Wait, someone has my salary information? Essentially, my actual pay stubs? What I earn, what I pay for health care, what my taxes are? And they sell that data? To debt collectors?
And… it’s Equifax? You mean, THAT Equifax?
That was the collective voice of the Internet this weekend when Redditors discovered The Work Number, an Equifax product that does, indeed, collect and sell such sacred information.
I’m used to this reaction. That’s the reaction I got four years ago when I first brought the story of The Work Number, owned by Equifax, to light. Ostensibly it’s a simple tool to verify employment during resume checks. But in fact The Work Number is much, much more. Like many of these stories, it didn’t get quite the attention it deserved at the time. When I would periodically bring up The Work Number in various places, I’d hear that sentiment over and over.
But the internet SHOUTED it this weekend. For some reason, my original Work Number story for NBC News made the rounds, and for many hours this Saturday, it was the top story on Reddit.com.
You never know how long it will be before a story gets the attention it deserves. (An aside to myself: Keep writing stories that matter, even if it seems like no one is reading. You never know.)
I’m pretty sure this story was resurrected by Joel Winston, who wrote an updated piece on The Work Number for Fast Company. Winston had been speaking with me about his story for a while. The obvious news hook for it was the recent massive Equifax breach. If losing your Social Security number was bad, how would you feel if Equifax gave away your biweekly paystubs to the whole world? While The Work Number data (also known as TALX, the firm Equifax acquired to create this division) was not part of the Equifax SSN hack, security journalist Brian Krebs had reported earlier this year that identity criminals had been abusing TALX to commit tax refund fraud. More recently, he detailed how easy it was to steal data from TALX.
Equifax temporarily took down its TALX portal in response to Krebs’ more recent post.
That shouldn’t be a surprise. Of course TALX had problems. After all, Equifax has a poor record of applying simple patches.
Here’s the critical point: There IS a big surprise in this story. The surprise is: Equifax has my salary history?
Since the very beginning of the Age of Data Breaches—starting with ChoicePoint in 2005—consumers certainly become concerned when they hear their personal information has been stolen. But that’s rarely the real source of anger. Instead, it’s this:
Who is this company and why do they have my data in the first place?
This includes the massive Equifax breach, too. That story captured and kept Americans’ attention because they are still confused about who and what has their most intimate digital details. Each time there’s a stark reminder, like a big data theft, they get newly angry. Not at the hack, but at their helplessness in the digital age. The hate wasn’t about the hack; the hate was directed squarely at Equifax, and which took and collected all that personal information without ever asking permission.
So on Saturday, a 4-year-old story landed atop the Internet’s front page (my first top story on Reddit, I believe). And while an occasional commenter complained, “this story is old,” for the most part, the discussion centered on one thing: What the Hell is The Work Number and why does it know what my take-home pay was last week?
Not only does The Work Number collect the data; it sells the data, too. To collection agencies. You know what’s a powerful tool for a debt collector? Knowledge of how much money you make. An alert that you just got a job, or you got a raise. And yes, that happens.
From the original story:
Its database is so detailed that it contains week-by-week paystub information dating back years for many individuals, as well as other kinds of human resources-related information, such as health care provider, whether someone has dental insurance and if they’ve ever filed an unemployment claim. In 2009, Equifax said the data covered 30 percent of the U.S. working population, and it now says The Work Number is adding 12 million records annually.
Equifax turns around and sells some of this data to third parties, including debt collectors and other financial services companies.
Equifax declined to be interviewed, but in an emailed statement to NBCNews.com, it confirmed that it shares “employment data” with debt collectors and others, and said it does so in compliance with Fair Credit Reporting Act guidelines.
“In all cases, these entities must have a permissible purpose to request employment information,” Equifax spokesman Timothy Klein said.
In other words, your human resources department at work is probably helping debt collectors chase after you. Bet that didn’t come up as part of your sensitivity training!
As my original story pointed out, there’s plenty of useful things The Work Number does, just as there’s plenty of useful things Equifax does. Many even help consumers. The problem is the element of surprise. In the Information Age, consumers are constantly blindsided by ways corporations turn them into product. If people are shocked by the way you make money, and you spend a lot of energy trying to keep it quiet, perhaps that’s a business model problem. I know for certain that’s a regulatory problem.
It might take years, but eventually, that “surprise” is going to end up on the front page of Reddit. Or The New York Times. As always, it’s better to hit issues like this up front. Now more than ever, consumers need and deserve transparency. It’s one of the great ironies of our time that during the Information Age, secrets are thriving. We need to fix that, and fast.
Red tape wrestling tips
The Work Number is a credit bureau, which means you are entitled to see what it knows about you once each year, for free. You should do so. Fill out the form at The Work Number here. Let me know how it goes; in the past, I know consumers have received spotty results, in part because not every HR department participates.
Brian Krebs has a good piece up explaining how to opt out of participation in Work Number data.
This article originally appeared on BobSullivan.net.
