What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2021-02-25 compared with 2020-02-20 · 134 added, 101 removed, 329 unchanged (42% of the section changed)

11 unchanged sentences

We maintain support operations in the Republic of Ireland, Chile, Costa Rica and India.

We also offer Equifax branded credit services in Russia through a joint venture, have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and the United Arab Emirates, have an investment in a consumer and commercial credit information company in Brazil and have an investment in an identity authentication company in Canada.

We also offer Equifax branded credit services in Russia through a joint venture, have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and the United Arab Emirates and have an investment in a consumer and commercial credit information company in Brazil.

Equifax was originally incorporated under the laws of the State of Georgia in 1913, and its predecessor company dates back to 1899.

4 unchanged sentences

• Workforce Solutions — provides services enabling customers to verify income and employment (Verification Services) of people in the U.S., as well as providing our employer customers with services that assist them in complying with and automating certain payroll-related and human resource management processes throughout the entire cycle of the employment relationship, including unemployment cost management, employee onboarding, tax credits and incentives, I-9 management and compliance, tax form management services and Affordable Care Act management services (Employer Services).

Workforce Solutions has recently established Verifications Service operations in Canada and is working toward a similar operation in Australia.

Workforce Solutions recently established operations in Canada and Australia.

• International — provides products and services similar to those available in the USIS operating segment but with variations by geographic region.

3 unchanged sentences

We also sell consumer credit information to resellers who may combine our information with other information to provide direct-to-consumer monitoring, reports and scores.

2017 Cybersecurity Incident

In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of certain personally identifiable information of U.S., Canadian and U.K.

Criminals exploited a software vulnerability in a U.S.

website application to gain unauthorized access to our network.

In March 2017, the U.S.

Department of Homeland

Security distributed a notice concerning the software vulnerability.

We undertook efforts to identify and remediate vulnerable systems;

however, the vulnerability in the website application that was exploited was not identified by our security processes.

We discovered unusual network activity in late-July 2017 and upon discovery promptly investigated the activity.

Once the activity was identified as potential unauthorized access, we acted to stop the intrusion and engaged a leading, independent cybersecurity firm to conduct a forensic investigation to determine the scope of the unauthorized access, including the specific information impacted.

Based on our forensic investigation, the unauthorized access occurred from mid-May 2017 through July 2017.

No evidence was found that the Company’s core consumer, employment and income, or commercial reporting databases were accessed.

We continue to cooperate with law enforcement in connection with the criminal investigation into the actors responsible for the 2017 cybersecurity incident.

On February 10, 2020, the U.S.

Department of Justice announced that four members of the Chinese People’s Liberation Army were indicted on criminal charges for their involvement in the 2017 cybersecurity incident.

The Company has taken actions to provide consumers with tools to protect their credit data.

Immediately following the announcement of the 2017 cybersecurity incident, the Company devoted substantial resources to notify people of the incident and to provide free services to assist people in monitoring their credit and identity information.

Since then, the Company has been focused on implementing significant improvements to its data security systems, technology platforms and risk management processes, in an effort to underpin its business strategy.

Our Business Strategy

2 unchanged sentences

• Lead our industry in data security.

We are focused on becoming a leader in our industry in the effectiveness of our data and technology security practices.

We are focused on being a leader in our industry in the effectiveness of our data and technology security practices.

This includes building an Equifax culture that considers data and technology security, and more broadly risk management, as a primary requirement in all decisions.

1 unchanged sentence

• Transform our technology.

We are rebuilding our technology infrastructure, accelerating our migration to a public cloud environment, employing virtual private cloud deployment techniques, and rationalizing and rebuilding our application portfolio using cloud-native services.

This technology transformation is a significant part of our goal of leading our industry in data and technology security capability.

Our goal is to deliver market-leading capabilities to our customers in terms of speed of bringing new products and services to market;

ease of customer and partner implementation and integration;

ease of consumer access to and interaction with Equifax;

system resiliency and uptime;

and ultimately cost to serve.

We are undergoing a multi-year technology transformation which is already broadly impacting our internal and external information technology systems.

We have undertaken a cloud data and technology transformation in order to rebuild our technology infrastructure, accelerate our migration to a public cloud environment, employ virtual private cloud deployment techniques, and rationalize and rebuild our application portfolio using cloud-native services.

Our investment in cloud-native technology is enabling the creation of our single data fabric and implementation of best-in-class cloud-based tools and capabilities.

Our goal is to leverage our cloud data and technology transformation to accelerate innovation and new product development;

deliver market-leading capabilities to our customers;

facilitate customer and partner implementation and integration;

improve ease of consumer access to and interaction with Equifax;

and strengthen system resiliency and uptime.

• Lead in data and analytics, to develop unparalleled analytical insights leveraging Equifax’s unique data.

