Congress recently amended the federal Fair Credit Reporting Act ("FCRA") to further regulate the use and disclosure of reports containing certain consumer informa-tion. Effective on September 30, 1997, the amendments also impose new obligations on employers who use these reports in conjunction with the employment application process and current employment relationships, and on employers who take certain action based upon the information contained in the reports. While FCRA extends well beyond the employment arena, the nature of FCRA's new obligations and the significant liability which can be imposed for violations demand particular attention from employers and their counsel.
The Purpose And Scope Of FCRA
FCRA was originally enacted in 1970 to insure the accuracy, relevancy and confidentiality of consumer reports which affect decisions by users of the reports concerning a consumer's eligibility for credit, insurance and employment. Congress expressly found that consumer reporting agencies have "assumed a vital role" in assembling and disclosing credit and other information on consumers, and thus recognized a need "to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy." Indeed, D. Barry Connelly, the President of Associated Credit Bureaus, Inc., recently told a congressional subcommittee that there are now "approximately 180 million credit active consumers" who "are likely to have more than one credit history maintained."
The threshold task involves a determination of coverage. FCRA requires compliance by all "persons", defined broadly to include "any individual, partnership, corporation, trust, estate, cooperative, association, government or governmental subdivision or agency, or other entity." However, FCRA affords protection to a more narrow class of "consumers", defined to include only "an individual". In addition, although the term "credit" is included in the title of the act, FCRA regulates the use and disclosure of a broader scope of information which may be included in a "consumer report", ranging from a consumer's credit standing and credit capacity, to a consumer's general reputation, character and personal characteristics. Furthermore, FCRA applies only to communications by a "consumer reporting agency," as that term is defined under the act. In short, one must determine: (1) whether the information concerns a "consumer"; (2) whether the information is used or expected to be used, or collected in whole or in part, for one of the purposes specified in FCRA; and (3) whether the information is provided by a "consumer reporting agency."
FCRA Amendments - Expanding The Scope
Technological advances from the fax machine to the internet have made it faster and easier to obtain consumer information from a world wide web of sources. As two commentators have noted, "[t]he public policy of the Act assumes that the nation has a social interest both in meeting the needs of credit markets for consumer credit information and in the accuracy of the report and the privacy of consumers." Indeed, Congress recognized the need to "further protect Americans from abusive invasion of privacy" when it reformed FCRA in 1996. The increased ability of employers to obtain consumer information about current and potential employees led to the enactment of provisions which specifically address the employment relationship. It should be noted, however, that FCRA does not appear to prohibit an employer from declining to hire an applicant, or from firing a current employee, because of the individual's refusal to authorize the employer to obtain a consumer report, provided that the employer's action does not otherwise violate any state or federal equal employment opportunity law. FCRA also does not appear to require employers in the first instance to obtain consumer reports prior to or in conjunction with making an employment decision relating to a consumer.
However, once an employer seeks to obtain a report, the employer must comply with FCRA which, as amended, can be separated into four types of obligations: (1) obligations prior to obtaining a consumer report; (2) obligations after obtaining a consumer report, but prior to taking adverse action against a consumer; (3) obligations after taking adverse action against a consumer based upon a consumer report; and (4) other obligations relating to the use and disclosure of consumer reports
1. Pre-Receipt Obligations
Before obtaining a consumer report, an employer must make a clear and conspicuous disclosure to the consumer, in a separate document, that a consumer report may be obtained and get the consumer's written authorization for the procurement of the report. This requirement suggests that an employer may not include the disclosure directly on its employment application or in a document which contains other FCRA or non-FCRA disclosures. Although not expressly prohibited, the "separate document" requirement taken literally further suggests that the disclosure may not be stapled or otherwise attached to an employment application.
In addition to FCRA's disclosure requirements, a consumer reporting agency may not furnish a consumer report for employment purposes until the employer certifies: (a) it has disclosed to the consumer that a consumer report may be obtained; (b) the consumer has authorized the employer in writing to procure the report; and (c) the information contained in the report will be used for a permissible purpose. While there have not yet been any reported cases interpreting this provision, the terms "has disclosed" and "has authorized" suggest that an employer must provide a separate certification to the consumer reporting agency for each consumer, and only after making the disclosures and obtaining the consumer's authorization.
