Employer Guidelines for Complying with the Fair Credit Reporting Act
Table of Contents:Relevant Provisions of the FCRA
Definition of "Consumer Reporting Agency"
Definition of "Consumer Report"
Definition of "Investigative Consumer Report"
Definition of "Permissible Purpose"
Employer Obligations Under the FCRA
Disclosure and Authorization Required for Consumer Reports
Additional Disclosure Required for Investigative Consumer Reports
Notice of Adverse Action
Notice to Consumer Reporting Agency
Penalties/Causes of Action
Suggestions
Do It Yourself
Retain Reputable Investigative Services
Prepare An Appropriate Compliance Strategy
Employers have become much more security sensitive, and many are retaining outside firms to conduct background checks of applicants and employees. The goal is to make more informed employment decisions and avoid hiring the wrong individual. Few employers realize, however, that under certain circumstances such investigations can be considered “consumer reports,” which are regulated by federal law and subject to a number of limitations and requirements. The following is a review of major provisions of the Fair Credit Reporting Act (the “FCRA”) as it affects employment-related investigations.
Relevant Provisions of the FCRA
Congress' stated purpose in enacting the FCRA was to require certain credit reporting agencies to adopt “fair and equitable procedures” that meet the needs of consumers with respect to the protection of the confidentiality, accuracy, relevancy and proper utilization of information. Given that far-reaching mission, it is broadly drawn and covers a wide range of activities. The FCRA permits “consumer reporting agencies” to gather and distribute information about a “consumer” in the form of a “consumer report.” “Consumers” protected by the FCRA include applicants and employees. Other definitions under the FCRA are extremely broad and include a number of entities and actions that are related directly to employers as described below.
Definition of "Consumer Reporting Agency"
A consumer reporting agency is defined under the FCRA as any entity “which for monetary fees, dues or on a cooperative, non-profit basis regularly engages...in the practice of assembling or evaluating consumer credit information or other information on consumers.” It does not include governmental agencies or public law enforcement authorities. The extremely broad definition does include, however, private security firms hired by employers to conduct background checks and obtain information about employees and applicants. The Federal Trade Commission (the “FTC”), which enforces the FCRA, indicated in an opinion letter that this definition includes agencies retained by employers to investigate employees with respect to workers' compensation claims and other private entities and organizations hired by employers to investigate workplace misconduct such as sexual harassment allegations, fraud and employee violence. This expansive definition has not been confirmed in any court, as it is uncertain whether the FTC's broad interpretation will be adopted.
Definition of "Consumer Report"
A consumer report is defined under the FCRA as “any written, oral or other communication of any information by a consumer reporting agency bearing on a consumer's credit-worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living” when it is used for “employment purposes.” Given this broad definition, consumer reports include driving record reports, criminal records reports, educational records, and prior employment references, as well as traditional credit reports, when such information is provided by a consumer reporting agency.
Definition of "Investigative Consumer Report"
An investigative consumer report is a more intimate type of consumer report; it is defined as a “consumer report or portion thereof in which information on a consumer's character, general reputation, personal characteristics, or mode of living is obtained through personal interviews with neighbors, friends or associates of a consumer reported on or with others with whom he is acquainted or who may have knowledge considering any such items of information.” Again, given this expansive definition, investigative consumer reports include such things as outside investigations, personal references, interviews with neighbors regarding workers' compensation investigations, and interviews with co-workers regarding personal conduct (for example, interviews related to allegations of sexual harassment).
Definition of "Permissible Purpose"
Credit reporting agencies are permitted to distribute consumer and investigative consumer reports only when such information is used for a “permissible purpose.” Under the FCRA, such information may be distributed when the consumer reporting agency has reason to believe that the intended use of the information is for employment purposes. While employers who retain the services of consumer reporting agencies for the purpose of investigating applicants and/or employees are authorized to receive consumer reports, they also are required to comply with significant notification and authorization requirements as described in detail below.
Employer Obligations Under the FCRA
The FCRA imposes specific restrictions and obligations on employer use of consumer reporting agencies and consumer reports.
Disclosure and Authorization Required for Consumer Reports
Before an employer may obtain a consumer report or cause one to be prepared, it must disclose to that person in writing that such a report may be obtained and secure the person's written authorization. This written disclosure must be contained in a separate document used solely for that purpose, and it may not simply be included on an employment application or in an employee handbook.
Additional Disclosure Required for Investigative Consumer Reports
If an employer wishes to obtain an investigative consumer report, it must follow the requirements discussed above with respect to consumer reports and meet the following additional requirements:
- An employer must advise the employee or applicant in writing that an investigative consumer report may be requested no later than three days after the report is requested.
