Retirement Plan Data Selling | How to Protect Your Privacy

GAO Findings on Retirement Data Privacy

A new report from the Government Accountability Office reveals that personal information belonging to millions of Americans is potentially for sale. The watchdog analyzed 31 service providers that manage employer-sponsored retirement plans. Its findings show that 29 of these firms either explicitly allow data sharing or fail to state whether they distribute participant information to outside parties for marketing. Over 126 million Americans hold these accounts, which collectively represent more than $9 trillion in assets.

Employers share sensitive data with these financial service providers to handle account contributions and investment processing. This data includes birth dates, Social Security numbers, and specific account balances. The GAO investigation indicates that 17 of the 31 reviewed providers do not limit their ability to sell this participant data to brokers. Only 12 firms provide an opt-out mechanism for account holders.

Implications for Plan Participants

The lack of clear privacy guardrails presents a risk to account security. Data brokers often compile information from various sources, making it harder for individuals to control how their details circulate. Financial firms frequently use this data to market their own products to unsuspecting plan participants. This commercialization of retirement savings data complicates the financial landscape for employees who are merely trying to save for their future.

Regulators have historically treated data privacy as a component of the broader fiduciary responsibility of plan sponsors. However, the current findings suggest that contractual language remains inadequate. Without explicit protections, the information shared with payroll administrators and asset managers moves easily into the open market. This exposes account holders to unwanted solicitations and potential fraud.

Recommendations and Future Oversight

The GAO recommends that the Labor Department issue updated guidance to protect participant privacy. This recommendation encourages the labor secretary to define which types of information must remain private. It also proposes that service providers obtain explicit written permission before they use or share participant information for marketing. Such steps would standardize best practices across the industry.

In response, the Labor Department noted its support for protecting personal information but did not commit to new specific requirements. The agency pointed to existing 2021 cybersecurity guidance, which already requires fiduciaries to address data protection in their contracts. It signaled that it will consider whether additional supplemental guidance is necessary given current resource constraints. For now, plan participants remain exposed to practices that prioritize data monetization over account security. Investors should remain cautious about the visibility of their personal financial records.