We use proprietary advanced analytical platforms, including capabilities in machine learning and advanced visualization tools, to leverage our unique data to develop leading analytical insights that enhance the precision of our customers’ decisioning activities.

As a part of the rebuilding of our technology infrastructure, we are also rebuilding our analytical platforms using cloud native services in a public cloud environment.

We strive to continue to advance these capabilities through ongoing data monetization activities, the acquisition of distinctive and differentiated assets, and continued advancement of capabilities in artificial intelligence and machine learning.

6 unchanged sentences

Equifax understands the importance of providing consumers with user-friendly capabilities to see, understand and question their consumer credit file and information.

As part of our

technology transformation, we are rebuilding our digital and call center technology infrastructure to provide an experience focused on making consumers’ interactions with Equifax as effective and efficient as possible.

As part of our technology transformation, we are rebuilding our digital and call center technology infrastructure to provide an experience focused on making consumers’ interactions with Equifax as effective and efficient as possible.

• Foster a culture of customer centricity.

3 unchanged sentences

We strive to accelerate innovation through expanded customer focus and collaboration.

We intend to leverage our unique data assets and capabilities, as well as customer expertise and customer data and technology assets, to help us jointly create high-value analytical products and services targeted at a broader range of customer needs.

We intend to leverage our cloud native technology and unique data assets and capabilities, as well as customer expertise and customer data and technology assets, to help us jointly create high-value analytical products and services targeted at a broader range of customer needs.

We seek to expand partnerships in order to further broaden the key customer domains and verticals that our products and services are able to serve.

We seek to increase our share of clients’ spend on information-related services through these new products and services, price our products and services in accordance with the value they represent to our customers, increase the range of current products and services utilized by our clients, and improve the quality and effectiveness of our support for both customers and consumers.

range of current products and services utilized by our clients, and improve the quality and effectiveness of our support for both customers and consumers.

We believe there are opportunities to continue to expand in the U.S.

3 unchanged sentences

• Build a world-class Equifax team by investing in talent to drive our strategy and promote a culture of innovation.

We attract top talent by providing opportunities to grow and lead within our company.

We regularly undertake talent initiatives to engage, develop and retain our top talent.

At Equifax, we are focused on nurturing our people by providing meaningful opportunities for career advancement and development, fostering an inclusive and diverse work environment, and promoting employee engagement and recognition.

We regularly undertake talent initiatives to attract, develop and retain our top talent.

Markets and Clients

Our products and services serve clients across a wide range of verticals, including financial services, mortgage, state and federal government, employers, consumer, commercial, telecommunications, retail, automotive, utilities, brokerage, healthcare and insurance industries.

Our products and services serve clients across a wide range of verticals, including financial services, mortgage, government (state, federal and local), employers, consumer, commercial, telecommunications, retail, automotive, utilities, brokerage, healthcare and insurance.

We also serve consumers directly.

Our revenue streams are highly diversified with our largest client providing less than 3% of total revenue.

Our revenue streams are highly diversified with our largest client providing approximately 3% of total revenue.

The following table summarizes the various end-user markets we serve:

(1) The Mortgage vertical as a percentage of consolidated revenue increased to 32% in 2020 from 20% in 2019 due to the significant growth in U.S.

mortgage volume.

(2) Predominantly sold to companies who serve the direct-to-consumer market and includes other small end user markets.

2 unchanged sentences

We market our products and services primarily through our own direct sales organization that is structured around sales teams that focus on client segments typically aligned by vertical markets and geography.

In the U.S., the vertical market sales teams for the Mortgage, Financial, Government and Automotive markets sell products from both the USIS and Workforce Solutions business units.

Sales groups are based in field offices located throughout the U.S., including our headquarters in Atlanta, Georgia, and in the countries where we have operations.

We also market our products and services through indirect channels, including alliance partners, joint ventures and other resellers.

In addition, we sell through direct mail and the internet.

In addition, we sell through the internet.

Revenue from international clients, including end users and resellers, amounted to 22% of our total revenue in 2020, 27% of our total revenue in 2019 and 29% of our total revenue in 2018.

13 unchanged sentences

Direct-to-consumer credit monitoring X X

Employment and income verification services X X

Employment and income verification services X X X

Business process outsourcing (BPO) X X X

1 unchanged sentence

Each of our operating segments is described more fully below.

For the operating revenue, operating income and total assets for each segment see Note 13 of the Notes to the Consolidated Financial Statements in this report.

For the operating revenue, operating income and total assets for each segment see Note 13 of the Notes to the Consolidated Financial Statements in Item 8 of this report.

USIS provides consumer and commercial information solutions to businesses in the U.S.

1 unchanged sentence

Online Information Solutions.

Online Information Solutions’ products are derived from multiple large and comprehensive databases of consumer and commercial information that we maintain about individual consumers and businesses, including credit history, current credit status, payment history and address information.

