The federal Fair Credit Reporting Act (the “FCRA”) 15 USC § 1681 et seq., as amended by the Fair and Accurate Credit Transactions Act of 2003 (the “FACT Act”) and by Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”) regulates the scope and flow of information between users of consumer reports, furnishers of information, and consumer reporting agencies (“CRAs”).
A consumer report in general means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for credit or insurance to be used primarily for personal, family, or household purposes; employment purposes; or any other purpose authorized under FCRA section 604 [15 U.S.C. § 1681a(d)(1)].
Note: “consumer” means an individual [FCRA section 603(c)].
A CRA may furnish a consumer report under the following circumstances. (For brevity, only purposes that are or may be considered relevant to our clients are included. The client should determine the permissible purpose based on its particular facts and circumstances.)
a) In accordance with the written instructions of the consumer to whom it relates.
b) To a person which it has reason to believe that intends to use the information for employment purposes; or
c) Otherwise has a legitimate business need for the information in connection with a business transaction initiated by the consumer.
Employment purposes when used in connection with a consumer report means a report used for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee. [15
U.S.C. § 1681a(h)].
The Federal Trade Commission (the “FTC”) in its most recent report issued in July 2011 (the “Staff Report”) confirms its previous opinion that the term “employment purposes” is interpreted liberally to effectuate the broad remedial purpose of the FCRA. As a result, the FCRA’s broad definition of the term “employment purposes” extends beyond traditional employment relationships, e.g., to volunteers and independent contractors. (Staff Report at 32.) It is prudent, therefore, to consider the potential significance of the FTC’s commentary with respect to how vetting of individuals for, among other things, project labor assignments is treated.
a) The employer must certify to the CRA that:
• it has a permissible purpose for procuring a consumer report;
• it has provided the required disclosures to the applicant/ employee (described below);
• it has obtained the requisite written authorization from the applicant/employee;
• it will not use the information contained in the report in violation of any federal or state equal opportunity law or regulation; and
• it will, if any adverse action is to be taken based on the consumer report, provide the applicant/employee with a copy of the consumer report and a summary of the consumer’s rights under the FCRA.
The FTC indicates that a blanket certification to the CRA is permissible in most circumstances.
b) Before furnishing a consumer report, a CRA must:
• verify the employer’s identity, and that it is a legitimate business entity;
• verify that it will use the report for its stated purpose;
• provide to the employer a copy of the CFPB-issued notice to users which describes the user’s obligations under the FCRA.
Before procuring a consumer report, the employer must provide to the applicant/employee a disclosure that a report may be procured, and obtain his/her authorization. Guidance from the Staff Report and other authoritative literature regarding the disclosure/authorization document state that:
• Disclosure must be in a standalone document, which means that it cannot be part of an employment application, and may contain only minor additional items, such as the type of information that may be obtained, providing the description does not confuse the applicant/employee or detract from the mandated disclosure. Two published court decisions ruled that including a liability waiver constitutes a technical violation under the FCRA. (WD Pa. 2013, no. 2:08-cv-01730-MRH, and Dist. Md., 2012, no. 8:11-cv-01823-DKC.)
• Disclosure language and request for authorization may be combined in a single document, and certain identifying information may be included.
• One-time blanket disclosure can be used if it states “clearly and conspicuously” that the employer intends for the disclosure and authorization to cover consumer reports obtained as part of the application process, and any additional reports obtained during the course of employment. (Note: an “evergreen” clause may not be valid for California employers.)
• Combined disclosures for consumer reports and investigative consumer reports are permitted, but employers that intend to obtain both types of reports must provide the disclosures required by FCRA section 604(b) for consumer reports and by section 606(a) for investigative consumer reports.
• Disclosure/authorization form must include check-boxes for California, Minnesota and Oklahoma applicants/employees to expressly request from the employer a free copy of the report.
• Electronic authorization is permitted by the text of the FCRA for DOT-regulated employers in certain circumstances [15 U.S.C. §§ 1681b(b)(2)(B),(C)]. The Staff Report’s general acceptance of electronic signatures rationally would appear to extend to employment-purpose reports. Notably, many record repositories such as DMVs still require an ink signature.
