Companies Still Vulnerable to FCRA Litigation

Submitted to HR Magazine

Over the past 18 to 24 months, several companies have been sued for violating various provisions of the Fair Credit Reporting Act (FCRA). This is the main federal law that governs Consumer Reports, like credit reports and employment background checks.

For purposes of this article, we will focus on employment background check reports.

The FCRA is a federal law, so there’s no “wiggle room” when it comes to compliance. It was designed to promote the accuracy, fairness, and privacy of consumer reporting information. Essentially, its purpose is to protect consumers, who have the right to know what information is in their file, whether information in their report has been used against them, and to dispute anything contained within the report that they believe to be false. A reasonable expectation of privacy is also promised to consumers under the FCRA.

It’s important that companies conducting background investigations on employees or independent contractors stay up-to-date on FCRA compliance.

Pink Screening interviewed more than 1,000 HR, Talent Acquisition and Safety professionals over the past two months to find out if companies have been keeping pace with recent changes to the FCRA, as created by Congress and as inerpreted by the courts, and this is what we found.

Many companies are still using a Disclosure and Authorization form that is not compliant

The FCRA requires employers seeking a background check to provide the applicant or employee with a “clear and conspicuous disclosure” that the prospective employer may obtain a consumer report for employment purposes. The employer’s disclosure must be “in a document that consists solely of the disclosure,” although the law permits the individual’s signed authorization to be included in the document.

Courts have found that including job application-type inquiries or liability waivers or additional state disclosures or any type of certifications are not permitted. Likewise, the federal consumer disclosure form cannot be bundled together with other pre-hire documents.

Yet of the companies we interviewed, nearly two thirds are still violating one or more of these provisions.

Many companies are vulnerable to Section 1681b(f) Violations (Permissible Purpose Claims re: Independent Contractors)

In Smith v. Mutual of Omaha Insurance Company, the plaintiff originally filed a FCRA lawsuit challenging the defendant’s “pre-adverse action” process under 15 U.S.C. § 1681b(b)(3).  Section 1681b(b)(3) generally requires businesses using consumer reports (background checks) “for employment purposes” to provide a copy of the report and summary of rights under the FCRA before taking any adverse action “based in whole or in part” on the report.  The plaintiff claimed that he did not obtain a position as an insurance agent based on his background check, and that the company had failed to comply with these pre-adverse action requirements.  The company defended the claim on summary judgment, however, in part on the threshold issue that the plaintiff was an independent contractor and therefore the prerequisite of “employment purposes” for Section 1681b(b)(3) to apply to the plaintiff was lacking.  After reviewing the evidentiary record, the court ultimately held that the company was right—the position that the plaintiff applied for was an independent contractor position so the “employment purposes” FCRA requirements, including Section 1681b(b)(3), did not apply. 

Although the court’s ruling should have ended the case, there was a catch.  While the company’s summary judgment motion was pending, the plaintiff amended the complaint to add an alternative theory of relief.  The plaintiff now claimed that if it turned out that he was an independent contractor, and if the court agreed that the FCRA’s employment purposes provisions do not apply to independent contractors, then the company had violated a separate FCRA provision, Section 1681b(f).  Section 1681b(f), a rarely-litigated FCRA provision, states:

A person shall not use or obtain a consumer report for any purpose unless—

(1) the consumer report is obtained for a purpose for which the consumer report is authorized to be furnished under this section; and

(2) the purpose is certified in accordance with section 1681e of this title by a prospective user of the report through a general or specific certification.

The FCRA provides a list of “permissible purposes” for a consumer reporting agency (CRA) to prepare consumer reports for businesses.  One of the “permissible purposes” is “employment purposes.”  Often, CRAs will have their clients “certify” to the purpose for which they will obtain consumer reports in the initial service agreement or contract, to comply with this and other similar FCRA requirements. 

The plaintiff alleged in the amended complaint that the company had certified to the CRA that it would obtain consumer reports only for “employment purposes.”  The plaintiff thus claimed that if the company now asserted that his consumer report was not obtained for “employment purposes” via its independent contractor defense, then the company had violated Section 1681b(f) by obtaining a report for some other purpose that it had not certified to and the court held that the plaintiff could proceed to litigate the theory.   

The court noted that there were other additional “permissible purposes” for which the company could have properly obtained plaintiff’s report.  For instance, the company could have been allowed to obtain the report “in accordance with the written instructions” of the plaintiff, which is another enumerated “permissible purpose” for obtaining reports.  But the court noted that the company had obtained the plaintiff’s report for a not-certified-to permissible purpose. 

Because of the potential focus on contract documents signaled by the Smith court, it can be helpful for CRAs and employers to work cooperatively on language consistency for the full array of potentially-relevant screening documents to best ensure defenses.

For example, an agreement between an employer and a background screening company might include the following “Permissible Purpose” language.

Under the FCRA, you are required to identify your permissible purpose for requesting consumer data. You certify to us that your permissible purpose is for Employment Purposes or in accordance with the written instructions of the consumer where a consumer will be screened for tenancy or to work as an independent contractor, or to serve as volunteer or to enroll in an education program.

Many companies are not correctly implementing the legally required Adverse Action process

Many companies have been sued over the past two years for failing to implement the Adverse Action process or failing to correctly follow the legally required steps. It’s a two-step process that employers must follow when potentially denying employment based on the applicant’s background check results.

The process includes sending two notices: a Pre-Adverse notice and a Final Adverse notice.

Both of these notices must also include the FCRA Summary of Rights, a copy of the completed background check report and in some jurisdictions, even local disclosures are required. The Pre-Adverse notice must also notify the applicant that they have the right to dispute the accuracy and they have the right to respond with an explanation of the circumstances and any mitigating factors, and the notices should provide an easy way for the applicant to respond.

Additionally, numerous state and local laws require (and the EEOC strongly encourages) that employers perform what is known as an “Individualized Assessment.” This includes referencing the specific reason that may disqualify the applicant with a brief explanation of why this reason would disqualify them. In New York City and Los Angeles, these cities require that the employer complete and send to the candidate a comprehensive Individualized Assessment form with the Pre-Adverse notice.

Also, as part of the Individualized Assessment, the EEOC says that employers should follow the Green Factors when contemplating Adverse Action. These include considering:

– The nature and gravity of the offense or conduct
– The time that has passed since the offense or conduct and/or completion of the sentence
– The nature of the job held or sought

You must then wait 10 business days before sending the final Adverse Action Notice (federal courts have suggested that waiting five business days is reasonable but many state laws require up to 10 days).

Some background screening systems provide clients with partial access to this process and some background screening systems have fully automated the process, making it geocentric so that it’s fully compliant in all jurisdictions. You should consult your background screening vendor to see how this process works in their system and what steps, if any, you must implement on your own.

Employers should not let down their guard when it comes to FCRA compliance and related lawsuits. Although most class action lawsuits that wind up in the news involve large, recognizable companies, employers of any size are at risk and should frequently review their forms and processes to ensure that they are in compliance.

Staying up to date on the latest FCRA lawsuits can also help avoid litigation. You can track this information online but your best bet would be to consult an experienced employment law attorney and use a trusted consumer reporting agency.