The employers software vendor Intuit steals the data and sells it to Equifax for their own profit. The employer gets nothing, but could decide to opt-out. The employee who's privacy is being grossly violated gets nothing and cannot even opt-out of sharing the data?
GDPR doesn't sound like such a bad idea now...