A Look Back And Ahead At Background Reports Under FCRA
Publication
1.10.19
In what is becoming an annual warning, lawsuits under the Fair Credit Reporting Act are again on the rise. Whether brought against consumer reporting agencies for reporting inaccurate or outdated information or employers for failing to satisfy disclosure and notice requirements, FCRA litigation increased by 4 percent from 2017.[1]
Given the outcome of several high-profile FCRA cases, further increases can be expected in 2019. Indeed, FCRA claims are frequently brought on a class basis resulting in multimillion-dollar settlements, often for purely procedural violations stemming from the law’s highly technical requirements. In 2018, Uber resolved an FCRA class action for $7.5 million for purportedly conducting background checks without obtaining proper notice and authorization,[2] while Amazon resolved an FCRA class action for $5 million due to its alleged failure to provide a “stand-alone” disclosure and authorization to conduct background reports.[3]
As the rise in FCRA litigation continues, we look at some of the familiar trends these cases follow, as well as some recent developments.
The FCRA In Employment
The FCRA was enacted to promote the accuracy, fairness and privacy of information maintained by consumer reporting agencies while also satisfying the important need for consumer reports. An employer triggers FCRA obligations when it requests a “consumer report” on an applicant or employee, a term which includes a broad category of reports such as driving records, criminal records, credit reports and many other reports procured from a third-party, consumer reporting agency such as a credit reporting company, a record-checking company or an investigative firm.[4]
Before requesting the report, the employer must issue a stand-alone document to the applicant or employee disclosing its intent to procure the report for employment purposes and obtain the applicant’s or employee’s signed authorization.[5] If the report contains information that the employer may use as a basis for taking adverse action — for example, not hiring an applicant or terminating a current employee — the employer must give the applicant or employee a copy of the report, as well as a summary of consumer rights.[6] The employer must then wait a “reasonable period of time” before actually taking adverse action, at which point the employer must give the applicant or employee notice of the adverse action, along with specific information about the consumer reporting agency which provided the report.[7]
Full Disclosure
Perhaps the greatest risk for employer noncompliance is in preparing the “stand-alone” disclosure and authorization form. As courts and the Federal Trade Commission have repeatedly advised, the “stand-alone” requirement limits what information can be included in the FCRA disclosure. Last year, the FTC issued the following guidelines:
While plaintiffs have attempted to expand this list to exclude any language not specifically authorized by the FCRA, courts have shown some reluctance. In 2018, courts issued decisions reaffirming that disclosures regarding consumer reports and investigative consumer reports may be included within the same document, and that they may be presented at the same time as the employment application as long as they remain separate documents from the employment application.[9] At least one court further held that the inclusion of additional text advising applicants of their right to obtain a copy of the consumer report under state law does not violate the “stand-alone” disclosure requirement.[10]
Still, in this aspect, employers should adhere to the adage that “less is more.” While employers may include disclosure statements in employment applications, the FTC has advised that “an employer that follows this procedure must also clearly and conspicuously disclose in a completely separate document that a consumer report may be obtained for employment purposes.”[11] Moreover, courts continue to find violations where disclosure forms include repeated references to state law, corporate privacy and health information policies, and separate FCRA-required documents.[12]
There's Still Standing
Given that most FCRA employment violations arise from alleged procedural deficiencies in the background disclosure and authorization form, the first question in any FCRA case is whether the plaintiff has incurred an injury from the alleged violation sufficient to confer Article III standing. After all, even if an employer uses a deficient disclosure and authorization form, it may not have caused any substantive harm to the plaintiff, for example, where the resulting background check did not disclose any negative information on the plaintiff or did not otherwise affect the plaintiff’s employment status.
It has been nearly two years since the United States Supreme Court clarified when FCRA plaintiffs have standing to sue. In Spokeo Inc. v. Robins, the court held that an FCRA claimant cannot “allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III.”[13] The court explained: “An example that comes readily to mind is an incorrect zip code. It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.”[14]
If only it were so simple. Rarely are courts presented with straightforward FCRA allegations of an incorrect zip code from which no harm results; accordingly, following Spokeo, FCRA litigants continue to argue over the breadth of the Supreme Court’s “injury-in-fact” requirement. While allegations of inaccurate background information resulting in the denial of an employment opportunity will generally suffice, claims that an FCRA procedural violation caused emotional distress and/or an invasion of privacy are more difficult to assess.
