Navigating the Fair Credit Reporting Act

Employers of all sizes use third-party consumer reporting agencies to conduct background investigations such as credit, criminal, education and employment background checks. Such investigations are labor-intensive, costly and require specialized knowledge (especially if the employer has a multi-state presence). Therefore, a third-party vendor is the natural choice for outsourcing such a task. However, employers should beware that outsourcing the background check process does not automatically insulate the employer from liability when it relies on the information in a report. Using such third party reports places the employer squarely within the myriad of requirements under the Fair Credit Reporting Act ('FCRA'). 15 U.S.C. ' 1681. This article highlights some of the key provisions of the Fair Credit Reporting Act as it applies to a broad range of employers and provides practical insight concerning compliance with the FCRA's requirements.

When the FCRA Applies to Employers

The FCRA is a consumer protection law in that it requires consumer reporting agencies to adopt reasonable procedures to ensure the accuracy and fairness of credit reporting and to prevent identity theft. Many of the provisions focus on consumer reporting agencies such as credit bureaus and background checking agencies and those businesses which use such information when determining whether to extend credit or do business with an individual (lenders, insurance companies, etc.).

So, how does a consumer protection law, which applies mostly to a niche group of consumer reporting agencies and financial institutions, have broad implications for employers in other industries? The FCRA has special provisions for employers who rely on third-party consumer reporting agencies when making employment decisions. Employers who use information gained from third-party vendors in whole or in part as a basis for determining whether to hire, promote or retain an individual are required to comply with disclosure, certification and notification requirements. Willful or negligent noncompliance subjects an employer to civil liability.

Notice Requirements

Prior to conducting the background check, employers must provide the applicant or employee with a clear and conspicuous written disclosure that a report may be obtained for employment purposes. The disclosure must be in a stand-alone document, not buried in an employment application. Next, the employer must obtain a signed authorization from the applicant or employee permitting the employer to obtain a consumer report. The employer must also certify to the consumer reporting agency that it has complied with and will continue to comply with all FCRA requirements.

Once the company receives the background check results, the FCRA basically requires the employer to break the employment decision-making process into two steps. First, if the employer is considering taking adverse action based in whole or in part on the report, then the employer must provide the applicant or employee with a Pre-Adverse Action Disclosure that includes a copy of the background report received, along with a description of consumer rights as summarized by the FTC.

Next, if the employer does make a final decision to take an adverse action based in whole or in part on the consumer report, a written Adverse Action Notice must be provided to the individual regarding the decision along with the following additional information: the name, address and telephone number of the agency that provided the report; a statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide the individual with specific reasons why the adverse action was taken; notification of the consumer's right to obtain a free copy of the consumer report within 60 days from any consumer agency that maintains files on a nationwide basis; and notification for the consumer's right to dispute with the agency the accuracy or completeness of any information in a consumer report furnished by the agency.

Adverse Actions

When making an adverse decision based on information contained in a consumer report, an employer should be very careful. First, the FCRA notification requirements are triggered when the decision is based in whole or in part on the information received in the consumer report. So, if other factors played a part or even if other factors were predominate in reaching the decision, any consideration of the report requires the employer to comply with the Pre-Adverse Action and Adverse Action Disclosures.

Not only do the onerous notification requirements of FCRA apply when an employer takes adverse action, but many states limit the ability to use credit or criminal histories when making employment decisions. Also, employers should remain cognizant of potential state law claims for breach of contract, wrongful termination or defamation. Further, credit response is limited by use of the Bankruptcy Act, which includes a specific provision that prohibits discrimination by private employers against employees who filed for bankruptcy.

Last, an employer should always be certain that the criteria used in making such decisions is job-related. Historically, plaintiffs have been successful with Title VII discrimination claims by arguing that an employer's selection criteria that are not sufficiently job-related and have a disparate impact on protected classes meet the requirements for a discrimination claim. As such, the FCRA requirements may not be the only guides that apply when adverse action is taken ' always check related laws.

Workplace Investigations

When faced with a sexual harassment complaint, whistleblower complaint, or other employee misconduct, employers frequently turn to a third party to conduct the investigation. This makes sense in situations where an outside investigator can provide specialized knowledge; a neutral, fair and objective perspective; and can protect the integrity of the investigation.

