Data may well be the asset of the 21st century, but selling access to certain data about individuals may raise the risk of attracting unwanted attention from both regulators1 and class action litigants. As organizations collect more types of data about consumers, they are more likely to have data that may constitute “consumer report” data under the Fair Credit Reporting Act (FCRA).2 Organizations that try to monetize such data by selling access to consumer profiles can easily run afoul of the FCRA.
This article discusses recent Federal Trade Commission (FTC) enforcement actions against two background check companies that allegedly failed to avoid the FCRA trip wires and face a combined $1.5 million in fines.3 The FTC aggressively enforces the FCRA and violations commonly occur due to a failure to create and implement adequate policies and procedures. This article also explains how the U.S. Supreme Court may review the Ninth Circuit’s recent decision to join other federal appellate courts in making FCRA class action lawsuits easier to bring for plaintiffs. Given the appellate courts’ interpretations of the FCRA, plaintiffs likely will increasingly make FCRA claims in an effort to obtain compensation for alleged general privacy violations. Any organization that sells access to data profiles about individuals is advised to determine whether it must comply with the FCRA and, if necessary, implement policies and procedures that meet the FCRA’s requirements.
Under the FCRA, a company is a “consumer reporting agency” (CRA) and has certain obligations if it assembles or evaluates information about individuals for the purpose of selling “consumer reports” to third parties.4
“Consumer Reports.” There are two requirements that must be met before information constitutes a credit report.5 First, the information must contain certain categories of data, i.e., data relating to credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living. Second, the information must be used for the particular purpose of establishing eligibility for employment, housing, credit, or insurance, or other similar purposes. Therefore, to determine whether information constitutes a credit report, one must review the type of information and the use of the information.
Possible Consumer Reports in the Employment Context. The FCRA defines a consumer report used for “employment purposes” as “a report used for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee.”6 Regulators and courts may conclude that consumer reports include employment screening reports about the prior work experience of job applicants, information in employment records, and information about education and licenses.7
CRAs’ Obligations Under the FCRA. The FCRA imposes several obligations on CRAs. Generally, a CRA must have procedures in place to ensure that it provides the information in a consumer report only to permitted third parties.8 For example, a CRA may provide a consumer report pursuant to a valid legal request, with a consumer’s consent, or to a third party that intends to use the information in connection with a credit transaction, employment, insurance underwriting, license eligibility, or other legitimate business related to a transaction initiated by the consumer.9 The FCRA requires a CRA to follow reasonable procedures to ensure the maximum possible accuracy of the information it provides in a consumer report and follow certain procedures for responding to a consumer’s dispute over the accuracy of such information.10 A CRA must also ensure that certain information is not included in a consumer report, e.g., old civil and criminal court records and other adverse items.11 Finally, a CRA must provide notice to any furnishers of information contained in the consumer report and any recipient of the report about their responsibilities under the FCRA.12
FCRA Obligations when CRAs Provide Consumer Reports for Employment Purposes. A CRA may provide consumer reports for employment purposes only to a third party that provides proper disclosures and obtains consent from the consumer about whom the information pertains. The third party must also certify that it will not use the information in violation of equal employment opportunity laws.13 The FCRA requires that when a consumer report contains negative public-record information, the CRA must provide notice to the consumer at the time of providing notice to a third party and maintain procedures to keep such public-record information up to date.14
Potential Consequences of Noncompliance. Federal and state regulators may bring actions against alleged FCRA violators.15 A consumer may also sue a CRA for willful or negligent noncompliance with the FCRA. For willful noncompliance, the FCRA states:16
Any person who willfully fails to comply with any requirement imposed under [the FCRA] with respect to any consumer is liable to that consumer in an amount equal to the sum of—
(1)(A) any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000; . . ..17
Recent Federal Trade Commission Enforcement Actions
The FTC regularly investigates organizations that it considers to be CRAs when they do not seem to follow procedures to provide the proper notices, perform necessary diligence on data recipients, or perform required diligence to ensure the consumer report data is accurate.
Two Alleged CRAs. According to the FTC’s complaint, InfoTrack sold background screening reports containing public information to employers so they could make decisions about hiring and other employment-related issues. Similarly, the FTC alleged that Instant Checkmate sold background reports pulled from public records and advertised them for use to establish a person’s eligibility for employment or housing. As such, the FTC concluded that InfoTrack and Instant Checkmate were CRAs that provided consumer reports to their customers and had FCRA obligations.
Alleged Noncompliant Practices. Both InfoTrack and Instant Checkmate allegedly knowingly failed to follow FCRA-compliant procedures in a way that constituted a pattern or practice. The complaint stated that Instant Checkmate failed to perform diligence on the recipients of the reports to ensure the recipients took reasonable steps to identify themselves to Instant Checkmate, certified the purpose for which the...
