An NBC News investigation released yesterday revealed that credit reporting agency Equifax has assembled a private database containing the employment and salary records of more than one-third of U.S. adults, and is perfectly fine selling that data off to the highest bidder:
Some of the information in the little-known database, created through an Equifax-owned company called The Work Number, is sold to debt collectors, financial service companies and other entities… [...]
Its database is so detailed that it contains week-by-week paystub information dating back years for many individuals, as well as other kinds of human resources-related information, such as health care provider, whether someone has dental insurance and if they’ve ever filed an unemployment claim. In 2009, Equifax said the data covered 30 percent of the U.S. working population, and it now says The Work Number is adding 12 million records annually.
The information is collected with the cooperation of employers, who pay The Work Number to provide verification services for former employees, surrendering data at the same time. Fortune 500 companies and government agencies representing 85 percent of the federal civilian population contract with The Work Number. And since Equifax is a credit reporting agency, rather than just a data-mining outfit, it’s all perfectly legal for them to provide this information to debt collection agencies.
Sen. Jay Rockefeller (D-WV), Chairman of the Senate Committee on Commerce, Science and Transportation, opened a congressional investigation into the data-mining practices of several corporations including Equifax in October of last year, sending letters to each company asking for extensive details about all data collection operations since the start of 2009. But the investigation focuses on background check services rather than it’s financial reporting services.
The FTC also ordered nine data brokerages to tell the agency how they harvest and use consumer data in December, and has taken action against data brokers in the past, including an $800,000 settlement against Spokeo for illegally marketing and selling personal information for employment screening in violation of the Fair Credit Reporting Act. But critics say the regulators don’t have the authority or tools to effectively protect consumer privacy.
For instance, consumers have no legal right to access the information collected about them by data miners, or correct it when it is inaccurate. While the FTC has urged congress to change this through legislation, no action has been taken. Other consumer privacy protections supported by the FTC have similarly stalled, including the creation of comprehensive Do-Not-Track standards, which have been largely dying a slow death.