The Fair Credit Reporting Act, 15 U.S.C. ?? 1681 et seq. (FCRA), was amended substantially in 1996 to impose significant new obligations on businesses that obtain "consumer reports" in connection with "employment" decisions. These amendments were intended to enhance the privacy protections afforded to individuals in the workplace by ensuring that: i) certain kinds of information about them are not obtained by employers without their consent, and ii) they have an opportunity to review and correct errors in reports that may be a factor in a decision adversely affecting their employment.
Recent opinions by the staff of the Federal Trade Commission (FTC), which is responsible for administering the FCRA, have highlighted the expansive scope of the terms "consumer report" and "employment." These opinions underscore the need for all title companies (both insurers and agents) that use third parties to provide, verify, or evaluate any kind of information on current or prospective employees to be aware of the potential applicability of the FCRA and to take the steps necessary to avoid liability for violations of the Act.
In particular, the FTC staff has recently concluded that, for purposes of the FCRA, individual title insurance agents should be considered "employees" of the title insurers they represent. This opinion, by itself, is of concern because it imposes significant and potentially impractical burdens on insurers in their relationships with their agents that were not contemplated by Congress when it decided to expand the rights of employees in 1996. Even greater problems arise when this opinion is considered in conjunction with another recent FTC staff opinion, which has concluded that a report provided by an "outside organization" (such as a law firm) to assist an employer in the investigation of a sexual harassment claim constitutes a "consumer report" covered by the FCRA.
When the two staff opinions are read together, the implication is that investigations conducted by third parties- and possibly investigations conducted by the insurer - of possible fraud or misbehavior by individual agents or individuals who work for corporate agencies are subject to the FCRA. If this is the case, significant problems may be created for insurers and agents in investigating and taking action on agents or employees involved in wrongful conduct.
This article is divided into three parts. Part I provides a brief review of the coverage of the FCRA in the employment context. Part II discusses the obligations imposed on employers who use "consumer reports" in making employment-related decisions and explains why "consumer reports" include far more than credit reports obtained from credit reporting agencies such as Equifax. This discussion will be of interest to all title companies that rely upon third parties for information or assistance in making employment-related decisions. Part III discusses the recent FTC staff opinions, some of the potential problems created by those opinions, and why they are misguided.
I. Coverage of The FCRA /1
The FCRA applies to "consumer reports" provided by "consumer reporting agencies" (CRAs). As the FTC staff has cautioned, "[t]hose in the business community who believe the FCRA is limited to credit reports are misreading the law."/2
A "consumer report" is any written or oral communication by a CRA of any information that bears on any of seven personal factors where the information is used, expected to be used, or collected for certain specified purposes, including "employment purposes:"/3 i) credit worthiness, ii) credit standing, iii) credit capacity, iv) character, v) general reputation, vi) personal characteristics, or vii) mode of living. (Because the type of information provided in a consumer report goes well beyond "credit information," such information will be referred to in this article as "Personal Information.") A CRA is any person that, for a fee, regularly engages in the "assembling or evaluating" of Personal Information for the purpose of furnishing consumer reports to third parties./4
Under these definitions, credit bureaus or credit reporting agencies are clearly CRAs. But private investigators, employee screening services, companies that provide background checks or public record information, and potentially lawyers and law firms, are also CRAs if they regularly /5 engage for compensation in assembling or evaluating such information for the purpose of furnishing reports to be used for employment, credit, insurance underwriting, or other purposes covered by the FCRA.
A consumer report is used for "employment purposes" not only when it is used in connection with a decision to hire an applicant, but when it is used in deciding whether to promote, reassign, or terminate a current employee, or in connection with an investigation into potential wrong-doing by the employee.
The combination of (i) the expanded obligations imposed by the 1996 amendments on businesses that obtain "consumer reports" for "employment purposes;" (ii) the broad definitions of these two terms in the Act and in recent FTC interpretations; and (iii) the civil liabilities (including the possibility of punitive damages) imposed on employers who violate the Act, suggests that all title companies should carefully review their information-gathering practices in connection with employment and agency-related decisions.
