Association of Workplace Investigators

Training Institute

ICRAA, FCRA, FACTA:Acronyms That Investigators and Clients Need to

Know

By Pamela L. Hemminger

Law Offices of Pamela L. Hemminger1720 Earlmont Ave.

La Canada Flintridge, CA 91011pamela.hemminger@gmail.com

818 790-6635

This paper is not intended to nor does not it constitute legal advice; no attorney-clientrelationship is established as a result of dissemination of this paper and any persons wishinglegal advice concerning the subject matter of this paper should consult their legal counsel.

i

TABLE OF CONTENTS

I. INTRODUCTION............................................................................................................ 1

II. KEY DEFINITIONS........................................................................................................ 2

A. "Consumer Report" (Federal Law)............................................................................... 2

B. "Investigative Consumer Report" (Federal Law) ......................................................... 3

C. “Consumer Credit Report” (California Law) ............................................................... 3

D. “Investigative Consumer Report” (California Law) ..................................................... 4

E. California / Federal Differences Re Types of Reports ................................................. 4

F. “Consumer Reporting Agency” (Federal Law) ............................................................ 5

G. “Investigative Consumer Reporting Agency” (California Law) .................................. 5

H. “Consumer Credit Reporting Agency” (California Law) ............................................. 5

III. INVESTIGATIONS AND FCRA................................................................................ 5

A. Historical Background Re Misconduct Investigations and Other Investigations......... 6

1. Pre-FACTA............................................................................................................... 6

2. Vail Letter ................................................................................................................. 6

3. FACTA Amendment................................................................................................. 6

B. “Consumer Reporting Agency” .................................................................................... 7

1. In-House Investigators .............................................................................................. 7

2. Outside Private Investigators .................................................................................... 7

3. Attorneys As “Consumer Reporting Agencies” ....................................................... 8

4. Employment Agencies ............................................................................................ 10

5. Exception for “Transactions or Experiences” Between Consumerand Investigator....................................................................................................... 10

6. “Regular” Report Preparation Required ................................................................. 11

ii

C. “Employment Purposes”............................................................................................. 11

1. Not Limited to Master / Servant Relationships....................................................... 11

D. Background / Screening Investigations -- Procedures................................................ 13

1. Employers’ Obligations .......................................................................................... 13

2. Consumer Reporting Agencies’ Obligations .......................................................... 14

3. Record Disposal ...................................................................................................... 18

E. Investigative Consumer Reports -- Additional Requirements.................................... 20

1. Additional Employer Obligations ........................................................................... 20

2. Additional Consumer Reporting Agency Obligations ............................................ 21

F. Workplace Misconduct Investigations Post-FACTA – Procedures ........................... 22

1. Not Related To Credit ............................................................................................. 22

2. Restricted Access .................................................................................................... 22

3. Subsequent Limited Disclosure Required............................................................... 22

G. FCRA Notice Forms................................................................................................... 23

H. Potential Civil Liability .............................................................................................. 23

1. Willful Noncompliance........................................................................................... 23

2. Negligent Noncompliance ...................................................................................... 23

I. Potential Criminal Liability ........................................................................................ 23

J. Administrative Enforcement....................................................................................... 24

IV. INVESTIGATIONS AND CALIFORNIA LAW ...................................................... 24

A. California Investigative Consumer Reporting Agencies Act(Civil Code §1786 et. seq.) .......................................................................................... 24

1. Employer Obligations ............................................................................................. 25

2. Obligations of Investigative Consumer Reporting Agency .................................... 27

B. Investigative Consumer Reports for Suspicion of Wrongdoing orMisconduct.................................................................................................................. 32

iii

1. Notice and Consent Not Required .......................................................................... 32

2. Report Copy Need Not Be Given To Consumer .................................................... 32

3. Adverse Action Notice Need Not Be Given ........................................................... 32

4. Right to Inspect Files of Investigative Consumer Reporting Agency .................... 32

5. Right to Obtain Report Copies from Investigative Consumer ReportingAgency .................................................................................................................... 33

6. Delayed Disclosure of Public Records In Internal Investigations ForSuspicion Of Wrongdoing Or Misconduct. ............................................................ 33

C. Obligations of Direct User of Public Records (Without Use of InvestigativeConsumer Reporting Agency) .................................................................................... 33

D. Consumer Credit Reporting Agencies Act (Civil Code §1785.1 et. seq.) .................. 34

E. Potential Civil Liability .............................................................................................. 36

1. Noncompliance with ICRA..................................................................................... 36

2. Noncompliance with Consumer Credit Reporting Agencies Act ........................... 36

V. PREEMPTION............................................................................................................... 37

A. General Principle ........................................................................................................ 37