Our clients utilize the information and analytical insights we provide to make decisions for a broad range of financial and business purposes, such as whether, and on what terms, to approve auto loans or credit card applications, and whether to allow a consumer or a business to open a new utility or telephone account.

6 unchanged sentences

These decisioning technology applications assist with a wide variety of decisioning activities, including determining pre-approved offers, cross-selling of various products, determining deposit amounts for telephone and utility companies, and verifying the identity of their customers.

We have also compiled commercial databases regarding businesses in the U.S., which include loan, credit card, public records and leasing history data, trade accounts receivable performance, and Secretary of State and Securities and Exchange Commission registration information.

We have also compiled commercial databases regarding businesses in the U.S., which include loan, credit card, public records and leasing history data, trade

accounts receivable performance, and Secretary of State and Securities and Exchange Commission registration information.

We offer scoring and analytical services that provide additional information to help mitigate the credit risk assumed by our clients.

7 unchanged sentences

and to realize additional revenue from existing customers through more effective cross-selling of additional products and services.

Our products are also utilized by customers to support digital identity verification and fraud detection and protection.

These products utilize information derived from consumer and commercial information, including credit, income, asset, liquidity, net worth and spending activity, which also support many of our Online Information Solutions’ products.

18 unchanged sentences

In addition, we provide software and services to employers to assist in their compliance with the Affordable Care Act.

The Work Number ® .

The Work Number ® is our key repository of employment and income data serving our Verification Services and Employer Services business units.

We rely on payroll data received from tens of thousands of organizations to regularly update the database.

We rely on payroll data received from over one million organizations to regularly update the database.

The updates occur as employers and other data contributors transmit data electronically to Equifax from their payroll systems.

3 unchanged sentences

We have not experienced significant turnover in the employer contributors to the database because we generally do not charge them to add their employment data to The Work Number ® database and the verification service we offer relieves them of the administrative burden and expense of responding to third-party employment verification requests while providing them with the assurance that the process is automated and not subject to human interpretation.

The Work Number ® database is approaching 380 million current and historic employment records at December 31, 2019.

The Work Number ® database is over 460 million current and historic employment records at December 31, 2020.

Workforce Solutions has established an income and employment verification service in Canada, known as Verification Exchange.

6 unchanged sentences

We also offer specialized services that help our customers better manage risk in their consumer portfolios.

This operating segment’s

products and services generate revenue in Argentina, Australia, Canada, Chile, Costa Rica, Ecuador, El Salvador, Honduras, India, Mexico, New Zealand, Paraguay, Peru, Portugal, Spain, the U.K.

This operating segment’s products and services generate revenue in Argentina, Australia, Canada, Chile, Costa Rica, Ecuador, El Salvador, Honduras, India, Mexico, New Zealand, Paraguay, Peru, Portugal, Spain, the U.K.

We also maintain support operations in the Republic of Ireland, Chile, Costa Rica, and India.

4 unchanged sentences

These products are sold in the U.K.

Marketing products, which are similar to those offered in our Financial Marketing Services business unit in the U.S., are primarily available in the U.K.

Limited marketing products are available in the U.K.

and, to a lesser extent, in Spain.

2 unchanged sentences

Asia Pacific.

Our Asia Pacific operation provides consumer and commercial information solutions products, marketing products, workforce solutions, and personal solutions products.

Our Asia Pacific operation provides consumer and commercial information solutions products, marketing products, workforce solutions, and consumer credit protection products.

We offer a full range of products, generated from credit records and other data, including credit reporting and scoring, decisioning technology, risk management, identity management, authentication and fraud detection services.

4 unchanged sentences

Latin America.

Our Latin America operation provides consumer and commercial information solutions products, marketing products and personal solutions products.

Our Latin America operation provides consumer and commercial information solutions products, marketing products and consumer credit protection products.

We offer a full range of products, generated from credit records that we maintain, including credit reporting and scoring, decisioning technology, risk management, identity management, authentication and fraud detection services.

Our consumer products are the primary source of revenue in each of the countries in this region in which we operate.

Our consumer products are the primary source of revenue in each of the countries in this region in which we operate, with the exception of Mexico where debt management services constitute the core of the business.

We also offer various commercial products, which include credit reporting, decisioning tools and risk management services, in the countries we serve.

15 unchanged sentences

Revenue generated by the online consumer information services component of our USIS operating segment is typically the lowest during the first quarter, when consumer lending activity is at a seasonal low.

Revenue generated from the Employer Services business unit within the Workforce Solutions operating segment is generally higher in the first quarter due primarily to the provision of Form W-2 preparation services which occur in the first quarter each year.

Revenue generated from the Employer Services business unit within the Workforce Solutions operating segment is generally higher in the first quarter due primarily to the provision of Form W-2 and 1095-C services that occur in the first quarter each year.

Revenue generated from our financial wealth asset products and data management services in our Financial Marketing Services business is generally higher in the fourth quarter each year due to the significant portion of our annual renewals and deliveries which occur in the fourth quarter of each year.

