A Chicago-area woman said when she posted her resume on job recruiting sites, she never expected that information would be disseminated across the web.
“My privacy is of my utmost concern and importance,” said Lynne, who asked NBC 5 Investigates to change her name. “I’ve had a series of ex-boyfriend stalkers in the past.”
Lynne’s ordeal began in the spring of 2015, when she said she posted her resume on CareerBuilder and Indeed to find a job. Years later, Lynne, who routinely plugs her name into online search engines to make sure her information is not accessible, said she was “extremely horrified” to find that exact resume posted on a random online directory.
“I go through great lengths to keep my information private,” Lynne said. “Various companies I have worked at in the past, even in a management position, I have asked my superiors that my name was never listed on our company website for the very purpose that my name wasn’t searchable or traced.”
Her information was posted on a site called Trustoria, which boasts being the largest online professional directory in the world. A monthly subscription fee gives users access to more information, including, in some cases, home addresses, phone numbers and family members.
NBC 5 Investigates found profiles of Chicago politicians, athletes, journalists and more. Some searches yielded current home addresses and phone numbers.
“It’s a really, really big money-making business,” said Nick Percoco, Chief Security Officer at Kraken Cryptocurrency Exchange.
Trustoria is not unique. There are dozens of sites that market personal data. Percoco said something as inconspicuous as posting a resume for a job opening can undermine users’ privacy. Couple that information with what’s available through public records and social media, and data aggregators can now offer a very detailed picture of anyone.
“If someone wants to do harm and track you down, they can use information about you they find online to help them in that,” Percoco said.
Lynne said she contacted Trustoria to take her information down, citing intellectual property and copyright laws. The company refused.
"If I post my resume on a job site, that’s my specific goal and intention to find a job," Lynne said. "Not for someone else, another third party person, to come along and data scrape the website and make a profit off my 30-plus years of hard work in my industry."
Daliah Saper, an attorney specializing in tech and social media, said information harvested from job sites is easily obtainable and not invasive enough to prosecute within current Illinois laws.
“The problem with resumes is it doesn’t include your driver’s license or social security number. It’s pretty much information that you could obtain from an aged phone book,” Saper said. “As soon as you voluntarily upload your resume and information, you have arguably forgone any privacy rights.”
Saper said if posting resumes on a job site, consider using a P.O. Box for an address or creating a unique email address solely for job searching.
CareerBuilder and Indeed pointed NBC 5 Investigates to their lengthy privacy policies. Both companies prohibit improper data scraping of their sites, but spokespeople did not specify what action the companies take to prevent it.
“We do not welcome data scraping of our users’ information and make efforts to prevent it from occurring. However, we are unable to prevent all occurrences of scraping and/or caching by websites outside of Indeed control,” said an Indeed spokesperson.
A spokesperson for CareerBuilder said in an email that it “shares the information voluntarily provided by users with its affiliated companies, recruiters, educators and service providers.” The spokesperson did not answer when NBC 5 Investigates asked for examples of “service providers” and “affiliated companies.”
Trustoria said its sites operate similarly to other search engines that “crawl and index” information publicly available online and then gather that data into comprehensive profiles.
“It is not possible to update or remove business and professional listings on these sites because they are cached search engine results compiled from external sources,” Trustoria Customer Service wrote NBC 5 Investigates in an email. “Your viewer will need to update the primary sources.”
Cyber security experts said anyone concerned about privacy should heed this warning.
“Anything you put online is there forever. There’s no deleting it. The Internet doesn’t forget,” Percoco said.
