Tranchau (Kris) T. Nguyen of the U.S. Government Accountability Office explains how retirement plan providers may be collecting, using, and sharing participants’ personal data in ways many workers do not expect.
Jeffrey Snyder, Broadcast Retirement Network
Well, Kris, it’s always great to see you. Thanks for popping by the program this morning. Thank you for having me.
Good to see you. Yeah, it’s always a pleasure to see you. And, you know, it’s another great report.
GAO, we’ll get into that in a second. You put out a lot of great reports. This is a great report.
I think a lot of people, whether you’re in the retirement industry or you’re a participant in a retirement plan, will find interesting. Before we get into the meat and potatoes, I want to ask you some maybe some blocking and tackling questions, an allusion to the NFL season, of course. What’s the why behind?
Why did the GAO determine that it would like to take on this project?
Tranchau (Kris) T. Nguyen, U.S. Government Accountability Office
Well, GAO is an investigative arm of Congress. And Congress was concerned about data privacy issues in retirement plans, such as the potential use and sharing of information beyond the intended purpose, which is to administer these plans. So some of the concerns dealt with the selling of the information or for the purpose of marketing the information.
Jeffrey Snyder, Broadcast Retirement Network
Okay, so obviously this privacy in general, if anyone reads, I mean, you had to be sleeping under a rock, my words, not yours, to not know that privacy is a big issue for everyone. Data is a big issue. So you got this mandate from the Congress.
You went about the report. Now, how did you, if you don’t mind me asking, I’m just asking some blocking questions and tackling questions. How did you begin the process to actually do the research?
Did you interact with the US record keepers that do this type of work or was it through other intermediaries?
Tranchau (Kris) T. Nguyen, U.S. Government Accountability Office
That’s right. In order to conduct our study, among the many steps that we took, such as interviewing experts in the field, the central piece to our work is our review of privacy disclosures that were publicly available of 31 record keepers and asset managers of retirement plans. So while the number sounds very small, but these entities serve a vast number of retirement plans and participants.
Jeffrey Snyder, Broadcast Retirement Network
Yeah, I mean, their 31 record keepers may cover the bulk of 401k, 403b and governmental 47 plans. I mean, they do. These record keepers, I think for the audience’s benefit, Kris, they do a lot.
They’re not just administering the plan. They have phone centers. They have tools and capabilities to help people meet their retirement needs.
So they do a lot.
Tranchau (Kris) T. Nguyen, U.S. Government Accountability Office
That’s right. The record keepers, their role is to track the information of your plans. For example, the contributions that you make to your plans, the growth of those plans, the financial information with the bank information and such.
In addition to some personal information that they need from you, such as your beyond your name address, but also your security number, bank information, and the asset managers have the responsibility to manage your funds. So these entities have a big responsibility in carrying out the administration of these retirement plans.
Jeffrey Snyder, Broadcast Retirement Network
Yeah, it’s not your mother’s or mom and dad’s 401k plan. Things have really evolved, I know, within the retirement industry. So let me ask you some basic follow-up questions based on the findings.
So when and why do the record keepers or retirement plans actually share data? You talked about, so security number, there may be things like your name, address, other information. So what is the rationale as to why or when that is shared?
Tranchau (Kris) T. Nguyen, U.S. Government Accountability Office
So the need to share information between service providers is so that they have the adequate information to keep tabs of your investments over time and the growth of your investment and make sure that all that information is proper and that they carry out the services for the individuals, such as asset management, investing your investments in these firms, right? The asset managers have those responsibilities. So it’s an important role for them to ensure the accuracy of your retirement savings over time.
Jeffrey Snyder, Broadcast Retirement Network
Yeah. And just for the audience’s benefit, when I first started in the retirement industry, everything keyed off the social security number. I don’t know, when I was still working in record keeping, they actually, Kris, they actually took off the social security number off of the statement and some of the confirmation.
So I know this is something that early on, and this is going back probably 20 years, they really were focused on removing this information. So really important to share this information. Now you’re better, you and the team are better than I am because you actually looked at all the privacy disclosures.
There’s a lot of confirmations and things that come out as a result of the retirement plans from prospectus to confirmations. What did you find in those privacy disclosures?
Tranchau (Kris) T. Nguyen, U.S. Government Accountability Office
What we found was that only two prohibit the sharing of information and then more than half did not limit the selling of this information. And in fact, only two of the 31 allow the opting out of the selling of these data. So this is an important piece to understand that your information can be at risk for sharing information, for marketing purposes or for the selling of your information.