II. Obligations of Employers Who Use Consumer Reports
The FCRA imposes four separate sets of obligations on persons that obtain consumer reports to be used for employment purposes./6
1. Before obtaining a consumer report, the employer must: make a clear and conspicuous disclosure to the consumer in writing "in a document that consists solely of the disclosure" that a consumer report may be procured for employment purposes; and obtain the consumer’s written authorization to procure the report./7
The FTC staff has clarified that the disclosure and authorization may be contained in the same document, so long as no other information is contained in it./8 More importantly, the staff has made clear that, if properly drafted, an employer may obtain a one-time authorization from applicants and current employees that would permit the employer to obtain a consumer report at any time during the application process or the employee’s tenure. /9 Obtaining such a one-time authorization obviates the problem of having to obtain the employee’s consent to procuring a consumer report during a confidential investigation or at a time when the employee may be unwilling to provide such consent.
2. Before taking any "adverse action" based in whole or in part on a consumer report, the employer must provide the consumer with:
"Adverse action" includes "a denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee." /11
The Act does not specify how long the employer must wait to take the adverse action after it has provided the copy of the report and notice of the consumer’s rights. The FTC staff has indicated that five days may be appropriate, "although the facts of any particular employment situation may require a different time." /12
3. If the employer takes adverse action based in whole or in part on information contained in a consumer report, it must provide to the consumer:
These requirements must be complied with even though there is some overlap with the information provided by the employer in the "pre-adverse action" phase. /14
4. Separate additional requirements are imposed if the employer seeks to obtain an "investigative consumer report." An "investigative consumer report" (ICR) is a type of consumer report that is developed through personal interviews with neighbors, friends, associates, or others who may have knowledge about the consumer being reported on. In addition to complying with the obligations discussed above applicable to all consumer reports (e.g., obtaining the consumer’s written authorization for procuring a consumer report), an employer:
may not procure an ICR unless, not later than three days after requesting the report, it has mailed or delivered a notice to the consumer that (a) "clearly and accurately" informs the consumer that such a report may be made, and (b) informs the consumer of his right to request additional disclosures regarding the nature and scope of the investigation requested; and
must provide such additional information on the nature and scope of the investigation within five days of a request by the consumer. /15
While employers who request ICRs from the well-known consumer reporting agencies can generally count on them to provide information on these obligations, employers may sometimes seek reports that fall within the definition of "investigative consumer report" from parties, such as private investigators, who may not realize that they are "consumer reporting agencies"-and, hence, who may not themselves be in compliance with, or may not alert the employer to its requirements under, the Act.
For example, the FCRA would be triggered in any of the following scenarios where an employer: i) requests information on an individual’s driving record or criminal convictions from a provider that gathers such information from public sources; /16 ii) obtains a drug test on an employee from a party that is indisputably a CRA (e.g., an employment screening service); or iii) uses an intermediary to evaluate the information provided by a drug testing laboratory. /17 Similarly, a company that provides screening services for employers-criminal history searches, education and employment verifications, or reference checks-would be a CRA even if it never provided information relating to the individual’s credit. If that company made phone calls simply to verify information, it would be providing a consumer report but would not be engaged in preparing an investigative consumer report. If, however, the company went beyond verifying facts, and asked whether the applicant was a good student, or a good worker, or took drugs, the information gathering would constitute an "interview" and the FCRA provisions on ICRs would be triggered. /18
In addition to possible enforcement actions by the FTC (which may include civil penalties of up to $2,500 per violation for a "knowing violation, which constitutes a pattern or practice of violations"), employers who violate their FCRA obligations face potential civil liability to the affected consumer. In the case of willful non-compliance with any requirement, the employer may be liable for actual damages of not less than $100 nor more than $1,000, plus punitive damages as the court may allow and court costs and attorney’s fees. /19 In the case of negligent noncompliance, the employer is liable for actual damages, plus court costs and attorney’s fees. /20 In addition, state attorneys general are authorized to bring actions on behalf of the residents of their states to enforce their rights under the FCRA. /21
III. FTC Staff Interpretations on Insurer-Agent Relationships and Third-Party Investigations of Workplace Incidents
Two relatively recent staff interpretations have pointed out that the coverage of the FCRA may extend to reports and organizations that are far afield from the kind of reports and organizations that are commonly understood to be the focus of the FCRA. It should be noted that the FTC does not have authority to promulgate legislative or trade regulation rules under the FCRA that have binding effect on the public and the courts. Accordingly, the FTC’s published Commentary on the FCRA /22 and FTC staff opinions merely reflect the agency’s views on how the Act applies, but are not binding on the courts as would be the case with regulations authorized by statute.
