The Fair Credit Reporting Act was recently amended to address consumer privacy concerns arising from data breaches. If you are an employer who performs background checks on your employees or applicants by using third party consumer reporting agencies, you need to be aware that updated paperwork is now required under the Fair Credit Reporting Act (“FCRA”).
Under FCRA, in order for an employer to obtain a consumer report, the employer must provide a legally compliant disclosure and obtain appropriate authorization from the employee or applicant prior to obtaining the consumer report, as well as provide additional notice before taking any adverse action based on the contents of a consumer report. This additional notice, contained in a form called “Summary of Your Rights Under the Fair Credit Reporting Act” is also used when an employer obtains a more in-depth type of report called an “investigative consumer report.”
The 2018 FCRA amendments, effective September 21, 2018, require an explanation in the “Summary of Rights” of new mechanisms available for consumers to place a “security freeze” on their accounts to stop any release of their information, as well as for placing a “temporary fraud alert” on their accounts. In response to these amendments, the Consumer Financial Protection Bureau (CFPB) has updated the 2012 version of the “Summary of Rights” form (https://files.consumerfinance.gov/f/documents/bcfp_consumer-rights-summary_2018-09.docx). Employers should immediately begin to use this new form but may continue to use the 2012 form for a limited time if it is supplemented with a separate page containing the required notices as to the new actions. It is probably best, however, to begin use of the new form as soon as possible. Failure to use a legally compliant “Summary of Rights” can result in substantial liability for employers.
It is possible that the CPFB will undertake additional revisions to its forms based on these amendments.