles claims of that kind.
This page explains how federal consumer law in the United States treats a breach and its aftermath, from the company's side and from the consumer's. It covers the credit-report problems a breach can cause and the options federal law gives a consumer.
A data breach is unauthorized access to, or acquisition of, personal information that a company or organization holds.
Information exposed in a breach can include:
- Social Security numbers
- financial account numbers
- login credentials such as usernames and passwords
- medical records
- payment card data
A breach does not by itself mean a company broke any law. Whether a consumer has legal options depends on the facts: what was taken, how the company protected it, what the company said about its practices, and what has happened to the consumer since.
What Federal Law Requires After a Breach
The federal baseline is the Federal Trade Commission Act. Under 15 U.S.C. § 45(a)(1), "unfair or deceptive acts or practices in or affecting commerce" are declared unlawful. 15 U.S.C. § 45(a)(2) empowers and directs the FTC to prevent persons, partnerships and corporations from using them, except for certain entities, among them banks, savings and loan institutions, federal credit unions and common carriers subject to the Acts to regulate commerce.
The statute limits what counts as "unfair." Under 15 U.S.C. § 45(n), the FTC may not declare a practice unlawful as unfair unless it meets three conditions:
- it causes or is likely to cause substantial injury to consumers;
- consumers cannot reasonably avoid that injury themselves;
- the injury is not outweighed by countervailing benefits to consumers or to competition.
Under 15 U.S.C. § 45(b), when the FTC has reason to believe a company is using such a practice and a proceeding would be to the interest of the public, it issues a complaint, and if after a hearing it is of the opinion that the practice is prohibited, it issues an order requiring the company to cease and desist. 15 U.S.C. § 45 is an enforcement tool in the FTC's hands. Whether a company's handling of personal information was unfair or deceptive depends on its facts.
The Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., applies to credit reports and the agencies that compile them, which is where fraudulent accounts or errors that follow a breach can appear. Congress's stated purpose in 15 U.S.C. § 1681(b) is to require consumer reporting agencies to adopt reasonable procedures with regard to "the confidentiality, accuracy, relevancy, and proper utilization" of consumer information.
Where state law fits
State law may add its own protections, including rules on breach notification, meaning when and how a company has to tell people their information was exposed. Those rules differ from state to state, so the answer for any one consumer depends on where they live and which state's law applies to the company. This page states federal law only and does not set out any one state's rules.
How a Data Breach Can Affect a Consumer Report
A few terms help here:
- A consumer reporting agency is a company that collects information about consumers and sells reports on it.
- A consumer report is the report that agency provides, such as a credit report.
- A furnisher is a company, such as a lender or a collector, that reports information about you to the agency.
When stolen information is used to open an account, that account and its unpaid balance can land on your consumer report.
The right to dispute. Under 15 U.S.C. § 1681i(a)(1)(A), a consumer may dispute the completeness or accuracy of an item in their file. The dispute can go to the agency directly or through a reseller. The agency must then, free of charge, conduct a reasonable reinvestigation, meaning a fresh check of the disputed item. It must either record the item's current status or delete it within 30 days of receiving the dispute. Under 15 U.S.C. § 1681i(a)(1)(B), that period may be extended by not more than 15 additional days if the agency receives relevant information from the consumer during the 30 days. Under 15 U.S.C. § 1681i(a)(1)(C), the extension does not apply if, during the 30 days, the item is found to be inaccurate or incomplete or the agency determines that it cannot be verified.
The furnisher's part. Within 5 business days of receiving the dispute, the agency must notify the furnisher and pass along all relevant information it received. The agency may end a reinvestigation it reasonably determines is frivolous or irrelevant. If it does, it must notify the consumer not later than 5 business days after making that determination, and the notice must give the reasons and identify any information required to investigate the disputed information. An item that is found inaccurate or incomplete, or cannot be verified, must be deleted or modified promptly. A deleted item may not be reinserted unless the furnisher certifies that it is complete and accurate. If an item is reinserted, the agency must notify the consumer in writing within 5 business days.
Blocking identity-theft information. Separately from the dispute process, federal law has further rules that allow information resulting from identity theft to be blocked from a consumer report. Those rules are covered on the identity theft attorney page.
Freezes and fraud alerts. According to the CFPB, a security freeze prevents prospective creditors from accessing your credit file. It is free to place and lift at each of the three nationwide companies, and each must be contacted separately. According to the FTC, a fraud alert tells businesses to check with you before opening new credit in your name. An initial alert lasts one year, and a request to one bureau is passed to the other two.
These are FCRA rights about the report itself. They are separate from any obligation a company has to notify consumers about a breach.
What Consumers Can Do After a Breach
Federal agencies describe the following steps, which are available without a lawsuit.
Reporting identity theft to the FTC. The FTC's page refers to an FTC identity theft report completed at IdentityTheft.gov, the FTC's identity theft site. That report matters for an extended fraud alert: the FTC says an extended alert is available to people who have experienced identity theft and have completed that report or filed a police report. According to the FTC, it lasts seven years.
Checking the credit reports. The FTC notes that accounts in your name you do not recognize could be a sign of identity theft, and it describes how to get free credit reports. Placing an initial fraud alert also lets a consumer get a free copy of their report from each of the three bureaus.
Freezing or alerting. According to the CFPB, a nationwide credit reporting company must place a freeze within one business day of a request made by telephone or secure electronic means. For a request by mail, the deadline is three business days after it is received. The company must send written confirmation within five business days of placing the freeze. The FTC says a freeze lasts until the consumer lifts it, and it can be lifted temporarily, for example to apply for credit or rent an apartment.
Disputing errors. A fraudulent account or a wrong late payment can be disputed under 15 U.S.C. § 1681i, as described above.
Remedies and Lawsuits
Remedies differ by statute and depend on what a court finds. The consumer rights remedies page sets out what each federal law provides, and how consumer lawsuits work walks through the stages of a case. Broader background on bringing a case appears on the consumer lawsuit page.
How Inquiries Through Federal Consumer Rights Work
Federal Consumer Rights is an information and inquiry website, not a law firm; a request for a case review may be passed to attorneys, who decide for themselves whether to respond, and the site represents no one and promises no response or outcome.
Requesting a Consumer Rights Case Review
This page does not cover state breach notification rules. A consumer rights case review can be requested through Federal Consumer Rights.