A. Insurance Agents Are "Employees" of an Insurer for FCRA Purposes - the Kane-Solomon Letter (10/7/98)
Prior to the Kane-Solomon letter, there were three possible bases on which CRAs could provide reports to insurers on individual agents or on principal owner/operators of corporate agencies. /23
First, such reports could be provided "in accordance with the instructions of the consumer to which it relates." /24 Accordingly, a title insurer can always obtain a consumer report on an individual agent, or on an owner, officer or employee of the agency, if it has received the authorization of that individual. /25
Second, there is language in the FTC Commentary and case law supporting the view that reports obtained on individuals in connection with a business they own and operate are not "consumer reports" even if the information is provided by a CRA. /26 The essence of this view is that the use to which a report is put determines whether or not the report is a "consumer report" covered by the Act (i.e., if the report is used for making a decision on a business operated by the consumer it is not a report on the individual in his capacity as a "consumer".)
Third, a number of courts interpreting the language of the FCRA as it existed prior to 1996 have determined that, if the CRA collected the information in connection with its "consumer reporting" business (as would likely be the case regarding a credit report from a credit bureau), the report it provides is a "consumer report" but the business entity requesting the report has a permissible purpose to obtain the report under ?604(b)(3)(E) (i.e., that the requesting party "has a legitimate business need for the information in connection with a business transaction involving the consumer"). /27 Indeed, this language was found to provide a permissible purpose for a title insurer to obtain a credit report on the principal owner of one of its agencies. /28
The language as amended in 1996 now provides that a consumer report may be provided by a CRA to a person who has a "legitimate business need for the information . . . in connection with a business transaction that is initiated by the consumer." /29 The new requirement that the transaction has to be "initiated by the consumer" should allow an insurer to continue to obtain a consumer report in connection with its consideration of an application by an individual to become an agent. Whether it is broad enough (like the prior language) to allow an insurer to obtain a consumer report after the agency relationship has been established (e.g., in connection with an audit or investigation of the agency) is not as clear. /30
Against this background, the FTC’s opinion in the Kane-Solomon Letter appears to have added yet another level of obligations and complications for insurers who need to obtain consumer reports on their agents. The letter responded to an inquiry whether individuals who enter into agency relationships with a title insurance company (including individuals with whom the insurer has an agency agreement but who are employed by a corporate agency) are "employees" of the insurer for FCRA purposes. This is an important issue for insurers because the FCRA imposes significant additional obligations on the use of consumer reports in the "employment" context that are not imposed if such reports are deemed to be used in connection with "business transactions" involving the consumer. /31
In reaching the conclusion that agents are "employees" for FCRA purposes, the Letter cited the Isaac-Allison Letter (2/23/98) in which the staff concluded that individuals retained as drivers by trucking companies are "employees" even though they own and operate their own trucks. The Isaac-Allison letter had cited Hoke v. Retail Credit Corp., 521 F.2d 1079, 1082 (4th Cir. 1975), cert. denied, 423 U.S. 1087 (1976), in which the court ruled that, because of its "broad remedial purposes," the FCRA definition of "employment" should not be constrained by the common law concepts of master and servant, and that personal information furnished by a CRA to a state Board of Medical Examiners to aid in the assessment of a physician’s application for a medical license should be deemed to be furnished for "employment purposes."
While it is understandable that the FTC would not want to draw a bright line between individuals hired as "contractors" and individuals hired as "employees," treating individuals who operate an insurance agency business as "employees" of the insurer is neither required nor justified by the earlier FTC precedents. The staff could just have easily concluded that the insurer-agent relationship was covered by the "business transaction" language of ?604(a)(3)(F).
