How Personal Employment Information Is Shared And Sold

For attorneys who counsel either businesses or individuals, it’s important to know what rules and limitations apply to the increasingly popular trend of outsourcing employee verification services.  The issues associated with this trend are far-reaching and beg the question:  How can we better regulate and improve this beneficial type of outsourcing, for employers and employees alike?

The key to answering these questions begins with an understanding of the dual role credit reporting agencies play as database sponsors in the employee verification industry.  For example, in addition to compiling consumer credit scores, credit reporting giant Equifax also is in the business of compiling other information that is equally personal; namely, confidential details about workers’ current and former employment.  In fact, Equifax might even be selling information as personal as your compensation level, the name of your healthcare provider, whether you’ve ever filed for unemployment benefits, and your paystub history.

What is “The Work Number”

The Work Number, a subsidiary of Equifax, provides various financial and employment verification services.  The Work Number uses its ever-expanding database to confirm employment and income information for commercial verifiers, social service verifiers, and potential future employers.  The Work Number’s database currently contains the employment and salary records of over one-third of U.S. adults, and it includes detailed employee information about weekly paystubs, healthcare providers, medical and dental insurance, and unemployment compensation claims.

The Work Number built its database with the cooperation of thousands of U.S. businesses.  The Work Number markets itself to these willing participants as a means for busy human resource departments to outsource the time consuming task of verifying a range of information on former and current employees.  This service is so attractive that participating businesses actually pay for the ability to send The Work Number all employee information typically needed in the verification process.  The Work Number fields verification inquiries on the employer’s behalf, freeing up employer staff time for other tasks.

While providing employers with a valuable service, The Work Number simultaneously funnels this information it receives from its clients to its parent company, Equifax.  In turn, Equifax sells the information to third parties such as debt collectors, student loan issuers, and financial institutions.

Although Equifax’s sharing of the personal information garnered by The Work Number under in its role as a verification service provider is indisputable, the extent of such sharing is in question.  In an interview with NBC News, Equifax spokesman Timothy Klein denied that salary information is sold to debt collectors.[i]  Klein’s statement is in conflict, however, with Equifax CEO Richard Smith’s 2009 NYSE Magazine interview, in which he stated “[W]e can provide information about a debtor’s location, income, and employment.  That can help prioritize which accounts to pursue first.”[ii]

Because employer use of The Work Number has become so prevalent, the District of Columbia has issued new guidelines for low-income housing compliance, which include a provision governing the treatment of applicants whose employment and earnings can be verified only via The Work Number.[iii]  Likewise, the current Code of Mississippi Rules actually includes The Work Number’s email address, phone number, and website address in a statutory provision that instructs applicants for State-funded childcare on how to provide income and employment verification.[iv]  Considering The Work Number’s fast-paced growth and the privacy concerns it poses for consumers, it makes sense to consider what safeguards, if any, are in place to protect us.

Fair Credit Reporting Act

The most obvious consumer protection tool implicated by Equifax’s practices is The Fair Credit Reporting Act (FCRA).  The FCRA regulates instances in which “consumer reports” or “investigative consumer reports” are requested from a “consumer reporting agency.”[v]  For purposes of the FCRA, a “consumer reporting agency” includes any entity that regularly assembles credit or other information about consumers and furnishes that information to third parties via any means of interstate commerce.[vi]  Thus, Equifax and The Work Number are considered consumer reporting agencies for purposes of the FCRA.  “Consumer reports” include any communication of a consumer’s personal characteristics which will serve as a factor establishing the consumer’s eligibility for credit or insurance or for employment purposes.[vii]  By contrast, “investigative consumer reports” include reports regarding the consumer’s personal characteristics gathered during personal interviews, but do not include specific factual information about the consumer’s credit record.[viii]  Due to the more personal nature of information contained in an investigative consumer report, stricter guidelines are in place regarding disclosure of investigative consumer reports compared to ordinary consumer reports.  To the extent Equifax and The Work Number provide third parties with consumers’ personal and financial information, Equifax and The Work Number furnish consumer reports.

There are three types of recipients of the information provided by Equifax and The Work Number: prospective employers, financial institutions and creditors, and third party purchasers.  The FCRA applies differently to each recipient type.

