High-profile enforcement actions by the Federal Trade Commission (FTC) have increased overall employer awareness of the employer-specific requirements of the Fair Credit Reporting Act (FCRA) and corresponding state laws. Before January 1, 2013, employers should use the new FCRA notices for their background check programs, which reflect modest changes to the mandatory agency-drafted FCRA summary of rights form (the "FCRA Summary of Rights"). The FCRA Summary of Rights form must be included: (1) as an enclosure with the first of the two "adverse action" notices – the "pre-adverse action" notice; and (2) with the disclosures for "investigative consumer reports" (i.e., consumer reports based on personal interviews conducted by a consumer reporting agency (CRA), such as in-depth reference checks). The updates reflect the transfer of much of the responsibility for interpreting the FCRA from the FTC to the newly created Consumer Financial Protection Bureau (CFPB).1
The CFPB, which now has the primary rulemaking responsibility for the FCRA, recently issued regulations requiring the updates that replace the contact information for the FTC in the FCRA Summary of Rights with the contact information for the CFPB.2 The new FCRA Summary of Rights is available here. Below is a brief reminder for employers about the FCRA's employment-related provisions and the remedies available to applicants and employees if an employer fails to follow the FCRA's requirements.
Summary of the FCRA's Employment-Related Provisions
The FCRA imposes distinct requirements on employers that obtain "consumer reports" (background reports) from CRAs. Before an employer may obtain a consumer report from a CRA, typically the employer must make a "clear and conspicuous" written disclosure to the consumer, in a document that consists "solely" of the disclosure, that a consumer report may be obtained.3 The applicant or employee must provide advance written permission for the employer to obtain a consumer report for "employment purposes."4 (Investigations into suspected misconduct related to employment are subject to certain relaxed FCRA rules.5)
The FCRA imposes additional disclosure obligations on employers that obtain investigative consumer reports.6 Employers must disclose to the applicant or employee that an investigative consumer report may be obtained from a CRA. The disclosure must include a statement informing the applicant or employee of his or her right to request additional disclosures of the "nature and scope" of the investigation, as well as the FCRA Summary of Rights.
The employer also must certify to the CRA that it has a "permissible purpose" for procuring a report from the CRA.7 The employer must certify to the CRA that it: (1) has provided the required disclosures to the applicant or employee; (2) has obtained the requisite written authorization from the applicant or employee; (3) will not use the information contained in the report in violation of any federal or state equal opportunity law or regulation; and (4) will, if any "adverse action" is to be taken based on the consumer report, provide the applicant or employee with a copy of the consumer report and the FCRA Summary of Rights.8
If the employer takes any adverse action against the applicant or employee based in whole or even in part on information contained in the report, the employer typically must follow a two-step notification process. First, before the employer implements the adverse action against the applicant or employee, it must provide a "pre-adverse action" notice to the individual, which must include a copy of the consumer report and the FCRA Summary of Rights.9 If after waiting the required time the employer is prepared to take the adverse action against the applicant or employee, it must then provide an "adverse action" notice to the individual (which includes the information required by the statute itself, such as the contact information for the CRA).10
The FCRA also requires employers to ensure the proper destruction of consumer reports.11
Summary of FCRA Remedies
The FCRA allows an applicant or an employee to pursue a private right of action against an employer for "negligently" or "willfully" failing to comply with any of the FCRA's requirements with respect to that individual. The statute of limitations for violations of the FCRA requires that an action must be brought by the earlier of: (1) two years after the date of discovery by the plaintiff of the violation; or (2) five years after the date on which the violation that is the basis of the alleged liability occurred.12 The range of available damages varies for negligent and willful violations. An employer that negligently fails to comply with any requirement of the FCRA with respect to an applicant or employee is liable for: (1) actual damages sustained by that individual; and (2) reasonable attorneys' fees and costs.13 The FCRA also sets forth remedies for willful violations of the statute. There are three different types of damages available for a willful violation: (1) actual damages or statutory damages ranging between $100 and $1000; (2) punitive damages; and (3) attorneys' fees and costs.14
Before January 1, 2013, employers should substitute the new FCRA Summary of Rights for the one currently being used when they: (1) enclose the form with the "pre-adverse action" notice; and (2) provide the form with required disclosures for investigative consumer reports. Because of the intensive focus on background check programs by the Equal Employment Opportunity Commission (EEOC)15 and the wave of new state laws (e.g., the new laws in Vermont16 and Indiana17), it is also an opportune time for employers to consider thoroughly assessing their credit and criminal record-based screening policies and procedures for opportunities to fortify compliance with all applicable laws.