First Published in Law360.

In recent years, members of the defense bar and human resources community speculated that private class litigation over criminal background checks in the hiring process had run its course or was facing an inevitable sunset. That prediction turned out to be wholly inaccurate.

Many assumed that the U.S. Supreme Court's 2016 landmark ruling in Spokeo Inc. v. Robins,1 which restricted a plaintiff's standing to bring Fair Credit Reporting Act claims in federal court, would put the FCRA litigation machine out of business. It has not.

Others reasoned that there was a limited number of large attractive employer targets for litigants to pursue under these theories, and that they were quickly bringing their processes into compliance to avoid exposure. In fact, the plaintiffs bar is not so selective, and filing these claims has become formulaic and low-cost, high-volume, and profitable.

Perhaps the most frequent misconception has been that, once an employer is sued in a FCRA class action, and survives or settles it, it will not be sued again. Too many Fortune 500 employers have been surprised to learn this is not the case.

The Nature of the Claims and Extent of Exposure

The FCRA governs the delivery and use of criminal background reports in the hiring process by employers and the vendors that furnish these reports. A large number of the increased filings are against such credit reporting agencies for alleged violation of their own obligations under the FCRA.

The most frequent claims against employers involve the alleged failure to provide adequate notice to an applicant that a background check will be run, and the alleged failure to provide additional notices in advance of making an adverse action decision, such as denial of a job offer, based on the report.

Damages for a class claim generally include a range of $100 to $1,000 per violation, per class member, plus attorney fees and potential punitive damages.

A recent survey of nearly 150 FCRA class action lawsuits2 showed that defendant employers have paid more than $150 million in the last 10 years3 to settle litigation claims for alleged FCRA violations. In the last few years alone, to settle FCRA class actions:

  • Performance Food Group Co. paid $1.9 million;4
  • Petco Animal Supplies Inc. paid $1.2 million; 5
  • 7-Eleven Inc. paid $1.9 million; 6
  • Delta Air Lines Inc. paid $2.3 million; 7
  • A subsidiary of PepsiCo Inc. paid $1.2 million; 8
  • Costco Wholesale Corp. paid $2.5 million; 9 and
  • Frito-Lay Inc. paid $2.4 million; 10

Why Is FCRA Litigation Accelerating?

FCRA-related lawsuits hit well over 4,00011 in 2019. This compares to 2,500 in 2014. Even with the global pandemic caused by COVID-19, 2020 shows no signs of slowing the trend of increased FCRA-related litigation year to year.

As of June, 12 plaintiffs filed more than 2,500 FCRA-related claims13 -- putting 2020 on pace to see the most FCRA-related lawsuits ever.

Defense attorneys who focus on litigating FCRA class actions will make the following observations about the reasons for acceleration.

Rapid Hiring

Prior to the pandemic onset in March, the U.S. economy was hiring at record pace, still replacing the workforce that had been trimmed after the 2008 financial crisis, and barreling further toward record-low unemployment rates. This period of high-volume, rapid hiring and the background checks that accompanied it, created new opportunities for errors in FCRA compliance.

This rapid hiring effort created hundreds of thousands of new potential representative plaintiffs, and presented large classes of applicants that could win large damages verdicts. As hiring accelerated, more and more FCRA claim opportunities emerged.

Smaller Firms Are Joining the Landscape

Substantially more plaintiffs class action firms have joined the hunt for FCRA plaintiffs in recent years, and have automated the high-volume filing of identical pleadings from case to case. FCRA litigation is no longer the exclusive purview of a handful of national practice firms that pioneered it more than a dozen years ago. Smaller plaintiffs law firms are particularly effective in mining new plaintiff representation through their deep local relationships and single-market focus.

Compliance Challenges

It is true that many employers responded to the wave of FCRA litigation by auditing their process and bringing it into compliance. But it is surprisingly easy for a compliant background check program to drift into actual or perceived noncompliance despite the employer's best efforts.

Especially for large national employers with higher turnover, full FCRA compliance is highly difficult to police when so many departments are involved, are vulnerable to human error and suffer their own internal turnover.

The key stakeholders in the process -- compliance officers, in-house attorneys, information technology personnel, recruiting personnel and the background check vendor -- also occasionally assume the process is proceeding as intended, when in fact minor adjustments or process deviations have taken hold over time. This creates opportunity for new vulnerabilities in compliance to occur, even where there was once a full and intentional "fix."

State Court Filings

The Spokeo decision limited a plaintiff's ability to maintain certain FCRA claims in federal court, but it had little impact on the ability to proceed in state courts or in arbitration. Since Spokeo, class action plaintiffs lawyers more frequently file initially in state courts (where many would prefer to litigate) to avoid the more demanding federal standing requirements.

Some New FCRA Litigation Trends and Defenses

While the framework of the two core claims against employers, inadequate disclosure and lack of preadverse action notice, remains the same, several new trends, arguments and defenses have emerged in the past three years.

Double Dipping

Plaintiffs seek to double dip in FCRA damages by pleading two separate causes of action for a single violation. Specifically, plaintiffs will assert that an inadequate disclosure (claim 1) renders invalid an applicant's written authorization to conduct the background check (claim 2).