While a key FTC staff member has indicated that the staff would be willing to discuss their interpretation with representatives of the insurance industry (they recognize that the Kane-Solomon Letter affects all insurers, not just title insurers), they have indicated that the prospects of the staff changing its view are not great. In their opinion, the problems (which they recognize may exist) are created by the language of the FCRA, not by their interpretation of that language. While consideration should be given to presenting the legal and policy arguments to the staff as to why agents should not be treated as employees for FCRA purposes, relief on this issue may only be obtainable through legislative action. /32
The need for regulatory or legislative action on this issue is further highlighted by the FTC staff opinion in the Keller-Vail Letter, discussed next.
B. Sexual Harassment Investigations-the Keller-Vail Letter (4/5/99)
The Civil Rights Act of 1964 prohibits discrimination in employment, and obligates employers to investigate acts of sexual harassment in the workplace and to take appropriate corrective or disciplinary action. EEOC guidelines mandate prompt investigations of disputed allegations of harassment and a commitment to employees that such allegations will remain confidential to the extent consistent with the need to conduct an investigation. /33
There is little question that if, in the course of an investigation of a workplace incident, an employer requests a credit report from Equifax on an employee, the FCRA would apply to that report. On the other hand, does the FCRA apply when an employer retains a lawyer or law firm to investigate on its behalf and report on a sexual harassment claim when the only information collected or evaluated by the lawyer is information from the employer’s records and workforce? The Keller-Vail Letter concludes "yes" and the implications of that conclusion are profound.
The letter can be summarized in short order:
an employer’s decision after a sexual harassment investigation may constitute "adverse action" against an employee, as that term is defined by the FCRA;
an employer who seeks the assistance of an "outside organization" in connection with such an investigation is therefore seeking assistance in connection with an "employment" decision, as defined by the FCRA;
the report of that outside organization will concern information "bearing on a consumer’s . . . character, general reputation, personal characteristics, or mode of living" and, hence, would constitute a "consumer report" if the outside organization is a "consumer reporting agency";
if the organization (law firm) "for monetary fees . . . regularly engages, in whole or in part in the practice of assembling or evaluating" personal information for use in employment decisions by its clients, the organization falls within the definition of a consumer reporting agency;
the fact that the outside organization only collects and reports on information from the employer’s own records and from its work force is irrelevant because the FCRA does not make a consumer report dependent on the source of the information used in the report; and
if the investigation by the outside organization involves personal interviews with "neighbors, friends, or associates" (fellow employees) of the consumer being reported on-which will almost always be the case -- the report is an "investigative consumer report." Accordingly, all of the other obligations imposed on the employer in connection with an investigative consumer report (discussed in Part II, above) are applicable and the law firm now has to satisfy all of the obligations imposed on a CRA that provides investigative consumer reports.
The staff’s interpretation could have significant and negative unintended consequences for employers who utilize the assistance of third persons, such as law firms and investigators, in addressing and resolving discrimination and other workplace disputes (e.g., violence in the workplace). Among the many problems and ambiguities created by the conclusion are:
will it deter employers from seeking advice and assistance in investigating and resolving such workplace issues?
will it effectively disable smaller companies from conducting necessary investigations and obtaining necessary legal advice?
will it deter law firms from providing such assistance (not only does the law firm have to meet the obligations of a CRA, but the "reports" it prepares for the client are likely to be deemed "investigative consumer reports," thereby triggering the additional obligations imposed on CRAs in connection with such reports)?
what if employees involved in such claims refuse to give authorization for the employer to obtain the "consumer report" from the employer’s attorney or outside consulting firm?
how does the attorney-client privilege and attorney-work product doctrine apply if the law firm’s report is a consumer report that must be provided to the employee, and the law firm is a CRA that must make its "files" on the employee available to the employee?
And this is just the beginning of the list.
It may well be impossible for employers and law firms to undertake in a proper and effective manner the work that has to be done (in some cases, as a matter of statutory obligation) to investigate and resolve workplace incidents and, at the same time, fully comply with FCRA obligations. This Hobson’s choice has been created by the fact that the FCRA regulatory scheme was not really designed to apply in the circumstances of a lawyer’s investigation of workplace misconduct and is a "bad fit" when applied to such investigations. As more companies and lawyers come to appreciate the ramifications of the Keller-Vail Letter, it would not be surprising to see efforts undertaken to encourage the FTC to re-examine the issue or to obtain a legislative amendment to the FCRA.
