Resume Database Nightmare:
Job Seeker Privacy at Risk

Contents:

• Introduction
• Information about the author
• Summary of report findings
• "Resume Sale" at HotResumes.com
• Biotech and pharmaceutical resume database privacy issues
• Policy recommendations
• Recommendations to job seekers
• Contributors
   
  • Appendix A: HotResumes.com invoice to Biotechcareers for "resume sale"
  • Appendix B: Text of Medzilla job seeker notification
  • Appendix C: HotResumes privacy policy & information as of 2/11/03
  • End Notes

Introduction

Pam Dixon, during the course of researching a separate study of resume databases, has discovered serious consumer privacy issues in resume databases that rise to the level of deserving immediate consumer notice. This report, below, highlights her findings.

The report itself is comprised of a consumer notice, which is based primarily on public documents. The report also contains policy recommendations and job seeker tips.

The complete study findings along with an extensive consumer guide will be published later this year.

The author has joined forces with the Privacy Rights Clearinghouse, a non-profit consumer advocacy organization, to disseminate the consumer information in this report.

Information about the Author *

Pam Dixon is an author and researcher conducting a year-long study of privacy issues impacting job seekers. The study is funded by the Rose Foundation Consumer Privacy Rights Fund.

Ms. Dixon is the author of seven books related to technology, with two books specifically about online job searching. She is the author of the Privacy Foundation's 2001 report on the privacy practices of Monster.com, www.privacyfoundation.org/privacywatch/monster.asp. She is the principal investigator for the Online Job Search Privacy Study. 

Summary of Report Findings

The information in this alert was obtained from public documents that have already been published unless otherwise noted.¹

• HotResumes.com sold 4, 941 resumes and/or email addresses. 2 (See Appendix A for a copy of the published invoice of what is described as a "resume sale.")

• Legal documents indicate that a Mr. Jason Monastra, while he was the owner of Biotechcareers.com, a job site focused on biotechnology-related jobs, gained paid access to health and biotech-related resumes. ³ He downloaded thousands of resumes for his use. ⁴ Mr. Monastra was using the resumes to create an internal resume database. ⁵ Medzilla, Inc, a prominent health, pharmaceutical, and biotech job site, sued Mr. Monastra over this matter. ⁶

• Four large biotechnology and health related job sites exist: Medzilla, HireHealth, BioSpace, and BioView. Thousands of job seekers' resumes were taken from Medzilla, a prominent health, pharmaceutical, and biotech job site. ⁷ According to telephone interviews with each of the other companies, ⁸ company representatives told researchers that Mr. Monastra did access resumes at HireHealth in fall, 2002. BioView told researchers Mr. Monastra accessed its resume database in August 2002, and was stopped immediately. BioSpace told researchers its resume database was not accessed by Mr. Monastra.

• Legal documents indicate that Medzilla notified the jobseekers whose resumes had been downloaded by Mr. Monastra of its lawsuit and related issues. ⁹ (A copy of the Medzilla notice to jobseekers is in Appendix B. )

"Resume Sale" at HotResumes.com

According to legal documents, HotResumes.com sold 4,941 resumes and/or email addresses to Biotechcareers.com for .33 cents each in a sale that was invoiced on November 30, 2002. This invoice was made public and was published as part of a lawsuit against Mr. Monastra. (Medzilla vs. Optimum Intelligence et al.)¹⁰ The invoice was noted as a "resume sale" and it was marked as paid. A copy of the invoice is in Appendix A.

Mr. Monastra additionally asserted in legal documents that he had purchased email addresses from HotResumes.com. ¹¹

On its Web site, HotResumes, in its publicly published Frequently Asked Questions section, states that it receives resumes from three sources:

Legal documents did not indicate where the data that comprised the HotResumes.com "resume sale" originated from.

For reference purposes, the HotResumes published privacy policy on its Web site is quoted below in part. To reiterate, legal documents did not indicate where the data comprising the sale came from, so researchers do not how the HotResumes posted privacy policy applies to its invoiced "resume sale" to Biotechcareers.com.

HotResumes.com privacy policy excerpt:

Biotech and Pharmaceutical Resume Database Privacy Issue

In July, 2002, Dr. Frank Heasley, the owner of Medzilla.com, a biotechnology job site, became aware that Jason Monastra, who was at the time a recruiter and the owner of Optimum Intelligence, was making a large number of resume downloads from the Medzilla resume database. Dr. Heasley quickly discovered that Jason Monastra was also the owner of a new job search site called Biotechcareers.com and had downloaded approximately 2,400 resumes from the Medzilla database within the space of several weeks. ¹⁴

October 15, 2002, Medzilla filed suit against the owner of Biotechcareers.com. ¹⁵ November 15, 2002, Dr. Heasley contacted the 2,399 job seekers whose resumes Mr. Monastra had downloaded and notified them that their resumes had been taken from the resume database and used in ways not allowed by the terms of agreement of the Medzilla site. ¹⁶

The entire Medzilla notice to job seekers is published in legal documents.¹⁷ The text is reprinted in Appendix B in full.

