CLARIFICATION: This story was updated Feb. 1 with additional information about Kathy Sandy’s Work Number disclosure report.

The Equifax credit reporting agency, with the aid of thousands of human resource departments around the country, has assembled what may be the most powerful and thorough private database of Americans’ personal information ever created, containing 190 million employment and salary records covering more than one-third of U.S. adults.

Follow @RedTapeChron

Some of the information in the little-known database, created through an Equifax-owned company called The Work Number, is sold to debt collectors, financial service companies and other entities.

"It's the biggest privacy breach in our time, and it’s legal and no one knows it’s going on," said Robert Mather, who runs a small employment background company named Pre-Employ.com. "It's like a secret CIA."

Despite all the information Americans now share on social media and websites, and all the data we know companies collect on us, one piece of information is still sacred to most people: their salaries. After all, who would post their salary as a status update on Facebook or in a tweet?

But salary information is also for sale by Equifax through The Work Number. Its database is so detailed that it contains week-by-week paystub information dating back years for many individuals, as well as other kinds of human resources-related information, such as health care provider, whether someone has dental insurance and if they’ve ever filed an unemployment claim. In 2009, Equifax said the data covered 30 percent of the U.S. working population, and it now says The Work Number is adding 12 million records annually.

How does Equifax obtain this sensitive and secret information? With the willing aid of thousands of U.S. businesses, including many of the Fortune 500. Government agencies -- representing 85 percent of the federal civilian population, including workers at the Department of Defense, according to Equifax -- and schools also work with The Work Number. Many of them let Equifax tap directly into their data so the credit bureau can always have the latest employment information. In fact, these organizations actually pay Equifax for the privilege of giving away their employees' personal information.

Equifax turns around and sells some of this data to third parties, including debt collectors and other financial services companies. 

Equifax declined to be interviewed, but in an emailed statement to NBCNews.com, it confirmed that it shares "employment data" with debt collectors and others, and said it does so in compliance with Fair Credit Reporting Act guidelines. 

"In all cases, these entities must have a permissible purpose to request employment information," Equifax spokesman Timothy Klein said. 

He also said consumers give these third parties the right to access the data "at the time of application" for credit.

"A consumer grants verifiers (creditors) and their assigned debt collectors the right to verify employment should the consumer default on their account," he said. 

Data for debt collectors
Companies sign up for The Work Number because it gives them an easy way to outsource employment verification of former workers. Firms hate taking these calls, which usually come when a former employee is applying for a new job, because they are a costly distraction for human resources departments and open the firm up to lawsuits if someone says something disparaging about the former employee. So they contract with The WorkNumber, which automates the process. In exchange, firms upload their human resources data to The Work Number, which was part of an independent St.Louis-based firm named TALX until it was acquired by Equifax in 2007 for $1.4 billion.

The Work Number offers consumers some benefits. It provides an easy way for prospective landlords to verify an applicant's income, for example. Consumers tell the Work Number they want a one-time access code, which they then give to a landlord so he or she can verify that the potential tenant can really afford the apartment.

But The Work Number serves dual purposes. It’s also a massive database that Equifax monetizes in a variety of ways, despite the reassuring-sounding messages found all over TheWorkNumber.com.

"Can just anyone get my income information from The Work Number?" reads one passage. Answer: "No. You have to give someone authorization to get your income information from the service."

Employers who sign up for the service go to great pains to reassure workers that their data is safe and secret. Columbia University, when it explained to employees it was transitioning to The Work Number, posted this on the school's website:

"You are the only person who can authorize access to your salary information."

But Kathy Sandy of Sommerville, N.J. was surprised to find that a debt collector had accessed information from her report two years ago, something she learned only when she obtained her "consumer disclosure" from The Work Number. Because the data is considered a credit report, consumers are entitled to one free report every year. The report shows what data the report contains, and what entities have seen it.

Sandy's Work Number report, which she shared with NBC News, is 22 pages long -- an amazingly detailed history of every paycheck she had received for years. The first page of the report lists "verifiers who have requested your data in the past 24 months." On the list is "Pressler and Pressler," a law firm that specializes in debt collection. The firm had sued her in small claims court over a credit card debt that she says she was already repaying. It is not clear from Sandy’s report what employment data was shared with Pressler and Pressler; Equifax says it does not provide salary information to debt collectors, but it does provide other information.

"I found out debt collectors can access this information, which is strange," Sandy said. "I assumed with The Work Number, for that information, you had to have a (passcode) … but they got in, and got it somehow without my consent."

In brochures where Equifax advertises sale of the data, it's not shy about the source.

"The Work Number specializes in employment and income verification. It's direct from the source: the employer. It's current, as of the last pay period. It's delivered quickly -- on demand," says one brochure, titled "Portfolio Monitoring."

In his statement to NBC News, Klein confirmed that "pay rate" information is shared with third parties, including "mortgage, auto and other financial services credit grantors," as authorized under the Fair Credit Reporting Act.

He denied that salary information is sold to debt collectors, however.

"Debt/Collection agencies may request employment information -- which may be nothing more than verifying that a consumer is working where they say they are – if it qualifies under permissible purpose," he wrote. "Collections agencies are not provided salary information."

That contradicts an assertion made recently by Equifax CEO Richard Smith in 2009, when he talked about how detailed The Work Number data is.

"With FirstSearch and TALX we can provide information about a debtor’s location, income and employment," said Smith in an interview published on NYSE Magazine’s website, referring to The Work Number’s former parent company. "That can help prioritize which accounts to pursue first. If they’re employed, that business has a better shot at collecting what is owed to them."

