Online Job Search Web Sites:
Tips to Safeguard Your Privacy

These tips result from the author's year-long research study of the online job search and resume-writing industries. To learn more about the research, visit the author's web sites: www.worldprivacyforum.org and www.jobsearchprivacy.org.

• Introduction
• Tips for Job Seekers Who Use Online Resume Services
• Consumer Tips for Using Resume Writing Services
• Help for Job Seekers

Introduction

In any job search, it is important to circulate a resume. However, job seekers need to carefully minimize privacy issues related to resumes and personal data while still maintaining appropriate exposure to employers.

It is important for all job seekers to understand that employers, commercial job search sites, and resume databases vary widely in privacy practices and controls. Learning to choose a quality job search site and resume database with good privacy practices has become an important part of your job search if you plan to use the Internet as a job search tool.

Another key skill is to discriminate between valid job search-related email and other offers and unhelpful maybe even fraudulent solicitations for your resume or personal data.

Remember, in the information economy your resume and your personal information have a "street value." It is important to protect your resume and personal information from people and businesses who want to use it primarily to make a profit instead of primarily to help you find employment.

The World Privacy Forum and the Privacy Rights Clearinghouse have received credible complaints from consumers who had their identities stolen after using the services of online job search sites. Recently, an identity theft scam was operating through job fairs at State Departments of Labor, resulting in stolen identities of hundreds of people who supplied resumes, Social Security numbers (SSNs), and financial information to a fraudulent company. You can go far in avoiding these problems by following these tips.

Tips for Job Seekers Who Use Online Resume Services

1. Read the privacy policy. Do not use a job search site, a resume writing service, a resume distribution service, or any job search service that does not have a posted privacy policy on its Web site. A privacy policy is a legal document that explains to you how a site or business will handle your personal data. It is also the basis of legal protection for you in case you run into any problems. If the privacy policy is not posted on the Web site, you do not have this legal protection. Posting privacy policies is voluntary. Most job sites today do post privacy policies. When you use the site, print out the policy and keep a copy of it for your records.

Be sure to look for specific privacy policy statements about resumes, registration information, and statements about how that information is used, stored, and shared. Pay particular attention to how long a site says it will keep or store your resume. Preferably, job and resume sites should state that they promise to keep your resume for a limited, specific amount of time, such as one to six months, after which the site will delete your resume. Without specific, written statements about how long your resume may be kept, your resume can be archived for years, legally. Most job seekers do not want resumes circulating after they have gotten a job.

2. Make sure you can delete the resume. Before you post a resume, check to make sure you can delete your resume after you have posted it. Look in the job site's privacy policy for resume deletion instructions. If you don't find any such instructions on the site, write an email to the site and ask how or if you can delete your resume. If you are not satisfied with the reply, do not post your resume to that site. You must be able to delete your resume when you want to. After all, it belongs to you.

3. Get it in writing. If you plan on using a resume writing service in your job search efforts, get an agreement in writing that the service will not sell or share your resume or personal data with any third parties or partners. Also, ask to see the privacy policy of any resume writing services you may use and ask specifically about how the service handles and stores your resume. This applies to traditional and online resume writing services. For additional tips on resume writing services, see the next section.

4. Post your resume sparingly. It is tempting to go to every job site you can find and post your resume. Focus on quality, not quantity. If you believe you must post your resume online, hand-pick just a handful of sites that have good privacy policies and a good track record. Choose sites that other people working in your profession have had good luck with, and post only to sites that allow you to mask your contact information.

5. Use a disposable email address. If you decide to post your resume to a site that does not allow you to mask your identity, then mask it yourself. Use an email address that you can cancel if you start getting spam, and don't give out your full name, phone number, or home address.

6. Omit references on your resume. When you post a resume online with your references' names and phone numbers on it, you are giving their information away without their consent in what can be a very public forum.

7. Pay attention to business affiliates. Be aware that many resume writing services and job sites have affiliations with other businesses. When you are given recommendations, be sure to evaluate each recommendation on its own merit. Check for yourself if it is a good deal or not.

8. Limit personal information. No credible employer ever needs your bank account numbers, credit card numbers, mother's maiden name, or identifying characteristics such as eye color. If an employer requests these items from you, don't give them the information.

9. Safeguard financial data. If you plan on purchasing services from a commercial job site or writing service, look for a privacy policy that details how that service will handle your credit card data. Whenever possible, you may want to consider using PayPal to purchase services in order to protect your financial information from a company you do not know well.