Prospective Employers

The Work Number markets itself as a means for prospective employers to verify employment information of job applicants.  Thus, as its core business, The Work Number provides sensitive information to prospective employers.  Because the FCRA applies whenever employers request consumer reports from a consumer reporting agency like The Work Number, the FCRA is implicated by The Work Number’s information transfers to prospective employers.

The FCRA addresses issues such as what types of employers can obtain consumer reports, how they must obtain the report, what they must do before taking adverse action in response to the report, and what they must do after taking adverse action.[ix]  The Work Number contends that FCRA guidelines are met when it provides prospective employers with employment information.  Such guidelines include providing job applicants with written notice that information obtained from a consumer report may be used when making decisions concerning their employment.[x]  This notice must appear in a document containing only this disclosure.[xi]  Additionally, the consumer must provide written authorization of the procurement of the report.[xii]  To the extent The Work Number provides employment verification to prospective employers and meets these guidelines, it is within its rights to do so.  What the FCRA fails to address, however, is how other information in The Work Number’s database, such as salary and insurance information, is used for non-employment purposes.

Financial Institutions and Creditors

In addition to providing potential employers with consumers’ employment information, The Work Number also concedes to providing creditors and financial institutions with employment information from its database.  In an interview with NBC News, Equifax spokesman Timothy Klein admitted that pay rate information is shared with third parties.[xiii]  These third parties typically include mortgage, auto, and financial services credit grantors.  Klein said The Work Number provides such information to financial institutions and credit grantors in compliance with the FCRA, but denied that salary information is sold to debt collectors.[xiv]  The Work Number asserts that consumers give such third parties the right to access this information at the time the consumer applies for credit.

Section 1681 of the Fair Credit Reporting Act states that generally, a consumer reporting agency, like Equifax or The Work Number, may only furnish a consumer report to such third parties when the consumer reporting agency has reason to believe the third party “intends to use the information in connection with a credit transaction involving the consumer … and involving the extension of credit to, or review or collection of an account of, the consumer.”[xv]  Even assuming Klein’s assertion is true that consumers grant these third parties access to such information, other provisions in the FCRA raise the question of whether this authorization is sufficient.  Subsection (c)(1)(A) of the FCRA requires that “the consumer authorize[e] the agency to provide such report to such person.”[xvi]  This language suggests that a much more personalized authorization transaction may be required than Klein alluded to in his statement.  Namely, it appears that the consumer must furnish the specific consumer reporting agency in question with authorization to provide the report to the specific financial institution or creditor requesting the report.  Interestingly, although in certain circumstances a consumer may authorize all reporting agencies to give all creditors this information by executing a general waiver at the time he or she applies for credit, another subsection of the FCRA indicates the consumer may have an additional line of defense.  Pursuant to subsection (c)(1)(B)(iii), a consumer may elect to have his name and address excluded from lists provided by consumer reporting agencies in connection with credit transactions not initiated by the consumer.[xvii]

Unfortunately, the rules delineating when reporting agencies like Equifax and The Work Number can give creditors and financial institutions other information from The Work Number’s database are unclear.  It is not clear when, how, and with regard to whom the consumer must provide authorization for a reporting agency to share this information.  However, given that consumers must be clearly notified in writing and provide authorization prior to issuance of a consumer report when such report will be used for employment purposes, a strong argument can be made that this same proactive and consumer oriented approach should apply to all sections of the FCRA.

Equifax Information Sold to Third Parties

In addition to providing information to prospective employers, financial institutions, and creditors, Equifax also sells some of this information to interested third parties.  For example, Equifax heavily markets The Work Number’s services to student loan issurers.  Thanks to The Work Number’s information, student loan issuers have seen a 5.5% increase in Right Party Contact and a 7.3% increase in Collections Resolution.[xviii]  Additionally, Equifax provides information from The Work Number to financial firms.  In these transactions, the information is packaged as a “portfolio monitoring” service which allows financial firms to market their products to a specially selected group of consumers.  The Work Number’s information is also marketed to these firms as “proactive managing of risk.”  In this context, the firms analyze information from The Work Number for early warning signs about when someone might soon run into financial trouble.  The marketing campaign for these services touts “Using The Work Number to stay abreast of employment changes can expand your ability to mitigate risk while maximizing product and service potential.”[xix]

