Some of the information in the little-known database,
created through an Equifax-owned company called The Work Number, is sold to
debt collectors, financial service companies and other entities.
"It's the biggest privacy breach in our time, and it’s
legal and no one knows it’s going on," said Robert Mather, who runs a
small employment background company named Pre-Employ.com. "It's like a
secret CIA."
But salary information is also for sale by Equifax through
The Work Number. Its database is so detailed that it contains week-by-week
paystub information dating back years for many individuals, as well as other
kinds of human resources-related information, such as health care provider,
whether someone has dental insurance and if they’ve ever filed an unemployment
claim. In 2009, Equifax said the data covered 30 percent of the U.S. working
population, and it now says The Work Number is adding 12 million records
annually.Despite all the information Americans now share on social media and
websites, and all the data we know companies collect on us, one piece of
information is still sacred to most people: their salaries. After all, who
would post their salary as a status update on Facebook or in a tweet?
How does Equifax obtain this sensitive and secret
information? With the willing aid of thousands of U.S. businesses, including
many of the Fortune 500. Government agencies -- representing 85 percent of the
federal civilian population, including workers at the Department of Defense,
according to Equifax -- and schools also work with The Work Number. Many of
them let Equifax tap directly into their data so the credit bureau can always
have the latest employment information. In fact, these organizations actually
pay Equifax for the privilege of giving away their employees' personal
information.
Equifax turns around and sells some of this data to third
parties, including debt collectors and other financial services companies.
Equifax declined to be interviewed, but in an emailed
statement to NBCNews.com, it confirmed that it shares "employment
data" with debt collectors and others, and said it does so in compliance
with Fair Credit Reporting Act guidelines.
"In all cases, these entities must have a permissible
purpose to request employment information," Equifax spokesman Timothy
Klein said.
He also said consumers give these third parties the right to
access the data "at the time of application" for credit.
"A consumer grants verifiers (creditors) and their
assigned debt collectors the right to verify employment should the consumer
default on their account," he said.
Data for debt collectorsCompanies sign up for The Work
Number because it gives them an easy way to outsource employment verification
of former workers. Firms hate taking these calls, which usually come when a
former employee is applying for a new job, because they are a costly
distraction for human resources departments and open the firm up to lawsuits if
someone says something disparaging about the former employee. So they contract
with The WorkNumber, which automates the process. In exchange, firms upload
their human resources data to The Work Number, which was part of an independent
St.Louis-based firm named TALX until it was acquired by Equifax in 2007 for
$1.4 billion.
The Work Number offers consumers some benefits. It provides
an easy way for prospective landlords to verify an applicant's income, for example.
Consumers tell the Work Number they want a one-time access code, which they
then give to a landlord so he or she can verify that the potential tenant can
really afford the apartment.
But The Work Number serves dual purposes. It’s also a
massive database that Equifax monetizes in a variety of ways, despite the
reassuring-sounding messages found all over TheWorkNumber.com.
"Can just anyone get my income information from The
Work Number?" reads one passage. Answer: "No. You have to give
someone authorization to get your income information from the service."
Employers who sign up for the service go to great pains to
reassure workers that their data is safe and secret. Columbia University, when
it explained to employees it was transitioning to The Work Number, posted this
on the school's website:
Advertise | AdChoices
"You are the only person who can authorize access to
your salary information."
But Kathy Sandy of Sommerville, N.J. was surprised to find
that a debt collector had accessed information from her report two years ago,
something she learned only when she obtained her "consumer
disclosure" from The Work Number. Because the data is considered a credit
report, consumers are entitled to one free report every year. The report shows
what data the report contains, and what entities have seen it.
Sandy's Work Number report, which she shared with NBC News,
is 22 pages long -- an amazingly detailed history of every paycheck she had
received for years. The first page of the report lists "verifiers who have
requested your data in the past 24 months." On the list is "Pressler
and Pressler," a law firm that specializes in debt collection. The firm
had sued her in small claims court over a credit card debt that she says she
was already repaying.
"I found out debt collectors can access this
information, which is strange," Sandy said. "I assumed with The Work
Number, for that information, you had to have a (passcode) … but they got in,
and got it somehow without my consent."
In brochures where Equifax advertises sale of the data, it's
not shy about the source.
"The Work Number specializes in employment and income
verification. It's direct from the source: the employer. It's current, as of
the last pay period. It's delivered quickly -- on demand," says one
brochure, titled "Portfolio Monitoring."
In his statement to NBC News, Klein confirmed that "pay
rate" information is shared with third parties, including "mortgage,
auto and other financial services credit grantors," as authorized under
the Fair Credit Reporting Act.
He denied that salary information is sold to debt
collectors, however.
"Debt/Collection agencies may request employment
information -- which may be nothing more than verifying that a consumer is
working where they say they are – if it qualifies under permissible
purpose," he wrote. "Collections agencies are not provided salary
information."
That contradicts an assertion made recently by Equifax CEO
Richard Smith in 2009, when he talked about how detailed The Work Number data
is.
"With FirstSearch and TALX we can provide information
about a debtor’s location, income and employment," said Smith in an
interview published on NYSE Magazine’s website, referring to The Work Number’s
former parent company. "That can help prioritize which accounts to pursue
first. If they’re employed, that business has a better shot at collecting what
is owed to them."