C. The Implications of the Conclusions in the Kane-Solomon and Keller-Vail Letters
When considered in tandem, the two staff opinions may raise significant problems for title companies.
First, title companies that obtain information or evaluations from third parties, such as a credit bureau, investigator or private attorney, to assist in investigating the possible fraud of an employee, and title insurers that retain such outside assistance in connection with an investigation of an individual agent, are now potentially subject to all of the FCRA obligations regarding consumer reports used for "employment" purposes.
Second, where an insurer, utilizing only its own in-house staff, investigates the potential wrongdoing of an employee or officer of a corporate agency and prepares a report on its findings that is shared with the agency, such report could be viewed as a "consumer report" if the insurer itself is deemed to be a "consumer reporting agency." The report no doubt bears on Personal Information of the employee and could be used as a factor in an "employment" decision regarding that employee. The pertinent question, therefore, is whether the insurer is a CRA in connection with the preparation of the report. While good arguments can be advanced that the insurer is not providing this report to the agency "for a monetary fee, dues, or on a cooperative non-profit basis," and that the insurer’s purpose in preparing the report was for its own protection-rather than "for the purpose of furnishing consumer reports to third parties"-it is not clear whether the FTC staff would reach the same conclusion.
The circumstances in which an insurer may conduct investigations of its agents and obtain information on them has historically been determined by (a) the terms of the agency contract between the parties and (b) the "privileges" granted by state statutes or the common law for communications of information about a third party between a person who has such information and a person who has a legitimate reason for obtaining that information. These regimes have not led to any problems that necessitate the application of the burdensome and ill-fitting requirements of the "employment" provisions of the FCRA to the insurer-agent relationship, nor have they prompted the need to treat reports by third parties on workplace incidents as "consumer reports" covered by the Act. Whether the FTC or the Congress can be made to appreciate that fact, and therefore to reverse the staff determinations reflected in the Kane-Solomon and Keller-Vail Letters, remains to be seen.
1 State law may also be applicable to the use of consumer reports in the employment context. While state laws addressing certain FCRA requirements are preempted, for most of the matters discussed herein state laws are not preempted unless the state law is inconsistent with the FCRA and then only to the extent of the inconsistency. FCRA ?624, 15 U.S.C. ?1681t. State laws that impose more burdensome obligations are not inconsistent with the FCRA if a person can comply with both obligations. See Credit Data of Arizona v. State of Arizona, 602 F.2d 195 (9th Cir. 1979).
2 Haynes-Poquette Lettter, 6/10/98. The FTC staff opinions (which are identified by the name of the FTC staff person writing the letter and the name of the person to whom the letter was written) are available at the FTC’s website (http://www.ftc.gov/os/statutes/fcra/).
3 FCRA ?603(d)(1), 15 U.S.C. ?1681a(d)(1). Other purposes include establishing the consumer’s eligibility for credit or insurance to be used primarily for personal, family or household purposes, or by a person who has a legitimate business need for the information in connection with a business transaction that is initiated by the consumer.
4 FCRA ?603(f), 15 U.S.C. ?1681a(f).
5 A conversation with an FTC staff member suggests that the staff views the word "regularly" as meaning "with any degree of frequency."
6 The Act also imposes obligations on users of consumer reports not to request such reports unless they have a "permissible purpose" (FCRA ?604(f), 15 U.S.C. ?1681b(f)), and not to obtain such reports under false pretenses (FCRA ?619, 15 U.S.C. ?1681q).
7 FCRA ? 604(b)(2), 15 U.S.C. ?1681b(b)(2). Before providing such reports, CRAs are required to obtain the employer’s certification that it has complied with the notice and authorization requirements, that it will comply with its obligations in the event it takes "adverse action," and that the information in the report will not be used in violation of any applicable Federal or state equal employment opportunity law or regulation. FCRA ?604(b)(1), 15 U.S.C. ?1681b(b)(1).
8 Lamb-Steer Letter, 10/21/97.
9 Haynes-James Letter, 8/5/98; Isaac-Brisch Letter, 6/11/98 (making clear that the notice and authorization requirements must be met even where the employer is requesting a consumer report on a current employee suspected of criminal misconduct).
