Statement of Maneesha Mithal Associate Director Division of Privacy and Identity Protection Federal Trade Commission Bureau of Consumer Protection

Meeting of October 20, 2010 - Employer Use of Credit History as a Screening Tool

I. Introduction

Chairman Berrien and Commissioners, my name is Maneesha Mithal, and I am the Associate Director of the Division of Privacy and Identity Protection at the Federal Trade Commission ("Commission" or "FTC").¹ The FTC appreciates this opportunity to discuss the Fair Credit Reporting Act ("FCRA") requirements that relate to the use of consumer reports in employment. ² As the nation's consumer protection agency, the FTC has a long-standing role in protecting the FCRA rights of employees and we intend to continue to work in this critical area of importance to their livelihoods.

The FCRA regulates the practices of companies that maintain and provide consumer reports (known as "consumer reporting agencies" or "CRAs"), the entities that provide information to CRAs (known as "furnishers"), and the users of consumer reports (such as employers) to ensure that sensitive consumer report information is used with fairness, impartiality, and respect for the consumer's privacy. The FTC has played a central role in interpreting and enforcing the FCRA for over three decades. It shares authority for enforcing the FCRA with other federal agencies,³ and will soon share enforcement responsibilities with the newly-created Bureau of Consumer Financial Protection.⁴

This testimony first will describe some of the legal rights and obligations that apply under the FCRA when consumer reports are used for employment purposes. Second, it will highlight the FTC's law enforcement efforts in this area. Finally, it will discuss the FTC's efforts to educate employees and employers about the use of credit reports in employment.

II. FCRA Framework For Using Consumer Reports in Employment

The FCRA imposes requirements on CRAs when they provide consumer reports for employment purposes and on employers that use such reports. These requirements are designed to promote privacy, accuracy, and fairness in the use of consumer of reports for employment. To further ensure accuracy of consumer reports, the FCRA also gives consumers the right to dispute inaccurate information.

A. Requirements for CRAs

The FCRA imposes several requirements on CRAs that provide consumer reports to employers. First, before providing the report to an employer, the CRA must take reasonable measures to ensure that the employer has a "permissible purpose" for receiving the report and that the employer certifies the purposes for which it is obtaining the consumer report.⁵ These requirements are designed to promote the privacy of sensitive consumer report information so that it is only shared in specified circumstances. Permissible purposes include the use of such information for credit transactions, insurance underwriting, and employment decisions.⁶ Permissible purposes do not include, for example, mere curiosity about a consumer.

In the employment context, permissible purposes of a consumer report are limited to "employment, promotion, reassignment, or retention."⁷ Thus, employers may only obtain a consumer report about employees or applicants, and may not simply use their status as employers to get consumer reports about competitors, opposing parties in litigation, or anyone else. Finally, under the permissible purpose requirement, CRAs must have reasonable procedures in place to ensure that consumer report recipients are who they say they are.⁸ Thus, for example, a CRA must take reasonable measures to ensure that a purported employer seeking a report is not simply someone posing as an employer to get information about a consumer.

Second, CRAs must take reasonable steps to ensure the accuracy of consumer reports they provide to employers. The FCRA mandates that CRAs follow "reasonable procedures to assure maximum possible accuracy of the information [they report]."⁹ It does not establish a requirement of absolute accuracy and does not require CRAs to guarantee that reports are error- free.

Third, when providing consumer reports to employers, CRAs must comply with certain procedural requirements. CRAs must give employers a notice that informs them of their duties under the FCRA.¹⁰ CRAs must also obtain certifications from employers that (1) they are in compliance with the FCRA, and (2) they will not use consumer report information in violation of any federal or state equal employment opportunity laws or regulations.¹¹

Finally, the FCRA requires that CRAs take special steps if public record information is included in consumer reports provided to employers. If a CRA provides an employer with a report that has negative information about an employee that is based on public records — for example, tax liens, outstanding judgments, or criminal convictions — that CRA either has to notify the employee directly that it has provided the information to the employer, or has to adopt strict procedures to make sure the information is accurate.¹²

B. Requirements for Employers

The FCRA places special obligations upon employers to provide certain notices to consumers and obtain their consent when using consumer reports for employment purposes. Specifically, before an employer can get a consumer report, the FCRA requires the employer to notify the applicant or employee in writing that a report may be used, and to obtain the applicant or employee's consent.¹³ This requirement serves an important role by alerting job applicants and employees to the fact that the employer may consider consumer report information in connection with the consumer's application or employment.

