A new report from the Government Accountability Office (GAO) has raised concerns that Americans' retirement plans may be sharing or selling personal information, which could be used to market financial products and services to plan participants [1]. According to the GAO, over 126 million Americans are enrolled in employer-sponsored retirement plans, such as 401(k) accounts, with total assets exceeding $9 trillion [1]. These plans are typically managed by external financial service providers, and employers share personally identifiable information—including birth dates, Social Security numbers, account numbers, and balances—with asset managers, payroll providers, and record keepers [1].
The GAO's review of privacy disclosures from 31 service providers found that 29 either explicitly allowed data sharing or did not specify whether participant data could be shared for marketing purposes [1]. Furthermore, more than half of these providers (17 out of 31) did not limit their ability to sell participant data to data brokers or other third parties [1]. Only 12 of the 31 service providers had privacy disclosures that allowed plan participants to opt out of data sharing [1].
The report highlighted that while service providers require access to personal data for investing and processing contributions, the lack of restrictions on data sharing and selling increases the risk of inadvertent exposure and potential access by bad actors [1]. The GAO recommended that the Labor Department issue additional guidance to clarify what participant information should be considered private and when service providers should obtain written permission before using or sharing this information [1]. The GAO also suggested that best practices should be identified, including providing individual participants with choices regarding how their personal information may be used, sold, or shared [1].
In response, the Labor Department stated it "fully supports the goal of appropriately protecting the personal information of participants and beneficiaries of plans," though it neither agreed nor disagreed with the GAO's recommendations [1].
CONCLUSION
The GAO's report highlights significant gaps in privacy protections for Americans' retirement plan data, with most service providers allowing or not specifying data sharing and selling practices. The Labor Department's response indicates support for stronger protections, but no immediate regulatory action has been taken. This issue may prompt further scrutiny and potential regulatory changes impacting retirement plan providers and participants.