Lost 401(k) Cash Database Encounters DOL Data Collection Hurdles

The US Labor Department is relying on employer data disclosures to build a registry by year’s end to connect retirement savers with unclaimed 401(k)s, a move that will require overcoming plan sponsors’ liability concerns.

The Employee Benefits Security Administration hit a snag earlier this year when the IRS refused to share plan data with the DOL, citing confidentiality rules. Now the agency is seeking voluntary submissions from plan sponsors to track down “lost” assets, unclaimed by participants or their beneficiaries when workers leave their jobs.

Regulators’ new focus on plan cybersecurity along with separate DOL enforcement initiatives is making that a hard sell for private-sector retirement plans. There is fear they could be exposing themselves to federal audits or private-sector litigation by handing over data willingly, or that they might risk that data falling into the wrong hands by sharing it at all.

The SECURE 2.0 Act Congress passed in December 2022 gave EBSA until the end of this year to collect data for a searchable online tool to find lost retirement income “in consultation with the Secretary of the Treasury,” but neither Congress nor the DOL expected the obstacles they’ve encountered.

“There are technical issues that I think we didn’t anticipate in getting hold of data from the Internal Revenue Service and Treasury, chiefly having to do with constraints that those agencies feel and their ability to freely share the data with us,” Tim Hauser, EBSA’s deputy assistant secretary for program operations, said in an interview with Bloomberg Law.

Absent that key data sharing arrangement, the DOL has turned to voluntary data collection in hopes that plans can lend a hand. The amount of funds at issue is high—some 29.2 million left-behind or forgotten 401(k) accounts contained approximately $1.65 trillion in assets as of May 2023, according to data compiled by Capitalize.

But employer plan sponsors are hesitant to share data that includes employees’ social security numbers and account balances, even with the agency.

The plan sponsors are concerned that, in an attempt to fix the problem on its own, the DOL could also equip its enforcement arm with the information they say is intended only for use in the database.

Cybersecurity Concerns

Federal regulators such as EBSA can launch investigations into potential wrongdoing and audits examining whether plan sponsors conducted adequate due diligence to try and return “lost” accounts, as they are required to do as fiduciaries under the Employee Retirement Income Security Act of 1974.

Locating those participants and correcting irresponsible plan behavior has been a national enforcement priority for EBSA since at since at least 2021.

Workers can also sue their employers for alleged breaches of fiduciary duty under ERISA if their data is compromised. State privacy laws also protect against the unlawful sharing of consumer data.

“It’s unfortunate, but plans and plan fiduciaries really do sort of have to think defensively,” said Elizabeth Hopkins, senior partner at Kantor & Kantor LLP. “I’m sympathetic to the notion that, in a perfect world, this shouldn’t be hard to give this information over voluntarily, but on the other hand, we don’t live in a perfect world.”

The DOL has been ramping up its pressure on plans to do more to protect personally identifiable data, issuing subregulatory guidance in 2021 on avoiding cybersecurity threats that has formed the basis for questions investigators routinely ask during unrelated plan audits.

EBSA has recently sought to hold plan sponsors accountable for data breaches, as well as recordkeepers Alight Solutions and JP Morgan, through enforcement actions. Even before issuing the cybersecurity guidance, the agency sought to hold plan sponsors like Abbott Laboratories liable for unlawfully sharing participant data, which prompted a DOL investigation and private litigation in 2020.

“Unless they make some changes to the guidance to give employers a little more grace and some assurances related to cybersecurity, there’s going to be very little uptake on this,” Suzanne Odom, principal at Jackson Lewis P.C., said of the DOL.

The DOL’s enforcement track record has plan sponsors concerned that the agency would accuse them of fiduciary breaches related to safeguarding plan data, even when the sensitive information in question is being shared with EBSA itself.

Hauser said he rejects the idea that the DOL would allege a plan sponsor breached their fiduciary obligations to participants by entrusting their data to the agency. But he said DOL is still seeking a better solution for populating the database in the limited months it has left to create it.

Hauser said he’s working closely with the “relevant agencies” to potentially use data, but that Congress has the power to clarify whether DOL has access to the personally identifiable information contained in the Form 8955-SSA data it’s asking employers to hand over.

“It may well be that there’s a decision that the simplest and best fix is the legislative one, but right now we’re just trying to work out the problem dealing with the other agencies and we’re trying to get a voluntary data collection to help us over the hump here in December,” Hauser said.

Enforcement Looms Large

The idea of a lost-and-found registry dates back to at least 2016.

Since 2017, the agency has recovered more than $6.7 billion in unclaimed retirement assets for participants and beneficiaries by conducting targeted audits and, at times, suing plan sponsors over ERISA breaches.

“All plan sponsors and plan administrators have the best intentions involved in making sure people get the retirement benefits that they are due, but at the same time, nobody wants the Department of Labor in their house, because they don’t leave,” said Odom.

Plan sponsors are concerned that sharing more detailed plan data with the agency will prompt closer scrutiny, opening the door for potential audits, but Hauser said that tips or leads that inform enforcement action will be “separate and apart” from data the agency intends to collect to begin populating the lost-and-found registry.

“The point of this database is quite clearly not to serve as a source for enforcement actions,” he said.

Incentivizing Participation

Plan sponsors who are reluctant to embrace a lost-and-found system are looking at the issue the wrong way by viewing it as a part of the DOL’s enforcement program, according to Hauser.

“It’s the exact opposite, and if you want to guarantee that we have to keep doing these investigations and we have to keep going through everyone’s records, a good way to do that would be to not have a good lost-and-found system,” he said.

The agency hopes to address employer concerns following a public comment period on their request set to end June 17.

“I actually think there are many disincentives to sharing voluntarily,” said Allison Itami, principal at Groom Law Group. “I think plans are really picking up on that like, ‘we can’t really give you all of this sensitive information,’ it really opens them up to a lot of other potential avenues of liability.”

As the December database deadline approaches, the DOL has tempered expectations that its first outing will represent a final product. Hauser said there is a long road ahead for building out the tool.

“I don’t think they are going to let perfection stop them from trying to get something in process and working to make those connections and those matches,” Itami said. “It doesn’t do them or anyone any good, in terms of their mission of retirement security, if five years from now they make a match for somebody who needed the money today.”