However, use of a third party to provide investigative information to an employer would ordinarily bring such activity within the ambit of the FCRA. In 1999, the Federal Trade Commission issued a document known as the 'Vail Letter,' in which the FTC verified that private investigators qualified as 'consumer reporting agencies' under the FCRA, thus triggering the notice and disclosure requirements. Under that guidance, an employer would have to obtain a targeted employee's signed authorization prior to conducting the investigation and would also require a full disclosure of the investigation to be released to the targeted employee if the employer was contemplating adverse action based in whole or in part on the information obtained during the investigation. Employers everywhere decried the impracticality and breach of confidentiality that resulted from compliance with this guidance.

The Fair and Accurate Credit Transactions Act of 2003 ('FACT') amended the FCRA to exempt investigations of suspected employee misconduct from some of FCRA's reporting and disclosure provisions. The amendment, which was effective March 31, 2004, clarified the dilemma and attempts to balance the employer's interests of wanting to conduct fair and complete third-party investigations and ensuring confidentiality with being fair to the targeted employee. Now, under the FCRA, such investigations are exempted from the prior authorization requirements and only a redacted summary of the investigation is required if an adverse action is taken. The summary must contain the nature and substance of the communication upon which the adverse action is based but the sources of information may be redacted for confidentiality purposes.

Supreme Court Gives Guidance On 'Willful' Noncompliance

Recently, the U.S. Supreme Court rendered an opinion affirming a Ninth Circuit Court of Appeals decision which found that 'willful' noncompliance with the FCRA includes reckless disregard. Safeco Ins. Co. of America v. Burr, 2007 WL 1582951 (U.S.). Although the case was a consumer class action against insurers in connection with automobile or homeowner policies, the Supreme Court's decision impacts employers as well.

In the case, the Ninth Circuit addressed issues surrounding what constitutes an adverse action when writing insurance policies, however it also addressed the definition of 'willful' noncompliance under the Act's punitive damages provision. In resolving the issue of what constitutes 'willful' noncompliance, the Supreme Court finally put to rest a circuit split and provided guidance to employers everywhere. The Ninth Circuit had adopted the approach that the act must have been performed 'knowingly and intentionally' but that it need not be the product of 'malice or evil motive.'

In adopting a position that 'willfulness' is 'knowing and intentional' conduct, the Ninth Circuit held that 'perverse incentives' would not be created for companies to 'avoid learning the law's dictates by employing counsel with the deliberate purpose of obtaining opinions that provide creative but unlikely answers to 'issues of first impression.”

The Supreme Court reached the same conclusion, holding that reckless conduct was sufficient to constitute willfulness under the Act. However, the Court concluded that the insurance company's actions did not rise to the level of 'willfulness' in that its interpretation using statutory construction principles was reasonable in the absence of relevant case law. Of particular interest to corporate counsel, both insurance companies argued that good faith reliance on legal advice should render companies immune to claims seeking punitive damages. The Court did not foreclose the possibility of such immunity but opted not to address the issue in light of the fact that a willful violation had not been found.

Accordingly, in-house and outside legal counsel must be sure to provide companies with objective legal direction on compliance with FCRA. A company's reliance, even if in good faith, on advice which is based on novel legal arguments may be found to be willfully noncompliant and subject to punitive damages.

Practical Steps to Assure Compliance

Based on the decision in Safeco, companies are urged to objectively evaluate their compliance with the FCRA. Corporate counsel can begin by looking at the following:

• Check your company's authorization form to ensure it is a separate document, sufficiently detailed with a prominent disclosure.
• Ensure that the Company's HR Department has a mechanism for preventing the usual response letter from being generated when a FCRA-compliant adverse action letter should be generated instead.
• Ensure that the Company is differentiating between the pre-adverse action and the adverse action letters.
• Make offers contingent on the outcome of background checks and only submit the background checks when you are confident you intend to hire the candidate. This ultimately saves the company money and reduces the number of pre-adverse and adverse action letters that must be sent, thus raising less opportunity for claims.
• 'Ensure that investigations conducted by external investigators are properly disclosed to the employee post-investigation.
• If ever in doubt as to the interpretation of a provision, rely on objective legal counsel which is based on solid legal arguments.

Taking these proactive steps will help to assure a standardized process is in place when an employer requests third party reports, and that all facets of the FCRA are being followed.

Mark Blondman and Brooke Iley are partners in the Employment, Benefits and Labor practice at Blank Rome LLP in Washington, DC. Blondman may be reached at [email protected] or 202-772-5800; Iley can be contacted at 202-772-5816 or [email protected]. Associate Patricia Barrett also participated in the drafting of this article.