If an employer intends to take an adverse employment action based, either in whole or in part, on information in a credit report, such as denying a job application, reassigning or terminating an employee, or denying a promotion, the employer must provide the individual with a pre-adverse action disclosure before taking the adverse action.¹⁴ The pre-adverse action disclosure must include a copy of the consumer report on which the employer is relying and a summary of the consumer's rights under the FCRA, the form of which is prescribed by the FTC. This summary describes consumers' FCRA rights, including their right to obtain copies of their consumer reports and dispute information in them, as described below.¹⁵

Once the employer has taken the adverse action, it must give the individual a notice that the action has been taken based on information in the consumer report. This notice must include the name, address, and phone number of the CRA that supplied the report, and must inform the consumer of his or her right to dispute the accuracy or completeness of any information in the report, and of his or her right to a free report from the CRA upon request within 60 days.¹⁶

C. Consumers' Dispute Rights

The pre-adverse action notice, adverse action notice, and summary of rights are designed primarily to promote accuracy of consumer reports and to ensure that consumers are not denied important benefits based on erroneous information. The notices inform consumers of their right to check their reports for inaccuracies and to dispute erroneous or incomplete information. Under the FCRA, consumers have the right to dispute information in their consumer reports with (1) the CRA that supplied the report to the employer and/or (2) the party that provided the disputed information to the CRA, (the furnisher) such as a bank or mortgage company. The consumer's dispute triggers an obligation on the part of the CRA and/or the furnisher of the contested information to reasonably investigate the dispute.¹⁷ If the information provided to the employer is incorrect, the CRA must correct the information, and upon the consumer's request, send the employer an updated report.¹⁸ If the furnisher and/or CRA confirms the accuracy of the information originally provided to the employer, and the consumer still disagrees with the information, the CRA must mark the consumer report as disputed.¹⁹

These dispute provisions provide consumers with an important right. As a significant number of employers use credit reports in employment decisions,²⁰ it is critical that the information contained in them be as accurate as possible and that consumers' dispute rights be effective.

III. Law Enforcement

The FTC monitors the operation of the credit reporting system to identify and investigate possible law violations. Although it does not have examination or auditing authority, the FTC has pursued an aggressive law enforcement program to ensure that CRAs, furnishers, and consumer report users (including employers) comply with their responsibilities under the FCRA. Some examples follow.

First, as noted above, CRAs must have reasonable procedures in place to ensure that they are providing consumer reports only to those with a permissible purpose. In the FTC's well- known case against the CRA ChoicePoint, the FTC alleged that the company sold 160,000 consumer files to identity thieves posing as clients (in some cases, as employers).²¹ The FTC alleged that ChoicePoint lacked reasonable procedures to verify that its customers had a permissible purpose for obtaining consumer reports. In settling the case, ChoicePoint agreed to an order requiring it to pay $10 million in civil penalties for alleged violations of the FCRA and $5 million in consumer redress for identity theft victims. Last year, the FTC charged that the company violated the order and obtained a stipulated modified order under which ChoicePoint agreed to pay additional monetary relief in the amount of $275,000.²²

Second, the FTC has brought a number of actions over the years against employers for violations of the adverse action and pre-adverse action notice requirements.²³ Most recently, the FTC charged two railroad contractors with failing to provide pre-adverse action and adverse action notices to employees who were fired and job applicants who were rejected based on information in their consumer reports.²⁴ Under negotiated settlement orders, the companies were required to pay penalties in the amount of $1,000 per violation, and are subject to specific injunctive, record-keeping, and reporting requirements to ensure compliance with the FCRA.

Third, the FTC has filed several actions alleging that CRAs failed to meet their obligations to investigate disputes. For example, in cases filed in 2000 against the three principal nationwide CRAs – Equifax, Experian, and TransUnion – the FTC alleged that the companies violated the FCRA by failing to maintain adequate personnel to respond to consumers registering disputes by telephone, resulting in busy signals, excessive hold times, and the blocking of calls from particular locations. The CRAs signed consent decrees requiring them to maintain adequate personnel, conduct audits to ensure future compliance, and pay a total of $2.5 million in civil penalties.²⁵

Fourth, the FTC has brought several actions against CRAs for failing to provide the required notices to consumer report users, informing them of their obligations under the FCRA. Most recently, the FTC obtained a civil penalty of $150,000 from Central Credit, LLC to resolve charges that it failed to provide such notices, among other things.²⁶

