The Equifax Breach: 8 things you need to know about your legal options

So you're one of the 150 million people whose identity has been undermined by the Equifax leak, and you want them to be on the hook for the identity theft that's almost certainly headed your way. What are your options?

Here's a very brief overview of how you can seek compensation from Equifax, things you should consider when you do so, and steps you should absolutely take right now

1. Equifax victims have three legal options: class actions, individual lawsuits & arbitration.

The potential for damages related to the Equifax leak is huge, so don't expect them to voluntarily pony up - that would almost certainly bankrupt them. If you want Equifax to compensate you for the harm they caused you, you're going to have to rely on a legal claim to force them to pay. There are three ways you can go about that: bring an individual lawsuit, join a class action, or bring an arbitration. These options each have their pros and cons, and they are mutually exclusive - you can only use one.

Individual Lawsuits

Individual lawsuits will allow a single person to sue Equifax in court. Its pros are that it is likely to result in an outcome that's tailored to your specific situation, it gives you the highest level of due process rights and protections, and it minimizes the likelihood of conflicts of interest with other plaintiffs or attorneys. It also gives you complete control over the arguments that you make and the compensation you ask for. However, it will be a long, complicated and expensive process - it will probably take years and cost hundreds of thousands in attorney's fees which you, not Equifax, will be responsible for paying. 

Class Actions

A class action is when lots of individuals join together to sue Equifax in one court case. The pros of the class action are that the costs and hassle of bringing the suit are shared among everyone, and they're generally paid out of the proceeds of the case. That means that they're easy and there are no upfront costs to you. However, a class action will take just as long, if not longer, than an individual lawsuit, the compensation you get won't be tailored to your specific situation, and you likely won't have any opportunity to make arguments or weigh in on decisions.

Arbitrations

Arbitrations are where you and Equifax agree to have a private citizen hear and decide your dispute. Keeping your dispute out of the government's judicial system, in theory, makes it faster, simpler and cheaper than an individual lawsuit or class action. However, arbitrations tend to be presided over by lawyers who are known to side with companies over consumers, and you won't get many of the rights and protections that you're entitled to in court. Arbitration decisions are also hard to appeal, so if you think you've been treated unfairly you generally can't ask a real court to intervene.

Remember, these are mutually exclusive - if you're going to seek compensation from Equifax, you're going to have to choose one and live with its pros and cons.

2. You're probably already involved in a class action, even if you don't want to be.

Class actions are opt-out, not opt-in. That means that you don't have to sign up for a class action to be part of it. Instead, a class action automatically includes everyone who meets the criteria of the "class", and anyone who doesn't want to participate has to proactively withdraw.

As of writing, at least two class actions have already been filed against Equifax, and their classes are defined very broadly - that means that, unless these class actions get thrown out, you're likely already a plaintiff in one of them. 

3. Participating in a class action could get you screwed - here's how to get out.

So you're already part of a class action - why is that bad? Why not just sit back, relax and wait for your check in the mail? 

Class actions are cookie cutter lawsuits - they treat each plaintiff involved (that's you) as if his or her experience and injuries are the same as everyone else's. If a class action succeeds, you'll get a cookie-cutter payout - something that's calibrated to the mean rather than to your specific situation. That's all well and good if you fare the same or better than most people in the class, but what if you don't?

None of us know the extent of our damages from the Equifax leak yet - it may take us years to figure out how much of our personal information was compromised and how it's going to be used, and we can expect the impacts to vary greatly by person. If you participate in the class action and accept the cookie-cutter payout, then you are waiving your right to pursue your individual damages. If it winds up that you faired much worse than average - say, your identity was completely stolen and your bank accounts and retirement funds drained - too bad, you're just going to have to live with your $500 class action payout check. 

So keep an eye on the class actions, especially when they get close to settling. If you hear about a settlement for some small to moderate sum, strongly consider opting out and preserving your right to bring your own suit. Opting out is easy - it usually involves entering your information into an online database. There will be specific instructions on the settlement notice (which should be sent to your address) or you can likely find them on websites like topclassactions.com.

4. Equifax can force some people into arbitration and out of class actions - but they've said they won't.

If you've ever signed up for any of Equifax's services, including signing up for free credit monitoring in the wake of the breach, you've already signed their "mandatory arbitration clause". This means that Equifax can technically force you to use arbitration instead of filing an individual lawsuit or participating in a class action. However, Equifax has publicly stated that they won't force breach-related claims into arbitration, so your options are still open.

5. Individual lawsuits will be long, complicated and expensive.

So you're not wild about participating in a class action, and you're trying to choose between an individual lawsuit and an arbitration - how do you choose? One thing to keep in mind is that an individual lawsuit will likely take years to move its way through the court system. It will also be a complicated process - one that will require you to either hire professional help at several hundred dollars an hour or quit your job to become an amateur legal expert.

While some types of claims will allow you to hire a lawyer without any upfront cost, this probably isn't one of them. If you bring an individual suit, you'll likely have to cover your own legal fees, upfront, in cash. 

6. Arbitration has its problems - but if you want to have the option, you have to act now.

Arbitration has a very bad reputation among consumer advocates. That's because it's rightfully seen as secretive and heavily biased towards companies over consumers. It's also because it isn't subject to many of the due process rights and protections that we've built into our public judicial system. But that doesn't mean you should dismiss it out of hand. 

Despite its flaws, arbitration is generally faster, simpler and cheaper than an individual lawsuit. You can probably make it through the process without ever hiring a lawyer, and without any other significant costs. In most cases, Equifax will even reimburse you for the $200 filing fee to start the arbitration. There's also reason to believe that the traditional flaws of arbitration will be less relevant in the Equifax case - once the class actions have been litigated and there's a general consensus in the courts that Equifax is liable for damages, it will be hard for an arbitrator to disagree.

So, while you should be wary of arbitration in general, it may be your best ticket to personalized compensation in this case. Here's the catch - arbitration is a creature of contract, so both you and Equifax have to agree, in writing, to subject the dispute to arbitration. If you've never signed up for an Equifax service, then you don't have that agreement in place. But you can lock Equifax into arbitration if you act quickly - all you have to do is sign up for their free credit monitoring service, and don't opt out of the arbitration agreement. 

7. No matter how you choose to pursue Equifax, you probably don't have a claim. Yet.

In order to bring any sort of legal claim against Equifax, you need to have incurred damages. No damages, no compensation. So if your identity hasn't been stolen, if your information hasn't been used, and if you haven't been forced to take expensive steps to protect yourself, you probably don't have grounds to bring a claim yet. 

8. You only get one bite at the apple.

As part of a settlement with Equifax through any of these channels, you'll likely have to sign a release of future claims arising from the breach. That means that you shouldn't rush to the courthouse to bring a small claim for the emotional distress that the breach has caused you. If you do, you may forfeit your ability to seek compensation for the identity theft that's still in the works. So keep your powder dry - save the legal tools for when you really need them. Hopefully you never will.