9 unchanged sentences

We emphasize our improved decision making and product quality while remaining competitive on price.

Our marketing services products also compete with the foregoing companies and others who offer demographic information products, including Acxiom, Harte-Hanks and Infogroup.

We also compete with Fair Isaac Corporation with respect to certain of our analytical tools and solutions.

• Competition for our commercial solutions products primarily includes Experian, Dun & Bradstreet and Cortera, and providers of these services in the international markets we serve.

• Competition in the Verification Services market includes employers who manage verifications in-house, lenders who obtain verifications directly from employers, and other online and offline verification companies, such as CCC Verify, Thomas & Company and First Advantage.

We also compete with Fair Isaac Corporation with respect to certain of our analytical tools and solutions and LexisNexis in identity and fraud and other solutions.

• Competition for our commercial solutions products primarily includes Experian, Dun & Bradstreet and Moody's, and providers of these services in the international markets we serve.

Competition in the Employer Services market is diverse and includes in-house management of such services or the outsourcing of one or more of such services to other third-party outsourced providers like Corporate Cost Control and Thomas & Company;

1 unchanged sentence

human resources management services providers such as Oracle and Silk Road;

payroll processors such as ADP and Ceridian;

payroll processors such as ADP, Paychex and Ceridian;

accounting firms such as PwC and EY;

17 unchanged sentences

federal, state and foreign laws for strategic or financially important intellectual property developed in connection with our business.

Certain intellectual property, where appropriate, is protected by registration under applicable trademark laws or by prosecution of patent applications.

Certain intellectual property, where appropriate, is protected by filing for registration under applicable trademark and patent laws.

We own a number of patents registered in the U.S.

and several in foreign countries.

We also have certain registered trademarks, service marks, logos and internet domain names in the U.S.

and in several foreign countries.

We also have both registered and common law trademarks, service marks, logos and internet domain names in the U.S.

and in many foreign countries, the most important of which are “Equifax,” “The Work Number,” “Interconnect,” “Equifax Ignite,” and variations thereof.

2 unchanged sentences

However, certain Company trademarks, which contribute to our identity and the recognition of our products and services, including but not limited to the “Equifax” trademark, are an integral part of our business, and their loss could have a significant negative impact on us.

We also protect certain of our confidential intellectual property and technology in compliance with trade secret laws and through the use of nondisclosure agreements and other means of protecting and limiting access to such information.

We also protect certain of our confidential intellectual property and technology with trade secret laws where applicable and through the use of nondisclosure agreements and other means of protecting and limiting access to and use of such information.

We license other companies to use certain data, software, and other technology and intellectual property rights we own or control, primarily as core components of our products and services, on terms that are consistent with customary industry standards and that are designed to protect our interest in our intellectual property.

9 unchanged sentences

Failure to satisfy those legal and regulatory requirements, or the adoption of new laws or regulations, could have a significant negative impact on our results of operations, financial condition or liquidity.

federal, state, local and foreign laws and regulations are evolving and can be subject to significant change.

federal, state, local and foreign laws and regulations are evolving and can be subject to significant change, particularly given the recent change in U.S.

presidential administrations and the new U.S.

In addition, the application and interpretation of these laws and regulations are often uncertain.

3 unchanged sentences

Summary of U.S.

Regulation Relating to Consumer and Data Protection

Regulations Relating to Consumer and Data Protection

operations are subject to numerous laws and regulations governing the collection, protection and use of consumer credit and other information, and imposing sanctions for the misuse of such information or unauthorized access to data.

Many of these provisions also affect our customers’ use of consumer credit or other data we furnish.

Examples of the most significant of these laws include, but are not limited to, the following:

Examples of the most significant U.S.

laws include, but are not limited to, the following:

Federal Laws and Regulation

• FCRA - The Fair Credit Reporting Act (“FCRA”) regulates consumer reporting agencies, including us, as well as data furnishers and users of consumer reports such as banks and other companies.

The Fair Credit Reporting Act (“FCRA”) regulates consumer reporting agencies, including us, as well as data furnishers and users of consumer reports such as banks and other companies.

FCRA provisions govern the accuracy, fairness and privacy of information in the files of consumer reporting agencies (“CRAs”) that engage in the practice of assembling or evaluating certain information relating to consumers for certain specified purposes.

2 unchanged sentences

CRAs are required to make available to consumers a free annual credit report and free credit freezes.

The FCRA imposes many other requirements on

CRAs, data furnishers and users of consumer report information.

The FCRA imposes many other requirements on CRAs, data furnishers and users of consumer report information.

Violation of the FCRA can result in civil and criminal penalties.

1 unchanged sentence

Regulatory enforcement of the FCRA is under the purview of the United States Federal Trade Commission (“FTC”), the Consumer Financial Protection Bureau (“CFPB”), and state attorneys general, acting alone or in concert with one another.

