Originally published in The Florida Bar Journal, Vol. 94, No. 2, March/April 2020.
The importance of the Fair Credit Reporting Act (FCRA or the act), 15 U.S.C. §1681, et seq., cannot be underestimated as each of us depends on the accuracy of information collected and shared about us to evaluate us for credit, insurance, and employment purposes. Although the act’s name might lead one to believe that the FCRA regulates the sharing of “credit” information only, the FCRA regulates the sharing of many other types of information about individuals (consumers), including about individuals’ character, reputation, personal characteristics, and mode of living, when the information is obtained through a “consumer reporting agency.”[1] The FCRA authorizes businesses to obtain and use consumer reports for employment purposes, but companies must comply with strict disclosure and consent requirements. Given the strict requirements and the prevalence of class-action claims for violations, companies should take care to understand their obligations when using consumer reports for employment purposes.
Background on the Use of Consumer Reports for Employment Purposes
Employers desire, and are sometimes required, to screen and monitor applicants and employees for reasons such as evaluating individuals for the safety of a company’s workforce and customers,[2] protecting the company’s reputation and information, and assessing whether such individuals are trustworthy. Under the FCRA, employers are prohibited from obtaining a “consumer report” relating to an individual (a potential or existing employee[3] in this context) for employment purposes unless certain steps are followed.[4]
“Consumer report” is broadly defined and generally includes any communication of any information by a “consumer reporting agency” bearing on an individual’s “credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living” that may be used to evaluate the individual’s eligibility for employment purposes, or another purpose authorized by the FCRA.[5] There are a few specific exclusions to the definition of “consumer report,” some of which are discussed below.[6] The act defined “consumer reporting agency” as anyone that “regularly engages in whole or in part in the practice of assembling or evaluating. . . information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.”[7]
Requirements Prior to Procuring a Consumer Report for Employment Purposes
Before obtaining a consumer report, employers must provide applicants and employees a written “clear and conspicuous disclosure” that a consumer report may be obtained for employment purposes “in a document that consists solely of the disclosure.”[8] Employers also must obtain the individuals’ written authorization, which can be made on the disclosure document, but nothing else can appear on the disclosure form.[9]
Courts have found companies in violation of the initial disclosure and authorization requirements in many ways. For example, courts have held that employers violated the standalone requirement by including the disclosure in an application form or other document, or by adding a liability waiver or other superfluous information to such disclosures.[10] And courts have held that employers violated the clear and conspicuous requirement by using a disclosure form that is not “reasonably understandable” or “readily noticeable.”[11]
Many employers satisfy the initial disclosure and authorization requirements at the outset of the relationship, after making a conditional offer of employment, and then use that one-time, blanket disclosure and authorization throughout the employment relationship. In Kelchner v. Sycamore Manor Health Center, 135 F. App’x 499, 502 (3d Cir. 2005), the Third Circuit Court of Appeals held that a blanket disclosure and authorization is permissible throughout the employment relationship for non-investigative consumer reports.[12]
If an employer plans to obtain an investigative consumer report, however, there are additional requirements. An investigative consumer report is a consumer report, or part thereof, in which information on an individual’s character, general reputation, personal characteristics, or mode of living is obtained through personal interviews with others, such as associates, friends, or neighbors.[13] An employer obtaining such a report must clearly and accurately disclose that it may procure an investigative consumer report and state whether the report will contain information as to the individual’s character, reputation, personal characteristics, and/or mode of living.[14] That disclosure must be made in writing and mailed or otherwise delivered within three days of the request for the report.[15] The disclosure must tell the consumer he or she has the right to request additional disclosures and a written summary of rights. If the consumer makes a written request for the additional disclosures within a reasonable time, the employer must make a full and accurate written disclosure of the nature and scope of the investigation sought and mail or deliver those additional disclosures within five days after receiving the consumer’s request, or within five days after such employer first requested the report, whichever is later.[16]
Requirements After Procuring a Consumer Report for Employment Purposes
• Pre-Adverse Action Requirements — After obtaining a consumer report, the employer must provide additional disclosures if it may take an adverse action based partially or completely on information in the report.[17] “Adverse action” is broadly defined to include any decision for employment purposes that adversely affects the applicant or employee, not just a denial or termination of employment.[18]
