The federal Fair Credit Reporting Act (FCRA) applies to employers who obtain “consumer reports” from a “consumer reporting agency” for employment purposes. A “consumer report” is one that has information bearing on the person’s “credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living.” A “consumer reporting agency” is a company that sells or provides consumer reports. The most common type of consumer report is a credit report obtained from a credit reporting agency but, as the quoted definition demonstrates, the law sweeps far more broadly than garden-variety credit reports.
If an employer wants to obtain and use consumer reports for employment purposes, the FCRA requires the employer to take the following steps:
Disclose to the person in writing, in a separate standalone document, that the employer intends to get such a report;
Obtain the person’s written authorization;
If the report reveals information that may cause the employer to take “adverse action” against the person (such as declining to hire or promote), the employer must notify the person of the results of the report and give him or her a copy of the report and a copy of the document “A Summary of Your Rights Under the Fair Credit Reporting Act” published by the Federal Trade Commission;
Give the person sufficient time to review the report so that he or she can challenge anything that is inaccurate; and
If the employer ultimately decides to take adverse action against the person due in part to the information in the report, the employer must notify the person of that fact and provide the following additional information:
a. The name, address and phone number of the agency that provided the report;
b. A statement that the agency did not make the employment decision and cannot give specific reasons for it;
c. A statement that the person has the right to obtain a free copy of his or her report from the agency if a request is made within 60 days; and
d. A statement that the person has the right to dispute directly with the agency the accuracy or completeness of any information provided by the agency.
The very first step mentioned, the initial disclosure, has tripped up a number of employers. The FCRA has three specific requirements for the initial disclosure. It must be:
in a written document that consists “solely” of the disclosure.
Recent Ninth Circuit Decisions
Two recent decisions by the U.S. Court of Appeals for the Ninth Circuit (the federal appeals court that has jurisdiction over the nine Western States), illustrate how some employers have run afoul of those requirements.
In the first case, Syed v. M-1, LLC, 853 F.3d 492 (9th Cir. 2017), the employer’s disclosure form contained release language in addition to the FCRA disclosure. That additional language was found to have violated the requirement that the disclosure document must consist “solely” of the disclosure.
In the second case, Gilberg v. California Check Cashing Stores, LLC, Case. No. 17-16263 (9th Cir. January 29, 2019), the employer’s form contained information required by several states that have their own disclosure requirements and limitations applicable to employees employed in their states. (Those states include California and New York.) As it did in Syed, the court concluded that the form violated the “solely” requirement.
Potential Consequences of FCRA Violations
In the case of a willful violation of the FCRA, the person is entitled to actual damages suffered or statutory damages up to $1,000, whichever is higher, plus attorneys’ fees and costs of the lawsuit. Punitive damages are also possible. Moreover, when a lawsuit is based on standard employment forms, it is relatively easy for the claim to be brought on behalf of a class of all similarly-situated applicants and employees—greatly expanding the potential monetary liability.
Takeaways for Employers
At least for employers in the nine Western States covered by the Ninth Circuit, the takeaways from the recent decisions are clear. First, make sure the FCRA disclosure is an entirely separate, standalone document. Second, limit the disclosure form to the language required by the FCRA. Remove all other language. If the employer is doing business in a state that has its own notification/consent requirements, use a separate form that is tailored to and limited to the state-required language—do not combine the forms! Third, use clear, understandable language in a type and font that is easily readable.
Remember to Comply With State and Local Requirements Too. As just noted, a number of state and local jurisdictions have requirements and limitations that exceed those of the FCRA. Some, for example, prohibit credit checks of prospective employees unless they are substantially job related. Also, an increasing number of states and local jurisdictions are adopting restrictions on obtaining and using criminal records for employment purposes. Some simply prohibit asking about criminal records on employment application forms (“ban the box” laws), while others prohibit taking adverse action based on a criminal record without having a legitimate business reason. Be sure to learn about the state and local requirements that are applicable and comply with them as well.
 There are slightly different requirements concerning federally-regulated truck drivers. In addition, there are more demanding requirements concerning “investigative consumer reports”—reports that contain information about the person’s “character, general reputation, personal characteristics, or mode of living” obtained through personal interviews with neighbors, friends or associates of the person or others who may have knowledge of such matters. Both of these topics are beyond the scope of this update.