Klein said Smith misspoke when describing TALX’s services, and reiterated that salary information on consumers is not sold to debt collectors.

'Unbelievably scary'
With or without the income data, The Work Number data is incredibly valuable to debt collectors -- and it may come as a surprise to many workers that their employers, directly or unwittingly, help debt collectors.

Equifax markets The Work Number specifically to student loan issuers. In another brochure on the firm's website, Equifax brags that The Work Number makes debt collectors' jobs easier.

"The Work Number produced a 5.5 percent lift in Right Party Contact and a 7.3 percent lift in Collections Resolution versus current skip-trace methods," the "case study" brochure says.

Equifax’s resale of The Work Number data doesn’t stop there. It also offers "portfolio monitoring" to financial firms who might want to market their products to consumers … or to get early warning on someone who might soon land in financial trouble. It calls this "proactive managing of risk." 

"The Work Number is part of our employment and income verification service. It provides continual track of changes to your customer or client portfolio, delivered on demand per your schedule," it says. "Simply submit a portfolio of customer or client accounts and The Work Number does the rest. ... Using The Work Number to stay abreast of employment changes can expand your ability to mitigate risk while maximizing product and service potential."

Mather has been in the employer data business for more than 20 years, and he says that if Americans suspected their employers were giving away their personal information to a credit bureau, they'd be shocked.

"The story here is how (The Work Number) is getting this information," he said. "When people find out, no respectable employer will continue to do this."

Larry Ponemon is a privacy expert who operates The Ponemon Institute, a consulting firm. He said he’d never heard of companies selling employer data to debt collectors.

"Are you joking? Oh my god, I'm shocked," Ponemon said when the business was described to him. "This is unbelievably scary. I consider payroll information very sensitive and private." In studies he's conducted, salary data is always among the information consumers say is most private.

"If the public knew about this, there would be such outrage," he said. "It's just ... really depressing."

Paul Stephens, director of policy and advocacy at the Privacy Rights Clearinghouse, had heard of The Work Number, but only because some consumers have complained to his agency that the data in its database is inaccurate. Some workers find that when they try to use the information for employment verification, their titles are outdated or otherwise misrepresent their work history, which can be embarrassing for a job applicant.

When told that the data is sold to third parties, he said he was under the impression the data was not shared.

"I think it is something that would be offensive to many people. One typically considers salary information to be shared by your employer just with IRS," he said. 

A glance at the language on The Work Number's website suggested to Stephens that the firm is legally within its rights to share the information, however.

"You get into the 'permissible purpose' doctrine," he said. "Debt collectors have a permissible purpose to look at your credit information. It was my impression that the data was only being given out when employees released it."

'Secret' process?
Data brokers are under heightened scrutiny in Washington, D.C., lately. There are two separate congressional investigations of the industry, and the Federal Trade Commission announced in December that it had begun an inquiry into how brokers obtain their information. Equifax received an inquiry letter from the FTC, but only for the data broker portion of its business involving non-financial data, such as criminal background records and address information.

Credit reporting agencies, such as The Work Number, are distinct from data brokers and are governed by special rules. Ironically, those special rules may open the door for Equifax -- and the credit-reporting side of its business -- to resell the salary information, says Katrina Blodgett, a lawyer with the Federal Trade Commission. She is one the agency’s experts on the Fair Credit Reporting Act. 

The FTC filed a case against TALX and Equifax in 2008 for allegedly failing to provide employers with sufficient notice about their disclosure responsibilities under the Fair Credit Reporting Act. Equifax admitted no wrongdoing and paid a small fine.  

Blodgett said the Fair Credit Reporting Act and subsequent updates give consumers specific legal rights, such as the ability to dispute errors in credit reports. But it also creates permissible purposes for access, including giving financial service companies the right to review credit reports of consumers they do business with. 

"It’s not as easy as it should be to say whether debt collectors can get your consumer reports, because it depends on the circumstance," she said, adding that she believed Equifax could have the right to sell the salary information to debt collectors because it is part of a credit report.

Much attention has been paid to the use of credit reports by human resource departments in recent years, and Congress gave job applicants special rights when a credit report is used during the job interview process. The reverse isn’t true, however, Blodgett pointed out.

"There are special restrictions on how credit reports can be used in hiring decisions, but there are no special restrictions on how employment reports (such as salary information) is used for non-employment purposes," she said.

She said she wasn’t surprised that Equifax is selling the information in The Work Number.

"They are a credit bureau. They sell credit information to lenders," she said.

Mather wants the sale of employee information halted. His firm also performs third-party employment verification, but he does not resell the data he collects.

"I strongly believe there is no reason to resell employee information to debt collectors without the permission of the employer and employee," he said. "This 'secret' process needs to stop. I hope eventually a simple law is passed making it required to get the permission of the employee BEFORE his information is resold. It simply should NOT be used for any other purpose except for employment purposes without permission. In my view, it is a betrayal of trust."

Consumers who want to see what information The Work Number has on their employment history can visit this page on the TheWorkNumber.com. While reports are available online, consumers may have to fill out a form and mail it to The Work Number in some cases.

* Follow Bob Sullivan on Facebook.

* Follow Bob Sullivan on Twitter.

More from Red Tape Chronicles:

• Telecom firms can't say how 'crammed' charges were billed to unused phone
• Proposed 'privacy tax' would penalize firms that profit from consumers' info
• Net users fall for fake online lovers all the time, victims advocate says