Before taking an adverse action, the employer must provide the individual with a copy of the report and notice of his or her FCRA rights (collectively, the “pre-adverse action notice”).[19] To determine whether employers met their obligation to send a pre-adverse action notice, courts have refined the meaning of what constitutes an adverse action. For example, in Johnson v. ADP Screening & Selection Services, Inc., 768 F. Supp. 2d 979, 983 (D. Minn. 2011), the court held a decision to place an application on hold does not constitute an adverse action. And whether the coding of an individual in a particular manner amounts to a tentative internal decision or a final decision often depends on whether the applicant or employee “has a legitimate opportunity to cure inaccuracies in a report before receiving an adverse employment decision.”[20]
In Obabueki v. IBM Corp., 145 F. Supp. 2d 371, 391–2 (S.D.N.Y. 2001), affirmed, 319 F.3d 87, 88 (2d Cir. 2003), the court ruled an internal decision to withdraw an offer of employment was not an adverse action because the plaintiff “did not suffer any adverse effect until his offer of conditional employment was withdrawn” five days later. The court noted that the FCRA “expressly allows for the formation of an intent to take adverse action before complying with [the pre-adverse action notice requirements].” [21] Other federal courts have similarly found an adverse action does not occur until the decision is carried out, communicated, or actually takes effect.[22] When a decision goes “beyond a mere internal decision” before the pre-adverse action notice is provided, however, and the individual is not provided an opportunity to dispute the information, employers may face liability.[23]
Courts also have evaluated how long an employer must wait after sending the pre-adverse action notice before implementing an adverse action. The FCRA does not specify a time period, and courts have not agreed on a specific amount of time. Most courts agree “there must be some time between notice and action,”[24] because the purpose of providing the pre-adverse action notice “is to give current or prospective employees the opportunity to discuss and clarify information in a background report with the employer before adverse action is taken.”[25] As noted in Beverly v. Wal-Mart Stores, Inc., 2008 WL 149032, at *3 (E.D. Va. Jan. 11, 2008), some courts have held an employer must provide the individual with a “reasonable” or “sufficient” amount of time to respond to any inaccuracies.[26] A Federal Trade Commission staff member in a nonbinding opinion letter said five business days “appear[ed] reasonable,” but noted the facts of a situation may require a different amount of time.[27] One court held eight business days, as a matter of law, “afforded a ‘reasonable’ amount of time.”[28] Another court held an applicant received ample time to dispute the report with the employer when he received 14 calendar days.[29] Significantly, the court noted “[n]othing in the FCRA requires an employer to consider any correction that a reporting agency might make.”[30]
• Post-Adverse Action Requirements — After complying with its pre-adverse action requirements, if an employer determines it will, in fact, take an adverse action, it must send a post-adverse action notice, containing 1) the adverse action; 2) the individual’s credit score, the range of potential credit scores, the key factors negatively affecting the individual’s credit score,[31] the date the credit score was created and the person that provided the credit score or file, if a credit score was obtained; 3) the name, address and phone number of the consumer reporting agency; 4) the individuals’ right to obtain a free copy of a consumer report from the consumer reporting agency within a 60-day period; 5) the individual’s right to dispute with the consumer reporting agency the accuracy or completeness of any information in the report; and 6) state that the consumer reporting agency did not make the adverse action decision and cannot identify the reasons why the action was taken.[32]
The disclosure of the credit information must be provided in written or electronic form; the other information may be provided orally or in written or electronic form.[33] Although the post-adverse action notice is in some respects duplicative of the pre-adverse action notice, both are required.[34] But, the Seventh Circuit Court of Appeals, in Perry v. First Nat. Bank, 459 F.3d 816, 823 (7th Cir. 2006), held that there is no private right of action associated with the failure to meet the post-adverse action requirements.[35]
Separate Procedures for Investigations
Certain information received by employers in connection with investigations is excluded from the definition of “consumer report.” Specifically, consumer report does not include the communication of information to an employer “in connection with an investigation of (i) suspected misconduct relating to employment; or (ii) compliance with [f]ederal, [s]tate, or local laws and regulations, the rules of a self-regulatory organization, or any preexisting written policies of the employer;” provided that the communication is not made to evaluate credit and is only made to certain persons with a need to know, such as the employer, government, a self-regulatory organization, or “as otherwise required by law.”[36]
