Blacknet - SF Chron: Credit agencies sending our files abroad

[Bill Stewart]

More of Tim's Blacknet predictions coming true.

(And they didn't mention that the Jamaican call center's comment on
whether information might be used in ways that US laws didn't control was
"No problem, mon"...)

----------------
Credit agencies sending our files abroad
David Lazarus
Friday, November 7, 2003
)2003 San Francisco Chronicle |Feedback

URL: sfgate.com/article.cgi?file=/c/a/2003/11/07/MNG4Q2SEAM1.DTL

Two of the three major credit-reporting agencies, each holding
detailed files on about 220 million U.S. consumers, are in the process
of  outsourcing sensitive operations abroad, and a third may follow suit
shortly,  industry officials acknowledge for the first time.

Privacy advocates say the outsourcing of files that include Social
Security numbers and complete credit histories could lead to a surge  in
identity theft because U.S. laws cannot be enforced overseas.

For their part, the credit agencies say the trend is a necessary cost-
cutting move in light of new legislation that would allow all consumers
to  obtain free copies of their credit reports.

The top credit agencies  --  Equifax, Experian and Trans Union  -- have
refused in the past to comment on their outsourcing plans. No longer.

"A hundred percent of our mail regarding customer disputes is going to
go  to India at some point," said David Emery, executive vice president
and  chief  financial officer of TransUnion in Chicago. "We are now
testing the  system and  negotiating a contract with an outside vendor.
We expect to  sign that contract  by the end of the year."

Emery said in an interview that the decision to have an Indian firm
handle thousands of written requests for changes to credit files each
year  was  necessitated in part by the amended Fair Credit Reporting Act,
which  was  approved by the U.S. Senate on Wednesday.

The act would require credit agencies to provide copies of personal
credit files to anyone who asks  --  an expense that  TransUnion, for
one,  estimates could cost the company as much as $350 million a year.

A credit file serves as a snapshot of one's legal identity and
financial  status. It contains a person's name, address, date of birth,
Social Security  number and details of relationships with all credit-card
 issuers and other  lenders.

Emery also said the decision to "offshore'' a key customer service was
necessitated by "the competition placed on us by Equifax and Experian."

Equifax, he said, was the first major credit agency to move operations
abroad, establishing a facility in the Caribbean. Experian, meanwhile,
is  "actively testing" work with an overseas affiliate, Emery said.

"We had to get into this process for defensive reasons," he said.

An Equifax spokesman's first response when asked about the Atlanta
company's outsourcing was to insist that all customer service was handled
 at  North American facilities. Confronted with TransUnion's remarks,
though, a  senior Equifax official later offered a different answer.

"We have a vendor in Jamaica," said Rob Hogan, senior vice president  of
customer services. "The Jamaican workers handle data entry at the  very
beginning of the reinvestigation process (for disputed credit reports)."

He said the overseas workers had "limited access" to consumers' credit
files but were "closely supervised by our Atlanta office."

Hogan acknowledged that Equifax had had "problems from time to time"
with  consumers' privacy being compromised. But he said each problem had
led to  improvements in security. He also said there had been no known
security  breaches in the four years that Equifax has outsourced to
Jamaica.

"We take great care of our data," Hogan stressed. "It's our livelihood."

An Experian spokesman, Addrian Brooks, denied Trans Union's assertion
that the Costa Mesa company is now "actively testing" an overseas
operation.  "We are confident that Trans Union doesn't know what our
plans  are because we  don't know what their plans are," he said.

However, Brooks repeatedly emphasized that Experian could outsource  work
 abroad at any time.

"We definitely are evaluating every option on the table, and offshoring
is  one of them," he said. "I don't want to be quoted as saying we'll
never  do  it."

Privacy advocates say the outsourcing of credit agencies' work abroad --

and hence access to U.S. consumers' credit files  --  dramatically
increases  the chance that confidential information will get into the
wrong  hands.

"Consumers should be worried," said Beth Givens, director of the
Privacy  Rights Clearing House in San Diego. "The infrastructure to
protect  information  just isn't there in a lot of these places."

Credit industry officials bristle at such talk.

"Are we saying that Hindus are more criminal?" asked Stuart Pratt,
president of the Consumer Data Industry Association, a trade group for
credit- reporting agencies. "Are we saying that workers in India are less
 safe? That  strikes me as xenophobic, and I don't want to go there."

But privacy advocates say that this isn't a question of people's being
more or less trustworthy in one place or another. It's a question of
enforcement of strict U.S. laws.

"The problem is not that they're in India," said Chris Hoofnagle,
associate director of the Electronic Privacy Information Center in
Washington.  "The problem is that American laws are not going to be
enforced in India."

In fact, the Indian government, largely at the urging of privacy-
conscious  European officials, is working on new legislation aimed at
better  controlling the country's rapidly growing data-processing
industry.

But privacy advocates note that India passed a similar cyber-crime law
several years ago making it illegal to steal information from computers.
Since  then, only 11 people have been charged with violating the law and,
 of that  number, only two cases are being prosecuted.

"If you're an international crime ring, and you want Social Security
numbers for identity theft, you're going to look at the weakest link,"
said  Givens at the Privacy Rights Clearinghouse. "And that's quite
possibly these  overseas companies."

The credit-rating agencies say that privacy and security are their  most
important considerations and that they hold overseas affiliates to  the
same  high standards that they hold their domestic offices.

However, California's two Democratic senators expressed alarm that the
agencies are outsourcing work.

"The application of American law in a foreign country is difficult, if
not impossible," said Sen. Dianne Feinstein. "Therefore, the more
companies  move overseas, the less American law can control the uses for
which personal  data is put. And this can only represent an increasing
threat to the privacy  of our citizens."

Sen. Barbara Boxer said she would ensure that the matter was raised as
senators and House members completed changes to the Fair Credit Reporting
Act.

"This information is very significant, and I intend to make sure that
the  conferees who are finalizing the bill are aware of The
Chronicle's  investigation in hopes that they will protect Americans from
 such outrageous  invasions of privacy," Boxer said.

David Lazarus' column appears Wednesdays, Fridays and Sundays. He also
can  be seen regularly on KTVU's "Mornings on 2." Send tips or feedback
to  dlazarus at sfchronicle.com .

)2003 San Francisco Chronicle |Feedback

-------------------------------------
You are subscribed as billstewart at att.com
To manage your subscription, go to
  http://v2.listbox.com/member/?listname=ip

Archives at:
http://www.interesting-people.org/archives/interesting-people/