You have spent decades building your retirement savings. Now a federal watchdog is raising a question worth paying attention to: who else has access to the personal information tied to that account?
A new report from the Government Accountability Office (GAO) warns that the companies managing Americans’ retirement plans may be sharing or even selling participants’ personal data to market financial products and services.
What Kind of Information Are We Talking About?
When you enrolled in a 401(k) or similar employer-sponsored plan, your employer started to share some of your personal details with outside service providers. That can include your birth date, Social Security number, account numbers, and account balances.
Those providers (asset managers, payroll processors, and record keepers) use that information to run your plan. But according to the GAO, some of them go further.
What the GAO Found
The GAO reviewed privacy disclosures from 31 retirement plan service providers. Of those, 29 either explicitly allowed data sharing or simply did not specify whether participant data could be shared for marketing purposes.
More than half (17 of the 31) placed no limits on their ability to sell participant data to data brokers or other third parties. The GAO noted that selling data to third parties can increase the risk of it being exposed in ways participants never intended.
Only 12 of the 31 providers gave plan participants the option to opt out of data sharing at all.
How Big Is This?
The scope here is significant. Over 126 million Americans are enrolled in employer-sponsored retirement plans like 401(k)s. Total assets in those plans top $9 trillion, according to the GAO.
What the GAO Is Recommending
The GAO is calling on the Labor Department to issue clearer guidance on data privacy for retirement plan participants. Specifically, it recommended the Labor Secretary clarify what information should be considered private and spell out when service providers must get written permission before using or sharing it.
The GAO also suggested that guidance should identify best practices for giving plan participants a real choice about how their personal information is used, sold, or shared.
Where Things Stand Now
The Labor Department said it fully supports protecting participants’ personal information. However, it neither agreed nor disagreed with the GAO’s recommendations.
The agency pointed to a 2021 cybersecurity guidance it had already issued that addressed data privacy as part of service providers’ responsibilities to plan participants. It added that, as resources permit, it will carefully consider whether additional guidance is needed.
For now, most retirement plan participants have little visibility into how their information is being used and, in most cases, little ability to stop it. The GAO report puts that issue squarely on the table.