Although the above-described communications are not considered “consumer reports,” and, thus, the typical advance notice and authorization requirements for consumer reports are not required, the FCRA still requires employers to disclose information to such employees after (and if) the employer takes an adverse action based partially or completely on such communications. Specifically, the employer must provide a summary of the nature and substance of the communication that formed the basis for the adverse action, but the employer need not reveal the sources of information that would otherwise constitute an investigative consumer report.[37]
The scope of both parts of the investigation exclusion have been evaluated by courts. With respect to the first part, in Pyle v. Woods, 874 F.3d 1257, 1257 (10th Cir. 2017), the 10th Circuit Court of Appeals held that an investigation of “suspected misconduct relating to employment” does not require a preexisting suspicion of a particular employee. Moreover, so long as an employer genuinely suspects misconduct, the exclusion applies, and the employer’s suspicion need not be objectively reasonable.[38] However, in Mattiaccio v. DHA Group, Inc., 21 F. Supp. 3d 15, 20 (D.D.C. 2014), the court held the exclusion may not apply if an employer conducts its investigation not because of suspected misconduct, but in retaliation for an employee’s complaints about management.
Not surprisingly, given the statutory language, an employer does not need to be investigating employee misconduct to avail itself of the second part of the exclusion, relating to reports made “in connection with an investigation of” compliance with laws, regulations, rules, or internal policies.[39] Additionally, a report does not need to be required by a particular law or policy for the exclusion to apply.[40]
Background checks conducted as part of the hiring process do not meet the exclusion for investigations, because they are a condition to obtain employment, as opposed to an “investigation.”[41] In other words, “the background check itself cannot be the investigation, but must rather be a part of a larger inquiry.”[42]
Discrimination and Other Claims
The FCRA implicitly recognizes that information in consumer reports could be used in a discriminatory manner; to prevent that, an employer must certify to a consumer reporting agency that the information “will not be used in violation of any applicable [f]ederal or [s]tate equal employment opportunity law or regulation.”[43]
Practically speaking, in addition to following the mandates of the FCRA, employers should assess the risks of being subjected to discrimination and other claims when using consumer reports to make employment decisions. The Equal Employment Opportunity Commission (EEOC) in its Enforcement Guidance on the Consideration of Arrest & Conviction Records in Employment Decisions Under Title VII of the Civil Rights Act of 1964, as amended, 42 U.S.C. §2000e, et seq., no. 915.002, April 25, 2012 (the guidance), takes the position that employers may violate discrimination laws in certain circumstances when they request and/or use information in consumer reports, such as criminal history information. The EEOC says that a disparate treatment violation may occur when employers request or treat such information differently for different applicants or employees based on their race, national origin, or other protected characteristics.[44] Moreover, the EEOC says a disparate impact violation may occur when an employer’s neutral policy, such as a blanket ban on hiring individuals with criminal records, disproportionately impacts individuals with a particular protected characteristic, if the policy is not job related and consistent with business necessity.[45] Although the Fifth Circuit Court of Appeals, in Texas v. EEOC, 933 F.3d 433, 451 (5th Cir. 2019), held the guidance is not binding in any respect, the EEOC has instituted multiple lawsuits against employers for their use of criminal history information, and recently announced a $6 million settlement with Dollar General relating to a claim that the company’s employment screens had a disparate impact on African-American applicants in violation of Title VII.[46] In addition to claims under general discrimination statutes, and as part of a movement referred to as “ban the box” or “fair chance hiring,” many jurisdictions prohibit employers from inquiring into criminal history before making a conditional offer of employment.[47]
Damages
Violations of the FCRA can be costly because companies often violate the act with respect to numerous individuals under similar circumstances. In a private action, any person who negligently fails to comply with the FCRA is liable for actual damages.[48] If the violator “willfully” fails to comply, it is liable for actual damages or statutory damages “of not less than $100 and not more than $1,000,” and may be liable for punitive damages.[49] The Supreme Court, in Safeco Ins. Co. of Am. v. Burr, 551 U.S. 47, 69-71 (2007), held “willful” failure to comply with the FCRA is not limited to known violations, but also includes reckless disregard of FCRA obligations. Lost wages caused by FCRA violations constitute actual damages.[50] In Sloane v. Equifax Info. Servs., LLC, 510 F.3d 495, 500 (4th Cir. 2007), the court found that actual damages may also include damages for humiliation and mental distress.[51]
Also, a consumer who brings a “successful action to enforce any liability” is entitled to costs and reasonable attorneys’ fees, regardless of whether the violation was negligent or willful.[52] In Nagle v. Experian Info. Sols., Inc., 297 F.3d 1305, 1306-07 (11th Cir. 2002), the 11th Circuit Court of Appeals held a “successful action” must include some relief to the plaintiff beyond the mere entry of a judgment.
