Current Events: UK Company Illegally Sold Worker Data
According to an article at the Guardian, dozens of companies in the UK had been buying personal information about potential employees from a company called the Consulting Association in violation of British data protection laws. The Data Protection Act made it illegal to collect and distribute private information about individuals without telling them. The Consulting Association aggregated information from the companies that subscribed to its services, and in return it gave them data on workers trying to get jobs. The files kept by the Consulting Association included data on union activity and other private details. Some workers in the British construction industry have claimed for years that companies have been blacklisting union activists, and one worker may have been blacklisted after filing an unfair dismissal case against an employer. This event represents a violation of privacy of employees, and an attempt to stifle organized labor.
This arrangement was motivated by economics and facilitated by technology. Companies can potentially arrange to pay lower wages to employees in the absence of unions. Blacklisting and avoiding hiring workers who might organize unions or who would take the company to court for violating labor laws would allow a company to lower its expenses. Databases, hardly new technology, allowed the Consulting Association to maintain easily accessible records on individuals that it could give to client companies.
The current situation might have been prevented by more monitoring from the British government. According to the BBC, the Consulting Association’s arrangement had been going on for the last 15 years, and there had been complaints for years in the construction industry about blacklisting, but the government hadn’t discovered the problem until a short while ago. In addition, the Parliament had proposed but failed to pass legislation against blacklisting in particular, and that law might have been a deterrent to the practices in this incident, though, since the Data Protection Act wasn’t enough, it seems doubtful that adding another law would have helped. Also, companies should have data management policies that do not permit giving away employee data except under special circumstances. This might prevent a database like the one created by Consulting Association from developing in the first place. But since they benefited from the arrangement that developed, the companies involved in this case might not have found such a policy to be in line with their interests and avoided having one.
The broader issue in this incident is an individual’s control about information on himself. Companies that collect information about people, such as companies collecting data about their employees or Internet services collecting data about their customers, can archive that data in their own databases. Individuals usually have little control over whether or not information about themselves is kept or removed from these databases. Companies controlling these databases could be tempted to use the collected information in ways that are not in the best interests of the individuals involved, such as turning over the databases to advertisers. In this case, one of the reasons why Consulting Association’s actions were harmful was that workers had no way of finding out or refuting the assertions made about themselves in the databases.
Hopefully, lawmakers will respond to this case by passing new laws (and actually enforcing them in a timely manner this time) protecting the privacy of individuals. In addition to laws against blacklisting and increasing monitoring of hiring practices, legislators should consider passing more general laws to help individuals access and remove data about themselves from databases held by others.