Finally, the FTC has brought several actions to ensure that CRAs comply with their obligations to maintain reasonable procedures to ensure the accuracy of credit reports. For instance, the FTC brought an action against Far West Credit, a Utah-based CRA. The FTC's complaint alleged that Far West inserted into credit reports facially dubious information without adequately verifying the information. In settling the case, Far West agreed to put in place reasonable procedures to assure the maximum possible accuracy of information in credit reports that it prepares, and to pay $120,000 in civil penalties.²⁷

IV. Consumer and Business Education

A critical part of the FTC's mission is educating businesses and consumers. Among other outreach efforts, the FTC has published a large volume of education materials designed to help consumers and businesses understand their rights and obligations under the FCRA. Recently, the FTC published Employment Background Checks and Credit Reports, which explains to applicants and employees their rights under the FCRA with respect to the use of credit reports and other employment background checks.²⁸ The FTC also has numerous other consumer education materials for employees and consumers, including Building a Better Credit Record,²⁹ which advises consumers on steps they can take to legally improve their credit reports, deal with debt, and spot credit-related scams; How to Dispute Credit Report Errors,³⁰ which explains how to dispute and correct inaccurate information on a credit report and includes a sample dispute letter; and Your Access to Free Credit Reports,³¹ which explains how consumers can access their credit reports for free every twelve months.

The FTC also provides extensive guidance to businesses on their responsibilities under the FCRA. The FTC has issued a guide for employers, Using Consumer Reports: What Employers Need to Know, which is available, along with other resources for employers, under the "Human Resources" heading at the FTC's new Business Center.³² The FTC also makes information available to the business community through the FCRA section of its website,³³ which includes links to the statute and rules, staff opinion letters, comments on proposed rules, enforcement and other actions, and educational materials for businesses. In addition, FTC staff makes presentations at industry meetings and conferences regarding consumer report obligations of firms, and FTC staff routinely responds to questions and concerns raised by the business community on an informal basis.

V. Conclusion

The FCRA includes significant protections relating to the use of consumer reports for employment purposes, and the FTC is committed to using all of the tools at its disposal to ensure that job applicants and employees are protected. We look forward to continuing to work with the EEOC in this important area.

---

Footnotes

¹ While the views expressed in this statement represent the views of the FTC, my oral representations and responses to questions are my own and do not necessarily reflect the views of the FTC or any individual FTC Commissioner.

² Although today's hearing is about the use of credit reports in employment, the FCRA does not define the term credit report; rather, it uses the broader term consumer report, which is a report about a consumer that may or may not contain credit information. For example, "consumer reports" may consist of criminal background information, educational background information, or license information. The FCRA requirements discussed in the text apply to consumer reports that contain credit information (colloquially referred to as "credit reports") as well as any other type of consumer reports.

³See 15 U.S.C. § 1681s(b)(1)-(6) (also vesting authority in the Office of the Comptroller of the Currency, Office of Thrift Supervision, Federal Deposit Insurance Corporation, the Federal Reserve Board, National Credit Union Administration, Department of Transportation, and Department of Agriculture).

⁴See Consumer Financial Protection Act of 2010 (Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act, Public Law 111-203).

⁵ 15 U.S.C. § 1681e.

⁶ 15 U.S.C. § 1681b.

⁷ 15 U.S.C. § 1681a(h).

⁸ 15 U.S.C. § 1681e(a).

⁹ 15 U.S.C. § 1681e(b).

¹⁰ 15 U.S.C. § 1681e(d).

¹¹ 15 U.S.C. § 1681b(b)(1)(A)(i), (ii).

¹² 15 U.S.C. § 1681k(a)(1) and (2). Regardless of whether a CRA chooses to provide the notice or adopt strict procedures, section 1681e(b) of the FCRA still requires CRAs to have reasonable procedures to assure maximum possible accuracy.

¹³ 15 U.S.C. § 1681b(b)(2)(A)(i) and (ii). In certain cases, different rules apply to notices if the job is in the trucking industry (i.e., the qualifications and hours are regulated by the Secretary of Transportation or subject to safety regulation by a state transportation agency). 15 U.S.C. § 1681b(b)(2)(C)(i) and (ii). Employers of truckers are not required to provide a written summary and a copy of the consumer report before taking adverse action and may provide alternative pre-adverse action notices.

¹⁴ 15 U.S.C. § 1681b(b)(3)(A)(i), (ii).