• The Dodd-Frank Act - Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) created the CFPB.

• Dodd-Frank Act.

Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) created the CFPB.

The Dodd-Frank Act provides the CFPB with examination and supervisory authority over CRAs, including us.

5 unchanged sentences

Also, the Dodd-Frank Act empowers state attorneys general and state regulators to bring civil actions in certain circumstances for the kind of cease and desist orders available to the CFPB (but not for civil penalties).

• FTC Act - The Federal Trade Commission Act (“FTC Act”) prohibits unfair methods of competition and unfair or deceptive acts or practices.

The Federal Trade Commission Act (“FTC Act”) prohibits unfair methods of competition and unfair or deceptive acts or practices.

Under the FTC Act, the FTC’s jurisdiction includes the ability to bring enforcement actions based on the security measures we employ to safeguard the personal data of consumers.

1 unchanged sentence

There is no private right of action under the FTC Act.

• GLBA - The Financial Services Modernization Act of 1999, or Gramm-Leach-Bliley Act (“GLBA”), regulates, among other things, the use of non-public personal information of consumers that is held by financial institutions, including us.

The Financial Services Modernization Act of 1999, or Gramm-Leach-Bliley Act (“GLBA”), regulates, among other things, the use of non-public personal information of consumers that is held by financial institutions, including us.

We are subject to various GLBA provisions, including rules relating to the use or disclosure of the underlying data and rules relating to the physical, administrative and technological protection of non-public personal financial information.

1 unchanged sentence

Regulatory enforcement of the GLBA is under the purview of the FTC, the CFPB, the federal prudential banking regulators, the SEC and state attorneys general, acting alone or in concert with each other.

• CROA - The Credit Repair Organizations Act (“CROA”) regulates companies that claim to be able to assist consumers in improving their credit standing.

The Credit Repair Organizations Act (“CROA”) regulates companies that claim to be able to assist consumers in improving their credit standing.

There have been efforts to apply the CROA to credit monitoring services offered by CRAs and others.

1 unchanged sentence

Consumers can sue to recover the greater of the amount paid or actual damages, punitive damages, costs, and attorney’s fees for violations of the CROA.

State Laws and Regulation Relating to Consumer and Data Protection

State Laws and Regulations Relating to Consumer and Data Protection

• A number of states have enacted requirements similar to the federal FCRA.

6 unchanged sentences

• The New York State Department of Financial Services (“NYDFS”) has enacted extensive regulatory requirements applicable to CRAs that require registration with that agency, prohibit unfair and deceptive consumer practices and require compliance with significant portions of the NYDFS cybersecurity rules.

• We or certain of our operations are also subject to and affected by new state privacy and data security laws such as new data broker registration requirements in California and Vermont, and the recently implemented California Consumer Privacy Act (“CCPA”).

• We or certain of our operations are also subject to and affected by new and evolving state privacy and data security laws such as new data broker registration requirements in California and Vermont, and the California Consumer Privacy Act (“CCPA”).

The CCPA became effective January 1, 2020 and imposes additional data privacy requirements on many businesses operating in the state, including, potentially, with respect to employee data in addition to consumer data.

2 unchanged sentences

The CCPA also contains a private right of action in the event that a business suffers a security breach that was due to unreasonable security measures.

In November 2020, California voters passed the California Privacy Rights Act (“CPRA”), which maintains the core framework but expands the requirements of the CCPA effective January 1, 2023.

We may also become subject to and affected by new and proposed state privacy laws similar to the CCPA.

A number of other states, such as Florida, Illinois, Nebraska, New Hampshire, New York, Virginia and Washington, have introduced comprehensive data privacy legislation modeled after, and which contain certain elements of, the CCPA or the European General Data Protection Regulation.

More states are expected to introduce similar legislation in 2020 and if enacted it is expected that such laws would contain variations and impose new compliance risks and obligations on the Company.

A number of state legislatures, including New York and Washington, have introduced comprehensive data privacy legislation modeled after, and which contain certain elements of, the CCPA or the European Union's General Data Protection Regulation (“GDPR”), which is an extremely broad privacy law.

Additional state legislatures are expected to consider similar legislation in 2021.

If enacted, such laws may contain variations and impose new compliance risks and obligations on the Company.

• State banking and financial services regulatory agencies have asserted either express or implied authority under applicable state laws to examine us as a third-party service provider to financial institutions, and in certain cases to bring enforcement actions against us.

Generally, such examinations, and related enforcement actions, are focused on assessing our safety and soundness in support of financial institutions we serve.

In 2018, we entered into a consent order with certain state banking regulators in response to their multi-state review of our information security program.

This consent order obligated us to, among other things, make certain changes to our corporate governance and information security practices.

• We are also subject to federal and state laws that are generally applicable to any U.S.