In addition to being subjected to private actions by consumers, violators may be subjected to civil monetary penalties,[53] criminal liability,[54] and enforcement actions by states.[55]
Standing
Recently, attention has focused on a consumer’s requirement to show article III standing to sue in federal court for FCRA violations. The Supreme Court addressed this in Spokeo v. Robins, 136 S. Ct. 1540, 1550 (2016).[56] The defendant in Spokeo argued that the plaintiff did not have standing because the plaintiff did not allege any harm resulted from the FCRA violation at issue (the defendant allegedly published inaccurate information about the plaintiff). The Supreme Court remanded the case because the Ninth Circuit had failed to analyze “whether the particular procedural violations [of the FCRA] alleged in [the] case entail a degree of risk sufficient to meet the concreteness requirement [of the injury-in-fact requirement for standing to sue in federal court].” The court said a violation “of one of the FCRA’s procedural requirements may result in no harm” (such as when a consumer reporting agency disseminates an incorrect zip code). As a result, a plaintiff must allege more than a bare procedural violation of the FCRA “divorced from any concrete harm.”[57] In remanding, though, the court took no position as to whether the Ninth Circuit’s conclusion that the plaintiff alleged an injury in fact was correct.[58] As noted in Anderson v. Wells Fargo Bank, N.A., 266 F. Supp. 3d 1175, 1181-82 (D.S.D. 2017), since the Supreme Court’s decision in Spokeo, courts have been divided about “whether [FCRA] plaintiffs set forth violations of substantive rights sufficient to constitute a concrete injury or whether [they] assert[] ‘a bare procedural violation, divorced from any concrete harm.’”[59]
Conclusion
Given the myriad ways in which companies can violate the FCRA and other laws when obtaining information about applicants and employees from consumer reporting agencies, employers should carefully review the FCRA requirements and other risks before doing so.
[1] 15 U.S.C. §1681a(d)(1). [2] In Florida, employers can obtain a presumption against negligent hiring when they conduct a background investigation on applicants prior to hiring. Fla. Stat. §768.096. [3] Zamora v. Valley Fed. Savings & Loan Assoc., 811 F.2d 1368, 1370 (10th Cir. 1987) ([A]n employer cannot obtain a consumer report on an employee’s spouse “for employment purposes.”); Lamson v. EMS Energy Marketing Service, Inc., 868 F. Supp. 2d 804 (E.D. Wis. 2012) (independent contractor was not entitled to FCRA protections). However, the Ninth Circuit Court of Appeals, in dicta in Syed v. M-I, LLC, 853 F.3d 492, 508 n. 1 (9th Cir. 2017), said the FCRA’s initial disclosure and authorization requirements are “not limited to employer-employee relationships.” [4] 15 U.S.C. §1681b(b). “Employment purposes” means for the purpose of evaluating an individual for “employment, promotion, reassignment or retention as an employee.” 15 U.S.C. §1681a(h). [5] 15 U.S.C. §1681a(d). [6] 15 U.S.C. §§1681a(d)(2)(D) & (y). [7] 15 U.S.C. §1681a(f). [8] 15 U.S.C. §1681b(b)(2). [9] Id. [10] See, e.g., Syed, 853 F.3d at 492 (inclusion of liability waiver in same document as initial disclosure was FCRA violation); Gilberg v. Cal. Check Cashing Stores, LLC, 913 F.3d 1169 (9th Cir. 2019) (inclusion of extraneous information about state law requirements violated FCRA); Hargrett v. Amazon.com DEDC LLC, 235 F. Supp. 3d 1320, 1327 (M.D. Fla. 2017) (FCRA violation alleged where Amazon provided documents that contained liability waivers and