Jeffrey Snyder, Broadcast Retirement Network
Yeah, I guess that’s surprising. When I looked at the report, that was one of the key takeaways. I’m like, oh, that’s pretty interesting.
I just did a, this is not related to your report, but I just did something with the state of Utah where they looked at ed tech, ed technology used for K through 12 schools. And there was some data sharing going on among ed tech. So, you know, this is a very dynamic and fluid environment.
I don’t want to throw anyone under the bus, but clearly it’s an area that probably needs to be revisited and refreshed. So you’ll probably get another chance to look at the disclosures, Kris. Let’s talk about some of the privacy laws.
And I’m not an attorney. I, you know, not expecting you to be the legal scholar here, but when you look at, there’s a lot changing both at the federal level in terms of privacy laws and data laws, as well as the state privacy laws and data laws. That’s a lot for these companies to have to reconcile to comply with, isn’t it?
Tranchau (Kris) T. Nguyen, U.S. Government Accountability Office
Thank you for raising that point. We did look at state laws. Specifically, we talked to folks from California, Colorado, Virginia specifically.
And we also looked at how many states across the U.S. has privacy laws. And we found that 13, nine, I’m sorry, 19 states do have privacy laws. And California is the first one to have privacy laws for consumers.
And this is relatively recent. They implemented their law in 2020, just to give you a sense of the recency of these laws. What we learned is that it’s not clear whether these consumer protection laws would apply to retirement plans.
And ERISA, the federal law that is affecting retirement plans, generally supersedes these laws.
Jeffrey Snyder, Broadcast Retirement Network
Yeah. Again, I’m not a legal scholar, but I think that there’s a lot of having to mesh the state laws with the federal laws, figure things out. And if you’re the record keeper, one of the 31 record keepers, you have to follow both sets of laws.
So you’re doing business theoretically in all 50 states, potentially. So you’ve got to follow all those laws. And on top of that, you’ve got to follow the federal law.
I mean, that is a big job. And these record keepers have dozens of people that just focus on these regulations. Let me close by asking, what do you think in terms of the protections afforded to consumers?
I know you looked at this as part of the report. Obviously, there are some early stage developments with data privacy. It looks like things are going to continue to evolve over the next five, 10, 15, 20 years.
Tranchau (Kris) T. Nguyen, U.S. Government Accountability Office
So in addition to our finding regarding the privacy disclosures, that they don’t always protect the participants, the other piece that we found is that the Department of Labor, its guidance is insufficient. It’s not clear on what is considered private. And it’s not clear on when record keepers and asset managers need to get written consent to share the data.
So that is a key part of our work. And we made recommendation to the Department of Labor to issue guidance to help plan sponsors and record keepers and their service providers to understand their responsibilities to protect participant data. And in fact, there is an industry study that shows that the service providers indeed want additional guidance from DLO to help them navigate this area.
Jeffrey Snyder, Broadcast Retirement Network
Yeah, I feel bad for the Department of Labor. They have a lot of oversight and they have a lot of work to do, Kris. That’s just my editorializing a little bit.
I don’t really feel sorry for them. I’m sure they’re enthralled by having to handle all these things, but there’s a lot out there. And with the advent of AI, it’s dynamic and it’s very fluid and changing.
Kris, I can’t let you go without teasing out some additional work that you and the team are gonna be doing. I know cybersecurity is also something that you focus on, but can you give us a little hint, maybe a little taste of what you’re gonna be releasing in the next couple of months?
Tranchau (Kris) T. Nguyen, U.S. Government Accountability Office
Well, thank you for your question. With regard to this particular work, we will continue to monitor the recommendation and to see whether DOL will implement our recommendation. At the time, DOL neither agreed or disagreed with our recommendation, but we think it’s an important step in order to protect participants and guide the plan sponsors and service providers.
Congress has what it needs with regard to data privacy in the retirement plans. We don’t have additional work in this area regarding data privacy for retirement plans, but of course, GAO continues to do work related in this area because we are in the digital age and cybersecurity is a high risk issue that GAO has put on the radar screen.
Jeffrey Snyder, Broadcast Retirement Network
Yeah, really important work that you and the team are doing. And the federal government, for that matter, and the states, I wanna give everyone, and the retirement industry, I gotta give everyone credit because I don’t want bad phone calls. Kris, always great to see you.
Thanks for making a few minutes for us. And look, we look forward to having you back on the program again very soon.
Tranchau (Kris) T. Nguyen, U.S. Government Accountability Office
Thank you. Thank you for having me.