New Mandates Under The Fair Credit Reporting Act
Many of our readers know that the Fair Credit Reporting Act (FCRA) applies when an employer obtains a “consumer report” – a written, oral, or other communication of information by a consumer-reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living—for employment purposes. In other words, employers must comply with the FCRA when they use criminal history reports, driving records, and other background checks that were procured by a third party in making employment decisions. In contrast, where employers perform their own investigation into an applicant’s or employee’s background, the FCRA does not apply.
The FCRA requires employers to disclose that they may obtain and use consumer reports for employment decisions and to secure written consent from employees or applicants to obtain these reports. Before taking adverse action against an employee or applicant based on a consumer report, the employer must provide the individual with a copy of the report and notice of FCRA rights. The technical requirements of the FCRA are complex, and, with the 2018 enactment of the Economic Growth, Regulatory Relief, and Consumer Protection Act, they have become even more so. As a result of increasing concerns about data security breaches, Congress amended the FCRA to require that credit reporting agencies place “national security freezes” and fraud alerts on consumers’ credit reports upon request without cost to the consumer beginning in September 2018.
The new law requires that whenever a consumer is required to receive a Summary of Consumer Rights under the FCRA, that document must provide notice that the security freeze is available. The Consumer Financial Protection Bureau has updated its form Summary of Consumer Rights to contain that information. It can be found at the following link: https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf. Employers should ensure that they (and their third party background checking agencies) are using the most up-to-date forms containing this information.
In other FCRA developments, courts are continuing to address the issue of standing to sue for technical violations of the FCRA in the wake of the U.S. Supreme Court’s ruling in Spokeo v. Robins (2016). In Spokeo the Court held that concrete injury for alleged violations of the FCRA was necessary for standing to sue, and that a consumer could not satisfy the constitutional injury-in-fact requirement by alleging a bare procedural violation of the FCRA. Although this sounds straightforward, courts have reached different results in subsequent analyses of these claims.
On July 13, 2018, in Dutta v. State Farm, the U.S. Court of Appeals for the Ninth Circuit affirmed a ruling in favor of an employer on the ground that a rejected job applicant did not have standing to sue under the FCRA. Dutta alleged that State Farm rejected him for employment based on information in his credit report, without first providing him with a pre-adverse action notice and an opportunity to contest the information. The employer actually had mailed a pre-adverse action notice to Dutta, but he asserted that the notice was not compliant with the FCRA because he had already been told over the phone that he was being rejected based on his credit report. The court concluded that, even though Dutta alleged a violation of the pre-adverse-action notice requirement, he did not demonstrate any actual harm or a substantial risk of such harm because the employer would have made the same decision even if the violation had not occurred.
In contrast, on August 29, 2018, the U.S. Court of Appeals for the Seventh Circuit issued its opinion in Robertson v. Allied Solutions, LLC, another case in which the plaintiff applicant alleged that an employer had rejected her for employment based on information in her back-ground report, without providing her with a pre-adverse-action notice and an opportunity to contest the information in the report, as required by the FCRA. The trial court dismissed the lawsuit based on Robertson’s lack of standing, but the Seventh Circuit reversed. It held that Robertson had established standing by asserting that Allied Solutions had failed to provide her information she was entitled to by law—a copy of the background report and a summary of her legal rights under the FCRA. The “informational injury” was found to be concrete because Robertson was deprived of the opportunity to use the information for a substantive purpose—to allow her to provide context for negative information in the back-ground check, regardless of the information’s truth.
The FCRA continues to be a fertile ground for lawsuits, including class actions, even after the Supreme Court’s Spokeo opinion, which many thought would have a chilling effect on litigation as it was viewed as unfavorable to plaintiffs. Employers would be wise to ensure that all of the requirements of the recently amended FCRA are followed to the letter.