Scherzer Blog

No shortcuts to assuring maximum possible accuracy under the FCRA

When Congress formulated the Fair Credit Reporting Act (“FCRA”) more than 30 years ago, it noted that the law was enacted in order to protect consumers against “the trend toward…the establishment of all sorts of computerized data banks

[that placed a consumer] in great danger of having his life and character reduced to impersonal ‘blips’ and key punch holes in a stolid and unthinking machine which can literally ruin his reputation without cause [116 Cong. Rec. 36570].” This intent has been clearly supported by the amendments that followed allowing greater and more effective protection. But despite the leaps and bounds in legislation, much controversy still exists about the level of protection that this law provides to consumers.  And confusion abounds about the compliance requirements for consumer reporting agencies (“CRAs”) on whom the FCRA places “grave” compliance obligations. “There is a need to insure that consumer reporting agencies exercise their ‘grave’ responsibilities with fairness, impartiality, and a respect for the consumer’s right to privacy [15 U.S.C. § 1681(a)(4) (2006)].”

The FCRA mandates that “[w]henever a consumer reporting agency prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates [15 U.S.C. § 1681e(b)].” So what does this mean? Courts have taken two positions in interpreting the language of this section. The “consumer-friendly” version holds CRAs liable for reports that are technically accurate, but may be misleading or incomplete. (Koropoulos v. Credit Bureau, Inc., 734 F.2d 37, 40; D.C. Cir. 1984: “Congress did not limit the Act’s mandate to reasonable procedures to assure only technical accuracy; to the contrary, the Act requires reasonable procedures to assure maximum accuracy.”) The “business friendly” interpretation requires only technical accuracy in the CRA’s reporting.  [Todd v. Associated Credit Bureau Servs., Inc., 451 F. Supp. 447, 449 (E.D. Pa. 1977)].

While this case law is helpful in understanding the CRA’s liability under the statute, there is no doubt that a comprehensive guidance on the methodology to assure maximum accuracy is still much needed especially in view of the proliferation of the so-called “national databases” in the recent years. But despite the lack of clear guidance, a reputable CRA knows that “to assure” means “to earnestly inform or tell positively; state with confidence.” And reporting a record that was identified by name only or relying solely on private database record information in an employment background check does not pass the reasonable procedures test by any standard.

In an Internet marketplace that touts instant results, a CRA’s practice of sending searchers to the courthouse, pulling dozens of cases, and reviewing legal documents to ascertain correct subject identification and record information may be counterintuitive for many employers. And it takes time and money to assure the most accurate and up-to-date results. On the other hand, in a world of over a million people, is a quick and cheap database background search of any real value?

California limits social media use by employers and educational institutions

Effective January 1, 2013, California will join Maryland and Illinois in significantly restricting employers’ access to their employees’ and job applicants’ social media accounts. Signed into law by Governor Jerry Brown on September 27, 2012 and fittingly announced via Twitter, AB 1844 provides that an employer cannot require or request an employee or applicant to do any of the following:

  • disclose a username or password for the purpose of accessing personal social media;
  • access personal social media in the presence of the employer;
  • divulge any personal social media, except as provided in subdivision.

The law also prohibits an employer from discharging, disciplining, or otherwise retaliating against an employee or applicant for not complying with a request or demand by the employer that violates these provisions. However, an employer is not prohibited from terminating or taking an adverse action against an employee or applicant if otherwise permitted by law.

The law does preserve an employer’s rights and obligations to request that an employee divulge personal social media information reasonably believed to be relevant to an investigation of allegation(s) of employee misconduct or violation of applicable laws and regulations, provided that the information is used solely for purposes of that investigation or a related proceeding. An employer is also not precluded from requiring or requesting that an employee disclose a username or password for the purpose of accessing an employer-issued electronic device.

A companion law, AB 1349 that establishes similar requirements for postsecondary education institutions in regard to their students also goes into effect on January 1, 2013.

