When you think of the Fair Credit Reporting Act ("FCRA"), you likely do not instinctively picture an employer being hauled into court facing both civil and criminal liability. Nevertheless, when an employer fails to comply with the intricacies of the FCRA, that is exactly what just might happen.
Although the FCRA has regulated employers for some time now, a new federal agency has been crowned to enforce it. The newly created, but aggressive, Consumer Financial Protection Bureau ("CFPB") has replaced the Federal Trade Commission as the chief enforcer of the FCRA. Upon its entrance onto the scene, the CFPB has revised the standard forms employers are obligated to use under the FCRA. Albeit minimal, the revisions communicate the shift in agency power to the CFPB and include the CFPB's contact information.
The three forms affected by this change are:
- "Summary of Consumer Rights under the FCRA";
- "Notice of Furnisher Responsibilities: Obligations of Furnishers under the FCRA"; and,
- "Notice to Users of Consumer Reports: Obligations of Users under the FCRA."
The current version of each of these forms will become out of date as of the end of 2012. Thus, in order to comply with the FCRA, employers must begin using the updated forms on or before January 1, 2013.
While the revisions are not substantively significant, they do serve as important reminders to employers that sometimes form is more important than substance under the FCRA. On that note, employers are well-served to take this opportunity to review the basic requirements of the FCRA.
When Does the FCRA Apply to an Employer?
The FCRA applies to employers when they hire an outside third party, known as a "consumer reporting agency," to perform credit and background checks on employees and prospective employees. On the other hand, where an employer conducts background checks on its own without a consumer reporting agency's assistance (for example, the employer calls prior employers of an applicant directly), the FCRA is not implicated.
According to the FCRA, consumer reporting agencies are entities that assemble, evaluate, and furnish various types of personal background information (including credit history) to third parties such as employers. However, it is important to note that the FCRA covers more than just credit reports. Generally, the information that a consumer reporting agency furnishes to third parties is referred to collectively as a "consumer report." As specifically provided in the FCRA, a consumer report refers to any communication, whether written, oral, or otherwise, that is intended to be used for credit purposes or in evaluating an individual's eligibility for employment.
By statute, a consumer report may contain vast amounts of detailed information about an individual, including everything from the individual's creditworthiness and standing to general reputation and character. Moreover, the consumer report may incorporate criminal background reports, prior traffic reports, and, possibly, workers' compensation history.
When a consumer report includes information about an individual that is obtained through more invasive means (for example, through personal interviews of friends and business associates), it is termed an "investigative consumer report." An investigative consumer report contains information relating only to the individual's personal characteristics, reputation, and outwardly-viewed standard of living; it will not encompass information on the individual's credit record.
What Does the FCRA Require of an Employer?
There are four basic steps an employer must perform in order to comply with the FCRA.
Employee Notice and Authorization
First, before ever ordering a background check on an employee or prospective employee (collectively referred to in this article as an "employee"), the employer must notify the employee that the employer might order a consumer report on the employee. The notice must be clear and conspicuous and separate from an application for employment. Moreover, if the employer intends to order an investigative consumer report, a more specialized and stringent disclosure is required. But disclosure is not enough. The employer must also obtain the employee's written consent authorizing the employer to order the background check.
Second, the employer must certify to the consumer reporting agency that the employer:
- Has provided the employee with the necessary notices and disclosures;
- Has obtained the employee's written permission to procure the consumer report; and,
- Intends to use the consumer report for employment purposes (that is, employment decisions on hiring, firing, promoting, reassigning, and retaining employees).
The employer must also certify, in advance, that it will further comply with its obligations under the FCRA in the event that it chooses to take an adverse action against the employee based on information in the consumer report. Only after the employer has made the necessary certifications may the consumer reporting agency issue a consumer report to the employer.