10 FCRA ?604(b)(3), 15 U.S.C. ?1681b(b)(3).
11 FCRA ?603(k), 15 U.S.C. ?1681a(k).
12 Brinckerhoff-Weisberg Letter, 2/27/97.
13 FCRA ?615(a), 15 U.S.C. ?1681m(a).
14 Haynes-Hawkey Letter, 12/18/97.
15 FCRA ?606, 15 U.S.C. ?1681d.
16 Haynes-Lewis Letter, 6/11/98. If the employer obtains such information directly from the public records source, the FCRA is not triggered because the public records source is not deemed a "consumer reporting agency" and, hence, the information it provides are not "consumer reports."
17 Haynes-Islinger Letter, 6/9/98. If the employer deals directly with the drug testing laboratory, the FCRA is not triggered. This is because the laboratory is reporting on its own experiences with the consumer and, hence, is not a CRA. CRAs assemble or evaluate information about the consumer from third parties.
18 Haynes-Beaudette Letter, 6/9/98.
19 FCRA ?616, 15 U.S.C. ?1681n.
20 FCRA ?617, 15 U.S.C. ?1681o.
21 FCRA ?621(c), 15 U.S.C. ?1681s(c).
22 The Commentary is reproduced at 16 C.F.R. Part 600, Appendix.
23 Reports on the corporate agency itself are not covered by the Act since they are not reports on "consumers" (i.e., individuals).
24 FCRA ?604(a)(2), 15 U.S.C. ?1681b(a)(2).
25 Such authorization might be obtained at the time that the agency contract is entered into or renewed, or at any other time.
26 See FTC Comment 603(d)-3(C) ("Reports used to determine the eligibility of a business, rather than a consumer, for certain purposes, are not consumer reports and the FCRA does not apply to them even if they contain information on individuals, because Congress did not intend for the FCRA to apply to reports used for commercial purposes"); Comment 603(d)-6(B) ("A report on a consumer for credit or insurance in connection with a business operated by a consumer is not a ?consumer report’ and the Act does not apply to it."). See also Matthews v. Worthen Bank & Trust Co., 741 F.2d 217 (8th Cir. 1984) (FCRA does not apply to credit report obtained on individual in connection with the individual’s application to purchase a liquor store and lease space in a mall); Yeager v. TRW, Inc., 961 F. Supp. 161, 162 (E.D. Tex. 1997) ("FCRA does not apply to business transactions, even those involving consumers and their credit information," citing earlier cases in support).
27 See, e.g., Commeaux v. Brown & Williamson Tobacco Co., 915 F.2d 1264 (9th Cir. 1990); Ippolito v. WNS, Inc., 864 F.2d 440 (7th Cir. 1988).
28 Cambridge Title Co. v. Transamerica Title Ins. Co., 817 F. Supp. 1263 (D. Md. 1992), aff’d, 989 F.2d 491 (4th Cir. 1993) (title insurer had a "legitimate business need" for obtaining a credit report on the President and principal owner of an agency in connection with its annual reviews of the agency and an investigation into an apparent shortfall in the agency’s escrow accounts).
29 FCRA ?604b(a)(3)(F), 15 U.S.C. ?1681b(a)(3)(F) (emphasis added).
30 A reasonable reading of this language would be that the agency relationship represents a continuing "business transaction." If the agency relationship was entered into on the basis of an application submitted by the agent, the "business transaction" should be viewed as having been "initiated by the consumer" even if the individual was first approached by the insurer to sign up as an agent.
31 As discussed in Part II, above, an employer who requests a consumer report to be used in the employment context must (a) provide the consumer with a separate disclosure that a consumer report may be procured, (b) obtain the consumer’s written authorization to procure the report, and (c) provide the consumer with a copy of the report before taking "adverse action" against the consumer. These requirements are not imposed on persons who obtain consumer reports under ?604(a)(3)(F) in the case of "business transactions" with the consumer.
32 This was the route taken by the trucking industry in light of the Isaac-Allison Letter, discussed above. See FCRA ?? 604(b)(2)(B) & (C), and 604(b)(3)(B) & (C), added by Pub, L. 105-347 (November 2, 1998).
33 See EEOC "Enforcement Guidance: Vicarious Employer Liability for Unlawful Harassment by Supervisors," available at www.eeoc.gov/docs/harassment.hmt.