- It must advise the employee or applicant that the report may include information as to his/her character, general reputation, personal characteristics and mode of living.
- Also, an employer must provide the individual with a summary of his/her rights under the FCRA.
- Finally, an employer who wishes to order an investigative consumer report must advise the employee or applicant that, on written request, it will provide additional information, including a “complete and accurate disclosure of the nature and scope of the investigation requested.” If the additional disclosure is requested by the employee within a “reasonable period of time,” this information must be provided by the employer in writing and delivered (personally or by mail) no later than five days after receipt of the request or five days after the report is ordered, whichever is later. As a result, employers need not and should not respond to such a request unless and until an investigative report has been ordered.
Notice of Adverse Action
Before taking any “adverse action” (which includes “a denial of employment or any other decision for employment purposes that adversely affects and current or prospective employee”) based in whole or in part on a consumer report, an employer must provide the affected person with a copy of the report and a written description of that person's rights under the FCRA. (The consumer reporting agency must include the description of rights with the consumer report. The appropriate information is also included in an FTC publication entitled, “A Summary of Your Rights Under the FCRA.”)
After taking any adverse action, the employer again must notify the consumer that adverse action has been taken based in whole or in part on a consumer report. Further, the employer must provide the individual with:
- the name, address and telephone number of the reporting agency (including the toll-free number of a national agency);
- notice of the person's right to obtain an additional free copy of the report by making the request within 60 days;
- notice of the person's right to dispute the accuracy or completeness of the report with the consumer reporting agency; and
- a notice that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide the person the specific reasons why the action was taken.
The FTC has taken the position that the legislative history of the FCRA clearly anticipates that this notice will be accompanied by an opportunity to clear up any errors in the report, and the FCRA contains comprehensive procedures whereby consumers can correct such errors through the credit reporting agency. The FCRA, however, does not require employers to refrain from taking any action based on a negative report once the notice has been given. Nor does it require employers to give applicants or employees an opportunity to respond or explain, or to alter a decision based on an incorrect report. Furthermore, employers are excluded from liability based on any error in a consumer report provided by a consumer reporting agency.
Notice to Consumer Reporting Agency
Before a consumer reporting agency may provide or prepare a consumer report for an employer, it must obtain certification from the employer that the employer (1) provided the required disclosure to the applicant/employee, (2) received written permission to obtain the report, (3) will not use the information in violation of any applicable equal employment opportunity law or regulation, and (4) will abide by the requirements stated before taking any adverse employment action.
Penalties/Causes of Action
Employers that fail to give the appropriate notices or obtain authorizations may be sued by affected individuals. Consumer reporting agencies and users of consumer information who willfully or negligently fail to comply with any requirement imposed under the FCRA may be liable for actual damages, court costs and reasonable attorney's fees. Punitive damages are also available for willful violations. In addition, the FTC may sue employers for civil penalties of not more than $2,500 per violation.
The availability of tort actions by consumers is limited, however. The FCRA contains a provision that no consumer may bring any action or proceeding for defamation, invasion of privacy or negligence with respect to the reporting of information against any consumer reporting agency, any user of information (including employers or perspective employers) or any person who furnishes information to a consumer reporting agency unless the information is false and has been provided with malice or willful intent to injure the consumer. This is a very difficult burden, and it is unlikely to be met in the vast majority of cases.
Suggestions
Do It Yourself
The activities of employers who act as their own investigators and do not retain the services of a consumer reporting agency are not covered by the FCRA, and internally conducted background checks will avoid any need to comply. “Do-it-yourself' may not be possible given individual company resources, staff and time. Furthermore, even though information that an employer seeks directly from a governmental authority (such as conviction records from the state police) is not covered under the FCRA, it may be covered under state laws that require people seeking such information to have the prior written authorization of the person about whom the information is being sought.
Retain Reputable Investigative Services
Although employers are not accountable for errors in consumer reports, bad information engenders bad results. Prospective investigative services, therefore, should always be asked to provide information/confirmation of their FCRA compliance, as well as general references and credentials.
Prepare An Appropriate Compliance Strategy
Employers should develop an FCRA compliance strategy that includes: (1) establishing a procedure for giving required notices, (2) obtaining and retaining signed authorizations, and (3) maintaining documentation of activities. It is especially critical that various authorizations and forms containing all of the information required under the FCRA be prepared and distributed as required.
If you have any questions about the FCRA or would like assistance in preparing appropriate authorizations and notices, please feel free to contact any partner in Wildman Harrold's Employment and Labor Practice.