Notice of Proposed Adverse Employment Action
Third, if, after obtaining the consumer report, the employer intends to take an adverse action against the employee based on information in the consumer report, the employer must first notify the employee of the possible adverse action prior to taking such action. The concept of "adverse action" is quite broad and includes any employment-related decision which negatively affects the employee. Common examples of an adverse action include an employer's decision to not hire, to demote, or to terminate an employee, but lesser forms of negative decision-making such as reassignment, temporary suspension, and other disciplinary action may fall within the adverse action concept. The pre-adverse action notice given to an employee, aptly known as the "Summary of Consumer Rights" form, must contain a copy of the employee's consumer report and a summary of the employee's rights under the FCRA.
Notice of Adverse Employment Action
Lastly, only after sending the notice of proposed adverse action is an employer permitted to take the adverse action against the employee. However, if the adverse action is taken on account of information contained in the employee's consumer report, the employer still must provide a second notice to the employee that adverse action was, in fact, taken. In other words, "tell 'em what you're going to do, do it, then tell 'em what you did." The post-adverse action notice to the employee must include the following:
- The consumer reporting agency's name, telephone number, and address;
- A statement that the consumer reporting agency did not make the decision to take the adverse action against the employee and cannot explain the reasons why the adverse action was taken;
- A statement that the employee may obtain a free copy of his or her consumer report from the consumer reporting agency within 60 days; and,
- A statement that the employee may dispute the accuracy and/or completeness of the consumer report with the consumer reporting agency.
Unfortunately, there is no precise indication from the FCRA or the CFPB of exactly how long an employer must wait between notifying the employee of a proposed adverse action, taking the action, and then notifying the employee of the decision to take the adverse action. The FCRA requires a "reasonable" period of time between the steps, but the law does not articulate precisely how many days or weeks constitutes a reasonable period of time.
On the other hand, when the Federal Trade Commission administered the FCRA, it issued an opinion based on the facts of a specific case, concluding that a five-day period in which the pre-action notice, the action, and the post-action notice occurred was reasonable in light of the particular facts involved in that case. However, as we now are all aware, the Federal Trade Commission no longer administers the FCRA; the CFPB is the new enforcer. Whether the CFPB will adhere to a generalized five-day rule is unknown at this time. Nevertheless, employers should, at a minimum, wait a week between sending the pre- and post-adverse action notices.
What Penalties Does an Employer Face for Failing to Comply with the FCRA?
As previously indicated, an employer's failure to comply with the FCRA can result in fines and penalties, as well as civil and criminal lawsuits. When an employer negligently fails to comply with the FCRA, the employer is liable to the employee for any actual damages caused by the employer's negligence, as well as the employee's attorneys' fees. If willful non-compliance is involved, the employer faces punitive damages in addition to any actual damages.
Not only may an employer be liable to the employee, but it also may be liable to the consumer reporting agency! If the employer certifies to the consumer reporting agency that the employer intends to use the consumer report for employment purposes, but instead uses it for an unauthorized purpose, the employer can be held liable to the consumer reporting agency and the employee for any actual damages or $1000, whichever is greater. Furthermore, obtaining the consumer report in such a manner constitutes knowingly and willfully obtaining the report under false pretenses. Pursuant to the FCRA, obtaining information under false pretenses subjects the employer to criminal fines or, worse, imprisonment.
Oftentimes overlooked, the FCRA creates an obstacle course of requirements that employers must navigate. Not unlike other federal laws, the FCRA is a complex piece of legislation imposing potentially grave consequences on employers for non-compliance. Thus, as we enter another new year, all employers should review their processes and procedures and verify, at the very least, that they are using the appropriate forms as revised by the CFPB. If questions arise concerning the various steps required under the FCRA, employers are strongly encouraged to consult with experienced counsel and not try to thread the needle themselves.
© 2023 Ward and Smith, P.A. For further information regarding the issues described above, please contact .
This article is not intended to give, and should not be relied upon for, legal advice in any particular circumstance or fact situation. No action should be taken in reliance upon the information contained in this article without obtaining the advice of an attorney.
We are your established legal network with offices in Asheville, Greenville, New Bern, Raleigh, and Wilmington, NC.