Does a resume qualify as personally identifiable information relative to a privacy policy/tos?

Question

A certain freelancer marketplace website based in Pennsylvania has allowed Google to index over 1000 user resumes. As we all know, resumes contain personally identifiable information. Their privacy policy states the following:

• [site] does not rent or sell your personally identifiable information to third parties.
• [site] does not share your contact information with other users or third parties without your consent.
• Any personally identifiable information that you provide to [site] will be secured with industry standard protocols and technology.

In speaking with their staff, I have been informed that their terms of service contains language that makes users "solely responsible for information posted on our Website" and that users "hereby assign to [site] your rights in any Non-Multimedia Content." They believe that those statements in the terms of service override the quoted privacy statements.

It seems to me that an uploaded resume is "personally identifiable information" and that it should be "secured with industry standard protocols and technology." If the resume is publicly downloadable on the Internet, that's the definition of unsecured. Would their position stand up to the California CCPA, or Europe's GDPR rules? The resumes appear to belong to users from around the globe.

[EDIT] For clarity, this website is treating users' uploaded resumes as miscellaneous image files and allowing them to be indexed in Google. Resumes contain names, addresses, email addresses, telephone numbers, social media handles and a lot of other private information that most privacy conscious people would not want published openly on the Internet. Since Guru.com is a jobs/employment oriented website it's completely reasonable that people upload their resumes there for the purpose of sharing with employers/clients who are logged-in to their own accounts for hiring purposes, and there is no reason to think that these resumes would not be treated as PII or contact information as defined in the privacy policy.

Answer 1

[site] does not rent or sell your personally identifiable information to third parties.

[site] does not share your contact information with other users or third parties without your consent.

Look, they do not rent or sell your PII, but what is it that they do not share? Not PII but contact information.

Is contact information PII? Sure. Is PII contact information? Not necessarily.

Conclusion: they will not share your PII that is contact information, but will share (though not rent or sell) all other PII, such as resume without contact information.

it should be "secured with industry standard protocols and technology." If the resume is publicly downloadable on the Internet, that's the definition of unsecured.

"Secured" in this context means "protected from unauthorised access". Your resume is "secure" in the sense that noone can access it if the company does not want anyone to (but it turns out they actually want, haha).