10. Protect your Social Security number. Some legitimate online job application sites and employment kiosks may sometimes ask for your Social Security number(SSN) and date of birth prior to posting a resume or applying for a job. (For example, www.sportsauthority.com, www.albertsons.com, usajobs.opm.gov, studentjobs.gov, and many state job sites request this information.) Some of these sites conduct instant SSN matching or background checks on your information to verify it.

It is the position of the World Privacy Forum that you as a job seeker should never have to submit your SSN or date of birth prior to applying for a job, especially online where verification of where the SSN is going is more challenging. Broad dissemination of your SSN can lead to identity theft. It is appropriate for you to allow a serious employer to use your SSN and date of birth to conduct a background check after you have engaged in the interview process.Not all sites that request your SSN and date of birth are legitimate. As a general rule, you should not supply this information up front, especially in combination with your credit card information. If you are unsure about a site's validity, please see the help section at the end of this guide for options.

11. Limit cookies. Cookies that are deposited on your computer from third-party companies such as an advertising network (for example, Advertising.com, Atlas DMT, or Doubleclick) may track your activities over many Web sites. Most sites will allow you to browse without accepting cookies.

Set your browser to not accept third-party cookies. If you pick up third-party cookies, delete them. You can visit the Network Advertising Institute's (NAI) opt-out page and opt out of this tracking: http://www.networkadvertising.org/optout_nonppii.asp. Some companies that do not offer the NAI opt-out may allow you to opt out on separate pages.

12. Use an anonymizing service. Research has found that most sites allow you to look at job ads using anonymizing services. By all means take advantage of this. Using these services, which are free, will protect you from cookies and other privacy threats. Visit www.anonymizer.com, www.nonymouse.com, and www.junkbuster.com for more information about anonymous browsing.

13. Be realistic about risks. Even the most careful, conscientious sites cannot control your resume after an employer or a recruiter has downloaded it. Job sites do not have the ability to track or physically control how a recruiter or employer uses your resume after it is downloaded. Most sites watch for problems - such as rapid resume downloads -- and enforce terms of use agreements with employers and recruiters. But let the job seeker beware. When it comes to resume databases, some responsibility does fall to the job seeker to understand the risks involved in posting a resume in a database. 

14. Avoid vague offers. The more general the email "job" offer, the less valid it usually is. Vague wording like "We have thousands of jobs" or "We work with major companies" is a red flag. Requests to send in a new copy of your resume can spell trouble, too. Avoid vaguely worded offers, and avoid sending your resume in response to general email resume solicitations after you have posted your resume online.

15. Handling unsolicited email about your resume posting. If you post a resume to a resume database and receive unsolicited email other than from legitimate employers or recruiters, be sure to notify the site where you have your resume posted and tell them you have received the email. Be sure to forward the entire email you received to the site so that it can take action. Again, the more vague the email, the less legitimate it is likely to be.

16. Keep good records. Be sure to keep a record of where you have posted your resume. Remember to go back and delete your resume from the sites where you have posted it after you have finished your job search.

17. Your resume belongs to you. According to current copyright law, you own your resume and the copyright on it. If you don't like how your resume is being handled, you have the right to complain and take action.

18. Resume posting options. Job seekers have several options in circulating a resume.

• One option is to reply to job ads directly without going through a third party. Look for a company-related email address to send your resume to. Another option is to post a resume directly on the Web site of the company you wish to work for. Working with one carefully selected "headhunter" or recruiter is also an option.
• Many job sites and resume databases let you mask your contact information or email address when you post a resume. This resume posting option allows you to control who contacts you or not. If you are going to post a resume online, this should be the only way you post it.

Consumer Tips for Using Resume Writing Services

Resume writing services charge anywhere from $100 to $800 and up for their services. Most of these businesses accept credit card payment.

1. Privacy policy. If you do not see a privacy policy posted at a resume writing service site, you should think very carefully before deciding to use the site. A privacy policy is a legal document, and it is enforceable. It does give you some legal protection. However, if you use a site without a privacy policy and then you have problems, you have no viable legal recourse regarding privacy, and can end up very frustrated.

2. Policy tips. Things to look for in the privacy policy include credit card encryption, refund policy, and an explicit statement about resume sharing.

1. The privacy policy should state that it protects your credit card transaction. The term to look for is "SSL," or "encryption." The policy should state that the business will not share, distribute, or sell your resume. The policy should state how and under what circumstances you can get a refund if you are unsatisfied with the results of the service.
2. If the site says it only shares your resume "with your permission," you need to get a firm definition of what permission is from the business. Does the business get your written permission? If not, then how does the business get your permission? This is a very important follow-up question for you to ask if you see the term "permission" used.

