Your Employer is Giving Your Salary Data to Equifax, and Equifax is Selling It.
A massive Equifax database you've never heard of is collecting and selling your sensitive employment and income history. Here are the exact steps to see your file, freeze it, and take back control.
What is The Work Number?
Equifax offers a product called The Work Number, which it markets as the largest commercial database of income and employment information. In the simplest terms, they sell your personal income and employment information to 3rd parties for profit. As you can see from the screenshots below, Equifax is actively marketing the extent of their database and the number of people it covers.
Where does Equifax get this information?
They get this from your employer. Your employers are sending this information to Equifax, undoubtedly without your consent.
Then, Equifax allows approved verifiers to access this information, although “only” for the purposes as defined in the Fair Credit Reporting Act, which allows data usage for an extensive set of reasons:
Credit or loan applications (to determine eligibility for credit)
Insurance underwriting (to determine eligibility for insurance)
Rental housing applications (to determine eligibility for renting a home or apartment)
Employment purposes (for hiring, promotion, reassignment, or retention decisions, with the consumer’s written consent)
Court orders or federal grand jury subpoenas
Legitimate business need (in connection with a business transaction initiated by the consumer, or to review an account)
Account review or collection (to review an existing account or collect on a debt)
Professional licensing or government benefits (to determine eligibility for a license or benefit requiring financial responsibility)
Child support determinations (by child support enforcement agencies)
Law enforcement or national security (by certain government agencies for authorized investigations)
Consumer’s written instructions (when the consumer provides specific written permission)
Prescreened offers of credit or insurance (for making firm offers, provided FCRA requirements are met)
And in true data broker fashion, you are unable to opt out of having your information in their database.
Why is this a privacy problem?
At its simplest, this is a privacy problem because a centralized database contains precise information about your salary and compensation data for most of the companies you have worked for, and this information is being sold to third parties. This also includes information such as your title and the time of employment.
Access to this data can be used to make decisions about you, to market products to you (i.e., prescreen offers), or by malicious actors who could use this to identify valuable victims to target. Note: To get access to this data, all someone has to do is “verify” they are a business, which is not a complicated or difficult process — an applicatn only has to “show” that you work in an area such as mortgage, auto, consumer finance, rental or tenant screening, or pre-employment for hiring purposes.
Even more scary is that Equifax has a poor history of protecting customer data. In 2017, they were breached, and detailed personal information of ~150 million people in the US was compromised (source).
Your salary and compensation data are very sensitive information. They can be used against you in various situations (e.g., during new job compensation negotiations or when a bad actor identifies the most valuable targets). For example, Equifax advertises a product: “Talent Report™ Income and Employment - Provides verification of employment plus verification of a candidate’s income."
The only “benefit” that this service claims to provide employees is “more rapid employment verification” for credit decisions. I don’t think this is a particularly worthwhile benefit compared to the potential privacy harm associated with this product. It is, however, extremely valuable for Equifax to have this massive database of compensation information, and a HUGE benefit for companies to have access to this data (i.e., can help them set and control compensation across industries).
Here’s a sample employment data report from The Work Number. It includes highly granular information. When I pulled my report, it contained accurate data for every single pay period, not just annual summaries.
Here’s what you can do to protect yourself
1. Get a copy of your report
The easiest way is to set up an account on their website. This gives you the options to view, dispute, and put a freeze on your data. However, this method only works for certain employers, and you must be currently employed with access to your work email for it to be effective.
Online Account Method
Navigate to https://employees.theworknumber.com/
Scroll down to “How to Manage Your Data” and click sign up.
The first step is searching for your current employer. Once you identify your employer, you should be able to create an account.
Once you have an account, you can view your report online.
Other options:
Call the Client Service Center at 800-996-7566.
I have heard many anecdotes from people trying to deal with The Work Number that their phone-based customer service is terrible.
Mail: Download this form and mail it in to get your information. The address you send it to is on the form.
Email
Send an email to EDR@equifax[.]com with a request that they send you a message through their secure email platform (Virtru).
Complete the form, and email it back to them by replying through their secure email system.
I don’t recommend sending the form via regular email to them because it contains sensitive information, and a standard email will not be encrypted.
2. Dispute your data if necessary
Navigate to the dispute form at https://employees.theworknumber.com/data-dispute-form. Once you fill in your personal information, you can enter the information you want to dispute or change. This is why you need your report first to fill this out accurately.
Once you submit the form, Equifax will send you an email if any additional information is needed.
3. Freeze your data
You should freeze your report so that most normal, commercial verifiers will be unable to look up your information.
Navigate to https://employees.theworknumber.com/data-freeze-form
Complete the form with your personal information.
On the second screen, select the cause for the request. If you are unsure what to enter, type “Freeze”.
Bonus: Submit two additional privacy requests to Equifax using this form: https://myprivacy.equifax.com/opt-in-opt-out/personal-info. Fill out the form twice, and each time select one of the following options.
Right to Limit the Use
Right to Opt-Out
Once you submit the form, Equifax will send you an email if any additional information is needed.
4. Petition your employer to stop sharing your data
A big part of the problem here is that most of our employers are sending your sensitive, personal salary information to The Work Number, probably without your consent. If you care about this, you could petition your HR or company leadership to stop this practice.
This is something that Google and Apple workers were able to achieve, convincing the companies to offer them options to opt out of having their information sent to The Work Number. I’m proud to say that I initiated that effort at Google!
Stay Safe!
Tate
My first job was at Consumer Credit Bureau. I was a file clerk and my job was to answer the phones for potential lenders who were members. We had all this information; employment history, salaries, home addresses, etc. on every person that ever had a job or had received credit. This is nothing new, and it's been going on for quite some time now.
Excellent, informative, albeit alarming article.