The notice, sent from Frank Heasley, stated in part:

According to legal documents and the job seeker emails contained within them,¹⁸ the owners and / or agents of Biotechcareers.com contacted the job seekers whose resumes Mr. Monastra had downloaded. ¹⁹ Some of the job seeker email solicitations said the Biotechcareers.com site had an outdated copy of the job seekers' resumes, and requested the job seekers to "repost" their resumes on Biotechcareers.com by replying with a new resume attached. ²⁰

One such email sent to a job seeker, from support@biotechcareers.com dated November 16, 2002, stated:

Other job seekers were contacted by third parties through the Biotechcareers.com site, even though job seekers said they had not posted resumes there. According to documents, one such email came from Jim Hansen of LifeScience Associates November 18, 2002. ²¹

The subject line of the referenced email read: "Response to your resume posting on Biotechcareers.com." The message went on to state:

The email was signed by Jim Hansen, Relationship Manager of LifeScience Associates. The email referenced Biotechcareers at the bottom of the page. ⁽²¹⁾

Another email sent from Biotechcareers to a Medzilla resume poster November 22, 2002 ²² stated, in part:

The Medzilla notice to jobseekers mentioned "other biotech related job boards." ²³ Chris Amato of HireHealth is specifically mentioned in the Medzilla v Optimum Intelligence documents. ²⁴

In a telephone interview, Chris Amato of HireHealth.com, a large search site with a significant resume database, said he noticed a pattern of resume download on his resume database tying back to Biotechcareers.com. Mr. Amato told researchers he notified "hundreds" of job seekers by telephone that the privacy of the resumes they posted on HireHealth had been compromised. ²⁵

In a telephone interview, ²⁶ Pam Bailey, director of BioView, another large biotech job site, told researchers that she was contacted in August, 2002 by a job seeker with a question about an email solicitation from a recruiter. The email had referenced BioView's site.

Ms. Bailey researched the matter and discovered that a company called Optimum Intelligence, owned by Jason Monastra, had sent the email to the job seeker and had represented to the job seeker that he found their resume in the BioView database when in fact, the job seeker's resume was not in the BioView database. In the email, Mr. Monastra solicited the job seeker to send in a new copy of a resume to the address in the email.

BioView's parent company, Monster.com, sent a cease and desist letter to stop Mr. Monastra from soliciting BioView jobseekers. Ms. Bailey told researchers that Mr. Monastra's access to the resume database ended immediately, and that his account was shut down. ²⁷

In telephone interviews, BioSpace.com told researchers its database was not accessed by Mr. Monastra. ²⁸

The Medzilla lawsuit was settled in Medzilla's favor and dismissed February 3, 2003. ²⁹ The Biotechcareers.com domain was handed over to Medzilla as part of the settlement. ³⁰ In a telephone interview after the dismissal of the suit, Mr. Heasley told researchers that as part of the settlement, Mr. Monastra was directed to erase the Biotechcareers.com resume database. ³¹

No legal actions against Mr. Monastra or Biotechcareers.com have been publicly filed on BioView's behalf at this date, nor have they been filed on the behalf of BioSpace nor HireHealth. ³²

Legal documents indicate that the Biotechcareers.com resume database allegedly contained in "excess of 20,000 resumes" and "included over 30,000 registered users" at the time Mr. Monastra was directed to delete it.³³

Policy Recommendations

Author Pam Dixon joins the Privacy Rights Clearinghouse, a nonprofit consumer advocacy organization, in recommending that the Federal Trade Commission (FTC) undertake a thorough investigation of the entire job search industry, online and off.

Issues include:

• Deceptive data handling practices in regards to posted privacy policies.
• Poor and in many cases absent notification to consumers of data handling practices.
• Widespread industry practice of data mining and selling job seeker data, including names, email addresses, resumes, and in some cases Equal Employment data such as ethnicity and gender.
• Data security issues, including:
  • Poor to non-existent resume database access verification procedures.
  • Poor to non-existent job validation procedures.
  • Poor follow-through and lack of notification to job seekers of privacy lapses and problems.
• Widespread industry practice of using copyrighted information belonging to consumers (resumes) as an integral part of making a business profit while at the same time not fully disclosing this practice.