3. Locating the policy. If finding the privacy policy is a lot of work, treat this as a red flag. Look for privacy policies that are clearly and conspicuously posted on the business Web site. 

4. Payment services. If a business allows you to pay with PayPal, take it up on the offer, as it gives you more ability to keep your credit card information private.

5. Web seal programs. A Better Business Bureau (BBB) Seal on the site is positive, but only if it works. Many people see a BBB Seal on a site and take it at face value. Here's how to check to make sure a seal is active:

1. Click on the Seal. You should see a page pop up directly linked to the BBB site. The page will have a date, the company name, and a description of the business along with the business address and phone numbers. The Seal should be current, and not out of date.
2. Please note: some browsers may not allow pop up windows. If that is the case, see below.

Problems with seals:

1. If you click on a seal and it doesn't open, this is an indication that the seal no longer is active. Or, you may have a browser problem. If you click on a seal and a dated seal with the company name does not appear, go to www.bbbonline.org and look up the company on the BBB site at www.bbbonline.org/consumer/.If you click on a seal and it leads to a search page at the BBB, this too is a sign that the site is just trying to make it look like they have a seal.
2. If the site has a BBB seal but not a privacy policy, the site is in technical violation of the BBB seal program. The BBB requires that all sites with a posted seal also post a privacy policy.

If you have any questions about a seal, call the BBB and inquire about the seal's validity. Reliability Seal Program: (703) 247-9370
Privacy Seal Program: (703) 247-9336
Online Privacy Dispute Resolution Intake Center: (703) 247-9333
Fax: (703) 525-8277

6. Checklist. Here is a checklist of the things you can look at to help you make a decision about the quality of the site:

1. Does the site have a privacy policy? Does the site have secure credit card payment?Does the site give you a guarantee or warrantee before you buy?Does the site ask overly intrusive questions? For example, does the site ask for mother's maiden name, bank account numbers, or your physical characteristics? No resume writer needs this information from you, and valid resume writing businesses will not ask for this information. Does the site ask for date of birth or your Social Security number? If it does, you should not use the site, and you should report it to the FTC, (877) FTC-HELP. Does the site have adequate and correct contact information listed for itself? Have you tested the contact information? Does the site belong to a BBB? Have you checked the appropriate BBB for complaints against the business? www.bbb.org Does the site post an online BBB Seal? If so, is it a valid seal? www.bbbonline.org
2. If you send a privacy query to the site, does it answer with an affirmative response to you?

Help for Job Seekers

For updated tips on online jobseeking safety, consult this publication on the web site of the World Privacy Forum web site: "Job Seekers' Guide to Resume Databases: Twelve Resume Posting Truths," at
www.worldprivacyforum.org/resumedatabaseprivacytips.htmlIf you believe your resume or personal job search data, including your email address or your name, has been shared or used in a way inconsistent with a job site's posted privacy policy, you have recourse through the Federal Trade Commission (FTC). You may file a consumer complaint with the FTC by calling (877) FTC-HELP or by using the FTC's online filing system, located at http://www.ftc.gov/. Click on "File a Complaint Online."

If you have identity theft problems resulting from your resume posting, or if you are unsure about a company, visit the Web site of the World Privacy Forum, www.worldprivacyforum.org, and send in a complaint. Also, visit the Privacy Rights Clearinghouse www.privacyrights.org/identity.htm and the Identity Theft Resource Center www.idtheftcenter.org for facts and helpful information. The PRC provides other fact sheets relating to SSNs and financial information located at www.privacyrights.org/fs.

Pam Dixon gratefully acknowledges the Rose Foundation Consumer Privacy Rights Fund, whose financial support made this research possible

Copyright © Privacy Rights Clearinghouse/UCAN and the World Privacy Forum. This copyrighted document may be copied and distributed for nonprofit, educational purposes only. The text of this document may not be altered without express authorization of Pam Dixon, info2004@worldprivacyforum.org and the Privacy Rights Clearinghouse. This fact sheet should be used as an information source and not as legal advice. For distribution of this fact sheet, see our copyright and reprint guidelines. This copyrighted document may be copied and distributed for nonprofit, educational purposes only.The text of this document may not be altered without express authorization of the Privacy Rights Clearinghouse. This fact sheet should be used as an information source and not as legal advice. PRC fact sheets contain information about federal laws as well as some California-specific information. Laws in other states may vary. Overall, our fact sheets are applicable to consumers nationwide.

Privacy Rights Clearinghouse, 3100 - 5th Ave., Suite B, San Diego, CA 92103. Web: www.privacyrights.org