Corporate Governance and Equifax's Data Breaches

This case study analyzes the concept of corporate governance and evaluates the approaches of Equifax's data breaches from the perspective of business ethics theories.

Case Study
Table of Contents
INTRODUCTION...........................................................................................................................5
Overview of the case..............................................................................................................5

PART 1............................................................................................................................................5
Concept of corporate governance...........................................................................................5
PART 2............................................................................................................................................7
Evaluate the approaches of case from perspective of most relevant normative and descriptive
business ethics theories...........................................................................................................7
PART 3..........................................................................................................................................10
Analyse the stakeholder perspective on business behaviour................................................10
CONCLUSION..............................................................................................................................11
REFERENCES..............................................................................................................................12

INTRODUCTION
Corporate governance is defined as combination of regulations, rules, laws and processes
that helps in running of business effectively. This is a term which encompasses external as well
as internal elements that affects interest of stakeholders of an organisation. This can include the
impact on customers, government, suppliers, management and employees. Basically, board of
directors of company are developing framework for corporate governance which aligns
objectives of the business in an effective manner (Jacoby, 2018). There are specific processes
which are outlined in the corporate governance and this consists of action plans, disclosure
practices, performance measurements, compensation decisions, dividend policies, etc. The
present case is an example of the corporate strategy which includes Equifax’s Data Breaches.
Overview of the case
Equifax is among the three largest consumer credit reporting agencies within US. The
case happened in September 2017 in which the system of this company got breached and
personal data about more than 140 million Americans was compromised. The breaching included
data of customers like home address, names, social security numbers, date of births, license
numbers, etc. The biggest loss was the detail related to credit card of approximately 209,000
customers and clients. This breach was considered as high severity. There are different scandals
that occur in past but this included sensitivity of personal information by Equifax. This case was
case that diminished the company's goodwill and reputation within market.
PART 1
Concept of corporate governance
The corporate governance is defined as system of practices, rules, processes and
regulations that are helpful for firms in controlling and directing different business activities and
tasks. The corporate governance consists of balancing interest of stakeholders, executives,
customers, government, suppliers, financiers, etc. of the organisation (Hussain, Rigoni, and Orij,
2018). A good corporate governance provides framework for achieving organisational objectives
and goals. There are rules, regulations, policies, controls, resolutions which are put into place for
dictating corporate behaviour. There are two main stakeholders who directly affects governance
such as proxy advisors and shareholders. A key component for investor relation and community
in communication of corporate governance of the firm. Generally, all companies have are

striving to have high level of corporate governance. This includes that company is earning profits
and also demonstrating good corporate citizenship by spreading environmental awareness, good
corporate citizenship, ethical behaviour, etc (Pistor, 2019). A good corporate governance helps
in creating transparent set of regulations and rules and controlling in which directors,
stakeholders and executives have aligned the profits and incentives.
In context of Equifax, it is seen that they have not followed the aspect of having a good
corporate governance. The Equifax breach has seen attention of state, local and federal
government within US and Canadian regulators. The breach of data has affected different
governments like local government, State government and Federal government.
Local Government – Equifax is sued by cities of Chicago and Francisco. The complaint
done by San Francisco alleges that this company has violated unlawful, fraudulent and unfair
business practise in California. This company was blamed for not having success in
implementing and maintaining security practices within company. There was no timely notice of
the breach and there was failing in implementing and maintaining reasonable security practices.
There was restitution for the consumers of California who have purchased monitoring services of
credit from Equifax. This happened prior to the announcement of breach and there was $2,500
for every violation of the law. There was requirement of court order for implementing and
maintaining appropriate procedures and plans for security (Daniels, and Morck, 2019).
According to the Illinois Personal Information Privacy act, Equifax has to be lawfully punished
for exposing personal data and information of the consumers and enable in protecting it. The
notice of breaching was not circulated timely and consumers were misled by representing the
credit monitoring service as a service which is complimentary.
State Government - The general of the State Attorneys was active at the time of breach.
There was an enforcement action taken against Equifax. This complaint was about the violations
of Massachusetts data privacy laws and consumer protection laws. The Attorney General of
Massachusetts has launched the Stops Hacks. This was in consideration of improving
Electronic data Security Act. This bill needs to have a business which can hold sensitive data of
people of New York for adopting technical, administrative as well as physical safeguards. This
includes expanding the type of data which is triggering the requirements of reporting.
Federal Government – This government is conducting various investigations. The
executive of Federal Trade Commission has confirmed that they are doing strong investigation

