Worker Surveillance and FCRA Liability
Technology-driven workplace surveillance tools could trigger liability under the Fair Credit Reporting Act.
The Takeaway for Employers
Employers that use tracking technology and artificial intelligence (AI) to monitor workers and make employment decisions may now have one more thing to worry about—the Fair Credit Reporting Act (FCRA).
Many companies are familiar with the FCRA’s requirements for obtaining criminal background reports from third party consumer reporting agencies. Among other things, the FCRA requires that employers obtain worker permission before obtaining a consumer report and notify the employee before and after taking an adverse action based on the report’s contents.
Employers may have to follow the FCRA’s requirements if they buy AI or other sorts of data-driven reports or algorithmic scores from third party vendors, says the Consumer Financial Protection Bureau (CFPB), one of the federal agencies responsible for enforcing the FCRA, in guidance published in October 2024.
That’s a potentially significant compliance obligation for employers as AI becomes more prevalent through emerging technology and an increasingly remote workforce. There can be serious penalties for operating outside the FCRA. Violators can be sued, and FCRA claims can be particularly susceptible to class action treatment.
New Technology and Long-Standing Law: AI and the FCRA
The CFPB’s concern is that AI-generated reports can contain sensitive information not known by workers that can then be used against them in hiring decisions, job assignments, and career advances. Inaccurate reports could harm employees. The FRCA is aimed at increasing transparency around the use of such information.
It does that by regulating “consumer reports,” which means “any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for … employment purposes.” 15 U.S.C. § 1681a(d).
That definition raises two key considerations for employers. First, does the employer use “consumer report” for employment purposes, and second, does the entity providing the report qualify as a “consumer reporting agency”?
The first point is fairly straightforward. Information is used for employment purposes if it is used to evaluate someone for employment, promotion, reassignment, or retention. In a press release announcing the new guidance, the CFPB cited the following examples as ways that employers are using AI or tech-driven data for employment purposes:
- Predict worker behavior: This includes assessing the likelihood of workers engaging in union organizing activities or estimating the probability that a worker will leave their job, potentially influencing management decisions about staff retention and engagement strategies.
- Reassigning workers: Automated systems may use data on worker performance, availability, and historical patterns to reassign team members.
- Issue warnings or other disciplinary actions: These consumer reports might flag potential performance issues, leading to automated warnings or recommendations for disciplinary measures (potentially including firing) without direct human oversight.
- Evaluate social media activity: Some reports may include analysis of workers’ social media presence, potentially impacting hiring or other decisions.
The second point is a bit more convoluted because not all third parties that collect or assess data meet the definition of a “consumer reporting agency” under the FCRA. The agency offered the following two examples in the circular about how tech vendors could qualify as a “consumer reporting agency” under the FCRA:
- A third party could be a “consumer reporting agency” that assembles or evaluates consumer information if they collect consumer information to furnish reports to employers. A company that employers use to help make employment decisions could meet this standard in a number of ways. For example, similar to a “nationwide consumer reporting agency,” like Equifax, Experian, or TransUnion, some companies collect consumer data from third parties for dissemination to employers in background reports. Traditional background screening companies “assemble” or “evaluate” information about workers, often from public sources, such as criminal history records. Other firms might collect information from employers about workers’ collective bargaining activity, or job performance, and then sell it to other employers to make hiring decisions.
- In addition, an entity could “assemble” or “evaluate” consumer information within the meaning of the term “consumer reporting agency” if the entity collects consumer data in order to train an algorithm that produces scores or other assessments about workers for employers. For example, the developer of a phone app that monitors a transportation worker’s driving activity and provides driving scores to companies for employment purposes could “assemble” or “evaluate” consumer information if the developer obtains or uses data from sources other than an employer receiving the report, including from other employer-customers or public data sources, to generate the scores.
Employer Action Items
- Create a list of apps or other tools that you are concerned may qualify as a “consumer report” under the FCRA. Per the CFPB, look for tools that are driven by third-party data that you are using in connection with employment-related decisions impacting your workers. Given the cumbersome definitions in the FCRA, work with your legal team.
- Review those vendor service agreements to learn more about how they do their work and their FCRA compliance-related steps. Vendors that qualify as “consumer reporting agencies” have their own FCRA obligations that require, among other things, that they have procedures in place to ensure “maximum possible accuracy” in their reports and to implement a process to resolve disputes about information contained in the report.
- Ensure transparency with your workers. Audit your own practices to ensure that you are providing the required FCRA notices and obtaining the necessary consent from employees.
