본문 바로가기 주메뉴 바로가기
국회도서관 홈으로 정보검색 소장정보 검색

결과 내 검색

동의어 포함

목차보기

Title page 1

Contents 3

Highlights 2

Letter 6

Background 11

Managing Retirement Plan Data 11

ERISA 12

Consumer Data Privacy 14

Leading Practices for Privacy Protections for Personal Information 16

Retirement Plans Use and Share Participant Data to Administer Plans, but Selected Service Providers May Share or Sell Data, Increasing Privacy Risks 18

Plan Sponsors Collect and Share Participant Data, but Most Selected Privacy Disclosures Do Not Limit the Service Providers' Ability... 18

Plan Service Providers' Use of Data May Potentially Benefit Participants but Also Increase Privacy Risks 21

Selected Service Providers Inform Consumers of Privacy Policies, but Disclosures Do Not Fully Incorporate Leading Privacy Practices 22

Federal Agencies and States Have Taken Steps to Oversee Data Privacy, but DOL Has Not Provided Sufficient Guidance on Retirement Plans'... 26

DOL and Federal Agencies that Enforce Consumer Privacy Laws Have Not Taken Actions Against Retirement Plans for Sharing Participant Data 26

Data Privacy Laws in Certain States Provide Consumers the Right to Opt-Out of Data Sharing, but State Officials Said These Laws May... 28

DOL Has Not Provided Sufficient Guidance on Retirement Plans' Use of Participant Data 30

Conclusions 32

Recommendations for Executive Action 33

Agency Comments and Our Evaluation 33

Appendix I: Objectives, Scope, and Methodology 35

Appendix II: Comments from the Department of Labor 42

Appendix III: GAO Contacts and Staff Acknowledgments 44

Tables 3

Table 1. Examples of Defined Contribution Retirement Plan Service Providers 11

Table 2. Fair Information Practice Principles (FIPP) 17

Table 3. Fair Information Practice Principles (FIPP) 38

Figures 3

Figure 1. Data Sharing Among Plan Sponsors and Selected Service Providers in the Administration of Defined Contribution Retirement Plans 12

Figure 2. Selected Retirement Plan Service Provider Policies on Sharing or Selling Participant Data 18

Figure 3. Selected Retirement Plan Service Provider Policies for Participant Data Collection from Sources Other Than the Plan Sponsor 19

Figure 4. Incorporation of Fair Information Practice Principles (FIPP) into 31 Selected Retirement Plan Service Provider Privacy Disclosures 23

Figure 5. U.S. State Data Privacy Laws, as of November 24, 2025 29