In days of old, applying for a job was a pretty private affair. Check out a job ad, send the employer a CV, attend an interview. Now, protected in these online days by the anonymity of the Internet, it should be even more private.

It isn't.

The Internet isn't anonymous. You leave a digital trail everywhere you go, and filling out a CV on the Web is not quite the same as sending one directly to a potential employer. Indeed, according to the Denver-based Privacy Foundation, there is a danger that by applying for jobs online, your information -- including detailed work histories, salary information and other sensitive data -- might become a commodity that may end up in the hands of all sorts of people you never know about.

The Privacy Foundation's report released last month about the activities of the online recruitment site Monster.com, owned by TMP Worldwide Inc., is an instructive glimpse into how the Internet can work against the user and how commercial imperatives threaten to undermine the trust needed for the Internet to function.

The site works like this: Apply for a job posted on Monster.com and you are invited to create an account, which in effect means filling out a CV. You won't be alone: There are more than eight million CVs stored at Monster.com, the report says. That CV information will then go to your prospective employer.

So far so good. However, now -- unless you have chosen a "private posting option" -- your CV may also be accessible to all employers paying to access Monster.com's online database. This means a lot of eyeballs. According to the survey in January 2001 by the Society of Human Resource Managers, cited in the Privacy Foundation's report, the number of human-resource managers in the U.S. who use the Internet to find job candidates is growing annually. This is fine if you are hoping for exposure, but could be somewhat unnerving should, say, your present employer use the service.

Not only that: The Privacy Foundation's author, Pam Dixon, noticed that a CV filled out at a corporate Web site could end up on a third-party site such as Monster.com anyway. To demonstrate this, Ms. Dixon used a pseudonym to apply for a job in human relations at H&R Block, a financial and tax adviser, by creating a profile for herself. Immediately afterwards, she logged on to Monster.com and found exactly the same profile. Nowhere on the H&R Block site was an affiliation with Monster.com mentioned, according to Ms. Dixon, and links to the H&R Block's privacy policy didn't work at the time. (H&R Block, Ms. Dixon says, plans to terminate their arrangement with Monster.com for separate reasons. Monster.com says that any CVs submitted to an affiliated site are viewable only by that company and the individual job seeker.)

This sort of incident is scary. CVs are sensitive documents and to be cavalier with them borders on reckless. But it doesn't stop there. The report also claims that CVs that appear on Monster.com may also have been trawled from elsewhere on the Web, almost certainly without the author's knowledge. Ms. Dixon points to company documents submitted in court for a copyright suit last year that show Monster.com was working on software that would hunt for CVs from other Web pages throughout the Web and be stored at Monster.com without the CV owner's consent. (Monster.com didn't address the issue in its reply to the Privacy Foundation report and it isn't mentioned in its privacy policy. A company representative couldn't be reached for comment.)

Moreover, according to former Monster.com employees Ms. Dixon interviewed, even those applicants who submitted CVs directly to Monster.com may not have control over them. Several employees told her that recruiters are occasionally given access to old, inactive CVs that job seekers have requested be removed from the database.

Monster said in its reply to the Privacy Foundation that all deleted CVs were "permanently removed from the system," but acknowledged copies were kept on backup systems. The company's online privacy policy also notes that copies may be retained in separate databases of employers and recruiters, for which Monster.com sheds all responsibility "for the retention, use, or privacy of resumes in these instances."

By now I would be pretty upset if I had posted a CV to a company only to find it sucked into some grand database. But there is more. Using standard technology in Web browsers, Monster.com may build up a detailed profile of you, your location, employment and job interests. While most of this information is aggregated en masse as general, demographic data rather than sorted individually, users may still be alarmed at how their activities online can be monitored.

Ms. Dixon's work is pretty thorough. And it raises some important questions. As she concludes, "if job seekers and the personal information they provide becomes a commodity without adequate privacy protections, online sites may lose job seeker trust and a valuable tool will be tarnished." I couldn't agree more. As long as my personal data is going to be valuable to someone else, in whatever form, I'm going to be mighty careful to whom I give it.