Locke Lord QuickStudy: New FCRA Notice Requirements for Employers

A little-known provision of a new federal law will likely impact the hiring process of most employers. On September 12, 2018, without seeking any public comment and with no advanced notice, the Consumer Financial Protection Bureau (“CFPB”) promulgated a new disclosure form under the Fair Credit Reporting Act (“FCRA”).¹ Effective nine days later, on September 21, 2018, employers must provide this new form to applicants or employees when conducting background checks through the use of consumer credit reports. The new form, which updates the “Summary of Your Rights Under the Fair Credit Reporting Act,” is available here.² 

Although comments are usually sought and considered by government agencies before issuing this type of rule, the CFPB is instead soliciting comments after the rule has been published. Comments can be submitted through November 19, 2018, to address possible revisions to the form.

To help mitigate the impact of the limited notice provided by the CFPB, the agency stated that employers are temporarily allowed to continue to utilize the 2012 form, so long as the employer simultaneously provides the applicant or employee with a separate page containing the newly required information discussed below, along with updated contact information for certain FCRA enforcement agencies. Hopefully, when the CFPB releases its final rule, it will also provide a greater level of guidance to the public regarding the use of the new form.³

The CFPB promulgated this new form as a result of the Economic Growth, Regulatory Relief, and Consumer Protection Act that Congress adopted earlier this year, which is aimed at combatting identity theft. The Act requires that the FCRA disclosure form notify consumers (including applicants and employees) that they may obtain “security freezes” on their consumer credit report at no cost. This new mechanism freezes the consumer’s accounts so that credit reporting agencies cannot release any information without the consumer’s authorization. This action may, however, delay or interfere with the timely approval of a request or application, and the new form cautions applicants about that consequence if they place a freeze on their account. To avoid that circumstance, the new form explains that, instead of a “freeze,” consumers may place a temporary fraud “alert” on their account for one year (or seven years for victims of identity theft). 

Notably, many states (and even some municipalities) have additional or overlapping consumer reporting laws. While these laws are sometimes referred to as “mini-FCRAs,” they can be more burdensome than the federal FCRA. Some of these state and local laws govern the use of credit history information in making employment decisions. 

The FCRA and some of these “mini-FCRAs” contain strict disclosure requirements for performing background checks. Failure to abide by these requirements in the past has resulted in FCRA class action lawsuits and seven-figure settlements for employers. To minimize such liability, employers that utilize background checks during the hiring process (or at any other time) should ensure that they are abiding by all applicable requirements and providing the most up-to-date FCRA disclosure forms to applicants and employees.

---

1. The form was not published on the Federal Register until September 18, 2018.
2. Additionally, if an applicant or employee informs the employer that the applicant or employee believes he or she has been the victim of identity theft, the employer should provide them with the CFPB’s updated “Summary of Consumer Identity Theft Rights,” which is available here.
3. Comments may be submitted through the Federal eRulemaking Portal (http://www.regulations.gov), email (federalregistercomments@cfpb.gov), mail, or hand delivery to the CFPB’s office in Washington, DC. Any comments should reference Docket No. CFPB-2018-0025 or RIN 3170-AA82.