In what could be a portend of broader actions to follow, the Federal Trade Commission (“FTC”) last week has settled a $2.6 million claim against an employment background screening company for perceived violations of the Fair Credit Reporting Act, 15 U.S.C. § 1681s(a) (the “FCRA”). U.S. v. HireRight Solutions, Inc. This is the second-largest civil penalty obtained by the FTC against a private company for violations of the FCRA.
As employers increasingly rely on databrokers and credit reporting agencies to conduct background checks, they must review their background check providers’, as well as their own, policies and practices for legal compliance. Employer use of background report is increasingly under review by state and federal authorities. Employers that have failed to comply with the FCRA’s procedures in obtaining background reports regarding employees have also been sued and faced liability in several lawsuits in the past several years.
As we have previously written, under recently-issued EEOC enforcement guidance, any employer seeking a criminal background check of a potential employee must engage in an individualized assessment of that individual to determine whether a background check is required. Employers also may want to look more closely at the methodologies their screening companies employ, and related representations made in service agreements, to ensure their vendors meet and continue to meet the increasing scrutiny on the screening process.
The FTC alleged that HireRight Solutions, as a data broker, regularly sold consumer information under the FCRA by providing background reports to thousands of employers throughout the United States to assist them in making hiring decisions. Alleging that the background reports, which included criminal background history of certain individuals, were consumer reports under the FCRA, the FTC claimed that HireRight failed to follow reasonable procedures to assure the information furnished was correct. In addition, the FTC alleged in its complaint that HireRight Solutions failed to disclose to consumers, upon request, all the information maintained in their consumer report files, failed to conduct reinvestigations of the accuracy of the information in a consumer's file upon the company's receipt of a notice of dispute from a consumer and failed to maintain strict procedures to ensure that the public record information in the reports was complete and up to date at the time the information was reported.
The FCRA regulates the collection, dissemination, and use of consumer information, including consumer credit information, which is broadly defined under the statute and includes personally identifiable information about background employee data and applicant criminal records. Under the statute, a consumer report is any written, oral, or other communication of any information by a consumer reporting agency that bears on a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used or collected, in whole or in part, for the purpose of serving as a factor in establishing the consumer’s eligibility for among other things, employment. Under the Act, employers that request background reports for potential employees must notify the individuals of their rights under the FCRA and if any adverse action is taken, i.e., a job is not offered, based on information received through a consumer report, the employer must provide to the individual, a copy of the report and a description of the employee's rights under the FCRA.
The FTC's action against HireRight accompanies the agency's announcement in March of this year to increase its enforcement efforts and scrutiny of screening companies and data brokers. In light of the Dodd Frank Act, the FTC now shares FCRA enforcement jurisdiction with the Consumer Financial Protection Bureau. Evidence of the FTC's increased enforcement actions is growing: last week also saw the FTC fine Google $22.5M for what it determined was Google's deceptive trade practices linked to tracking cookies placed in Apple's Safari Internet browser. We expect the FTC to continue its aggressive enforcement efforts. More actions by the FTC are expected in the coming year in light of its announced enforcement efforts.