inapplicable state law notices); Milbourne v. JRK Residential Amer., LLC, 92 F. Supp. 3d 425, 431-33 (E.D. Va. 2015) (inclusion of liability release in disclosure form violated FCRA’s standalone requirement); Reardon v. ClosetMaid Corp., 2013 WL 6231606, at *13 (W.D. Pa. Dec. 2, 2013) (granting summary judgment against employer because the waiver of rights provision, even if it was narrowly tailored to the employer’s procurement of consumer reports, was not an “authorization,” which is the only other item that can appear on an initial disclosure). [11] Gilberg, 913 F.3d at 1176 (vacating, in part, summary judgment for employer because disclosure form was unclear). [12] The court also held that employers may require at-will employees to authorize the use of consumer reports as a condition of continued employment. Id. [13] 15 U.S.C. §1681a(e). [14] 15 U.S.C. §1681d(a). [15] Id. [16] 15 U.S.C. §1681d(b). [17] 15 U.S.C. §1681b(b)(3). [18] 15 U.S.C. §1681a(k). [19] 15 U.S.C. §1681b(b)(3). The consumer’s rights include the right to dispute information with the credit reporting agency. 15 U.S.C. §§1681g(c)(1)(B)(iii) & 1681(i). [20] Branch v. Gov’t Emps. Ins. Co., 286 F. Supp. 3d 771, 783, 785 (E.D. Va. 2017) (finding genuine material dispute about whether Geico took an adverse action against an applicant when it assigned her a fail grade). See also Costa v. Family Dollar Stores of Va., Inc., 195 F. Supp. 3d 841, 845 (E.D. Va. 2016) (“not recommended” code not adverse action). In Manuel v. Wells Fargo Bank, N.A., 123 F. Supp. 3d 810, 823 (E.D. Va. 2015), the court held there was a genuine issue of fact as to whether Wells Fargo’s use of an “ineligible” code was a final adverse action “because Wells Fargo was comfortable adhering to that decision without reviewing it if the individual did not file a dispute.” Another court expressly disagreed with that ruling. Dahy v. FedEx Ground Package Sys., Inc., 2018 WL 4328003, at *9 (W.D. Pa. Aug. 3, 2018), report and recommendation adopted, 2018 WL 4323808 (W.D. Pa. Sept. 10, 2018) (“There is nothing in the FCRA that requires an employer who makes a pre-adverse determination to revisit the decision again if the applicant does not dispute the information.”). [21] Obabueki, 145 F. Supp. 2d at 391-92. [22] Miller v. Johnson & Johnson, Janssen Pharms., Inc., 80 F. Supp. 3d 1284, 1294 (M.D. Fla. 2015), reconsideration granted on other grounds, sub nom. Miller v. Johnson, 2015 WL 12838840 (M.D. Fla. Jan. 21, 2015). [23] Id. at 1291-95. [24] Johnson, 768 F. Supp. 2d at 983-84. [25] Miller, 80 F. Supp. 3d at 1289. [26] Id. (denying summary judgment where defendant claimed it sent the pre-adverse action notice on Sept. 1 and the post-adverse action notice on Sept. 6, but plaintiff alleged he received both letters on Sept. 7). [27] F.T.C. Staff Opinion to Weisberg 06-27-1997. Although FTC informal staff opinions do not constitute “authoritative guidance” on the FCRA, many courts find them to be persuasive. Milbourne, 92 F. Supp. 3d at 431. [28] Reardon, 2013 WL 6231606, at *13. [29] Johnson, 768 F. Supp. 2d at 983-84. [30] Id. at 984. That makes sense, not only based on the statutory language, but also because it can take consumer reporting agencies a considerable amount of time to correct consumer reports, and employers often need to fill positions quickly. [31] When listing the key factors, generally a maximum of four factors may be listed, except when a key factor adversely affecting the score consists of the number of inquiries. 