Mini FCRA update: Georgia enacts new law, California law mired in uncertainty

Enacted in 1970, the Fair Credit Reporting Act (FCRA) provides federal regulation of consumer reporting agencies that provide consumer reports to third parties.

In the 45 years since the FCRA took effect, several states have passed their own version of the statute to provide additional protections for consumers. Colloquially referred to as “mini” FCRAs, the laws can be found in Arizona, California, Maine, Massachusetts, Minnesota, New Jersey, New York, Oklahoma, and Washington.

Joining the group: Georgia, where House Bill 328 took effect on July 1. The new law applies to consumer reporting agencies (CRAs) that “conduct business” within the state, defined as those entities that “provide information to any individual, partnership, corporation, association, or any other group however organized that is domiciled within this state or whose principal place of business” is located within Georgia’s borders.

A CRA encompasses any person or entity “which, for monetary fees or dues or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties.”

For its part, a consumer report broadly includes “any written, oral, or other communication of any information bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for purposes of credit, insurance, or employment.”

As it closely tracks the federal FCRA, Georgia’s law provides that a CRA that furnishes consumer reports for employment purposes in compliance with the federal statute will be in compliance with the state version.

While Georgia’s new law already took effect, other states have struggled with application of their mini FCRAs.

For example, in 2013, a federal court judge California ruled that one of the state’s two FCRA corrollaries, the Investigative Consumer Reporting Agencies Act (ICRAA), was unconstitutionally vague in Roe v. LexisNexis Risk Solutions, Inc. The case involved an anonymous plaintiff who sued when she failed to obtain employment.  She argued she didn’t get the job as a result of an allegedly inaccurate background check furnished by the defendant to her prospective employer in violation of both the FCRA and the ICRAA.

The defendant argued that the ICRAA was unconstitutionally vague as applied and the court agreed. In addition to the FCRA and the ICRAA, California had previously enacted the Consumer Credit Reporting Agencies Act (CCRAA), a law that governs consumer credit checks. The interplay between the CCRAA and ICRAA resulted in confusion for covered entities, the court found, as criminal background information about consumers was regulated by both laws, leaving companies uncertain about which statute’s requirements actually applied.

Although the plaintiff appealed the decision to the Ninth Circuit Court of Appeals, the federal appellate panel dismissed the appeal for procedural reasons; on remand, the federal district court later dismissed the case with prejudice in December 2013. However, the opinion in Roe remains valid law in the state, leaving a shadow of uncertainty hanging over the ICRAA.

Read Georgia’s House Bill 328.

Read Roe v. LexisNexis Risk Solutions, Inc.