Employers of all sizes use third-party consumer reporting agencies to conduct background investigations such as credit, criminal, education and employment background checks. Such investigations are labor-intensive, costly and require specialized knowledge (especially if the employer has a multi-state presence). Therefore, a third-party vendor is the natural choice for outsourcing such a task. However, employers should beware that outsourcing the background check process does not automatically insulate the employer from liability when it relies on the information in a report. Using such third party reports places the employer squarely within the myriad of requirements under the Fair Credit Reporting Act ('FCRA'). 15 U.S.C. ' 1681. This article highlights some of the key provisions of the Fair Credit Reporting Act as it applies to a broad range of employers and provides practical insight concerning compliance with the FCRA's requirements.

When the FCRA Applies to Employers

The FCRA is a consumer protection law in that it requires consumer reporting agencies to adopt reasonable procedures to ensure the accuracy and fairness of credit reporting and to prevent identity theft. Many of the provisions focus on consumer reporting agencies such as credit bureaus and background checking agencies and those businesses which use such information when determining whether to extend credit or do business with an individual (lenders, insurance companies, etc.).

So, how does a consumer protection law, which applies mostly to a niche group of consumer reporting agencies and financial institutions, have broad implications for employers in other industries? The FCRA has special provisions for employers who rely on third-party consumer reporting agencies when making employment decisions. Employers who use information gained from third-party vendors in whole or in part as a basis for determining whether to hire, promote or retain an individual are required to comply with disclosure, certification and notification requirements. Willful or negligent noncompliance subjects an employer to civil liability.

Notice Requirements

Prior to conducting the background check, employers must provide the applicant or employee with a clear and conspicuous written disclosure that a report may be obtained for employment purposes. The disclosure must be in a stand-alone document, not buried in an employment application. Next, the employer must obtain a signed authorization from the applicant or employee permitting the employer to obtain a consumer report. The employer must also certify to the consumer reporting agency that it has complied with and will continue to comply with all FCRA requirements.

Once the company receives the background check results, the FCRA basically requires the employer to break the employment decision-making process into two steps. First, if the employer is considering taking adverse action based in whole or in part on the report, then the employer must provide the applicant or employee with a Pre-Adverse Action Disclosure that includes a copy of the background report received, along with a description of consumer rights as summarized by the FTC.

Next, if the employer does make a final decision to take an adverse action based in whole or in part on the consumer report, a written Adverse Action Notice must be provided to the individual regarding the decision along with the following additional information: the name, address and telephone number of the agency that provided the report; a statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide the individual with specific reasons why the adverse action was taken; notification of the consumer's right to obtain a free copy of the consumer report within 60 days from any consumer agency that maintains files on a nationwide basis; and notification for the consumer's right to dispute with the agency the accuracy or completeness of any information in a consumer report furnished by the agency.

Adverse Actions

When making an adverse decision based on information contained in a consumer report, an employer should be very careful. First, the FCRA notification requirements are triggered when the decision is based in whole or in part on the information received in the consumer report. So, if other factors played a part or even if other factors were predominate in reaching the decision, any consideration of the report requires the employer to comply with the Pre-Adverse Action and Adverse Action Disclosures.

Not only do the onerous notification requirements of FCRA apply when an employer takes adverse action, but many states limit the ability to use credit or criminal histories when making employment decisions. Also, employers should remain cognizant of potential state law claims for breach of contract, wrongful termination or defamation. Further, credit response is limited by use of the Bankruptcy Act, which includes a specific provision that prohibits discrimination by private employers against employees who filed for bankruptcy.

Last, an employer should always be certain that the criteria used in making such decisions is job-related. Historically, plaintiffs have been successful with Title VII discrimination claims by arguing that an employer's selection criteria that are not sufficiently job-related and have a disparate impact on protected classes meet the requirements for a discrimination claim. As such, the FCRA requirements may not be the only guides that apply when adverse action is taken ' always check related laws.

Workplace Investigations

When faced with a sexual harassment complaint, whistleblower complaint, or other employee misconduct, employers frequently turn to a third party to conduct the investigation. This makes sense in situations where an outside investigator can provide specialized knowledge; a neutral, fair and objective perspective; and can protect the integrity of the investigation.