In 2018, employers had mixed results pursuing motions to dismiss for lack of standing, sometimes within the same case. Indeed, the U.S. Court of Appeals for the Seventh Circuit recently affirmed the dismissal for lack of standing of a plaintiff’s claim that her disclosure and authorization form contained extraneous information in violation of the FCRA, while also holding that the plaintiff had standing to pursue claims that she was not given a copy of her consumer report before her employer took adverse action against her.[15] The U.S. Court of Appeals for the Third Circuit issued a similar decision in which it held that a group of plaintiffs did not have standing to allege that their prospective employer failed to provide them with a copy of the Summary of Consumer Rights, but had standing to allege that the employer failed to provide them with a copy of their background report.[16]
As these decisions demonstrate, even post-Spokeo, there is no one-size-fits-all answer to the issue of standing. Rather, the parties must examine the evidence (or, in the context of a motion to dismiss, the well-pleaded factual allegations of the complaint) to determine whether a plaintiff may pursue his or her FCRA claims.
The Freeze Is On
As courts’ interpretation of the FCRA evolves, so does Congress’. In May 2018, to keep pace with growing concerns over data breaches and security, Congress passed the Economic Growth, Regulatory Relief, and Consumer Protection Act, which requires nationwide consumer reporting agencies to provide a “national security freeze” free of charge to consumers.[17] The law also requires employers who are contemplating action against an applicant or employee based on information contained in a consumer report — such as refusal to hire or termination — to provide the applicant or employee with a notice that includes information on the availability of a security freeze.
This is not particularly onerous; after all, as discussed above, employers were already required to provide applicants with a Summary of Consumer Rights prior to taking adverse action based upon a consumer report, and the Consumer Financial Protection Bureau revised its model form to comply with the new law in September 2018.[18] However, for employers who simply haven’t gotten around to updating their forms, there is risk of adding to the wave of FCRA litigation with yet another procedural violation of the law’s technical requirements.
Looking Forward On Background Reports
As the case law in the field continues to develop, we can hope for clarity on several issues, including what precise injuries confer Article III standing, what language can be included in a stand-alone disclosure, and what procedures are reasonable to ensure consumer reporting agencies’ compliance with the FCRA. It is, however, unlikely to result in a decrease in FCRA litigation. Indeed, with the uptick in high-profile FCRA settlements and recent amendments to the Federal Rules of Civil Procedure streamlining class action notice procedures, our safest prediction is yet another article reporting that FCRA litigation is on the rise this time next year.
Given the outcome of several high-profile FCRA cases, further increases can be expected in 2019. Indeed, FCRA claims are frequently brought on a class basis resulting in multimillion-dollar settlements, often for purely procedural violations stemming from the law’s highly technical requirements. In 2018, Uber resolved an FCRA class action for $7.5 million for purportedly conducting background checks without obtaining proper notice and authorization,[2] while Amazon resolved an FCRA class action for $5 million due to its alleged failure to provide a “stand-alone” disclosure and authorization to conduct background reports.[3]
As the rise in FCRA litigation continues, we look at some of the familiar trends these cases follow, as well as some recent developments.
The FCRA In Employment
The FCRA was enacted to promote the accuracy, fairness and privacy of information maintained by consumer reporting agencies while also satisfying the important need for consumer reports. An employer triggers FCRA obligations when it requests a “consumer report” on an applicant or employee, a term which includes a broad category of reports such as driving records, criminal records, credit reports and many other reports procured from a third-party, consumer reporting agency such as a credit reporting company, a record-checking company or an investigative firm.[4]
Before requesting the report, the employer must issue a stand-alone document to the applicant or employee disclosing its intent to procure the report for employment purposes and obtain the applicant’s or employee’s signed authorization.[5] If the report contains information that the employer may use as a basis for taking adverse action — for example, not hiring an applicant or terminating a current employee — the employer must give the applicant or employee a copy of the report, as well as a summary of consumer rights.[6] The employer must then wait a “reasonable period of time” before actually taking adverse action, at which point the employer must give the applicant or employee notice of the adverse action, along with specific information about the consumer reporting agency which provided the report.[7]
Full Disclosure
Perhaps the greatest risk for employer noncompliance is in preparing the “stand-alone” disclosure and authorization form. As courts and the Federal Trade Commission have repeatedly advised, the “stand-alone” requirement limits what information can be included in the FCRA disclosure. Last year, the FTC issued the following guidelines:
- Don’t include language that claims to release you from liability for conducting, obtaining or using the background screening report;
- Don’t include a certification by the prospective employee that all information in his or her job application is accurate;
- Delete any wording that purports to require the prospective employee to acknowledge that your hiring decisions are based on legitimate nondiscriminatory reasons;
- Get rid of overly broad authorizations that permit the release of information that the FCRA doesn’t allow to be included in a background screening report — for example, bankruptcies that are more than 10 years old.[8]
While plaintiffs have attempted to expand this list to exclude any language not specifically authorized by the FCRA, courts have shown some reluctance. In 2018, courts issued decisions reaffirming that disclosures regarding consumer reports and investigative consumer reports may be included within the same document, and that they may be presented at the same time as the employment application as long as they remain separate documents from the employment application.[9] At least one court further held that the inclusion of additional text advising applicants of their right to obtain a copy of the consumer report under state law does not violate the “stand-alone” disclosure requirement.[10]
Still, in this aspect, employers should adhere to the adage that “less is more.” While employers may include disclosure statements in employment applications, the FTC has advised that “an employer that follows this procedure must also clearly and conspicuously disclose in a completely separate document that a consumer report may be obtained for employment purposes.”[11] Moreover, courts continue to find violations where disclosure forms include repeated references to state law, corporate privacy and health information policies, and separate FCRA-required documents.[12]
There's Still Standing
Given that most FCRA employment violations arise from alleged procedural deficiencies in the background disclosure and authorization form, the first question in any FCRA case is whether the plaintiff has incurred an injury from the alleged violation sufficient to confer Article III standing. After all, even if an employer uses a deficient disclosure and authorization form, it may not have caused any substantive harm to the plaintiff, for example, where the resulting background check did not disclose any negative information on the plaintiff or did not otherwise affect the plaintiff’s employment status.