The employer is required to provide the following notices:
a) FCRA summary of rights must be provided to the applicant/employee (along with a copy of the consumer report) before an adverse action is taken and when requesting an investigative consumer report. We recommend that this notice be provided before procuring any type of a consumer report, at the time the disclosure/authorization form is given to the applicant/employee.
b) In addition to the FCRA notice referenced above, California employers must provide a notice of rights under Civil Code §1786.22 to the applicant/employee before procuring an investigative consumer report (consumer reports as defined by the FCRA are considered investigative consumer reports under California’s ICRAA).
c) California employers, under amended Civil Code §1785.20.5, prior to requesting a consumer credit report for employment purposes “. . . shall provide written notice to the person involved. The notice shall inform the person that a report will be used, and shall identify the specific basis under subdivision (a) of Section 1024.5 of the Labor Code for use of the report.”
d) New York Corrections Law (§750 et seq.) requires that employers provide a copy of Article 23-A to the applicant/employee prior to obtaining an investigative report, and for consumer reports, after the background check if the consumer report reveals criminal record information. We recommend that a New York employer provide this notice prior to procuring either type of a report, at the time the disclosure/authorization form is given to the applicant/employee.
a) Unless the annual salary of the applicant/employee is expected to meet or exceed $75,000 annually, the FCRA restricts the reporting of certain information deemed obsolete, as noted below. (Note: some states have laws that pre-empt the FCRA’s salary cap. California, for example, generally limits the reporting of most information to seven years, except for bankruptcy, which is 10 years, regardless of the salary amount.)
• Civil lawsuits, civil judgments and arrest records that antedate the report by more than seven years or until the governing statute of limitations has expired, whichever is longer;
• Accounts placed for collection or charged to profit-and-loss which antedate the report by more than seven years;
• Bankruptcies after 10 years;
• Paid tax liens after seven years;
• Any other negative information after seven years (except criminal convictions for which the FCRA places no time limit unless state law provides otherwise).
b) General or neutral information such as discrepancies in employment dates, position titles, degrees earned, etc. is not considered “adverse information” for purposes of the FCRA. [FTC Letter Nadell, (December 10, 1998]
Because an investigative consumer report (“ICR”) is a subset of a consumer report, all of its limitations apply, plus some additional ones. The FTC considers the act of obtaining subjective information to constitute an ICR. When the CRA merely verifies the dates of employment, job title, salary or degree earned, this is not considered an ICR, because no subjective information has been obtained. (FTC Letter, Hinkle, July 9, 1998.) However, if a CRA asks about the consumer’s job performance, then the report becomes an ICR.
The following additional restrictions apply to an ICR:
a) Except as allowed by FCRA section 613, an ICR may not provide public record information that has not been verified within 30 days of the report.
b) Potentially adverse information (from references for example) cannot be reported unless it is confirmed by an additional source that has independent and direct knowledge of the information, or the original source is the best direct source for the information.
c) All other information beyond public record information in the ICR cannot be older than three months.
d) An ICR does not include information on credit obtained from a creditor [FCRA section [603(e)].
A CRA is required to:
a) ensure that public record information that may have an adverse effect on the employment decision is complete and up-to-date (under the FCRA, public record information relating to arrests, indictments, convictions, suits, tax liens, and outstanding judgments is considered up-to-date “if the current public record status of the item at the time of the report is reported”) or
b) notify the applicant/employee that such public record information is being reported, along with the employer’s name and address, at the time that the public record information is reported to the employer.
Note: California’s statute does not allow the notice option–the information cannot be reported unless its accuracy is verified during the 30-day period ending on the date on which the report is furnished.
The definition of “adverse action” is not limited to a denial of an individual’s application for employment. Rather, “adverse action” under the FCRA includes corrective or other disciplinary action taken against an applicant/employee based in whole or in part on a consumer report. An employer’s decision may “adversely” affect an employee even if his/her pay is not reduced. For example, according to the Staff Report, “an employee who is denied an assignment requiring a security clearance that is withheld in whole or in part because of a consumer report suffers an ‘adverse action’ in employment even if the assignment would not have raised the employee’s salary.” (Staff Report at 35.)
a) Two notices are required, if an employer takes adverse action against an applicant/employee based in whole or in part on information contained in a consumer report or investigative consumer report. The employer must provide a “pre-adverse action” notice under Section 604(b) before taking the adverse action and a subsequent “adverse action” notice under FCRA section 615(a) after the adverse action is taken. As a result, “the notices may not be included in the same document.”