Strangely, the FCRA seemingly fails to address this type of information transfer at all.  While the FCRA provides guidelines for when a consumer reporting agency may furnish a consumer report, how and when a consumer report may be furnished for employment purposes, how and when a consumer report may be furnished in connection with credit or insurance transactions, and what added protections are afforded medical information, there is a lack of guidance regarding the sale of such information.  Nowhere does the FCRA expressly prohibit the sale of consumer information to third parties with a business interest in the information.  This is further complicated by the fact that Equifax owns The Work Number.  As a credit bureau, Equifax proceeds under the comparatively lax rules governing credit reporting agencies, which are distinct from those governing data brokers.  Thus, by virtue of Equifax’s affiliation with The Work Number, it can behave as a credit bureau, selling credit information to lenders.  The problem, however, is Equifax has access to a much greater wealth of consumer information than a credit bureau otherwise would, thanks to its affiliation with The Work Number.

The good news, however, is that the FCRA actually may address the problematic affiliation between Equifax and The Work Number.  Section 1681s-3 of the FCRA relates to affiliate sharing.[xx]  This section prohibits an entity that receives information which would be a consumer report from another entity under common ownership from using that information to make a solicitation for marketing purposes, unless the consumer is provided an opportunity to prohibit such solicitations after a clear disclosure has been made to the consumer explaining that information may be communicated amongst such entities for purposes of solicitation.[xxi]  However, even this provision of the FCRA might not be as helpful as it seems.  Although it may prohibit Equifax from using information it obtains from The Work Number to solicit business, that is only half the battle.  Equifax still could continue to sell the information it gathers by its own efforts to third parties.  The information might simply be less comprehensive.

Possible Solutions

In light of these revelations, the first question on many consumers’ minds is how to address this sharing or sale of private information, which appears to be lawful under the guidelines currently in place.

From an individual’s perspective, preventing sensitive information from ending up in The Work Number database seems like a futile proposition.  A job applicant, for example, could attempt to condition a prospective employment relationship on the employer’s agreement not to share any of the applicant’s personal or employment information.  However, given the current job market, most employees would have very little negotiating power, and most employers are unlikely to oblige, especially given the economy gained by utilizing The Work Number.  If an individual is unsuccessful in this negotiation, he or she can always turn down a job offer.  While doing so will keep the employee’s personal information safe for now, the applicant has cut off his nose to spite his face and remains unemployed.  It seems then that the only plausible way to regulate these information transfers is to address them before the consumer even gets involved.

Congress Should Revisit the Fair Credit Reporting Act

The most effective means by which to provide much-needed regulatory reform is to take legislative action.  Specifically, Congress should revisit the FCRA, taking into consideration the flaws and gaps that Equifax is exploiting.  One approach could include amending the FCRA to require a consumer’s written authorization before such information is sold.  Specifically, implementing the same comprehensive authorization guidelines currently in place regarding consumer reports used for employment purposes could serve as a model.  Under this approach, the consumer reporting agency would need to provide consumers with clear, conspicuous written notice of the possible sale of their information prior to the information being sold.  Such notice would need to be in a stand-alone document, and the consumer’s response, either authorizing the sale or not authorizing the sale, would also need to be in writing.

Another possible approach includes implementing stricter rules governing the flow of consumer reports out of credit bureaus, perhaps mirroring the already stricter guidelines governing disclosure of investigative consumer reports.  Additionally, Congress could amend the FCRA to clearly delineate exactly what information can be included in consumer reports.  Part of the current problem appears to involve the crossover between the personal and employment related information contained in The Work Number’s database with the credit information expected to be in the hands of a credit bureau, like Equifax.

John Balitis is a director and attorney with the law firm of Fennemore Craig in Phoenix where he co-chairs the firm’s Labor Relations and Employment Practice Group.  He represents businesses in all aspects of employment law. Kristin Penunuri is a student at the Sandra Day O’Connor College of Law at Arizona State University.  She is a legal writing intern at Fennemore Craig in Phoenix.