Can an employer use background dossiers and algorithmic scores and other third-party reports to make hiring decisions without adhering to the Fair Credit Reporting Act (FCRA). According to the Consumer Financial Protection Bureau the answer is a resounding NO.
What follows is a summary of the governance issuance by the Consumer Financial Protection Bureau. We also have comments in this summary. We encourage you to read the article in its entirety.
Many background dossiers that are compiled from databases collecting public records, employment history, collective-bargaining activity, or other information about a worker are “consumer reports” under the FCRA. Other types of consumer reports may include, for example, reports that convey scores assessing a current worker’s risk level or performance.
Employers that use consumer reports—both initially when hiring workers and for subsequent employment purposes—must comply with FCRA obligations, including the requirement to obtain a worker’s permission to procure a consumer report, the obligation to provide notice before and upon taking adverse actions, and a prohibition on using consumer reports for purposes other than the permissible purposes described in the FCRA.
The third-party providers furnishing these reports are “consumer reporting agencies” regulated by the FCRA, which (among other things) imposes an obligation to follow reasonable procedures to assure maximum possible accuracy, a requirement to disclose information in a worker’s file to the worker upon request, and a requirement to investigate worker disputes alleging inaccuracies.
The most traditional form of consumer report in use in the United States for employment purposes is a background dossier that checks a worker’s public records, including criminal history.
Consumer reporting agencies and other background screening companies now offer a range of reports to employers, including those that record current workers’ activities, personal habits and attributes, and even their biometric information.
Some companies may analyze worker data in order to provide reports containing assessments or scores of worker productivity or risk to employers. Today, such scores are used to make automated recommendations or determinations related to worker pay; predict worker behavior, including potential union organizing activity and likelihood that a worker will leave their job; schedule shifts or job responsibilities; or issue warnings or other disciplinary actions.
Congress passed the FCRA in response to concerns about companies that assemble detailed dossiers about consumers and sell this information. The FCRA regulates information in the form of “consumer reports,” a term defined to include “any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for” certain purposes, including “employment purposes.”
There are a few additional obligations that apply only to this kind of consumer report. For example, section 604(b) includes additional requirements when a consumer report is used for employment purposes, including a requirement to get permission from the worker. It also generally requires employers to provide notice to workers and a copy of their report before taking adverse action. In addition, upon request by a worker, “consumer reporting agencies” must disclose the identity of anyone who has used a consumer report for employment purposes in the two-year period preceding the date the request is made, which is longer than the one-year period used for other purposes. And “consumer reporting agencies” must follow certain procedures when reporting public record information for employment purposes.
The FCRA provides workers the right to know what is in their file at a “consumer reporting agency” and dispute incomplete or inaccurate information, requires such entities, in response to a consumer’s dispute, to correct or delete inaccurate, incomplete, or unverifiable information, and generally prohibits reporting of outdated negative information. In addition to requiring that most employers give workers notice before taking adverse action, the FCRA also generally requires that any person taking adverse action based on a consumer report provide notice to the consumer upon taking the adverse action. Finally, the FCRA strictly limits “consumer reporting agencies” to providing consumer reports only for certain specified permissible purposes. That means the background screener could not share consumer reports containing workers’ data with employers or others, absent a FCRA permissible purpose.
When looking at whether an employer that makes employment decisions based on a report from a third party is regulated by the FCRA, enforcers should consider two key questions:
The FCRA defines “employment purposes” to mean “a report used for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee.” The FCRA thus applies both to information used for the purpose of evaluating a consumer for employment initially, and to information used for ongoing employment purposes—i.e., promotion, reassignment, or retention.
A third party could be a “consumer reporting agency” that assembles or evaluates consumer information if they collect consumer information in order to furnish reports to employers.
In addition, an entity could “assemble” or “evaluate” consumer information within the meaning of the term “consumer reporting agency” if the entity collects consumer data to train an algorithm that produces scores or other assessments about workers for employers. For example, the developer of a phone app that monitors a transportation worker’s driving activity and provides driving scores to companies for employment purposes could “assemble” or “evaluate” consumer information if the developer obtains or uses data from sources other than an employer receiving the report, including from other employer-customers or public data sources, to generate the scores.
James P. Randisi, President of Randisi & Associates, Inc., has been helping employers protect their clients, workforce and reputation through implementation of employment screening and drug testing programs since 1999. This post does not constitute legal advice. Randisi & Associates, Inc. is not a law firm. Always contact competent employment legal counsel. To learn more about the rights of employees who test positive for marijuana, Mr. Randisi can be contacted by phone at 410.494.0232 or Email: info@randisiandassociates.com or the website at Randisiandassociates.com