for the Equifax breach. Another community that is conducting research on the Equifax breach
naming the consumer financial protection Bureau. This investigation is done for insider trading
that is associated with stock sales before the breach.
Within US, the government has indicted some members of military of China on charges
as they have hacked Equifax and exploited personal information and data of approximately 150
millions. They have allegedly conspired for hacking into computer networks of Equifax. They
kept an unauthorised access to computers of Equifax and stole sensitive informative of American
customers (Crane, and et. al., 2019). This case totally represents misconduct of the corporate
governance within company. It is essential for the organisations to adopt some regulations and
rules while managing work. This is helpful in managing work in proper manner and attaining
organisational objectives. Equifax must have ensured that data of clients and customers is
protected against theft and it is secured.
PART 2
Evaluate the approaches of case from perspective of most relevant normative and descriptive
business ethics theories
Ethics is defined as the term that deals with principles of morality as well as standards of
doing ethically right activities and tasks. The ethics encompasses responsibilities and rights of
humans. The various theories of business ethics are mentioned below -
Teleological ethical theory
These are the theories which are associated with consequences of actions that means
basic standards for the actions which are being morally right or wrong depending upon the evil
or good developed. The different type of teleological ethical theories are mentioned below -
Ethical Egoism – According to this theory, an action is considered as good if it is
producing and providing good results which are able to maximise self interest of people.
According to this theory, it is concluded that it is moral for promoting one's own good (Werhane,
2019). On the other hand, sometimes avoiding personal interest and doing good work for others
is also good. According to this, ethical egoism is different from psychological egoism. This
reflects that individuals are self centred and self motivated and actions can be performed for
maximising personal interest and not providing help to other people. For Equifax, it is concluded

that they should have served customers and clients in effective manner and they must have
protected their personal data and information.
Utilitarianism - This theory explains that any business action is good when the results
are providing maximum satisfaction for many people. This reflects that the managers of
company can develop an annual employee vacation for honouring the preferences. This provides
acting in a way that can help in maximising pleasure of workforce. In context of Equifax, it is
seen that all the business tasks and activities must possess some rules and regulations that fulfil
employee needs and demands.
Eudalmonism – As per this theory, any business action is good if is provides good results
in fulling the organisational goals as well as welfare of individuals. All the business activities
and tasks must be fruitful and this is done by promoting constructive goals of human nature. In
context of Equifax, it is essential for this company to provide employee training and knowledge
standards while work. The moral theory is helpful in maintaining wrongness and rightness of
actions which are dependent on consequences.
Deontological ethical theory
These are defined as theories which reflect that actions are morally right and they are
independent of the consequences. The different type of deontological ethical theories are
mentioned below -
Negative and Positive Rights theories - As per the negative rights theory, the business
action is right if it is protecting people from unwarranted or harm interference from different
individual (Vazquez, 2018). On the other hand, the positive rights theory reflects that an
individual is doing right if he is able to fulfil his needs and demands. It is important that all the
all the organisations must know what is good or bad for them. They should be having clear sight
of what are the consequences of the activities and tasks that are performed in business.
Social contract theories – These are the theories which says that individual contract with
others for abiding by political as well as moral obligations for society. When there are no law
and orders in the society, there are unlimited freedom. This means that there are cases in which
people are having unlimited freedom and this is related to having right for all things and avoiding
misdeeds.
Social Justice theories - According to this, the business actions are right when there is
confirmation of fairness in the distributive, redistributive and compensatory dimension of

rewards as well as costs (Arnold, Beauchamp, and Bowie, 2019). This is related to the
distributive dimension and having perceived fairness in distributing social benefits. This theory
is dependent on the wrongness or rightness of actions.
Virtue Ethical theory
This type of theory tells about the ethical value of the person which is determined by the
character. There are following types of ethics listed below -
Individual character ethics - As per this theory, character of each and every individual
depends upon the ethics of the identification and development of all traits of human beings. This
is helpful in estimating the intrinsic value of the ethical interactions with human beings.
Work character ethics – As per this theory, the development and identification of
practitioner, reflective and noble traits while work are honest, loyal, dependability, etc. This is
very essential while facing global competition.
Professional character ethics - This includes having self regulation and loyalty service
that estimates intrinsic ethical quality of the person (David, and James, 2019). This is associated
with few communities. This is explained with an example – if a doctor sees that there is double
billing of the OT's service then it is ethical duty of doctor to inform this immediately to the
management of hospital. If no action is taken then he has all the right to whistle blow and inform
public about the misconduct that is happening in the company. The ethical theories of virtue
depends upon the development of sound character. This is helpful in building substantive
foundation for the actions that are taken within business. When employees working in the
company are having strong character i.e. they are emotional, intellectual, social and moral virtues
for attaining self discipline and doing right thing, it is good for the company.
System Development Ethical theory
As per this theory, it is stated that there is requirement of developing work culture that is
supportive for ethical conduct (Collier, 2018). The different type of system development ethical
theories are personal improvement ethics, organisational ethics and extra organisational ethics.
These are described below -
Personal improvement ethics – This says that a business action is good if it is intended
for promoting personal responsibility of individual in order to have continuous learning, holistic
development and moral excellence. The employees working in company are provided effective
trainings for improving the skills and abilities of people working in the company.

