Equifax class action settlement—opt-in or opt-out?

Question

I'm trying to figure out whether it's better to include or exclude oneself from the Equifax class action settlement. I've been torn on the issue, for reasons I'll explain below.

Note to readers: It seems that doing nothing is definitely worse than either opting in or opting out, since you lose your rights, and don't receive the full benefits either! So it seems you should really at least do something by the deadlines (the first of which is in November).

The settlement terms specify the following (also see FTC site):

Settlement Benefit: Credit Monitoring Services:
The settlement provides a way to help protect yourself from unauthorized use of your personal information. Settlement Class Members may submit a claim to enroll in at least four (4) years of three-bureau credit monitoring services, provided by Experian, at no cost. These services include the following features:

• Three-bureau credit monitoring providing notice of changes to your credit report at all three national credit bureaus;

• Up to $1 million dollars in insurance covering costs related to identity theft or fraud;

• Real-time notification of credit inquiries and other notifications;

• On-demand online access to a free copy of one bureau credit report, updated on a monthly basis;

• CyberAgent® Dark Web Monitoring that monitors internet activity for the trading or selling of your personal information;

• Customer support provided by Experian; and

• Many other features described at www.EquifaxBreachSettlement.com.

If you make a valid claim and enroll in Credit Monitoring Services, you can also elect to enroll in up to six (6) years of one-bureau credit monitoring services provided by Equifax that would begin after the three-bureau Credit Monitoring Services expire. This one-bureau credit monitoring service will include automated online alerts for key changes to your Equifax credit report, on-demand online access to your Equifax credit report updated on a monthly basis, and, if you request, internet monitoring that includes searching suspicious websites for your Social Security number. You must opt in for these onebureau services when you submit your claim for Credit Monitoring Services, and you will be sent instructions for how to enroll in the one-bureau monitoring before your three-bureau Credit Monitoring Services expire. The cost of this service will be paid separately by Equifax, not out of the Consumer Restitution Fund.

Here are my concerns:

The cons:

At best, everything they're doing basically sums up to a ~$1000 cash payment:

• Compensation via monitoring seems like a rip-off, because free monitoring is already available for free from lots of sources anyway (CreditKarma, Mastercard, etc.).

• The 4-year service they appear to be referring to is supposedly "worth" $240/year. Even if I naively take that at face value, it's no better than Equifax paying $960. So for the sake of analysis, we can pretend it's a ~$960 cash payment from Equifax for all I care.

• I'm skeptical of the $1M insurance, but assuming it's referring to the same Experience service I can find online, it covers the following:

  • Unauthorized Electronic Fund Transfer (after you've sought reimbursement from your bank)
  • Investigator Costs for rectifying identity theft (though they choose the investigator)
  • "Reasonable" legal expenses incurred by you "with their written consent" for action against creditors/collection agencies, criminal defense (after dropped charges/acquittal—good luck defending), and medical/tax history collection.
  • Various minor costs (lost wages, family care, travel, etc.) up to around $10,000 total

  The terms are littered with catches like "reasonable", "with our consent", "after acquittal", etc... who's to guarantee we see the same things as reasonable? Who's to guarantee they consent to anything I really want or need? And how do you defend yourself when you're out of money and they only pay you after acquittal? et cetera.

• These are all only valid for a limited number of years (3-10, depending on the service), and they're going to be useless if your identity is stolen after a decade.

• You are limited in what you can be reimbursed for. If you incur costs that aren't covered for whatever reason, good luck recovering.

The pros:

Compare this to excluding yourself from the settlement:

• You don't need to prove anything to receive the ID monitoring/protection/insurance services. It's given to everyone automatically, and at least there's a small glimmer of hope that federal regulators might be willing to step in if something extremely egregious happens.

• There's no guarantee of any compensation at all. You'll have to fight on your own⁠—and if your identity gets stolen someday, how in the world would you prove in court that it was the Equifax breach that caused it?! It seems practically impossible to win such a case for most people, so you may well be left with nothing to gain, and lots of legal fees to lose.

• It seems you can't complain to the court if you exclude yourself.
  Not that most people intend to anyway, but if you intend to, then exclusion has a downside. (Which seems kind of messed-up to me, but that's how it seems to be.)

• There is no absolute legal limit in damages you can recover. (Though you may have a harder time recovering anything at all.)

• There's a high risk that, if the company files for bankruptcy or dies or otherwise changes legally, you may be unable to recover any damages in the future, even if something goes wrong and you can somehow prove this breach was the cause!

Summary:

So as I see it, it's mostly a lose-lose situation for consumers, and a win for Equifax—again, it's no better than paying everyone $1000 cash, which might be nice for those who are lucky enough to not get their identities stolen, but which would seem nowhere near enough for those who aren't so lucky, especially if it happens more than 10 years into the future.

But given that, as a typical consumer, you need to make the best of this situation, how should one go about deciding which is the better choice?

Answer 1

According to Charlie Warzel of the New York Times, there are additional actions you can take.

1. Write a letter to the court

Before anyone can get their money, the court — specifically, the United States District Court for the Northern District of Georgia — has to approve the settlement. This, two class-action lawyers told me, is where victims have some real power to exert some influence. According to one lawyer familiar with the settlement, one of the factors the court looks at are the responses from those who write letters.

2. Write a letter to your state attorney general

Another option is to write your state attorney general to complain about the settlement. Multiple class-action lawyers I spoke with noted that a number of state attorneys general were part of this settlement and that inundating them with letters could ratchet up the pressure to push back on the settlement.

3. File a formal, legal objection

   This option seems rather impractical.

It's also not clear to me what happens if you live in a state that is not covered by the settlement.

Answer 2

The function of a class-action settlement is to settle the issue globally (within the relevant jurisdiction) for all members of the class. This is extremely beneficial for the defendant (Equifax) as anyone not explicitly opting out in writing of the settlement will irrevocably give up their ability to sue for any damages caused by the data breach.

Think about that for a moment. All current and future victims, even those not yet aware of the settlement, will be forever legally barred from suing Equifax on their own for any damages that may be caused by this breach. (Caveat here - I am not a lawyer and there may be some arcane precedent for still suing, but this is the general purpose of class-action settlements) This is so ridiculously favorable for Equifax that it's actually their preferred outcome (short of having the suit dismissed entirely) - they pay a one-time fee for pennies on the dollar and receive virtual immunity going forward.

Opting out now is the one and only way to secure your future ability to sue Equifax. That being said, if anything does happen that compels you to file suit, you are doing so alone. You'll be taking on a massive corporation without the ability to entice high-powered lawyers with the promise of a class-action suit the the millions of dollars they will be able to reap in attorneys' fees that will come from a victory.

Only you can make the judgement as to whether or not the potential future impact is worth this risk. However, if the payout of a few hundred dollars in cash or a few years of credit monitoring is not appealing to you, then you really don't have much to lose in opting out now.

The extent of damage caused by the breach may not be measurable for some time to come. Perhaps there will be large-scale attacks on credit and financial accounts that were made possible by this breach. Perhaps the myriad flaws in the 'social security number as national ID and banking number' system will cause Congress to issue new laws that render the breach meaningless. Who knows what the future holds.

My personal answer would be that if you don't need the money, opt out. You may never need to utilize your right to sue, but it's not worth giving up for a handout. As a final note, while the credit monitoring is guaranteed, the cash payout is not. With the popularity of this claim and the viral attention it has received, class members may receive nothing more than a $1 bill.