B. Exceptions .................................................................................................................. 37

VI. TRAPS FOR THE UNWARY USING REPORTS ................................................... 37

A. Inquiries Into / Use of Information re Protected Status.............................................. 37

B. Credit Reports............................................................................................................. 38

1. California ................................................................................................................ 38

2. Washington ............................................................................................................. 39

3. Oregon..................................................................................................................... 39

4. Hawaii ..................................................................................................................... 39

5. Illinois ..................................................................................................................... 39

C. Adverse Impact of Credit History .............................................................................. 40

iv

D. Adverse Impact of Criminal Background Checks ...................................................... 40

E. Potential Aider / Abettor Liability.............................................................................. 41

F. Arrests / Certain Convictions – Specific Prohibitions................................................ 41

1. Arrest Records ........................................................................................................ 41

2. FEHC Regulations .................................................................................................. 42

3. Marijuana-related Convictions................................................................................ 42

4. “Rap Sheets” ........................................................................................................... 42

G. Medical Information ................................................................................................... 43

H. Unfair Business Practices Claims............................................................................... 43

APPENDIX 1: CHECKLIST FOR INVESTIGATORS PERFORMING WORKPLACEMISCONDUCT INVESTIGATIONS UNDER ICRAA

1

ICRAA, FCRA, FACTA:Acronyms That Investigators and Clients Need to Know

By Pamela L. Hemminger

I. INTRODUCTION

Both federal and California statutes regulating consumer reports, consumer credit reportsand/or investigative consumer reports potentially impact employment-related investigations andthe furnishing of various types of reports and information. These statutes impose obligations oninvestigators -- private investigators, attorneys and in-house human resource professionals andcounsel – that present traps for the unwary. Not only are the statutes and accompanyingregulations complex, dealing with many subjects in addition to workplace investigations, federaland California law differ such that integrating the requirements imposed by each is challenging,and there remain a number of unanswered questions.

The statutes which are the subject of this paper are the federal Fair Credit Reporting Act, asamended 15 U.S.C. §1681 et. seq. (FCRA), the Fair and Accurate Credit Transactions Act of2003 (FACT Act or FACTA), one of the acts amending FCRA, the California Credit ReportingAgencies Act, Civil Code §1785.1 et. seq. (CRAA) and the California Investigative ConsumerReporting Agencies Act, §1786 et. seq. (ICRAA). In 1990, the FTC had issued “Statements ofGeneral Policy or Interpretations” and Commentary concerning FCRA previously found at 16C.F.R. §600.1 et. seq. and Appendix to 16 C.F.R. Part 600. Then the FTC, acknowledging thatportions of the 1990 Commentary were obsolete, withdrew them and issued a July 2011 reportentitled 40 Years of Experience With the Fair Credit Reporting Act, An FTC Staff Report WithSummary of Interpretations, (“40 Years”) available atwww.ftc.gov/os/2011/07/110720fcrareport.pdf. The FTC did issue regulations at Congressionaldirection with respect to FACTA and subsequent amendments to FCRA. 16 CFR Parts 601-699.

Although the FTC was the government agency historically responsible for interpreting andenforcing FCRA, this changed with the enactment of the Dodd-Frank Wall Street Reform andConsumer Protection Act (Pub. L. 111-203, H.R. 4173), signed into law by President Obama onJuly 21, 2010. Dodd-Frank transferred rulemaking authority for FCRA to the ConsumerFinancial Protection Bureau (CFPB). The newly created CFPB has now become the agencyprimarily responsible for interpreting the FCRA. Thus, the FTC stated in 40 Years, at pp.1-2:

“Under the Consumer Financial Protection Act of 2010 (“CFPA) [Title X ofPub.L. 111-203 (Dodd-Frank Wall Street Reform and Consumer Protection Act)]the FTC retains its enforcement role but will share that role in many respects withthe newly-created Consumer Financial Protection Bureau (“CFPB”). The CFPBwill also take on primary regulatory and interpretative roles under theFCRA.” [emphasis added]

2

However, although the CFPB has general rulemaking and enforcement powerswith respect to FCRA, CFPB does not have explicit authority to supervise consumerreporting agencies. But, in July 2012, the CFPB adopted a rule providing for supervisionof defined consumer reporting agencies as "larger participants" under Dodd-Frank Act.The CFPB is authorized to supervise defined non-bank providers, and those include"larger participants" (those that have more than $7 million in annual receipts fromconsumer reporting activities).

It is not entirely clear to what extent 40 Years will accurately reflect the views ofthe CFPB and what role the FTC will play in the future with respect to FCRAinterpretation and enforcement.

