Are You Legal Under the Fair Credit Reporting Act

When it comes to hiring employees—particularly those who will dabble in a company’s finances—consumer reports can be crucial tools. You want to know if the person you’re considering putting in control of the company’s books has a history of bad credit or bankruptcy. It’s not so simple to run checks any more. In September 1997, the Consumer Credit Reporting Reform Act took effect, changing the Fair Credit Reporting Act in fairly substantial ways.

Dana Connell, a shareholder at employment law firm Littler, Mendelson, Fastiff, Tichy and Reinhard in Chicago, explains the changes and offers a four-step plan for compliance.

Can you offer some background on this act?
Until shortly before [the act took effect], I think most employers weren’t aware of it. It had nowhere near the fanfare of other employment statutes, such as the FMLA [Family and Medical Leave Act] and the ADA [Americans With Disabilities Act]. Also, the agency that enforces it—the Federal Trade Commission (FTC)—isn’t one most employers are used to dealing with.

My sense is that the act was designed to deal with the fact that there are a lot of consumer-report databases out there that can be used, and that they may not always be accurate. People who apply for jobs may be penalized by information they’re not aware of, and that is wrong.

So what’s the main thrust of this act?
Employers who want to run a consumer report on an applicant must inform that applicant and receive authorization in a way they never had to before. Historically what a lot of employers did was have a boilerplate at the end of the application form that advised the applicant of a number of things, including the fact that the company might try to get a consumer report on that applicant. That’s no longer good enough. You now have to have a disclosure that you’re going to seek a consumer report, and that disclosure has to be in a separate document.

What’s considered a consumer report?
Virtually any compilation of information on an individual that’s prepared by a third-party agency for the employer’s use in making employment decisions is going to be covered by the act. So if, for example, I used a third party who conducted reference checks for me, that would be covered under the act even though it’s not a credit report. By the same token, there are some things that aren’t covered. For instance if HR employs somebody who does direct surveillance—maybe because HR suspects an employee of theft—that would not be covered by the act because it’s direct observation by the company conducting that surveillance and not by a third party.

So what’s the first thing HR should do in light of this act?
The first thing is something that’s not hard to do, but employers have to prepare for it, and that’s this disclosure and written consent requirement. The disclosure has to be provided in a separate document—employers can include the written consent in it. They’re just notifying the applicant that a consumer report might be requested.

In addition to basic consumer reports, there are investigative consumer reports. An investigative report is prepared on the basis of interviews, whereas general consumer reports are based on database information. So for an investigative report, employers have to do both the disclosure required for a consumer report, and because the FTC views this type of report as a little more invasive, they have to notify the applicant that an investigative report might be made, that the applicant may request additional information as to the complete and accurate nature and scope of the investigation, and that the applicant may request a summary of [applicant] rights that the FTC has prepared. In the case of an investigative report, the employer must notify the applicant within three days of conducting the investigation that an investigation is planned. If the applicant asks for additional information regarding what the employer is looking at, the company has to provide that in five days.

What’s step two?
The employer has to [provide] a certification to the consumer reporting agency. This is just a step Congress has inserted to make sure there’s a record that people are doing what they have to do. This is a certification not to a government agency but to whomever the company is using to get the consumer report or investigative consumer report. It’s a certification of the purpose for which the report is being obtained and certification that the report will not be used for any other purpose. In the case of investigative reports, the employer also has to certify that if an applicant makes a request for further information, that the company will give it to him or her.

What’s step three?
It concerns any adverse action the employer may take based on the report. Before HR takes any adverse action based in whole or part on the report, it has to provide two documents to the individual. One is a copy of the consumer report the company has relied on; another is a summary of rights that the FTC has prepared—those summaries are typically provided by the consumer agency when they give the report. The employer has to do both those things before it takes the adverse action. If HR has requested a consumer report but that isn’t the reason HR chose not to hire the individual, it doesn’t have to give notice.

How provable is it that HR didn’t base its decision not to hire on a bad report?
It’s hard to prove. HR might want to consider sending a copy of the report and summary of rights with a cover letter indicating it was a courtesy and that the report wasn’t relevant to the hiring process. At least then there’s no way the FTC can argue the company wasn’t in technical compliance with the act.

Once HR has decided to take adverse action, how long must it wait?
The law doesn’t say how long employers have to wait before implementing the adverse action. Most employers aren’t going to be able to sit around and wait to have some long dialogue with the individual about it.

What happens after the company takes adverse action?
HR has to provide an adverse-action notice to the person it declines to hire. The notice has to be provided orally, in writing or electronically. It has to contain the name, address and phone number of the agency that provided the report. The employer must provide a statement that the consumer-reporting agency didn’t make the adverse decision; employers have to indicate the consumer has a right to obtain an additional free copy of the consumer report from the consumer-reporting agency by making a request within 60 days. Employers also must include a statement regarding the applicant’s right to dispute the accuracy or completeness of information with the consumer-reporting agency.

Does the act require the employer to say what part of the report caused the adverse action?
No, and the act doesn’t provide for some sort of appeal process by which the company may change its decision based on whatever the applicant resolves with a reporting agency regarding the accuracy of the information. The purpose of the act is to make the individual aware the employer is pursuing this information and to whether the company has any obligation to correct its actions if the information it relied on was wrong. Conceivably the individual could come back after the problem has been straightened out, but it’s not some articulated procedure set forth in the act.

Can the applicant obtain damages for technical mistakes?
Yes. This is a statute for which employers have to be careful they don’t make mistakes that are really just technical mistakes, because if they do, the applicant can pursue all kinds of damages as well as attorneys’ fees. I don’t believe there’s a limit, and I believe applicants can file for punitive damages under the Fair Credit Reporting Act. But most of this stuff employers can prepare for and develop forms for. As long as HR is willing to be kind of nerdy about it, it can prevent technical mistakes. For example, what employers should be doing right now is developing these notice and authorization forms. They should have some idea also of how they’ll respond if they’re requesting investigative consumer reports and the applicant requests more information regarding the nature and scope of the investigation—because they’re only going to have five days to put that together. They ought to be preparing what forms they’re going to use when they take adverse action based on credit reports. There are just some forms they need to have ready in the word processor to get out when these things occur.

Workforce, March 1998, Vol. 77, No. 3, pp.79-82.