We wish to emphasize that job seekers who are notified of privacy lapses impacting their job searches receive that notification voluntarily by the most ethical sites in the industry. We believe that all sites should notify job seekers of privacy lapses, and in a timely fashion.

Recommendations to Job Seekers

[Note: These tips for job seekers are also available on the Privacy Rights Clearinghouse Web site, Fact Sheet 25, "Online Job Search Web Sites: Tips to Safeguard Your Privacy," at http://www.privacyrights.org/fs/fs25-JobSeekerPriv.htm.]  

In any job search, it is undeniably important to circulate a resume. However, job seekers need to carefully minimize privacy issues related to resumes while still maintaining appropriate exposure to employers.

It is important for all job seekers to understand that resume databases vary widely in privacy practices and controls. Learning to choose a quality job search site and resume database with good privacy practices has become an important part of your job search if you plan to use the Internet as a job search tool.

Another key skill is to discriminate between valid job search related email and unhelpful  solicitations for your resume. 

Remember, in the information economy, your resume has a "street value." It is important to protect your resume from people and businesses who want to use it primarily to make a profit instead of primarily to help you find employment.

• Even the most careful, conscientious sites cannot control your resume after an employer or a recruiter has downloaded it.  Job sites do not have the ability to track or physically control how a recruiter or employer uses your resume after it is downloaded. Most sites watch for problems - such as rapid resume downloads  -- and enforce terms of use agreements with employers and recruiters. But let the job seeker beware. When it comes to resume databases, some responsibility does fall to the job seeker to understand the risks involved in posting a resume in a database. 
• The more general the email "job" offer, the less valid it usually is. In the Biotechcareers.com emails to job seekers, what stands out the most is that the emails asked jobseekers to send a resume to a new email address or to "update" their resumes. No specific, credible job was offered at one specific, verifiable company. Vague wording like  "We have thousands of jobs" or "We work with major companies" is a red flag. Requests to send in a new copy of your resume can spell trouble, too. Avoid vaguely worded offers, and avoid sending your resume to general email resume solicitations after you have posted your resume online. 
• Resume posting options for job seekers. Job seekers have several options to choose from in circulating a resume.
  • One option is to reply to job ads directly without going through a third party. Look for a company-related email address to send your resume to.
  • Another option is to post a resume directly on the Web site of the company you wish to work for.
  • Working with one carefully selected "headhunter" or recruiter is also an option.
  • Some resume databases let you mask your contact information or email address when you post a resume. This resume posting option allows you to control who contacts you or not. If you are going to post a resume online, this should be the only way you post it.

• Before posting a resume to any database, take the time to look for and read the privacy policy of that site and query the site owner with any privacy concerns. Be sure to look for specific privacy policy statements about resumes, registration information, and statements about how that information is used, stored, and shared. If the site does not have a privacy policy posted, that should signal that you should be especially cautious about posting a resume there, if at all.
• Pay particular attention to how long a site says it will keep or store your resume. Preferably, job and resume sites should state that they promise to keep your resume for a limited, specific amount of time, such as one to six months, after which the site will delete your resume. Without specific, written statements about how long your resume may be kept, your resume can be archived for years, legally. Most job seekers do not want resumes circulating after they have gotten a job.
• Before you post a resume, check to make sure you can delete your resume after you have posted it. Look in the job site's privacy policy for resume deletion instructions. If you don't find any such instructions on the site, write an email to the site and ask how or if you can delete your resume. If you are not satisfied with the reply, do not post your resume to that site. You must be able to delete your resume when you want to. After all, it belongs to you.
• If you plan on using a resume writing service in your job search efforts, get an agreement in writing that the service will not sell or share your resume with any third parties or partners. Also, ask to see the privacy policy of any resume writing services you may use and ask specifically about how the service handles and stores your resume. This applies to traditional and online resume writing services.
• Handling unsolicited email about your resume posting. If you post a resume to a resume database and receive unsolicited email other than from legitimate employers or recruiters, be sure to notify the site where you have your resume posted and tell them you have received the email. Be sure to forward the entire email you received to the site so that it can take action. Again, the more vague the email, the less legitimate it is likely to be.
• Keep good records. Be sure to keep a record of where you have posted your resume. Remember to go back and delete your resume from the sites where you have posted it after you have finished your job search.
• Post your resume sparingly. It is tempting to go to every job site you can find and post your resume. Focus on quality, not quantity. If you believe you must post your resume online, hand-pick just a handful of sites that have good privacy policies and a good track record. Choose sites that other people working in your profession have had good luck with, and post only to sites that allow you to mask your contact information.
• Use a disposable email address. If you decide to post your resume to a site that does not allow you to mask your identity, then mask it yourself. Use an email address that you can cancel if you start getting spam, and don't give out your full name, phone number, or home address.
• Never put a Social Security Number on your resume. You can provide it when you are invited for an interview or when the employer obtains your permission to conduct a background check. Widespread access to your SSN puts you at risk for identity theft.
• Omit references on your resume. When you post a resume online with your references' names and phone numbers on it, you are giving their information away without their consent in what can be a very public forum.
• Your resume belongs to you. According to current copyright law, you own your resume and the copyright on it. If you don't like how your resume is being handled, you have the right to complain and take action.

