Corporate Governance and Equifax's Data Breaches

Case Study
Table of Contents
INTRODUCTION...........................................................................................................................3
Overview of the case..............................................................................................................3

PART 1............................................................................................................................................3
Concept of corporate governance...........................................................................................3
PART 2............................................................................................................................................5
Evaluate the approaches of case from perspective of most relevant normative and descriptive
business ethics theories...........................................................................................................5
PART 3............................................................................................................................................8
Analyse the stakeholder perspective on business behaviour..................................................8
CONCLUSION................................................................................................................................9
RECOMMENDATIONS...............................................................................................................10
REFERENCES..............................................................................................................................11

INTRODUCTION
Corporate governance is defined as combination of regulations, rules, laws and processes
that helps in running of business effectively. This is a term which encompasses external as well
as internal elements that affects interest of stakeholders of an organisation. This can include the
impact on customers, government, suppliers, management and employees. Basically, board of
directors of company are developing framework for corporate governance which aligns
objectives of the business in an effective manner (Jacoby, 2018). There are specific processes
which are outlined in the corporate governance and this consists of action plans, disclosure
practices, performance measurements, compensation decisions, dividend policies, etc. The
present case is an example of the corporate strategy which includes Equifax’s Data Breaches.
Overview of the case
Equifax is among the three largest consumer credit reporting agencies within US. The
case happened in September 2017 in which the system of this company got breached and
personal data about more than 140 million Americans was compromised. The breaching included
data of customers like home address, names, social security numbers, date of births, license
numbers, etc. The biggest loss was the detail related to credit card of approximately 209,000
customers and clients. This breach was considered as high severity. There are different scandals
that occur in past but this included sensitivity of personal information by Equifax. This case was
case that diminished the company's goodwill and reputation within market.
PART 1
Concept of corporate governance
The corporate governance is defined as system of practices, rules, processes and
regulations that are helpful for firms in controlling and directing different business activities and
tasks. The corporate governance consists of balancing interest of stakeholders, executives,
customers, government, suppliers, financiers, etc. of the organisation (Hussain, Rigoni, and Orij,
2018). A good corporate governance provides framework for achieving organisational objectives
and goals. There are rules, regulations, policies, controls, resolutions which are put into place for
dictating corporate behaviour. There are two main stakeholders who directly affects governance
such as proxy advisors and shareholders. A key component for investor relation and community
in communication of corporate governance of the firm. Generally, all companies have are

striving to have high level of corporate governance. This includes that company is earning profits
and also demonstrating good corporate citizenship by spreading environmental awareness, good
corporate citizenship, ethical behaviour, etc (Pistor, 2019). A good corporate governance helps
in creating transparent set of regulations and rules and controlling in which directors,
stakeholders and executives have aligned the profits and incentives.
In context of Equifax, it is seen that they have not followed the aspect of having a good
corporate governance. The Equifax breach has seen attention of state, local and federal
government within US and Canadian regulators. The breach of data has affected different
governments like local government, State government and Federal government.
Local Government – Equifax is sued by cities of Chicago and Francisco. The complaint
done by San Francisco alleges that this company has violated unlawful, fraudulent and unfair
business practise in California. This company was blamed for not having success in
implementing and maintaining security practices within company. There was no timely notice of
the breach and there was failing in implementing and maintaining reasonable security practices.
There was restitution for the consumers of California who have purchased monitoring services of
credit from Equifax. This happened prior to the announcement of breach and there was $2,500
for every violation of the law. There was requirement of court order for implementing and
maintaining appropriate procedures and plans for security (Daniels, and Morck, 2019).
According to the Illinois Personal Information Privacy act, Equifax has to be lawfully punished
for exposing personal data and information of the consumers and enable in protecting it. The
notice of breaching was not circulated timely and consumers were misled by representing the
credit monitoring service as a service which is complimentary.
State Government - The general of the State Attorneys was active at the time of breach.
There was an enforcement action taken against Equifax. This complaint was about the violations
of Massachusetts data privacy laws and consumer protection laws. The Attorney General of
Massachusetts has launched the Stops Hacks. This was in consideration of improving
Electronic data Security Act. This bill needs to have a business which can hold sensitive data of
people of New York for adopting technical, administrative as well as physical safeguards. This
includes expanding the type of data which is triggering the requirements of reporting.
Federal Government – This government is conducting various investigations. The
executive of Federal Trade Commission has confirmed that they are doing strong investigation