In fact, there is no express recognition within the FCRA that these comprise two separate causes of action that lead to separate statutory damages. They should be treated as two parts of a single violation. This attempt to bifurcate a single cause of action should be the subject of express defenses and early motion practice to strike or dismiss the duplicative cause of action and/or damages claim.

Summary of Rights Claims

Similarly, plaintiffs will assert that an employer's failure to send applicants a copy of the summary of rights under the FCRA along with their preadverse action notice, is an independent violation of the act. At least for matters pending in federal court, there is emerging law suggesting that a plaintiff does not have standing to make such an assertion where he or she subsequently learned what his or her rights are under the FCRA.14

Willfullness

A plaintiff must establish that an employer's noncompliance with the FCRA was willful in order to recover the more attractive statutory range of damages -- as opposed to actual. Willfulness is also required to support a claim for punitive damages.

The evidence needed to establish willfulness under the FCRA continues to evolve inconsistently across courts and federal circuits.15 Understanding how to defeat a claim of willfulness in a given case may factor into decisions about challenging personal jurisdiction or venue.

Compliance Certification

An increasing number of FCRA lawsuits are being filed asserting merely that a consumer reporting agency vendor failed to obtain a certification of compliance from the employer, verifying that the background check would be only for lawful purposes. Obtaining this certification is mandated by Section 1681e of the FCRA.16

These claims may only be asserted against the vendor, but the employer that failed to deliver the certificate necessarily plays a part in the litigation, creating distraction and cost. More importantly, plaintiffs in such a case may seek discovery regarding that employer's broader process of compliance with the FCRA, which might expose that employer to a direct claim for its own noncompliance.

Investigative Consumer Reports

Plaintiffs have begun filing suits alleging that including language regarding "investigative consumer reports" in a regular consumer report disclosure violates the FCRA's stand-alone requirement for consumer report disclosures.

In March, in Walker v. Fred Meyer Inc., the U.S. Court of Appeals for the Ninth Circuit held that a consumer report disclosure form could include, without violating the FCRA, information about investigative reports, so long as "the information about investigative reports is limited to disclosing that such reports may be obtained for employment purposes, and providing a very brief description of what that means."

However, including a description of how to obtain the investigation files forming the basis for the investigative report, would violate the stand-alone requirement and should be included in a separate document.17

Novel Claims

Plaintiffs continue to advance novel claims under the FCRA, seeking to broaden its protections beyond the explicit statutory language. This increasingly occurs in the Ninth Circuit.

In one recent case from April, Luna v. Hansen and Adkins Auto Transport Inc., the plaintiff asserted that a prospective employer violated the FCRA by failing to provide the consumer report authorization on a stand-alone document.18 The Ninth Circuit summarily rejected this claim, pointing to the clear text of the statute, which only mandates that the consumer report disclosure be on a stand-alone document.19

In the Walker v. Fred Meyer case in March, the plaintiff alleged that the right to dispute information contained in a consumer report also encompasses the right to discuss the report with a current or prospective employer before adverse action is taken.20 Again, the Ninth Circuit rejected this novel argument, holding that the FCRA only requires notice of an opportunity to dispute the consumer report with the consumer reporting agency, not the employer directly.21

Avoid Becoming a Target

Employers can insulate themselves from FCRA exposure by taking merely two important steps, and by revisiting them regularly with the correct personnel at the table.

Routinely audit and update FCRA forms and process.

The core of the FCRA claims against employers continues to be that an initial disclosure form is inadequate -- it must be conspicuous and simple in a stand-alone page, without extraneous information -- or that an adverse action was taken against an applicant without sending an earlier notice to the applicant and allowing time to correct the record. In addition to the content of the forms, the process by which these notices are issued and decisions are made affect the holistic compliance requirement.

Employers must recognize that, given the multiple phases of the process, the frequent use of automation and online portals, and the numerous parties involved in the process, something will fall out of compliance eventually.

An automobile owner does not maintain his or her car once and then leave it unchecked for several years. There is too much going on under the hood, and parts and features need refreshing and alignment on a routine basis.

The complex operation of background check processes is no different. It should be reviewed frequently with all stakeholders at the table, and ideally with the assistance of FCRA litigators who best understand how minor drifting creates openings for class actions.

Examine your relationship with your background check vendor.

A high percentage of FCRA claims are spawned because an employer does not examine and question the mutual obligations under its contract with its consumer reporting agency vendor. The scope of responsibility of both parties must be clear and fully communicated to the employer's background check team.

Employers should resist purchasing fully off-the-shelf or turnkey services from a vendor. Relying on the expertise of a vendor is usually not a defense for employers who are pursued for FCRA violations, and the employer must know where the vendor's legal obligations end and the employer's begins.

Make certain that your paperwork includes the delivery of a compliance certification as discussed above. Finally, negotiate for reasonable indemnification obligations from the vendor in the event a claim is filed. Consumer reporting agencies have been narrowing their indemnity obligations in their form contracts in recent years, and employers should negotiate for more protection.

Conclusion

FCRA class litigation will accelerate as we enter 2021. It has attracted an increasing number of plaintiffs firms, and new theories of liability under the act are appearing regularly.

Employers can avoid being swept into this current by making their compliance transparent and uncomplicated, and by routinely reviewing their processes to ferret out occasional process glitches that may attract claims