1 unchanged sentence

We continuously monitor legislative and regulatory activities that involve credit reporting, data privacy, security and other relevant issues to identify issues in order to remain in compliance with all applicable laws and regulations.

Summary of International Regulation Relating to Consumer and Data Protection

Consent Orders with the FTC, CFPB, MSAG Group and NYDFS

• As part of the Consumer Settlement (as defined below), we entered into consent orders with the FTC, CFPB, MSAG Group (as defined below) and NYDFS pursuant to which we agreed to implement certain business practice commitments related to consumer assistance and our information security program, including third party assessments of our program.

These business practice commitments are extensive and require a significant amount of attention from management.

Summary of International Regulations Relating to Consumer and Data Protection

We are subject to various data protection, privacy and consumer credit laws and regulations in the foreign countries where we operate.

12 unchanged sentences

Information Commissioner’s Office, which focuses on upholding information rights in the public interest and the protection of data privacy for individuals.

• In Europe , we are subject to the European General Data Protection Regulation (“GDPR”).

In the U.K., we are subject to provisions that are broadly equivalent to the European Union’s General Data Protection Regulation (described below).

These equivalent provisions were adopted into U.K.

laws following the end of the transition period that followed the U.K.’s exit from the EU

• In Europe , we are subject to the EU's GDPR, which is an extremely broad and sweeping privacy law.

The GDPR establishes multiple privacy and data protection requirements that are more specific and comprehensive than those of the U.S.

4 unchanged sentences

It sets out specific obligations with respect to accountability and identifying purposes, consent, collection, use, disclosure, retention, accuracy, safeguards, personal data breach reporting, individual access and compliance.

Alberta, British Columbia and Quebec privacy legislation sets out similar privacy laws and rules that apply to our Canadian

Alberta, British Columbia and Quebec privacy legislation sets out similar privacy laws and rules that apply to our Canadian business.

The federal and provincial privacy regulators have powers of investigation and intervention, and provisions of Canadian law regarding civil liability apply in the event of unlawful processing which is prejudicial to the persons concerned.

3 unchanged sentences

• In Latin America, data protection and credit reporting laws and regulations vary considerably among Latin American countries.

Some countries, such as El Salvador, Ecuador and Honduras, establish a constitutional right to privacy without general data protection standards or a data protection authority.

Some countries, such as El Salvador, Paraguay, Chile and Honduras, establish a constitutional right to privacy without general data protection standards or a data protection authority.

These countries, however, have laws that govern the functioning of credit bureaus.

In 2018, Ecuador amended a 2017 law relating to the collection of credit data and the operation of a credit bureau within the country allowing the existence of private credit bureaus along with the public credit data registry to be established.

Other countries, such as Argentina, Uruguay, Peru, Costa Rica and most recently Brazil have enacted comprehensive data protection legislation similar to the European GDPR.

Brazil’s General Data Protection Law is scheduled to go into effect in August 2020.

Other countries, such as Argentina, Uruguay, Peru, Costa Rica and most recently Brazil have enacted comprehensive data protection legislation similar to the EU's GDPR.

The EU recognizes Argentina and Uruguay as having adequate levels of protection for personal data transfers and processing.

Peru also has a specific law for credit reporting.

Paraguay and Chile have fewer comprehensive data protection laws in place, but do have rules regarding reporting periods, consent and data collection.

• In Australia, we are subject to regulatory oversight by various agencies.

2 unchanged sentences

Our credit reporting business, Equifax Information Services and Solutions, is a member of an external dispute resolution scheme, the Australian Financial Complaints Authority, which has been approved by the OAIC to handle privacy and credit reporting complaints and make binding determinations.

The OAIC can register codes of practice under the Privacy Act 1988, and has registered the Privacy (Credit Reporting) Code 2014.

The OAIC can register codes of practice under the Privacy Act

1988, and has registered the Privacy (Credit Reporting) Code 2014.

The Australian Competition and Consumer Commission (“ACCC”) is the agency responsible for enforcing the Competition and Consumer Act of 2010 and related legislation concerning consumer protection and competition.

1 unchanged sentence

The Australian Retail Credit Association is a credit and credit reporting industry self-regulatory body, which administers principles and standards for the exchange of credit data between industry participants.

Equifax Australasia Credit Ratings Pty Limited (formerly named Corporate Scorecard Pty Limited, one of our Australian subsidiaries) holds an Australia Financial Services License, which allows it to provide general advice to wholesale clients by issuing a credit rating, and has been approved by the Reserve Bank of New Zealand as a rating agency under section 86 of the Non-bank Deposit Takers Act of 2013.

Equifax Australasia Credit Ratings Pty Limited (formerly named Corporate Scorecard Pty Limited, one of our Australian subsidiaries) holds an Australia Financial Services License, which allows it to provide general advice to wholesale clients by issuing a credit rating, and has been approved in New Zealand as a rating agency by the Reserve Bank of New Zealand under section 86 of the Non-bank Deposit Takers Act of 2013 (NZ).

