GAO warns retirement plans may be trading participants' personal data

In a new audit, the Government Accountability Office highlighted that retirement plans covering more than 126 million workers could be exposing participants' personal details to external financial service providers. Information such as birth dates, Social Security numbers, account numbers and balances may be transmitted to asset managers, payroll processors and record-keeping firms, which can then market additional products or sell the data to third parties.

The GAO examined privacy statements from 31 providers; 29 either explicitly permitted sharing or omitted any restriction, and 17 did not limit sales to data brokers. Only 12 of the providers offered an opt-out mechanism for plan members. The agency recommended that the Labor Department clarify which data should be treated as private and require written permission before any use or disclosure. The Labor Department responded that it supports protecting participant information but stopped short of endorsing the recommendations, noting existing 2021 fiduciary guidance on data privacy.