It has been nearly two years since the United States Supreme Court clarified when FCRA plaintiffs have standing to sue. In Spokeo Inc. v. Robins, the court held that an FCRA claimant cannot “allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III.”[13] The court explained: “An example that comes readily to mind is an incorrect zip code. It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.”[14]
If only it were so simple. Rarely are courts presented with straightforward FCRA allegations of an incorrect zip code from which no harm results; accordingly, following Spokeo, FCRA litigants continue to argue over the breadth of the Supreme Court’s “injury-in-fact” requirement. While allegations of inaccurate background information resulting in the denial of an employment opportunity will generally suffice, claims that an FCRA procedural violation caused emotional distress and/or an invasion of privacy are more difficult to assess.
In 2018, employers had mixed results pursuing motions to dismiss for lack of standing, sometimes within the same case. Indeed, the U.S. Court of Appeals for the Seventh Circuit recently affirmed the dismissal for lack of standing of a plaintiff’s claim that her disclosure and authorization form contained extraneous information in violation of the FCRA, while also holding that the plaintiff had standing to pursue claims that she was not given a copy of her consumer report before her employer took adverse action against her.[15] The U.S. Court of Appeals for the Third Circuit issued a similar decision in which it held that a group of plaintiffs did not have standing to allege that their prospective employer failed to provide them with a copy of the Summary of Consumer Rights, but had standing to allege that the employer failed to provide them with a copy of their background report.[16]
As these decisions demonstrate, even post-Spokeo, there is no one-size-fits-all answer to the issue of standing. Rather, the parties must examine the evidence (or, in the context of a motion to dismiss, the well-pleaded factual allegations of the complaint) to determine whether a plaintiff may pursue his or her FCRA claims.
The Freeze Is On
As courts’ interpretation of the FCRA evolves, so does Congress’. In May 2018, to keep pace with growing concerns over data breaches and security, Congress passed the Economic Growth, Regulatory Relief, and Consumer Protection Act, which requires nationwide consumer reporting agencies to provide a “national security freeze” free of charge to consumers.[17] The law also requires employers who are contemplating action against an applicant or employee based on information contained in a consumer report — such as refusal to hire or termination — to provide the applicant or employee with a notice that includes information on the availability of a security freeze.
This is not particularly onerous; after all, as discussed above, employers were already required to provide applicants with a Summary of Consumer Rights prior to taking adverse action based upon a consumer report, and the Consumer Financial Protection Bureau revised its model form to comply with the new law in September 2018.[18] However, for employers who simply haven’t gotten around to updating their forms, there is risk of adding to the wave of FCRA litigation with yet another procedural violation of the law’s technical requirements.
Looking Forward On Background Reports
As the case law in the field continues to develop, we can hope for clarity on several issues, including what precise injuries confer Article III standing, what language can be included in a stand-alone disclosure, and what procedures are reasonable to ensure consumer reporting agencies’ compliance with the FCRA. It is, however, unlikely to result in a decrease in FCRA litigation. Indeed, with the uptick in high-profile FCRA settlements and recent amendments to the Federal Rules of Civil Procedure streamlining class action notice procedures, our safest prediction is yet another article reporting that FCRA litigation is on the rise this time next year.
This article was originally featured on Law360 on January 9, 2019.
Related People
-
- Matthew R. Simpson
- Partner