b) Employers must provide a “pre-adverse action” notice even if the information contained in the consumer report (such as a criminal record) would automatically disqualify the applicant/employee from employment or otherwise lead to an adverse action based on the employer’s policies and procedures. (Staff Report at 53.)
c) The “pre-adverse action” notice must include a copy of the consumer report, the FCRA summary of rights, and any applicable state notices.
d) Where the employer does not have a “written” consumer report because the CRA provided the information to the employer orally, the employer may tell the applicant/employee orally what is in the report before taking adverse action. “Because the report itself is oral, an oral ‘copy’ is the proper method of compliance, as it conveys the information that Congress intended the consumer to know prior to suffering adverse action.” (Staff Report at 53.)
e) Once the employer provides the pre-adverse action notice, there is no specific period of time that an employer must wait before taking the adverse action against the applicant or employee. According to the Staff Report, employers must wait a “reasonable period of time,” but this will vary depending on the particular circumstances. Neither the FCRA nor the FTC has provided a bright-line test in this regard. However, based on existing case law, it is prudent for employers to wait at least five business days before taking the adverse action and providing the final adverse action notice. If an individual contacts the employer in response to the pre-adverse action notice to say there was a mistake (inaccuracy or incompleteness) in the consumer report, the employer may exercise its discretion whether or not to move forward with the hiring decision or engagement; the FCRA does not dictate a course of action.
f) Employers may provide the “adverse action” notice in a way that minimizes duplication with the “pre-adverse” action notice. For example, in the “adverse action” notice, the employer could note that the applicant/employee has already received a copy of the consumer report and the FCRA summary of rights.
(g) Although employers may arrange to have the CRA provide pre- adverse action notices directly to applicant/employee (i.e., outsource the process), the employer retains the ultimate liability. While some employers may want to be cut out of the process entirely, the decision in 848 F. Supp. 2d 532 (ED Pa 2012) indicates that this may be risky. The court held that the CRA’s pre-adverse action adjudication was actually an adverse action, because there was no opportunity for the consumers to contest the adjudication or change the outcome, and the process was missing the critical step of the employer making the final decision based on the full report and any information that the consumer may have provided to dispute the report.
(h) The adverse action notice must include the following:
• name, address and telephone number of the CRA that provided the report to the employer;
• statement that the CRA did not make the adverse decision and is not able to explain why the decision was made;
• statement setting forth the applicant’s/employee’s right to obtain a free disclosure of the report from the CRA, if the he/she makes a request for such a disclosure within 60 days; and
• statement setting forth the applicant’s/employee’s right to dispute directly with the CRA the accuracy or completeness of any information contained in the report that the CRA provided to the employer.
If the applicant/employee disputes the completeness or accuracy of information in the report, a CRA is required, without charge, to reinvestigate and record the current status of the disputed information or delete the item before the end of the 30-day period, beginning on the date on which it receives the dispute notice. The 30-day period may be extended by 15 days in certain circumstances. [15 U.S.C. § 1681i].
If the CRA updates the consumer report, both the individual and the employer must receive notice.
Disclaimer: The content of this publication is for general information only regarding employment-purpose consumer reports, and is not intended as an exhaustive review of any laws or regulations. Consumer reports for other permissible purposes under the FCRA have different legal requirements. SI is not endorsing or in any way directly or indirectly confirming any position articulated by the FTC staff in the Staff Report or the FTC’s prior advisory guidance. As noted in the Staff Report, some courts have expressly refused to extend any deference to the advisory opinion letters issued by the FTC staff. (Staff Report at 6.) The FTC’s interpretations are not substantive rules and do not have the force or effect of statutory provisions. They are guidelines intended as clarification of the FCRA and, like industry guides, are advisory in nature.
NOTHING IN THIS PUBLICATION SHOULD BE CONSTRUED AS LEGAL ADVICE. NO RECIPIENT SHOULD ACT OR REFRAIN FROM ACTING ON THE BASIS OF ANY INFORMATION PROVIDED HERE WITHOUT SEEKING ADVICE FROM A QUALIFIED ATTORNEY, LICENSED IN THE APPLICABLE JURISDICTION.
Date revised: 9-12-14 JG