15 U.S.C. §§1681g(f) & m(a)(2)(B). [32] 15 U.S.C. §1681m. [33] Id. [34] F.T.C. Staff Opinion to Weisberg 06-27-1997. [35] See also Alibris v. ADT LLC, 2015 WL 5084231, at *6 (S.D. Fla. Aug. 28, 2015) (“Plaintiff’s claim for violation of 15 U.S.C. §1681m(a) [the post-adverse action notice] fails as a matter of law because only Federal agencies and officials can enforce this section.”). [36] 15 U.S.C. §1681a(y). The Consumer Financial Protection Bureau has a form companies can use, called “A Summary of Your Rights Under the Fair Credit Reporting Act” (updated Sept. 2018). [37] 15 U.S.C. §1681a(y). The FCRA does not specify a deadline for making such disclosure. [38] Millard v. Miller, 2005 WL 1899475, at *2 (W.D. Wis. Aug. 9, 2005) (exclusion applied to a report the employer obtained post-termination for use at a workers’ compensation hearing). [39] Martin v. First Advantage Background Servs. Corp., 877 F. Supp. 2d 754, 759 (D. Minn. 2012). [40] Id. at 760 (denying defendant’s motion to dismiss because whether the report qualifies for the exclusion depends on the circumstances that caused Wells Fargo to obtain the report, which could not be resolved at that stage). The court later granted summary judgment for the defendant because the report was made in an effort to comply with the SAFE Act. Martin v. First Advantage Background Servs. Corp., 2014 WL 1260392, at *6 (D. Minn. Mar. 26, 2014). [41] Ramos v. Genesis Healthcare, LLC, 141 F. Supp. 3d 341, 347 (E.D. Pa. 2015). [42] Manuel, 123 F. Supp. 3d at 825-26. [43] 15 U.S.C. §1681b(b). [44] Id. [45] Id. [46] Dollar General to Pay $6 Million to Settle EEOC Class Race Discrimination Suit, Press Release from U.S. EEOC (Nov. 18, 2019). [47] See, e.g., New York City Human Rights Law, N.Y.C. Admin. Code §8-101, et seq. There is a conflict between the EEOC’s position (and the position articulated by ban-the-box legislation) and Fla. Stat. §768.096, which encourages Florida employers to ask questions on application forms about applicants’ convictions of crimes. [48] 15 U.S.C. §1681o. [49] 15 U.S.C. §1681n. [50] See, e.g., Miller, 80 F. Supp. 3d at 1296 (citing cases). [51] See also Zamora, 811 F.2d at 1370 (affirming jury award of emotional distress damages). [52] 15 U.S.C. §§1681n & o. [53] 15 U.S.C. §1681s; 16 C.F.R. §1.98(m). [54] 15 U.S.C. §1681q. [55] 15 U.S.C. §1681s. [56] Standing “limits the category of litigants empowered to maintain a lawsuit in federal court” to those who “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, 136 S. Ct. at 1547. Plaintiffs must clearly allege facts demonstrating each element. Id. Article III requires a concrete injury even when a statutory violation occurs. Id. at 1549. [57] Id. at 1549-50. [58] Id. at 1550. On remand, the Ninth Circuit again found the plaintiff had standing; the fact that defendant published inaccuracies about plaintiff that related to the type of information employers may find important sufficiently showed harm or at least a material risk of harm. Robins v. Spokeo, Inc., 867 F.3d 1108, 1115-16 (9th Cir. 2017). [59] Id. See also Syed, 853 F.3d at 499-500 (Plaintiff alleged standing when he alleged defendant procured a consumer report based on an illegal disclosure and authorization form, because the court “can fairly infer that [plaintiff] was confused. . . and would not have signed it had it contained a sufficiently clear disclosure.”); Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017) (affirming dismissal for lack of standing; “[u]nlike the plaintiff in Syed, [plaintiff] presents no factual allegations plausibly suggesting that he was confused …or that he would not have signed it had the disclosure complied [with FCRA requirements].”).