Klein said Smith misspoke when describing TALX’s services,
and reiterated that salary information on consumers is not sold to debt
collectors.
'Unbelievably scary'With or without the income data, The
Work Number data is incredibly valuable to debt collectors -- and it may come
as a surprise to many workers that their employers, directly or unwittingly,
help debt collectors.
Equifax markets The Work Number specifically to student loan
issuers. In another brochure on the firm's website, Equifax brags that The Work
Number makes debt collectors' jobs easier.
"The Work Number produced a 5.5 percent lift in Right
Party Contact and a 7.3 percent lift in Collections Resolution versus current
skip-trace methods," the "case study" brochure says.
Equifax’s resale of The Work Number data doesn’t stop there.
It also offers "portfolio monitoring" to financial firms who might
want to market their products to consumers … or to get early warning on someone
who might soon land in financial trouble. It calls this "proactive
managing of risk."
Mather has been in the employer data business for more than
20 years, and he says that if Americans suspected their employers were giving
away their personal information to a credit bureau, they'd be shocked."The
Work Number is part of our employment and income verification service. It
provides continual track of changes to your customer or client portfolio,
delivered on demand per your schedule," it says. "Simply submit a
portfolio of customer or client accounts and The Work Number does the rest. ...
Using The Work Number to stay abreast of employment changes can expand your
ability to mitigate risk while maximizing product and service potential."
"The story here is how (The Work Number) is getting
this information," he said. "When people find out, no respectable
employer will continue to do this."
Larry Ponemon is a privacy expert who operates The Ponemon
Institute, a consulting firm. He said he’d never heard of companies selling
employer data to debt collectors.
"Are you joking? Oh my god, I'm shocked," Ponemon
said when the business was described to him. "This is unbelievably scary.
I consider payroll information very sensitive and private." In studies
he's conducted, salary data is always among the information consumers say is
most private.
"If the public knew about this, there would be such
outrage," he said. "It's just ... really depressing."
Paul Stephens, director of policy and advocacy at the
Privacy Rights Clearinghouse, had heard of The Work Number, but only because
some consumers have complained to his agency that the data in its database is
inaccurate. Some workers find that when they try to use the information for
employment verification, their titles are outdated or otherwise misrepresent
their work history, which can be embarrassing for a job applicant.
When told that the data is sold to third parties, he said he
was under the impression the data was not shared.
"I think it is something that would be offensive to
many people. One typically considers salary information to be shared by your
employer just with IRS," he said.
A glance at the language on The Work Number's website
suggested to Stephens that the firm is legally within its rights to share the
information, however.
"You get into the 'permissible purpose' doctrine,"
he said. "Debt collectors have a permissible purpose to look at your
credit information. It was my impression that the data was only being given out
when employees released it."
'Secret' process?Data brokers are under heightened scrutiny
in Washington, D.C., lately. There are two separate congressional
investigations of the industry, and the Federal Trade Commission announced in
December that it had begun an inquiry into how brokers obtain their
information. Equifax received an inquiry letter from the FTC, but only for the
data broker portion of its business involving non-financial data, such as
criminal background records and address information.
Credit reporting agencies, such as The Work Number, are
distinct from data brokers and are governed by special rules. Ironically, those
special rules may open the door for Equifax -- and the credit-reporting side of
its business -- to resell the salary information, says Katrina Blodgett, a
lawyer with the Federal Trade Commission. She is one the agency’s experts on
the Fair Credit Reporting Act.
The FTC filed a case against TALX and Equifax in 2008 for
allegedly failing to provide employers with sufficient notice about their
disclosure responsibilities under the Fair Credit Reporting Act. Equifax
admitted no wrongdoing and paid a small fine.
Blodgett said the Fair Credit Reporting Act and subsequent
updates give consumers specific legal rights, such as the ability to dispute
errors in credit reports. But it also creates permissible purposes for access, including
giving financial service companies the right to review credit reports of
consumers they do business with.
Advertise | AdChoices
"It’s not as easy as it should be to say whether debt
collectors can get your consumer reports, because it depends on the
circumstance," she said, adding that she believed Equifax could have the
right to sell the salary information to debt collectors because it is part of a
credit report.
Much attention has been paid to the use of credit reports by
human resource departments in recent years, and Congress gave job applicants
special rights when a credit report is used during the job interview process.
The reverse isn’t true, however, Blodgett pointed out.
"There are special restrictions on how credit reports
can be used in hiring decisions, but there are no special restrictions on how
employment reports (such as salary information) is used for non-employment
purposes," she said.
She said she wasn’t surprised that Equifax is selling the
information in The Work Number.
"They are a credit bureau. They sell credit information
to lenders," she said.
Mather wants the sale of employee information halted. His
firm also performs third-party employment verification, but he does not resell
the data he collects.
"I strongly believe there is no reason to resell
employee information to debt collectors without the permission of the employer
and employee," he said. "This 'secret' process needs to stop. I hope
eventually a simple law is passed making it required to get the permission of
the employee BEFORE his information is resold. It simply should NOT be used for
any other purpose except for employment purposes without permission. In my
view, it is a betrayal of trust."
Consumers who want to see what information The Work Number
has on their employment historycan visit this page on the TheWorkNumber.com.
While reports are available online, consumers may have to fill out a form and
mail it to The Work Number in some cases.