Broker-dealers fall short in knowing their clients

It looks like broker-dealers are failing in their due diligence efforts on clients, as required by FINRA’s new Rule 2090. (FINRA is the largest non-governmental regulator of all securities firms doing business in the United States, and handles nearly every aspect of securities-related matters, from registering and educating industry participants, to writing and enforcing rules and the federal securities laws.)

According to several industry reports, the most violated rule this year has been a failure by broker-dealers to comply with FINRA’s know-your-customer obligations, now under Rule 2090 issued in July 2012. The rule, which is generally modeled after the former NYSE Rule 405(1), requires firms to use reasonable diligence regarding the opening and maintenance of every account in order to “know the essential facts concerning every customer.” The rule explains that “essential facts” are those required to:

  • effectively service the customer’s account;
  • act in accordance with any special handling instructions for the account;
  • understand the authority of each person acting on behalf of the customer; and
  • comply with applicable laws, regulations, and rules.

The know-your-customer requirements arise at the beginning of the relationship and do not depend on whether the broker has made a recommendation. Unlike the former NYSE Rule 405, Rule 2090 does not specifically address orders, supervision or account opening, which are areas that are explicitly covered by other rules.

In conjunction with this know-your-customer rule, FINRA has adopted transaction suitability Rule 2111, framed after the former NASD Rule 2310, which requires that a firm or associated person “have a reasonable basis to believe that a recommended transaction or investment strategy involving a security or securities is suitable for the customer, based on the information obtained through the reasonable diligence of the member or associated person to ascertain the customer’s investment profile.” According to FINRA, the measures constituting a reasonable diligence will vary depending on, among other factors, the complexity of and risks associated with the security or investment strategy and the firm’s or associated person’s familiarity with the security or investment strategy.

Rule 2111 further defines a customer’s investment profile, specifying that it includes, but is not limited to, the customer’s age, other investments, financial situation and needs, tax status, investment objectives, investment experience, investment time horizon, liquidity needs, risk tolerance, and any other information the customer may disclose to the member or associated person in connection with such recommendation. Accordingly, a broker must attempt to obtain and analyze a broad array of customer-specific factors, and also determine quantitative suitability if the broker has actual or de facto control over a customer account.

FINRA now makes it clear that a broker must have a firm understanding of both the product and the customer, and that the lack of such an understanding itself violates the suitability rule.

January 7th, 2013|Categories: Commercial Transactions Due Diligence|Tags: |

State laws restricting the use of criminal records gain momentum

By now, most employers are familiar with the EEOC’s April 2012 updated enforcement guidance on the use of arrest and conviction records for employment decisions under Title VII of the Civil Rights Act of 1964. And related state and local laws are quickly gaining momentum. More than 30 cities and at least 26 states now limit the type of criminal background information that employers can obtain or when they can request it.

Effective July 1, 2012, Indiana will join the roster of the restricting states. Its  SB 1033 will, in part, ban certain pre-employment inquiries, limit the types of criminal record information that employers and consumer reporting agencies (CRAs) can obtain from Indiana courts, and restrict criminal history information that CRAs can provide in background reports.

This law also provides that Indiana residents with restricted or sealed criminal records may legally state on an “application for employment or any other document” that they have not been adjudicated, arrested or convicted of the offense specified in these records. Covered employers (the term “employer” is not defined) will be prohibited from asking an “employee, contract employee, or applicant” about such records.

Limiting the scope that can be included in a background report, the law further prohibits courts from disclosing information pertaining to alleged infractions where the individual:

  • is not prosecuted or if the action is dismissed;
  • is adjudged not to have committed the infraction;
  • is adjudged to have committed the infraction and the adjudication is vacated; or
  • was convicted of the infraction and satisfied any judgment attendant to the infraction conviction more than five years ago.

Criminal history providers, such as CRAs, that obtain criminal history information from the state may only furnish information pertaining to criminal convictions, and are prohibited from including the following in background reports:

  • an infraction, an arrest or a charge that did not result in a conviction;
  • a record that has been expunged;
  • a record indicating a conviction of a Class D felony if the Class D felony conviction has been entered as or converted to a Class A misdemeanor conviction; and
  • a record that the criminal history provider knows is inaccurate.