The Australian Securities and Investments Commission regulates that business and has authority to investigate, prosecute, ban individuals, and to seek civil penalties.

In addition, new federal legislation comes into effect on April 1, 2020, mandating the supply by large banks of comprehensive credit information to credit reporting bodies, including Equifax, imposing certain disclosure, storage and reporting obligations on the credit reporting bodies and requiring the Attorney-General to review and report on the credit reporting system before October 1, 2023.

New federal legislation came into effect in February 2021 mandating the supply by large banks of comprehensive credit information to credit reporting bodies, including Equifax, imposing certain disclosure, storage and reporting obligations on the credit reporting bodies, requiring the provision by credit reporting bodies of free credit reports to consumers up to four times per year, permitting the reporting of financial hardship information within the credit reporting system and requiring the Attorney-General to review and report on the credit reporting system before October 1, 2024.

• In New Zealand, the regulatory framework provides for primary regulation under the Office of the Privacy Commissioner (“NZ OPC”).

3 unchanged sentences

The NZ OPC can issue practice codes under the Privacy Act 1993 and has issued and subsequently amended the Credit Reporting Privacy Code 2004.

New Zealand passed a new Privacy Act in 2020 that significantly expanded its privacy law.

A self-regulatory body, the Retail Credit Association of New Zealand addresses reciprocity of data issues relating to comprehensive credit reporting and data standards.

1 unchanged sentence

Entities that collect and maintain personal data and/or credit information must ensure that it is complete, accurate and safeguarded, and must adopt certain privacy principles with respect to collecting, processing, preserving, sharing and using such data and/or credit information.

Indian parliament is expected to pass legislation that would allow individuals to sue for damages in the case of a data breach, if the entity negligently failed to implement reasonable security practices and procedures to protect personal data and/or credit information and in 2018 the Personal Data Protection Bill was released by the Indian government (recently revised and retitled as the 2019 Personal Data Protection Bill).

The Indian parliament is expected to pass legislation that would allow individuals to sue for damages in the case of a data breach, if the entity negligently failed to implement reasonable security practices and procedures to protect personal data and/or credit information and in December 2019 legislators introduced the Personal Data Protection Bill, which is expected to be considered in 2021 with amendments.

This bill is expected to be enacted and eventually to impose additional privacy and data security requirements.

Our Indian joint venture is subject to regulation by the Reserve Bank of India, which is India’s central banking institution.

Our Indian business is subject to regulation by the Reserve Bank of India, which is India’s central banking institution.

• In Russia , credit reporting activities are governed by the Federal Law on Credit Histories No.218-fz, dated December 30, 2004.

1 unchanged sentence

Russia has also enacted a comprehensive data protection law that is similar to Europe’s approach and also has a data localization law.

In December 2019, a law increasing the fines for infringing Russia data localization and data protection laws came into force.

Tax Management Services

The Tax Management Services business within our Employer Services business unit in our Workforce Solutions segment is potentially impacted by changes in renewal or non-renewal of U.S.

In December 2019, a law increasing the fines for infringing Russia data localization and data protection laws came into force and Russia recently expanded its data protection laws to provide individuals with new rights.

Summary of Regulations Affecting our Employer Services Business

The Employer Services business unit within our Workforce Solutions business segment helps employers comply with various regulatory frameworks applicable to employers in the United States.

As a result, changes to those regulatory frameworks could impact the services we provide.

For instance, if the federal government or a state government mandates the use of E-Verify, our I-9 service may be impacted if the federal government changes the requirements for individuals to work in the United States.

The Unemployment Cost Management service could be impacted if a state government changes the requirements for employers to process and/or protest unemployment claims.

The Tax Management Services business within our Employer Services business is potentially impacted by changes in renewal or non-renewal of U.S.

federal and state tax laws or interpretations, for example, those pertaining to work opportunity tax credits and unemployment compensation claims.

Human Resources

Equifax employed approximately 11,400 employees in 22 countries as of December 31, 2020.

None of our U.S.

employees are subject to a collective bargaining agreement and no work stoppages have been experienced.

Pursuant to local laws, certain of our employees in Argentina and Spain are covered under government-mandated collective bargaining regulations that govern general salary and compensation matters, basic benefits and hours of work.

In some of our non-U.S.

subsidiaries, certain of our employees are represented by workers’ councils or statutory labor unions.

Our global employee base consisted of approximately 2,100 employees in our USIS business unit, 2,700 employees in our Workforce Solutions business unit, 3,900 employees in our International business unit, 500 employees in our Global Consumer Solutions business unit, and 2,200 employees in our corporate Centers of Excellence.

In 2020, we hired over 2,300 new employees and promoted approximately 1,100 employees as we continue to grow and transform our businesses around the world.

Inclusion and Diversity

We continue to make positive strides in support of our inclusion and diversity strategy.

