Fair Credit Reporting Act — A Flashpoint for Litigation and Regulatory Action

By Kristin Casler, featuring Michael O’Neil, Sherri A. Affrunti and Mark D. Temple of Reed Smith LLP.

The Fair Credit Reporting Act is a mine field. It is one of the most dangerous federal regulations for employers. Failure to dot an “i” or cross a “t” when using consumer reports or investigative reports during employee hiring can trigger a consumer class action that results not only in statutory damages and attorneys’ fees, but in punitive damages, even when no actual harm has been suffered. The Equal Employment Opportunity Commission and the plaintiffs’ bar are circling. With penalties for willful violations of $100 to $1,000 per job applicant, fairly quick math will demonstrate why it is imperative for employers of all sizes across all industries to spend the time, energy and resources to ensure FCRA compliance.

Employers Under Unprecedented Attack

In 2011, there were 1,940 FCRA class actions; as of September 30, 2015, 2,446 were filed, according to the National Law Review. Michael O’Neil, a partner at Reed Smith LLP said he receives alerts of new cases filed every day.

However, on Nov. 2, the U.S. Supreme Court heard arguments in Spokeo, Inc. v. Robins, which could change the class action landscape. The Court will decide whether Congress may confer Article III standing on a plaintiff who suffers no concrete harm, and who therefore could not otherwise invoke the jurisdiction of a federal court, by authorizing a private right of action based on a bare violation of a federal statute. The Ninth Circuit U.S. Court of Appeals found that while the plaintiff suffered no actual damages from an online posting of inaccurate wealth information, he satisfied the FCRA’s injury-in-fact requirement.

So, why is a law dating back to the 1970s generating so many new class actions? The statute’s tough-to-meet technical requirements and exponential potential for damages juxtaposed against standardized hiring practices simply make it a perfect storm for the hyper-vigilant plaintiffs’ bar. And, naturally, the litigation’s success has helped it snowball.

“The FTC, banking agencies and even states can enforce the statute, but these are coming from the plaintiffs’ bar,” O’Neil said. “The statute is enormous with a broad range of duties and recoveries. Anybody can sue for violation of any provision, even for a technical violation.”

Many FCRA cases do not involve an egregious violation of the law, O’Neil said. It’s not a defendant who was aware of the law and was just being mean. It’s an employer taking steps to comply with the law and making the wrong interpretation.

Compliance—More Important Than Ever

Many employers are not aware of the intricacies or the risks, O’Neil said. “These requirements are unique to employers. A credit grantor using a report to make a credit decision doesn’t have these requirements.”

Sherri Affrunti of Reed Smith said that employers who want to use consumer and investigative reports need to be aware of the limitations. The FCRA requires employers to follow very specific notice and disclosure procedures when obtaining or using consumer reports or investigative consumer reports from third-party consumer reporting agencies.

Consumer reports may include information related to criminal background checks, credit checks, educational history, employment history, driving and other license records, and information on an applicant’s general reputation or character that is used as a factor when considering eligibility for hire, promotion or other employment actions, including investigations.

Investigative consumer reports are obtained through personal interviews with neighbors, friends, or other people who may have knowledge of the applicant’s character, reputation and lifestyle. Many types of consumer reporting agencies and credit bureaus that mine social media for information fall under these requirements.

Before Obtaining a Consumer Report

Affrunti said that employers wishing to use a consumer report must:

• Notify the employee or applicant in writing that a report may be obtained and used for employment purposes.
• Obtain conspicuous written authorization from the employee or applicant prior to requesting a consumer report.
• File certification of compliance with the Consumer Reporting Agency and acknowledge that you won’t discriminate or misuse the information.
• Note special rules for requesting investigative consumer reports and for using reports during investigations.

Before Taking an Adverse Action

Before taking adverse action based on a report, Affrunti said an employer must:

• Notify the applicant or employee about the results.
• Provide a copy of the report.
• Allow a reasonable opportunity to notify the employer of inaccuracies or dispute the results.

The statutory timeframe is not specific and is often assumed to be five days. However, Affrunti said the time granted for review must be reasonable given the specific circumstances, such as in the instance of an intervening holiday. This point is a source of much litigation.

O’Neil said that an employer notified of, say, a felony conviction, can’t just refuse to hire the applicant. The employer must give the applicant time to respond.

After Taking an Adverse Action

If the employer takes adverse action, Affrunti said it must:

• Provide notice in writing that the action was taken as a result of the consumer report, including details of the report, who it came from, and the applicant’s rights.
• Include a statement that the consumer reporting agency did not make the adverse action decision and cannot provide information as to the reasons for the adverse action.
• Inform the employee or applicant of his or her rights under the FCRA, including the right to dispute the accuracy or completeness of the report and the right to obtain a free copy of the report from the consumer reporting agency, if requested, within 60 days.

Restrictions to Consider

The EEOC has warned employers that employment decisions based on criminal history reports may have a disparate impact on minorities and thus constitute discrimination, noted Mark Temple of Reed Smith. The EEOC has taken unprecedented action against employers on these grounds, citing its prior actions and unspecified case law to support its argument, Temple said.