¹⁵http://www.ftc.gov/os/2004/11/041119factaappf.pdf. Even though a consumer has the right to dispute errors in his/her report, the CRAs and companies providing information to the CRAs typically are allowed thirty days to investigate the consumer's dispute, and the information may not be corrected in time to affect the consumer's consideration for a particular job.

¹⁶ 15 U.S.C. § 1681m(a)(1), (2). The adverse action notice also must include a statement that the CRA that supplied the credit report did not make the decision to take the adverse action and cannot give the consumer any specific reasons for the decision. Id.

¹⁷ See 15 U.S.C. § 1681i; 15 U.S.C. § 1681s-2(a)(8).

¹⁸ 15 U.S.C. § 1681i(d).

¹⁹ 15 U.S.C. § 1681i(c).

²⁰ According to a recent study, approximately 60% of employers consider credit information at some point in the employment process. Society for Human Resource Management, Background Checking: Conducting Credit Background Checks, January 2010, available at https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/conductingbackgroundinvestigations.aspx.

²¹United States v. ChoicePoint, Inc., No. 06-CV-0198 (N.D. Ga. Dec. 6, 2006).

²²United States v. ChoicePoint, Inc., No. 09-CV-0198 (N.D. Ga. Oct. 19, 2009); see also United States v. Rental Research Servs., Inc., No. 0:09-CV-00524-PJS-JJK (D. Minn. Mar. 6, 2010).

²³ United States v. Imperial Palace, Inc., No. CV-S-04-0963 (D. Nev. Jul. 14, 2004); In re Altmeyer Home Stores, 125 F.T.C. 1295 (1998); In re Aldi's, 124 F.T.C. 354 (1997); In re Bruno's, Inc., 124 F.T.C. 1997); In re Marshall-Field, 116 F.T.C. 777 (1993); In re Macy's, 115 F.T.C. 43 (1992); In re McDonnell Douglas Corp., 115 F.T.C. 33 (1992); In re Keystone Carbon, 115 F.T.C. 22 (1992); In re Konbacker, 115 F.T.C. 13 (1992); In re Elect. Data Sys., 114 F.T.C. 524 (1991).

²⁴United States v. Quality Terminal Servs., LLC, No. 09-CV-01853 (D. Colo. Aug. 11, 2009); United States v. Rail Terminal Servs., LLC, No. 09-CV-1111 (W.D. Wash. Aug. 11, 2009).

²⁵ United States v. Equifax Credit Info. Servs., Inc., No. 1:00-CV-0087 (N.D. Ga. Jan. 13, 2000); FTC v. Experian Mktg. Solutions, Inc., No. 3-00CV0056-L (N.D. Tex. Jan. 13, 2000); United States v. Trans Union LLC, No. 00C 0253 (N.D. Ill. Jan. 13, 2000). Equifax subsequently settled charges that it had violated the consent decree, and the FTC obtained another Order requiring the company to pay $250,000 in disgorgement. United States v. Equifax

²⁶United States v. Central Credit, LLC, No. CV-0565 (D. Nev. Apr. 22, 2010); see also United States v. TALX Corp., No. 4:09-CV-01071 (E.D. Mo. July 9, 2009) (consent order requiring the payment of $350,000 civil penalty). Credit Info. Servs., Inc., No. 1:00-CV-0087 (N.D. Ga. Jul. 30, 2003); see also United States v. First Advantage Safe Rent, Inc., No. 8:10-CV-00090-PJM (D. Md. Jan. 14, 2010); In re Trans Union Credit Info. Co., 102 F.T.C. 1109 (1983); FTC v. TRW Inc., 784 F. Supp. 361 (N.D. Tex. Dec. 10, 1991); In re Equifax Credit Info. Servs., Inc., 120 F.T.C. 577 (1995).

²⁷United States v. Far West Credit, Inc., No. 2:06-CV-00041(TC) (D. Utah Jan. 17, 2006); see also In re Equifax Credit Info. Servs., Inc., 120 FTC 577 (1995); In re Trans Union, 102 F.T.C. 1109 (1993); FTC v. TRW Inc., 784 F. Supp. 361 (N.D. Tex. Dec. 10, 1991).

²⁸http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre36.shtm.

²⁹http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre03.shtm.

³⁰http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre21.shtm

³¹https://www.consumer.ftc.gov/articles/0155-free-credit-reports

³²http://business.ftc.gov/.

³³https://www.ftc.gov/sites/default/files/documents/reports/40-years-experience-fair-credit-reporting-act-ftc-staff-report-summary.