Among other significant mandates, criminal history information obtained from the state by CRAs may not include any Indiana criminal record information in an assembled report unless the CRA updates the information to reflect changes to the official record occurring 60 days or more before the date the criminal history report is delivered.

Regulatory focus on corporate social responsibility

Corporate social responsibility (CSR) policies that promote good citizenship are being implemented or revised at a record pace. In response to concerns about labor exploitation in the developing world, many companies have joined the Ethical Trade Initiative (ETI), which has established corporate codes of practice implementing human rights, ethical labor practices and environmental protection standards. Many also have adopted the United Nations Global Compact “ten universally accepted principles in the areas of human rights, labor, environment and anti-corruption.”

High on the CSR priority list for SEC-listed companies that use conflict minerals “in the functionality of production” of a manufactured product is developing a compliance program that will meet the requirements of Section 1502 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”). Due from the SEC within the next few weeks, the final rule will have a direct impact on reporting requirements for about half of all publicly traded companies in the United States, mandating them to disclose in 10-K, 20-F, and 40-F filings whether they manufacture products containing conflict minerals (specified as gold, wolframite, casserite, columbite-tantalite and their derivative metals, which include tin, tungsten, and tantalum, that are mined in the DCR or its adjoining countries). These metals are used in a broad array of products, including electronics, jewelry, tools, engines, medical equipment, chemicals, packaging, etc. And although the regulation technically applies to public companies only, it will have a significant bearing on any company anywhere in the world, public or private that is within the public company’s supply chain.

Under the rule as proposed, among other requirements, the affected SEC-listed companies must conduct certain due diligence, as outlined below.

  1. Determine if conflict minerals/metals are used to make their products.
  2. Determine if the metals originated in the DRC or in neighboring countries. If they did not, a report must be issued on how the metals’ origins were determined.
  3. If the metals were from DRC or adjoining countries, if the source is unknown or if it is from scrap or recycled sources, a supply chain due diligence to determine the source(s) must be performed and the results provided in an independently audited report.

The rule is expected to require the above-noted first and second steps regardless of the metals’ origin. The third step, i.e., the disclosure of the products manufactured and facilities where DRC materials may have been used, etc. must be completed only if the DRC is identified as a source or if the source cannot be determined. If applicable, in addition to specific annual report disclosures and the inclusion of a conflict minerals report as an exhibit, the companies will have to indicate on their websites whether or not they use conflict minerals in their products or in those contracted to be manufactured on their behalf.

Of course, this Dodd-Frank provision is not the only regulatory effort that addresses the elimination of child and forced labor, slavery, and human trafficking within supply chains. Public pressures over these atrocities have led to related policymaking within U.S. local and state governments, and around the world. For example, in 2011, California enacted SB 861 which requires issuers that do business with the state to fulfill the public reporting obligations outlined in the upcoming SEC rules. Issuers that fail to meet these obligations will be prohibited from seeking procurement contracts with the state. In Maryland, a similar “conflict minerals” law under SB 551 will become effective October 1, 2012. Rhode Island and Massachusetts are considering parallel legislation.

Other U.S. efforts include California’s SB 657, known as the California Transparency in Supply Chains Act, which effective January 1, 2012, mandates retail sellers and manufacturers doing business in California with annual gross receipts exceeding $100 million to conspicuously and clearly disclose their efforts and policies for ensuring that their supply chains are free from human trafficking and slavery. On a municipal level, the City of Pittsburgh calls on companies from all sectors to favor in their electronics purchasing decisions products that have been verified as being free of conflict minerals. And among several major worldwide endeavors, is the European Commission’s support of the United Nations and Organization for Economic and Cooperation Development (OECD) due diligence guidelines and recommendations for responsible supply chain management.

