When personal information is exposed in a data breach, someone who should not have it may now have it. Exposure alone does not mean identity theft has happened. Federal law lets a consumer place a free security freeze or a fraud alert with the nationwide credit bureaus to make new accounts harder to open in their name.
This page explains what a data breach is, what California's notice rule requires, and which tools federal consumer-reporting law gives a person whose information has been exposed.
What a Data Breach Is
A data breach is unauthorized access to personal information held by a company or organization. It also covers taking that information or disclosing it without authorization.
Personal information that may be exposed in a breach includes:
- names and dates of birth
- Social Security numbers
- financial account numbers and payment card numbers
- login credentials
- medical or health information
- government-issued ID numbers
What Breach Notification Laws Require of Companies
State law may add protections, and it differs from state to state. California's rule is in Cal. Civ. Code § 1798.82(a): an individual or business that conducts business in California and owns or licenses computerized data that includes personal information must disclose a breach of the security of the system, following discovery or notification of the breach, to a California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The section also covers encrypted personal information when the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the business reasonably believes the key or credential could render the information readable or usable. The disclosure must be made within 30 calendar days of discovery or notification of the breach, but it may be delayed to accommodate the legitimate needs of law enforcement, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
Under Cal. Civ. Code § 1798.82(d), the notice must be written in plain language and titled "Notice of Data Breach," and it must include, at a minimum, the name and contact information of the reporting individual or business and a list of the types of personal information that were or are reasonably believed to have been the subject of the breach, along with the other items that subdivision lists.
Whether any particular company's conduct may violate a law depends on the facts and on which law applies.
A person's own credit reports are one place to look. The FTC's guidance on credit freezes and fraud alerts says that unrecognized accounts in your name could be a sign of identity theft and that consumers can get free credit reports. Federal law also ties free reports to fraud alerts. When a nationwide credit bureau places an initial fraud alert, it must tell the consumer they may request a free copy of their file. When it places an extended fraud alert, it must tell the consumer they may request 2 free copies during the 12 months that follow. If the consumer asks, the bureau must provide the required disclosures free, no later than 3 business days after the request (15 U.S.C. § 1681c-1(a)(2), (b)(2)).
The FTC states that a person does not have to wait for their Social Security number or other information to be exposed in a data breach or misused by an identity thief to get a credit freeze, and that anyone can do it, any time.
What the Law Makes Available to Consumers After a Breach
The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., is the federal law behind most of these tools. It governs consumer reporting agencies, the companies that compile credit files, known as credit bureaus. It also governs the businesses that supply information to them and the businesses that use credit reports. Congress stated its purpose as requiring that consumer reporting agencies "adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information" (15 U.S.C. § 1681(b)).
In practical terms, the FCRA does not undo a breach. What it does is give a person some control over who can see their credit file and how carefully lenders must check identity before opening something new. The two main tools work differently: a freeze keeps requesters out of the file, apart from the listed exceptions, while a fraud alert leaves the file visible but tells businesses to verify identity before extending new credit.
Security freeze. The statute defines a security freeze as "a restriction that prohibits a consumer reporting agency from disclosing the contents of a consumer report that is subject to such security freeze to any person requesting the consumer report." When a consumer makes a direct request and provides proper identification, a nationwide bureau must place the freeze free of charge. It must act within 1 business day of a request made by toll-free telephone or secure electronic means, or within 3 business days of a request made by mail. Within 5 business days of placing the freeze, the bureau must confirm it and explain how to remove it. Removal on request is also free. It must happen within 1 hour for a phone or electronic request, or within 3 business days for a request by mail. A consumer may also ask to lift a freeze temporarily (15 U.S.C. § 1681c-1(i)).
A freeze does not block everyone. Its exceptions include companies the consumer already has an account with, when they are reviewing or collecting that account. They also include some government agencies acting under a court order, warrant or subpoena, and child support agencies. A freeze also does not apply to anyone using the information for insurance underwriting or for employment, tenant or background screening. The CFPB's explanation of security freezes adds that freezes "do not impact your credit scores in any way whatsoever."
The freeze rules described here apply to the nationwide credit bureaus. They are the bureaus the statute and the agency guidance above address, so a freeze placed with them is a freeze on those credit files.
Fraud alerts. A consumer may ask for an initial fraud alert by asserting in good faith a suspicion that they have been, or are about to become, a victim of fraud or identity theft. Once the bureau has appropriate proof of the requester's identity, it must keep the alert for not less than 1 year and refer it to the other nationwide bureaus. An extended fraud alert is available to a consumer who submits an identity theft report. It lasts 7 years. It also keeps the consumer off the bureau's lists for unsolicited credit and insurance offers for 5 years, unless the consumer asks to be put back on (15 U.S.C. § 1681c-1(a), (b)).
Disputes. If a consumer disputes the completeness or accuracy of an item in their file at a consumer reporting agency and notifies the agency directly, or indirectly through a reseller, the agency must, free of charge, conduct a reasonable reinvestigation to determine whether the disputed information is inaccurate, generally before the end of the 30-day period beginning on the date it receives the notice (15 U.S.C. § 1681i(a)(1)(A)). The site's pages on wrong information on a credit report and an account that isn't yours explain that process.
State law may add protections, and it differs from state to state. In California, Cal. Civ. Code § 1798.150 allows a consumer to institute a civil action, on the conditions that section states, when the consumer's nonencrypted and nonredacted personal information, or an email address with a password or security question and answer that would permit access to the account, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices. Whether a particular breach gives rise to a legal claim depends on its facts and the applicable law. Exposure by itself does not establish that anyone has been harmed in a legal sense. The page on consumer rights remedies describes how federal remedies are structured.
Steps a Consumer May Take After Receiving a Breach Notice
A consumer has several options after receiving a breach notice.
A consumer may read the notice for the types of information involved.
According to the CFPB, a consumer can freeze and unfreeze their files for free at Equifax, Experian and TransUnion, the three nationwide credit reporting companies, but must contact each one separately. The FTC explains that a consumer can place an initial alert by contacting just one of the three bureaus, which must tell the other two. The FTC also notes that a fraud alert can be placed even when a freeze is already in place, so a consumer is not limited to one or the other.
A consumer may also review credit reports for accounts they do not recognize, which the FTC says could be a sign of identity theft.
If the information has actually been misused, a consumer may complete an FTC identity theft report at IdentityTheft.gov or file a police report. The FTC describes either one as what makes a person eligible for an extended fraud alert. The site's page on identity theft and consumer law covers what follows from there.
What This Page Does and Does Not Cover
This page explains what a data breach is, California's notice rule and civil-action provision, and the federal credit-reporting tools available afterward: security freezes, fraud alerts and disputes.
It does not describe any other state's breach law, or consumer reporting agencies other than the three nationwide credit bureaus. A person's rights after a breach may depend on the state where they live and the type of information exposed. Whether a situation gives rise to a legal claim depends on the applicable law and the specific facts.
If You'd Like a Consumer Rights Case Review
This page covers personal information exposed in a data breach, California's notice rule and the federal credit-file protections described above.
A reader may request a consumer rights case review through Federal Consumer Rights.
