The Fair Credit Reporting Act

"User" certifications

regarding consumer

consent and disclosure

"Furnisher"

( e.g. , former

employer)

The Fair Credit Reporting Act (FCRA) is the broad Federal law that regulates how consumer reporting agencies provide information about consumer credit.As many employers know, however, FCRA also governs how employers secure and use certain important background information on applicants and employees for "employment purposes."In 2003, FCRA was amended by the Fair and Accurate Credit Transactions Act (FACTA) to add provisions dealing with identity theft and investigations of employees.¹ As a result of these amendments, the Federal Trade Commission, which administers FCRA, has issued four new FCRA notice forms, which became effective on January 31, 2005.²

This article provides background for employers on FCRA issues and highlights the changes in the "User Notice" and "Summary of Rights" that come into play when employers conduct background checks or investigations.

The General FCRARegulatory Scheme

FCRA has its own special terms and technical consent and disclosure procedures, all of which revolve around the relationships reflected in the diagram at the bottom of this article:the employer is the "user" of a "consumer report" or "investigative consumer report" ("ICR") that is provided by the "consumer reporting agency"(the "CRA") and which provides information on the "consumer" (the applicant or employee).A former employer can also be a "furnisher" of information that is collected by a CRA and which is included in a consumer report or ICR and provided to a prospective employer.

Applicants

An employer who accesses a consumer report while conducting a background check on an applicant has two main obligations under FCRA at the outset: (1) to comply with disclosure requirements and inform the applicant (the "consumer") in a separate document that a consumer report may be secured for employment purposes; and (2) to secure authorization in writing from the applicant to procure the consumer report.First, FCRA requires disclosure and consent from the "consumer" as a condition to procuring a consumer report for "employment purposes.""Employment purposes" are defined broadly under FCRA as any use of a consumer report "for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee."Second, the employer must certify to the CRA that it has satisfied these disclosure and consent requirements as a condition to securing the consumer report.

An employer who wants to use an ICR faces additional hurdles, because the ICR - which contains information culled from "personal interviews with neighbors, friends, or associates of the consumer" - is viewed as a more intrusive inquiry.An employer seeking an ICR similarly must disclose to the applicant that the ICR may be obtained, and generally will secure written authorization to acquire the ICR (since it may be included in a consumer report).Furthermore, an employer requesting an ICR must inform the employee or applicant that he/she has a right to request additional disclosures of the nature and scope of the investigation, and provide the current or prospective employee with a summary of consumer rights.The employer must certify to the CRA that it has made the proper disclosures to the employee or applicant prior to receiving the ICR.

If the employer decides to reject the applicant (an "adverse action" in FCRA parlance) based in whole or in part on a consumer report or ICR, the employer has another obligation: to satisfy FCRA, the employer must provide the applicant with a copy of the report and the Summary of Rights before taking such action. After taking adverse action, the employer must also provide notice to the consumer of the adverse action, provide the name, address, and telephone number of the CRA that furnished the consumer report on which the adverse action was based and notify the consumer of the right to obtain the CRA's report.The CRA has its own independent obligation to provide the "user" with the Summary of Rights along with the consumer report (as made clear in the User Notice).

Employees

In the case of employees, FCRA may come into play during an investigation of suspected misconduct or compliance with applicable law.As a result of employer opposition when the FTC interpreted FCRA to apply to internal investigations by employers, the FACTA amendments were promulgated to exempt employer investigations of alleged employee misconduct from the notice and disclosure mandate of FCRA. Under the FACTA amendments, a "consumer report" does not include communications made to an employer while investigating suspected employee misconduct relating to employment or employee compliance with applicable laws or with "preexisting written policies of the employer."By excluding these investigatory communications from the definition of "consumer report," FACTA eliminated the applicability of the general advance notice and consent requirements of FCRA - so the employee-target of the investigation could not effectively sabotage the investigation.Under FACTA, however, after an employer takes an adverse action against an employee based on these investigatory communications, the employer must still provide the employee with a "summary containing the nature and substance of the communication upon which the adverse action is based É."

The Revised Summary Of Rights And User Notice

On November 30, 2004, the FTC published as final rules in the Federal Register the new model notices prescribed by FACTA.The new notices went into effect on January 31, 2005.

As discussed above, applicants receive a Summary of Rights from the employer if the employer takes adverse action based on a consumer report or the employer undertakes an ICR.The employer also receives a User Notice from the CRA.

The revisions to the forms contain the following material modifications:

• The Summary of Rights states that advance written consent by an applicant may not be required in the trucking industry (there is an exception for oral or electronic consent in the trucking industry, where the only interaction with the applicant is by mail, telephone or computer).

• The User Notice has a new section "Special Procedures for Employee Investigations" expressly stating that covered investigations of "suspected misconduct" by employees, or "for compliance" by employees with applicable laws or the written policies of the employer are not treated as consumer reports, so long as certain conditions are met.

• When consumers have placed a fraud alert (identity theft alert) or military alert with a CRA, the User Notice provides that "users" must have reasonable policies in place to confirm the identity of the consumer (as a check against identity theft).

• The Summary of Rights adds a new disclosure regarding the consumer's right to access credit scores.

• The Summary of Rights has expanded information on consumer access to files maintained by the CRA and free file disclosure in the event of adverse action or identity theft.

¹The FACTA amendments provide new identity theft rights to consumers, including the right to place fraud or military duty alerts on their credit reports, to block business and credit bureaus from reporting information in their credit files that results from identity theft, and to obtain information from businesses about accounts or transactions in their name that result from identity theft. An identity theft rights summary is provided to consumers directly by CRAs that receive reports of suspected fraud or identity theft from consumers. The FTC FCRA website is at www.ftc.gov/credit.

²The new forms are: a summary of rights for victims of identity theft; a general summary of consumer rights; a notice of the duties of entities that furnish information to consumer reporting agencies; and a notice of the duties of users of information obtained from consumer reporting agencies.