Organisational ethics – This reflects that business actions are right when there is
conformation of development of formal as well as informal organisational processes. This is
helpful in enhancing the procedural results and innovation in ethical work cultural as well as
systematic justice. This is explained with an example – when there are no employee complaints
redressal system within the organisation and there are no voice system for feedback, it is duty of
manager for implementing system and providing voice for the employees. This provides help to
managers in supporting individuals as well as moral development. This minimises intense
resistance for overall moral development.
Extra organisational ethics- As per this, any business action is right when there is
promotion for collaborative partnership and respect for domestic as well as global constituencies.
This includes representing various factors that affects an organisation like economic, social,
Political, philanthropic which are affecting any company.
PART 3
Analyse the stakeholder perspective on business behaviour
Equifax is one of the major credit reporting agencies and it is also known as credit
bureaus. The main responsibility of them is to develop report on the individuals which is helpful
in providing detailed picture of credit history. The credit report is involved in collecting
information from clients and customers. These customers can be businessmen, credit card
companies, employers, consumers and landlords. When the person is applies for credit, leader
provides credit reports from Equifax for having history of repaying all the debts. The offer of
credit is expanded by the lender and a favourable interest rate is provided to individuals. The
landlords are given reports of credit before they decide for accepting the tenant and employer for
hiring. The stakeholder analysis for Equitax is mentioned below -
Stakeholders Perspective on business behaviour
Customers The clients and customers of Equifax are given
credit reports for their business. When this
breach happened, the data of customers got
leaked. This affected the trust and loyalty of
employees towards service provided by
Equifax. It is responsibility of the the company

to ensure that customer's data is safe and
secure (Schaltegger, and Burritt, 2018). After
this breach, the company faced lot of problems
in redeveloping trust among customers.
Employees and managers of Equifax The managers as well as employees working in
Equifax were badly affected by the case of
breach. All the employees lost their jobs as this
company's market reputation gone down. It is
the responsibility of management to take care
that all the employees are feeling safe while
working in the company. But in case of
Equifax, there was case of breaching of all
information. This caused problem to the
Equifax's workforce.
Government The government took strict actions against the
company's management. The US government
has indicated that personal data is protected.

REFERENCES
Books and Journals
Jacoby, S. M., 2018. The embedded corporation: Corporate governance and employment
relations in Japan and the United States. Princeton University Press.
Hussain, N., Rigoni, U. and Orij, R.P., 2018. Corporate governance and sustainability
performance: Analysis of triple bottom line performance. Journal of Business
Ethics, 149(2), pp.411-432.
Pistor, K., 2019. Company law and corporate governance in Russia. In The rule of law and
economic reform in Russia (pp. 165-187). Routledge.
Daniels, R. J. and Morck, R., 2019. Corporate Decision Making in Canada. Routledge.
Crane, A., and et. al., 2019. Business ethics: Managing corporate citizenship and sustainability
in the age of globalization. Oxford University Press, USA.
Werhane, P. H., 2019. The normative/descriptive distinction in methodologies of business ethics.
In Systems Thinking and Moral Imagination (pp. 21-25). Springer, Cham.
Vazquez, P., 2018. Family business ethics: At the crossroads of business ethics and family
business. Journal of Business Ethics, 150(3), pp.691-709.
Arnold, D. G., Beauchamp, T.L. and Bowie, N. E., 2019. Ethical theory and business.
Cambridge University Press.
David, M. and James, W., 2019. Business ethics. HAL.
Collier, J., 2018. Globalization and ethical global business. In Business Ethics and Strategy,
Volumes I and II (pp. 215-219). Routledge.
Schaltegger, S. and Burritt, R., 2018. Business cases and corporate engagement with
sustainability: Differentiating ethical motivations. Journal of Business Ethics, 147(2),
pp.241-259.