Strong corporate responsibility policies are here to stay. A 2011 U.S. State Department press release urges companies to “…begin to exercise due diligence immediately in order to ensure a viable and conflict free supply chain…”

January 7th, 2013|Categories: Commercial Transactions Due Diligence|Tags: , |

“Misspelling to defraud,” a case study from our files

The subject’s biography provided along with our client’s request for due diligence in connection with a private equity funding transaction was ridden with misspellings. And it did not say much, apart from boasts of professional accomplishments and financial success, and the subject’s self-description of being a “people-person who likes to travel.” But even with the biography’s vague statements and typos, our research quickly found that the subject’s company, which contained a transposed letter in its name, was affiliated with a Mexican multi-level marketing operation whose executives were recently arrested or are wanted by authorities for setting up allegedly fake websites whereby they defrauded investors for millions of dollars. As our research continued, we located media reports and online documents which indicated that the fraud spanned across three continents, and involved at least four other entities closely held by the subject, whose names were not listed in the biography. And according to various government sources, there is also mounting evidence of money laundering. Our client, although somewhat surprised by our findings, immediately halted the funding transaction.

January 7th, 2013|Categories: Commercial Transactions Due Diligence|Tags: , |

Diploma mill ordered to pay $22.7 million to 30,000 scam victims

On August 31, 2012, Belford High School, Belford University and several of their co-conspirators were ordered to pay $22.7 million to a class of more than 30,000 U.S. residents who were duped into purchasing fake high school diplomas from Belford. The defendants were also ordered to forfeit the websites used to perpetrate the scam, including www.belfordhighscool.com, www.belfordhighschool.org, www.belforduniversity.org, and www.belforduniversity.com.

The lawsuit, filed on November 5, 2009, charged that Belford High School is an Internet scam that defrauded students of their money by offering them a supposedly “valid” and “accredited” high school diploma. As affirmed by the judgment, the school is a fake and the diplomas are not valid. The lawsuit also alleged that the two accrediting agencies by which Belford claimed to be accredited – International Accreditation Agency for Online Universities and the Universal Council for Online Education Accreditation – are not legitimate accrediting agencies.

Notably, we came across Belford University in 2010 when a bachelor’s degree from the “school” was listed on an employment application by a candidate for a professional level position with one of our clients. Click here to read the 2010 blog.

 

Vermont is the latest state to restrict credit reports in employment decisions

Effective July 1, 2012, Vermont will be the eighth state to regulate the use of credit-related information for employment purposes. Although similar in many ways to laws already enacted in California, Connecticut, Hawaii, Illinois, Maryland, Oregon and Washington, Vermont’s requirements under Act No. 154 exceed those of other state laws as they prohibit even exempt employers from using an applicant or employee’s credit history as the “sole factor” in employment decisions. Additionally, Vermont exempt employers who take adverse action based in part on a credit history must return the report to the individual or destroy it altogether. Neither the Fair Credit Reporting Act (FCRA) nor any of the other similar state laws imposes such a requirement.

Generally, the Act prohibits employers from inquiring into an applicant’s or employee’s credit report or credit history, and further bans employers from discriminating against or making employment decisions (e.g. hire, fire, alter the compensation or any other term or employment condition) based on a credit report or credit history. Notably, credit history in this context includes credit information obtained from any third party that reflects or pertains to an applicant’s or employee’s “borrowing or repaying behavior, financial condition or ability to meet financial obligations,” even if that information is not contained in a “credit report.”

The trend in restricting credit report use for employment purposes will continue as several other states and the federal government are considering comparable legislation. Soon to follow most likely will be New Jersey. In May 31, 2012, the Senate approved S455 that would prohibit employers from seeking credit checks on employees or applicants under most circumstances. A parallel bill (A2840) was introduced by the Assembly on May 11, 2012, and a similar bill (A704) in December 2011.

What’s the practical meaning of EEOC’s new criminal records guidance?

On April 25, 2012, the U.S. Equal Employment Opportunity Commission (“EEOC”) approved new enforcement guidance regarding the use of arrest and conviction records in employment decisions. The guidance builds on longstanding court decisions and requirements that the EEOC issued over twenty years ago, focusing on employment discrimination based on race and national origin.

