What you need to know:

The Consumer Financial Protection Bureau has released new Fair Credit Reporting Act regulations requiring employers who conduct background checks on employees to update certain FCRA forms by January 1.

What you need to do:

When employers issue “pre-adverse action” notices or plan to obtain “investigative consumer reports” after January 1, they will need to use a new version of the FCRA Summary of Rights form to avoid facing significant liability for damages resulting from non-compliance.

Overview

The Consumer Financial Protection Bureau, which now has primary rulemaking responsibility for the Fair Credit Reporting Act, has released new regulations requiring employers to update certain FCRA-mandated forms by January 1. The changes consist primarily of substituting the CFPB for the Federal Trade Commission as the point of contact for questions regarding consumers’ rights under the FCRA.

In practical terms, this means that starting on January 1, employers must use a new FCRA Summary of Rights form, available here. The new FCRA Summary of Rights form should be enclosed:

  • When issuing a “pre-adverse action” notice before an employer takes any adverse action against an applicant/employee based on information contained in a consumer report; and
  • As part of the required disclosures to an applicant/employee when an employer plans to obtain an “investigative consumer report” relating to that individual.

Employer-Related FCRA Requirements

The FCRA imposes certain requirements on employers that gather and use “consumer reports” to hire, fire, promote, demote or reassign current or prospective employees. Consumer reports are defined broadly in the regulations to include background checks for employment purposes.

The FCRA prescribes the procedures that employers must follow when:

  • Obtaining consumer reports from consumer reporting agencies;
  • Obtaining investigative consumer reports (i.e., more in-depth reference checks) from consumer reporting agencies; and
  • Before taking adverse action against an applicant/employee based on information contained in a consumer report.

Before an employer may obtain a consumer report from a credit reporting agency, it must make a written disclosure of its intent to the applicant/employee. After the written disclosure, the applicant/employee must provide advance written permission for the employer to obtain a consumer report.

There are additional obligations on employers seeking more in-depth investigative consumer reports. Those employers must disclose to the applicant/employee that an investigative consumer report may be obtained from a credit reporting agency. As part of that disclosure, the employer must also inform the applicant/employee of his or her right to request more information regarding the scope of the investigation and must provide him or her with a copy of the FCRA Summary of Rights. In addition to the disclosure obligation to the applicant/employee, an employer must also make a certification to the credit reporting agency that it has, among other things, a permissible purpose for seeking such a report.

If an employer decides to take any adverse action against the applicant/employee based in whole or in part on information contained in a consumer report, the employer must provide two levels of notice to the affected individual. First, before the employer implements the adverse action against the applicant/employee, it must provide a “pre-adverse action” notice to the individual, which must include a copy of the consumer report and the FCRA Summary of Rights. Second, if the employer ultimately takes adverse action against the applicant/employee, it must then provide an “adverse action” notice to the individual.

Why Do These Regulations Matter?

It is important for employers to comply with FCRA regulations because failure to do so may have serious consequences. The FCRA allows individuals to pursue a private right of action against an employer for negligently or willfully failing to comply with any of the FCRA’s requirements. If successful, the individual may be entitled to actual damages and reasonable attorneys’ fees and costs. Employers who are found to have “willfully” violated the FCRA may be liable for actual damages or statutory damages ranging between $100 – $1000, punitive damages and attorneys’ fees and costs.

Next Steps

Before January 1, employers should substitute the new FCRA Summary of Rights for the current one when:

  • Issuing a “pre-adverse action” notice as required when an employer takes any adverse action against an applicant/employee based on information contained in a consumer report; and
  • As part of the required disclosures to an applicant/employee when an employer plans to obtain an “investigative consumer report” relating to that individual.