The EEOC advises employers to:

• Eliminate blanket policies and conduct individualized assessments.
• Ensure accuracy of criminal records obtained.
• Provide the individual with notice of possible denial/exclusion and an opportunity to provide additional information regarding the arrest or conviction.
• Ensure that denial/exclusion based on criminal history is sufficiently job-related and consistent with business necessity, including the duties and nature of the job, nature and gravity of the offense committed and the time that has passed since the offense and/or completion of the jail sentence.

Temple suggested employers track existing and pending state credit-check laws. Many have or have proposed “ban the box” laws that control when or if credit checks or criminal histories can be obtained or used for employment purposes.

FCRA and Social Media

Social media is another source of public information about employees, and the FCRA is regularly being applied to it, too. Temple said social media can provide a wealth of information, especially since people don’t think about how posts will impact their hiring or promotion. Employers wonder why they can’t take into consideration of that public information. Data mining companies are going even deeper into online activity. Temple said the FTC is warning such data brokers that it falls under the FCRA. One social media company was fined $800,000 for failing to comply, he said.

According to the FTC, a data collection agency “is a consumer reporting agency because it assembles or evaluates consumer report information that is furnished to third parties that use such information as a factor in establishing a consumer’s eligibility for employment.”

Types of FCRA Employment-Screening Claims

What is tripping up employers? O’Neil said information vendors and employers are seeing a lot of claims related to the disclosure form and the applicant’s consent form.

Stand-Alone Requirement for Disclosure/Consent Form (§1681b(b)(2)). What was once a formatting requirement is now being interpreted by the courts as a prohibition on extraneous language, O’Neil said. The form has to be by itself; it can’t be buried in a pile of papers. The applicant must be fully aware that the employer is pulling a report on them. Dozens of class action lawsuits have been filed against employers challenging the content of disclosure forms. You also can’t have extraneous language that doesn’t relate to the disclosure or consent. Even a release of liability or a statement that state law requires the disclosure are being deemed violations of the law.

“This demonstrates the challenges our clients have in complying with federal, state and now even municipal requirements,” O’Neil said.

In 2007, the U.S. Supreme Court in Safeco Insurance v. Burr lowered the standard for “willfulness” to “recklessness.” At issue in Safeco was whether the defendant's erroneous interpretation of the FCRA was “objectively unreasonable” and therefore supported a “willfulness” finding. Under the Safeco analysis, willfulness claims have been bolstered by recent court decisions on the stand-alone disclosure requirement and inclusion of waiver language, O’Neil said.

In a 2013 Western District of Pennsylvania decision (Reardon v. Closet-Maid) inclusion of a waiver in the disclosure was deemed a willful violation as a matter of law.

Other claims based on disclosure/consent forms include:

• Inclusion of form in employment application
• Inclusion of additional authorizations in form
• Inclusion of state-mandated notices in form

Other class action claims include:

• Pre-adverse action notice
• Content requirements
• Impact of scoring/adjudication by a data vendor
• Allowance for applicant to dispute before decision made

Best Practices to Minimize Risk

So, what do companies really need to be doing? Temple said it’s fairly common sense:

• Develop a policy or procedure showing you have looked at the statue and that you are making the best effort to comply throughout the process. Create a timeline or roadmap that makes it very, very easy for those involved in the employment process.
• Assure appropriate signed and dated authorizations are obtained before requesting a consumer report, confirming authorization to conduct the background check.
• Look at your notice and authorization forms – do they comply with the statute and with decisions and FCRA class claims being raised?
• Train your human resources people. Someone there needs to know what the rules are, what they need to do and what to do if questioned.

Affrunti cautioned not to apply a blanket disqualification policy for applicants. Develop standards, review your job descriptions, and determine if there are job-related reasons to disqualify. “A credit check is not as important for a janitor as for your CFO,” Affrunti said. “Apply your disqualification rule consistently so you don’t disqualify one ethnic group and not another with the same offenses in their background. Make individualized assessments and document them and the rationale applied in case you need to defend your decision.”

You also should be aware of and adhere to state laws. Engage reputable, FCRA-knowledgeable third-party vendors when seeking consumer reports, particularly those involving social media mining.

Be sure to regularly audit your process and comply with changing rules.

“If you have written procedures that comply with the statute, and you make an effort to train employees, and an incident occurred notwithstanding your efforts, you have a good argument that you are not in willful violation but may be in negligent violation,” O’Neil said.

Affrunti added that you should not do background checks too early in the hiring process. The FCRA makes no specific prohibition, but some state laws do dictate when in the process you obtain a report. Thus, you should be cautious in obtaining it before a conditional offer of employment, and you should not put new hires to work until the background check comes in.

“You undercut your own arguments about consistent application and adhering to your policies,” Affrunti said. “You may introduce inadvertently that the background checks aren’t that important.”

This article is based in part on a 2014 Reed Smith teleseminar, A Worsening FCRA Environment: The Screws Tighten on Employers.