However, use of a third party to provide investigative information to an employer would ordinarily bring such activity within the ambit of the FCRA. In 1999, the Federal Trade Commission issued a document known as the 'Vail Letter,' in which the FTC verified that private investigators qualified as 'consumer reporting agencies' under the FCRA, thus triggering the notice and disclosure requirements. Under that guidance, an employer would have to obtain a targeted employee's signed authorization prior to conducting the investigation and would also require a full disclosure of the investigation to be released to the targeted employee if the employer was contemplating adverse action based in whole or in part on the information obtained during the investigation. Employers everywhere decried the impracticality and breach of confidentiality that resulted from compliance with this guidance.

The Fair and Accurate Credit Transactions Act of 2003 ('FACT') amended the FCRA to exempt investigations of suspected employee misconduct from some of FCRA's reporting and disclosure provisions. The amendment, which was effective March 31, 2004, clarified the dilemma and attempts to balance the employer's interests of wanting to conduct fair and complete third-party investigations and ensuring confidentiality with being fair to the targeted employee. Now, under the FCRA, such investigations are exempted from the prior authorization requirements and only a redacted summary of the investigation is required if an adverse action is taken. The summary must contain the nature and substance of the communication upon which the adverse action is based but the sources of information may be redacted for confidentiality purposes.

Supreme Court Gives Guidance On 'Willful' Noncompliance

Recently, the U.S. Supreme Court rendered an opinion affirming a Ninth Circuit Court of Appeals decision which found that 'willful' noncompliance with the FCRA includes reckless disregard. Safeco Ins. Co. of America v. Burr, 2007 WL 1582951 (U.S.). Although the case was a consumer class action against insurers in connection with automobile or homeowner policies, the Supreme Court's decision impacts employers as well.

In the case, the Ninth Circuit addressed issues surrounding what constitutes an adverse action when writing insurance policies, however it also addressed the definition of 'willful' noncompliance under the Act's punitive damages provision. In resolving the issue of what constitutes 'willful' noncompliance, the Supreme Court finally put to rest a circuit split and provided guidance to employers everywhere. The Ninth Circuit had adopted the approach that the act must have been performed 'knowingly and intentionally' but that it need not be the product of 'malice or evil motive.'

In adopting a position that 'willfulness' is 'knowing and intentional' conduct, the Ninth Circuit held that 'perverse incentives' would not be created for companies to 'avoid learning the law's dictates by employing counsel with the deliberate purpose of obtaining opinions that provide creative but unlikely answers to 'issues of first impression.”

The Supreme Court reached the same conclusion, holding that reckless conduct was sufficient to constitute willfulness under the Act. However, the Court concluded that the insurance company's actions did not rise to the level of 'willfulness' in that its interpretation using statutory construction principles was reasonable in the absence of relevant case law. Of particular interest to corporate counsel, both insurance companies argued that good faith reliance on legal advice should render companies immune to claims seeking punitive damages. The Court did not foreclose the possibility of such immunity but opted not to address the issue in light of the fact that a willful violation had not been found.

Accordingly, in-house and outside legal counsel must be sure to provide companies with objective legal direction on compliance with FCRA. A company's reliance, even if in good faith, on advice which is based on novel legal arguments may be found to be willfully noncompliant and subject to punitive damages.

Practical Steps to Assure Compliance

Based on the decision in Safeco, companies are urged to objectively evaluate their compliance with the FCRA. Corporate counsel can begin by looking at the following:

• Check your company's authorization form to ensure it is a separate document, sufficiently detailed with a prominent disclosure.
• Ensure that the Company's HR Department has a mechanism for preventing the usual response letter from being generated when a FCRA-compliant adverse action letter should be generated instead.
• Ensure that the Company is differentiating between the pre-adverse action and the adverse action letters.
• Make offers contingent on the outcome of background checks and only submit the background checks when you are confident you intend to hire the candidate. This ultimately saves the company money and reduces the number of pre-adverse and adverse action letters that must be sent, thus raising less opportunity for claims.
• 'Ensure that investigations conducted by external investigators are properly disclosed to the employee post-investigation.
• If ever in doubt as to the interpretation of a provision, rely on objective legal counsel which is based on solid legal arguments.

Taking these proactive steps will help to assure a standardized process is in place when an employer requests third party reports, and that all facets of the FCRA are being followed.

Mark Blondman and Brooke Iley are partners in the Employment, Benefits and Labor practice at Blank Rome LLP in Washington, DC. Blondman may be reached at [email protected] or 202-772-5800; Iley can be contacted at 202-772-5816 or [email protected]. Associate Patricia Barrett also participated in the drafting of this article.