As a visible commitment to inclusion and diversity, in 2020, we established our first Chief Talent and Diversity Officer title.

This key leadership position reports directly to our Chief Human Resources Officer and is responsible for activating our talent strategy with a focus on furthering an inclusive and diverse workforce and culture.

We are advancing this strategy through deepening our commitment to employee affinity networks around the world, open dialogues to enhance understanding and mutual listening, on-going I&D focused training, and cultural heritage celebrations.

We’ve consistently improved enterprise-wide trends around representation and promotions for both women and employees of diverse ethnic backgrounds, and pride ourselves on promoting and hiring highly-qualified candidates who enhance our culture, add diverse perspectives, and deliver on our business strategy.

Women and leaders of diverse ethnic backgrounds make up over half of Equifax’s senior leadership team, including three of the four business unit leaders.

Consistent with our commitment to diversity, we recently implemented the requirement for diverse candidate slates for all higher level management roles.

Workforce Health and Safety

In fiscal year 2020, the COVID-19 pandemic had a significant impact on our people.

The safety and wellbeing of our employees remains paramount, and we took several actions to best serve our employees.

These included:

• ensured that no employees lost their roles or experienced furloughs due to COVID by actively shifting employees to other roles to protect full employment;

• transitioned all non-essential employees to work from home early in the pandemic;

• established rigorous social distancing, sanitization and restricted occupancy requirements for all worksites;

• extended extra paid time off when person or family member under their care contracted COVID;

• provided all employees globally an extra day of paid time off to support mental health and well-being;

• provided nearly 4,000 employees around the world who are not bonus eligible a special employee appreciation bonus.

See “Recent Events and Company Outlook” included in Item 7., “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” for additional detail regarding the impact of COVID-19 on our company.

2017 Cybersecurity Incident

In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of certain personally identifiable information of U.S., Canadian and U.K.

Criminals exploited a software vulnerability in a U.S.

website application to gain unauthorized access to our network.

In March 2017, the U.S.

Department of Homeland Security distributed a notice concerning the software vulnerability.

We undertook efforts to identify and remediate vulnerable systems;

however, the vulnerability in the website application that was exploited was not identified by our security processes.

We discovered unusual network activity in late-July 2017 and upon discovery promptly investigated the activity.

Based on our forensic investigation, the unauthorized access occurred from mid-May 2017 through July 2017.

No evidence was found that the Company’s core consumer, employment and income, or commercial reporting databases were accessed.

On February 10, 2020, the U.S.

Department of Justice announced that four members of the Chinese People’s Liberation Army were indicted on criminal charges for their involvement in the 2017 cybersecurity incident.

The Company has taken actions to provide consumers with tools to protect their credit data.

Immediately following the announcement of the 2017 cybersecurity incident, the Company devoted substantial resources to notify people of the incident

and to provide free services to assist people in monitoring their credit and identity information.

Forward-Looking Statements

This report contains information that may constitute “forward-looking statements.” Generally, the words “believe,” “expect,” “intend,” “estimate,” “anticipate,” “project,” “will” and similar expressions identify forward-looking statements, which generally are not historical in nature.

All statements that address operating performance, events or developments that we expect or anticipate will occur in the future, including statements relating to future operating results and statements related to the 2017 cybersecurity incident and improvements in our information technology and data security infrastructure, including as part of our technology transformation, our strategy, our culture, our ability to innovate, the market acceptance of new products and services and similar statements about our business plans are forward-looking statements.

This report contains information that may constitute “forward-looking statements.” Generally, the words “believe,” “expect,” “intend,” “estimate,” “anticipate,” “project,” “will,” “may” and similar expressions identify forward-looking statements, which generally are not historical in nature.

All statements that address operating performance, events or developments that we expect or anticipate will occur in the future, including statements relating to future operating results, the 2017 cybersecurity incident, improvements in our information technology and data security infrastructure, including as a part of our cloud data and technology transformation, our strategy, our ability to mitigate or manage disruptions posed by COVID-19, the impact of COVID-19 and changes in U.S.

and worldwide economic conditions that materially impact consumer spending, consumer debt and employment and the demand for Equifax's products and services, our culture, our ability to innovate, the market acceptance of new products and services and similar statements about our business plans are forward-looking statements.

Management believes that these forward-looking statements are reasonable as and when made.

1 unchanged sentence

Business” and below in “Item 7.

Management’s Discussion and Analysis of Financial Condition and Results of Operation — Business Environment and Company Outlook.” These risks and uncertainties include, but are not limited to, those described below in “Item 1A.

Management’s Discussion and Analysis of Financial Condition and Results of Operation — Business Overview.” These risks and uncertainties include, but are not limited to, those described below in “Item 1A.

Risk Factors,” and elsewhere in this report and those described from time to time in our future reports filed with the United States Securities and Exchange Commission (“SEC”).

11 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business