When a business finds itself stretched out and is unable to collect payments from customers, they enlist the services of Debt Collection Agencies. To do this, they have to provide the Debt Collection Agencies with consumer data that, in theory, may infringe upon the consumer's privacy rights.
Data protection and debt collection are very heavily entangled together. While the U.S. doesn't have a single federally applicable data protection act, but rather multiple entities which govern and overlap in many areas. Some of the legislations applying to the state of New York control the sharing of "personally identifiable information" from any person residing in the state of New York.
For example, New York state is subject to the provisions of the Federal Trade Commission Act (FTC) which is the main federal consumer protection law that prohibits unfair or deceptive practices.
Currently, privacy laws are a cluttered mess of different sectoral rules, which makes it important to consult a skilled legal advisor as situations differ on a case-by-case basis.
Since there are no specific federal privacy laws regulating many companies, they're pretty much free to do what they want with the data unless a state has its own data privacy law (more on that below).
In most states, companies can use, share, or sell any data they collect about you without notifying you that they're doing so.
No national law standardizes when (or if) a company must notify you if they expose your data to unauthorized parties.
If a business shares your data, including sensitive information such as your health or location, with third parties (like debt collection agencies), those third parties can further sell it or share it without notifying you.
However, one law that applies to consumer credit scores can protect the consumer to some extent: the Fair Credit Reporting Act (FCRA) covers information in your credit report. It limits who can see a credit report, what the credit bureaus can collect, and how information is obtained.
At first, sight, passing on information without the prior consent of a consumer's name and address to a debt collection agency to collect an outstanding balance infringes on the consumer's privacy. But it is extremely unlikely the consumer would consent to the processing of their data for the purposes of debt recovery. If the processing might have a negative impact on the consumer, this does not automatically mean that their interests always override those of the business.