In brief, the new guidance’s position is more aggressive, affirming that employers cannot automatically disqualify applicants with criminal records, and that their screening policies need to be consistent and structured for “individual assessment.” The guidance’s main points state that:

  • An arrest record does not establish that criminal conduct has occurred, and an exclusion based on an arrest, in itself, is not job related and consistent with a business necessity. However, an employer may make an employment decision based on the conduct underlying an arrest if such conduct makes the individual unfit for the particular position.
  • A conviction record will usually serve as sufficient evidence that a person engaged in a particular conduct. In certain circumstances, however, there may be reasons not to rely on the conviction record alone when making an employment decision.
  • A violation may occur when an employer treats criminal history information disparately for different applicants or employees, based on their race or national origin (disparate treatment liability). An employer’s neutral policy (e.g., excluding applicants from employment based on certain criminal conduct) also may disproportionately impact protected-class individuals and may violate the law if not job related and consistent with a business necessity (disparate impact liability)

The EEOC specifies two circumstances in which employers will meet the “job related and consistent with a business necessity” defense:

  • The employer validates the criminal conduct exclusion for the particular position under the Uniform Guidelines on Employee Selection Procedures (i.e., if there is data or analysis about criminal conduct as being related to subsequent work performance or conduct;) or
  • The employer develops a targeted screen considering at a minimum the nature of the crime, the time elapsed, and the particular job. The employer’s policy then provides an opportunity for an individualized assessment for those individuals identified by the screen to determine if the policy, as applied, is job related and consistent with a business necessity.

The guidance further asserts that although Title VII does not require individualized assessment in all circumstances, the use of a screen that does not include such assessment is more likely to violate its provisions. As an example of individualized assessment process, the EEOC recommends providing the applicants an opportunity to explain why they should not be denied a position due to the criminal record. The guidance also specifies the following factors that employers should assess:

  • Facts or circumstances surrounding the offense or conduct;
  • Number of charges of which the individual was convicted;
  • Older age at the time of conviction, or release from prison;
  • Evidence that the individual performed the same type of work, post-conviction, with the same or different employer, with no known incidents of criminal conduct;
  • Length and consistency of employment before and after the offense or conduct;
  • Rehabilitation efforts, e.g., education/training;
  • Employment or character references and any other information regarding fitness for the particular position; and
  • Whether the individual is bonded under a federal, state, or local bonding program.

The guidance recognizes that some employers are subject to federal statutory and/or regulatory requirements that prohibit them from hiring individuals with criminal records for certain positions. The EEOC notes that its new guidance does not preempt such federal guidelines, and explains that employers may be subject to a claim under Title VII if they scrutinize individuals to a higher degree than required under applicable federal requirements.

As in its previous version, the EEOC’s new guidance is not meant to be a deterrent to conducting background checks. But it should serve as a reminder that hiring policies and practices must be structured in compliance with the law.  

Agencies jointly support that FCRA Section 1681c does not violate first amendment

On May 3, 2012, the Federal Trade Commission (FTC) joined the Department of Justice (DOJ) and the Consumer Financial Protection Bureau (CFPB) in filing a memorandum brief in support of the constitutionality of the Fair Credit Reporting Act (FCRA), established in 1970 to protect credit report information privacy and to ensure that the information supplied by consumer reporting agencies (CRAs) is as accurate as possible.

In the case of Shamara T. King vs. General Information Services, Inc. (GIS), the CRAs address a provision of the FCRA that balances the Act’s dual purposes, i.e., to protect consumers from privacy invasions caused by the disclosure of sensitive information and to ensure a sufficient flow of information to allow the CRAs to fulfill their vital role.) The provision, Section 1681c, bars CRAs from disclosing arrest records or other adverse information that is more than seven years old, in most cases.

The agencies brief refutes GIS’s argument that this FCRA protection is an unconstitutional restriction of free speech, pointing out that the recent U.S. Supreme Court case law that GIS cites to support its argument, Sorrell v. IMS Health Inc., “does not change the settled First Amendment standards that apply to commercial speech, nor does it suggest that restrictions on the dissemination of data for commercial purposes

[such as those by CRAs] must satisfy stricter standards.” Therefore, the brief concludes, the court should not invalidate the FCRA provision, as it “directly advances the government’s substantial interest in protecting individuals’ privacy” while also accommodating the interest of businesses. The case is pending.

Go to Top