Page Outsourcing boasts that it helped Serasa Experian recruit 300 technology and finance professionals for a new shared services centre in Brazil. Serasa Experian sits inside the Experian data empire, a world built on records, systems, accuracy and information. Lovely. Then I asked Page for my own data. Page sent me redactions and another man’s completely unredacted CV. He was Lee Thompson. Just not me. I told Page. According to the other Lee Thompson, Page still had not informed him of the breach. Luckily, I already had.
Page Sells Precision To A Data Giant
Page Outsourcing has a case study called “300 tech and finance professionals joined Serasa Experian to open a brand-new SSC in Brazil”. The page says Serasa Experian is the Brazilian subsidiary of Experian, a multinational credit reporting company that collects and aggregates information on more than one billion people and businesses worldwide.
So we are not talking about a cupcake shop with a spreadsheet. We are talking about recruitment for a company inside one of the world’s major data empires. Records, credit information, systems, technology, finance, people’s details and the machinery of modern data life.
Page says Serasa Experian engaged it to help build a new shared services centre from scratch in São Carlos. It says the work involved recruitment outsourcing, RPO, over 18 months, covering technology and finance roles. It says 300 lives changed. That is Page’s phrase. Lives changed. Hold that thought.
All The Right Words
Page says candidates would join a specialised workforce using Serasa’s complex technology platform. It says vacancies covered infrastructure, development, database, architecture, project work, BI, accounts receivable, accounts payable, treasury and planning.
It says Page designed and implemented a bespoke recruitment process, covering everything from candidate outreach tone to career website pages, profile design and onboarding support. It also says all of the client’s information management was handled through an ATS.
Perfect. A recruitment company selling end-to-end talent infrastructure to a data giant. A case study full of process, systems, candidate management, onboarding, information handling and scale. Now meet the other Lee Thompson.
Same Name, Wrong Human Being
When I asked Page for my own data, Page sent me redactions and another person’s completely unredacted CV. Not a blank attachment. Not a typo. Not a harmless formatting wobble. A full CV.
The other person was also called Lee Thompson. He was just not this Lee Thompson. Well qualified but properly less handsome.
That is the kind of error that tells you something. Same name. Wrong file. Wrong claimant. Wrong disclosure. Wrong answer. My material arrived with a fuck tonne of redactions. His arrived exposed.
For a recruitment company, a CV is not a decorative object. It is the raw material of someone’s working life. Employment history, skills, education, contact details, personal profile and the story a candidate hands over because recruiters are supposed to know what they are doing with it.
Page did not send me an abstract data category. Page sent me a person.
The Breach I Had To Explain
I informed Page that it had sent me the wrong man’s CV. According to the other Lee Thompson, Page had still not informed him of the breach. I contacted him myself and told him.
Read that again. A recruitment company handling candidate records sent one Lee Thompson another Lee Thompson’s completely unredacted CV. I told Page it had happened. According to the affected person, Page still had not told him. So the disabled claimant Page was already fighting ended up doing the basic human warning Page apparently had not done.
That is not recruitment infrastructure. That is a filing cabinet with a panic button.
The Legal Bit Page Should Know
The ICO’s guidance is not complicated. A personal data breach includes sending personal data to the wrong recipient. Organisations must report certain personal data breaches to the relevant supervisory authority within 72 hours where feasible, if the threshold is met. If a breach is likely to result in a high risk to someone’s rights and freedoms, the affected person must be informed without undue delay.
A completely unredacted CV sent to the wrong person should at least trigger a serious assessment, a breach record and a proper decision about notification. This is not some obscure corner of data protection law hidden in a cave behind a dragon. This is basic candidate-record handling.
And Page is a recruitment company.
The Serasa Experian Problem
That is why the Serasa Experian case study matters. Page wants the world to know it can recruit at scale for a company built around data. It can manage hundreds of candidates. It can design processes. It can handle information through an ATS. It can support onboarding. It can change 300 lives.
But when one disabled candidate asked Page for his own data, Page sent him redactions and the completely unredacted CV of another man with the same name. Same name appears to have been enough to cough up the wrong person.
So yes, Page can talk about complex technology platforms when the client is Serasa Experian. It can talk about bespoke recruitment processes when the case study needs polish. It can talk about information management when it is selling competence.
Then, in my case, the system produced the other Lee Thompson.
Lives Changed
Page says its Serasa Experian project changed 300 lives. That phrase is meant to glow.
But recruitment companies change lives in less photogenic ways too. They change lives when they mishandle data. They change lives when they send the wrong CV to the wrong person. They change lives when someone has to find out from a stranger that their personal recruitment history has been exposed.
They change lives when a disabled claimant asking for his own records receives redactions, fog and another man’s unredacted employment life. That is the version that does not make the case study.
Page Partners, Data Edition
So here is the Page Partners entry. Page Outsourcing publicly boasts about recruiting 300 technology and finance professionals for Serasa Experian, a company it describes as part of a multinational credit reporting group collecting and aggregating information on more than one billion people and businesses worldwide.
Page says all client information management was handled through an ATS. In my own case, when I asked Page for my data, Page sent me another Lee Thompson’s completely unredacted CV. I informed Page. According to the affected Lee Thompson, Page had still not told him about the breach. I had to.
That is the collision. Not rhetoric. Not theory. Not a vibe. Receipts.
The Closing File
Page can sell recruitment precision to a data giant. Page can write case studies about systems, scale, specialist hiring and lives changed. Page can talk about candidate outreach, onboarding support and information management.
But when I asked for my own file, I received redactions and another man’s completely unredacted CV. He was Lee Thompson. Just not me.
And when Page was told, according to him, Page still did not tell him.
That is not precision. That is not information management. That is the other Lee Thompson finding out from this Lee Thompson because Page apparently could not manage the Thompson it already had.
Lee Christopher Thompson – Founder, The Cummins Accountability Project
Sources
- Page Outsourcing – 300 tech and finance professionals joined Serasa Experian to open a brand-new SSC in Brazil
- Experian plc – About us
- ICO – Personal data breaches: a guide
- TCAP-held document: Page DSAR/disclosure material showing outrageous redactions and the completely unredacted CV of another Lee Thompson
- TCAP-held correspondence: notification to Page that the wrong Lee Thompson CV had been disclosed
- TCAP-held correspondence: extensive contact between Lee Thompson (me) and Lee Thompson, who stated Page had not informed him of the breach