Help for Job Seekers

If you believe your resume or personal job search data, including your email address or your name, has been shared or used in a way inconsistent with a job site's posted privacy policy, you have recourse ³⁴ through the Federal Trade Commission (FTC.)

You may file a consumer complaint with the FTC by calling (1-877-FTC-HELP) or by using the FTC's online filing system, located at http://www.ftc.gov/. Click on "File a Complaint Online."

If you have identity theft problems resulting from your resume posting, visit the Web sites of the Privacy Rights Clearinghouse www.privacyrights.org/identity.htm and the Identity Theft Resource Center www.idtheftcenter.org for facts and helpful information. The PRC provides other fact sheets relating to SSNs, workplace privacy, and financial privacy, located at www.privacyrights.org/fs.  

You may additionally contact www.JobSearchPrivacy.org for further information or help as of February 24, 2003. New consumer information will be posted at the site, including a consumer guide to online job site privacy, throughout 2003 and beyond.  Email: info@jobsearchprivacy.org.

This report, "Resume Database Nightmare: Job Seeker Privacy at Risk," is available on the Privacy Rights Clearinghouse Web site at www.privacyrights.org/ar/Dixon-JobPrivacyRpt.htm  and at www.pamdixon.com.

Pam Dixon gratefully acknowledges Rose Foundation Consumer Privacy Rights Fund, whose financial support made this research possible.

Contributors

• The Honorable Judge Barbara Rothstein's docket clerk provided valuable assistance to researchers, as well as a timely copy of the Medzilla, Inc. v Optimum Intelligence LLC, et al Case No. CO2-2122R docket.

• Claudia B. Farrell of the FTC assisted in identifying documentation for researchers.

• Beth Givens, director of the Privacy Rights Clearinghouse, made significant and helpful contributions to this document.

Appendix A: Copy of HotResumes.com Invoice to Biotechcareers for "resume sale."

This invoice is referenced from the publicly available case files of Medzilla, Inc. v Optimum Intelligence LLC, et al Case No. CO2-2122R, U.S. District Court for the Western District of Washington at Seattle.

In the case file, the Declaration of Jason Monastra in Support of Opposition to Plaintiff's Motion to Compel, Exhibit 3, contains the invoice of HotResumes.com "resume sale" to Biotechcareers.com. The invoice is labeled as #628, and is dated November 30, 2002. The description of the goods is marked as a "Resume Sale," and the invoiced is marked as paid in handwriting.

(see attached TIFF File.)

Appendix B: Text of Medzilla job seeker notification.

This text is taken from Medzilla, Inc. v Optimum Intelligence LLC, et al Case No. CO2-2122R . Case file. Also: Declaration of Jason Monastra in Support of Opposition to Plaintiff's Motion to Compel, Paragraph 14, which contains the text of the email notice.

The message was sent November 14 to 2, 399 job seekers whose resumes Mr. Monastra had downloaded.

Appendix C :HotResumes Privacy Policy & Information as of February 11, 2003

Following is a portion of the February 11, 2003 version of HotResumes.com privacy policy as posted publicly on its Web site. The entire policy is available at http://www.hotresumes.com/. Researchers have retained for their records a complete printout of the February 11 policy for study and reference purposes.

Excerpt of HotResumes.com posted privacy policy:

Copyright © 2003-2006. Privacy Rights Clearinghouse/UCAN and Pam Dixon. This copyrighted document may be copied and distributed for nonprofit, educational purposes only. For distribution, see our copyright and reprint guidelines. The text of this document may not be altered without express authorization of the Privacy Rights Clearinghouse. This document should be used as an information source and not as legal advice. PRC documents contain information about federal laws as well as some California-specific information. Laws in other states may vary. Overall, our information is applicable to consumers nationwide.