On May 30, 2019, the Second Circuit issued its decision in Kidd v. Thomson Reuters Corporation, affirming the district court’s order granting summary judgment in favor of Thomson Reuters and defining what is required to qualify as a “consumer reporting agency” (“CRA”) covered by the Fair Credit Reporting Agency, 15 U.S.C. § 1681, et seq. (“FCRA”).
Plaintiff Lindsey Kidd (“Kidd”) applied for a job with the Georgia Department of Public Health (“GaDPH”). The GaDPH obtained a National Comprehensive Report through Thomson Reuters’ “Consolidated Lead Evaluation and Reporting” (“CLEAR”) online research platform. The report returned to GaDPH included a criminal conviction. GaDPH advised Kidd that there was a problem with her job application because of that conviction.
CLEAR “provides subscribers with access to proprietary and public records information for investigative purposes.” Thomson Reuters explicitly prohibits the sale and use of CLEAR for any purpose regulated by the FCRA through various means:
- Employee training
- Mandatory employee reporting
- Marketing materials
- Contractual requirements
- Mandatory customer certifications
- Customer vetting
- Remedial actions
Kidd later filed this putative class action against Thomson Reuters alleging multiple violations of the FCRA. The parties agreed to bifurcate the case, with a first phase limited to discovery on the threshold issues of whether Thomson Reuters is a CRA and whether CLEAR reports are “consumer reports” as defined by the FCRA. Thomson Reuters then moved for summary judgment on those two issues.
District Court Grants Thomson Reuters’ Motion for Summary Judgment
The United States District Court for the Southern District of New York held “that whether Thomson Reuters qualifies as a CRA turns in the first instance on whether its subjective purpose in assembling information concerning consumers is to furnish consumer reports to third parties.” In reaching this conclusion, the Court relied on the plain language of the statute, which “applies only to a person or entity that regularly assembles consumer information with a particular purpose or subjective intention – namely, of providing it to third parties for use (actual or expected) in connection with an FCRA-regulated end, such as employment eligibility.”
The Court rejected Kidd’s interpretation that an entity’s subjective intent is irrelevant to the question of whether it is a CRA under the FCRA: “Kidd’s construction would subject entities to coverage under the statute based solely on the intention of isolated users, thereby reading the phrase ‘for the purpose of’ out of the statute.” The Court relied on and quoted the FTC’s 40 Year Report in support of its holding: “If the entity supplying the report has taken reasonable steps to insure that the report is not used for [an FCRA-regulated] purpose, and if it neither knows of, nor can reasonably anticipate such use, the report should not be deemed a consumer report by virtue of uses beyond the entity’s control.” The Court noted however that an entity cannot “avoid being treated as a CRA merely by declaring that its purpose is not to provide the information for FCRA-regulated purposes. Put another way, disclaimers alone are not enough for an entity that otherwise qualifies as a CRA to avoid the reach of the statute.”
Here, Thomson Reuters took “affirmative steps – through both words and actions – at every stage of the customer acquisition, application, contracting, and support processes to ensure that subscribers are not using CLEAR for FCRA-regulated purposes.” The court also found that the 46 instances of suspected subscriber misuse admitted by Thomson Reuters “is miniscule when compared to the number of CLEAR subscribers (more than 80,000) and searches (more than 100,000 per day),” and thus does not establish that Thomson Reuters “regularly” assembles information for purposes of being a CRA. Plus, in every instance of suspected misuse, Thomson Reuters investigated the incident and took some form of remedial action.
Kidd appealed the decision to the Second Circuit.
Second Circuit Decision Affirms District Court’s Decision
The Second Circuit affirmed the district court’s order. The appellate court considered the specific question of “[w]hether, to qualify as a ‘consumer reporting agency’ under the FCRA, an entity must specifically intend to furnish a ‘consumer report.’” The Court held “that it must have such an intent.” The Court’s opinion, like the District Court, began with an analysis of the definition of a CRA under the FCRA. That definition requires a CRA to assemble or evaluate information on consumers “for the purpose of furnishing consumer reports.” “The ordinary meaning of ‘purpose’ corresponds loosely with the common-law concept of specific intent.” “The meaning of ‘for the purpose of’ in § 1681a(f) is therefore plain: A ‘consumer reporting agency’ is an entity that intends the information it furnishes to constitute a ‘consumer report.’”
To determine an entity’s intent, the Court must consider “the totality of a defendant’s actions.” A defendant cannot merely disclaim the requisite intent. Here, the Second Circuit agreed with the district court “that because it is undisputed that Thomson Reuters took numerous – and effective – measures to prevent CLEAR reports from being utilized as ‘consumer reports,’ no reasonable juror could conclude that Thomson Reuters intended to furnish such reports, and therefore it is not a ‘consumer reporting agency’ under the FCRA.”
Many companies collect and use individual data with the vast majority wanting to avoid coming within the FCRA’s definition of a “consumer reporting agency.” The Second Circuit decision lays an important defense framework for these and other companies desiring to conduct their business to avoid unintentionally becoming a CRA. Such entities should consider employing the same means employed by Thomson Reuters to bolster their defense that they have no intent to furnish consumer reports. Likewise, other companies should look to exploring whether the subjective intent analysis applied to the definition of consumer report might be applicable as to other FCRA definitions that impose specific requirements, such as who might be considered the “user” of a consumer report.