2. Post-Receipt Obligations: Before Taking Adverse Action
Once a consumer report is obtained, but before an employer takes "adverse action" against a consumer, the employer must provide to the consumer: (a) a copy of the consumer report; and (b) a description in writing of the consumer's rights under FCRA. However, two issues which are not addressed by this requirement are as noteworthy as those which are addressed. First, FCRA does not set forth a specific period of time for compliance prior to taking adverse action, although the term "before taking" suggests at the very least that the requirements must be met before a consumer is notified of any adverse action. Ironically, consumers familiar with FCRA may learn that adverse action has been taken once copies of the report and description of consumer's rights appear in the mailbox.
Second, FCRA does not appear to require an employer to provide a copy of the consumer report and description of the consumer's rights if the employer does not intend to take adverse action. However, an employer who wishes to ease the administrative burden associated with ensuring that it sends the required documents in cases when it intends to take adverse action can presumably send copies of the consumer report and the description of the consumer's rights whenever it obtains a consumer report, whether or not it intends to take adverse action.
3. Post-Receipt Obligations: After Taking Adverse Action
If and when an employer takes adverse action against a consumer based in whole or in part on information contained in a consumer report, the employer must provide: (a) oral, written, or electronic notice of the adverse action; (b) oral, written, or electronic identification of the consumer reporting agency that furnished the consumer report, and a statement that the agency did not make the decision to take adverse action against the consumer; and (c) oral, written, or electronic notice of the consumer's right to obtain a free copy of the consumer report from the consumer reporting agency (notwithstanding that the employer was already required to provide a copy of the report prior to taking adverse action), and to dispute with a consumer reporting agency the accuracy and completeness of any information contained in the report.
A potential problem could arise, for example, if an employer obtains a consumer report for an applicant, but decides to take adverse action against the applicant for reasons unrelated to the information contained in the report. FCRA does not prohibit an employer from ultimately taking adverse action against a consumer for reasons unrelated to a consumer report, e.g., lack of prior experience or failed typing tests, but the employer's decision is obviously still subject to scrutiny under other state and federal laws. However, because FCRA's requirements are triggered whenever adverse action is taken based "in whole or in part" on the information contained in a consumer report, the employer will likely bear the burden of proving that the action taken was not based in whole or in part on such information. To avoid these problems, employers may wish to amend their policies to either (a) provide the required disclosures whenever adverse action is taken and a consumer report has been obtained, and/or (b) seek to obtain a consumer report later in the application process in order to preserve the perception, and perhaps the reality, that adverse action was taken for reasons unrelated to a consumer report.
4. Miscellaneous Obligations
FCRA imposes additional obligations relating to the use and disclosure of consumer information. For example, various notifications and disclosures must be made by any person who takes certain action in connection with a transaction initiated by the consumer, based in whole or in part on information which is furnished by a person related by common ownership or affiliated by common corporate control, and which is the type of information included in the definition of "consumer report". Other FCRA obligations require disclosures to consumers in conjunction with solicitations for credit or insurance purposes, safeguards for persons who furnish information to consumer reporting agencies, and consent from a consumer before a consumer reporting agency furnishes a consumer report that contains medical information about the consumer. Whether these and other obligations apply will be determined by the particular transactions and circumstances in each case.
Potential Liability
The provisions for liability imposed for violations of FCRA add significant teeth to a statute which may not yet be a household name. The Federal Trade Commission is empowered to enforce FCRA administratively. In addition, an aggrieved party may commence an action in federal court "within 2 years from the date on which liability arises," or, when the defendant materially and willfully misrepresents information required to be disclosed, "within 2 years after discovery of the misrepresentation." A person who willfully fails to comply with any requirement under FCRA is liable for actual damages of not less than $100 and not more than $1,000, punitive damages, and costs and reasonable attorneys' fees. A person who negligently fails to comply with any requirement under FCRA is liable for actual damages, and costs and reasonable attorneys' fees. Additional penalties are imposed on persons who obtain a consumer report under false pretenses or knowingly without a permissible purpose, and on persons who file unsuccessful papers in bad faith or to harass.
Conclusion
The recent FCRA amendments will inevitably force employers to determine whether they want to obtain consumer reports as a matter of policy. For example, an employer may decide to obtain consumer reports only for potential employees, only for current employees, or only for a certain class of employees, e.g., employees who have direct access to cash. An employer may even decide that it does not want to obtain consumer reports about anyone in order to avoid FCRA's reach. As with most new legislation, the recent FCRA amendments will inevitably raise more questions than they answer, paving the way for litigation. However, the potential for significant liability suggests that FCRA should be taken seriously.
We hope you find this newsletter useful and informative. Please feel free to contact Michael Schmidt at (516) 694-8000 if you would like to discuss any of the cases and issues in more detail. Please note that this newsletter is not intended to provide legal advice for any particular matter.