The CFPB has now issued regulations found in appendices to 12 CFR Part 1022. EffectiveJanuary 1, 2013, certain FCRA notices have been modified. These include, among others: 1)Summary of Consumer Rights under the FCRA: Consumer reporting agencies must provide thisform to employers, and employers must provide it to applicants/employees when consumerreports are requested; (2) Notice to Users of Consumer Reports of their Obligations under theFCRA: Consumer reporting agencies must provide users with this notice; and 3) Notice toFurnishers of Information of their Obligations under the FCRA: Consumer reporting agenciesprovide this notice to designated furnishers of information.

Because of the extensive nature of the statutes, this paper is an overview and does not purportto be fully comprehensive. Details and exceptions to general rules are sometimes omitted in theinterest of clarity and succinctness. Whole areas of potential relevance are omitted, e.g. withrespect to all of the obligations of consumer reporting agencies, with respect to the handling ofcredit information and credit scores and with respect to identity theft issues.

II. KEY DEFINITIONS

To understand the application of relevant law, some basic definitions need to be understood.

A. "Consumer Report" (Federal Law)

"Consumer report" (federal law) means "any written, oral, or other communication of anyinformation by a consumer reporting agency bearing on a consumer's credit worthiness, creditstanding, credit capacity, character, general reputation, personal characteristics, or mode of livingwhich is used or expected to used or collected in whole or in part for the purpose of serving as afactor in establishing the consumer's eligibility for (A) credit or insurance to be used primarilyfor personal, family, or household purposes; (B) employment purposes; or (C) any other purposeauthorized under section 604 [15 U.S.C.§1681b].” Section 603(d)(1)1 [15 U.S.C.§1681a(d)(1)]

The purposes listed under section 604 are largely unrelated to employment-related consumerreports, although the following are potentially relevant: section 604 (a) (2) which provides that aconsumer report may be furnished “In accordance with the written instructions of the consumerto whom it relates.” and section 604(a)(3)(F) which provides that a consumer report may be

1 Throughout this paper, the section cited is that of the Fair Credit Reporting Act. It is followed by thecorresponding citation to the United States Code.

3

furnished to a person a consumer reporting agency has a reason to believe “otherwise has abusiness need for the information (i) in connection with a business transaction that is initiated bythe consumer; . . . .”

There are critically important exclusions from the definitions of “consumer report” includingcommunications in connection with investigations of suspected misconduct or policy violationsrelated to employment. Section 603(y) [15 U.S.C.§1681a(y)] See also Section 603(d)(2) [15U.S.C.§1681a(d)(1)] excluding “any report containing information solely as to transactions orexperiences between the consumer and the person making the report.” These are discussed inmore detail infra.

According to 40 Years, “[a] communication consisting solely of public record information isnot a ‘consumer report’ unless that information is provided by a CRA, is collected or used for thepurposes identified in section 603(d), and bears on at least one of the seven characteristics listedin the definition [credit worthiness, credit standing, credit capacity, character, generalreputation, personal characteristics, or mode of living]. Public record information relating torecords of arrest, bankruptcies, or the institution or disposition of civil or criminal proceedings,bears on one or more of these characteristics.” p. 21-22

B. "Investigative Consumer Report" (Federal Law)

An "investigative consumer report" is a consumer report or a portion thereof "in whichinformation on a consumer's character, general reputation, personal characteristics, or mode ofliving is obtained through personal interviews with neighbors, friends, or associates of theconsumer reported on or with others with whom he is acquainted or who may have knowledgeconcerning any such items of information. However, such information shall not include specificfactual information on a consumer's credit record obtained directly from a creditor of theconsumer or from a consumer reporting agency when such information was obtained directlyfrom a creditor of the consumer or from the consumer." Section 603(e) of the FCRA, 15 U.S.C.§1681a(e)

Note that an investigative consumer report under federal law is one in which information isgained through personal interviews and not through other means.

C. “Consumer Credit Report” (California Law)

A “consumer credit report” under California law means “any written, oral, or othercommunication of any information by a consumer credit reporting agency bearing on aconsumer's credit worthiness, credit standing, or credit capacity, which is used or is expected tobe used, or collected in whole or in part, for the purpose of serving as a factor in establishing theconsumer's eligibility for: (1) credit to be used primarily for personal, family, or householdpurposes, or (2) employment purposes, or (3) hiring of a dwelling unit . . ., or (4) other purposesauthorized in Section 1785.11.” Civil Code §1785.3(c)

Permissible purposes also include “[i]n accordance with the written instructions of theconsumer to whom it relates” Civil Code §1785.11(2), and pursuant to Civil Code§1785.11(3)(F) which provides that a consumer credit report may be furnished to a person the

4

consumer reporting agency has a reason to believe “[o]therwise has a business need for theinformation in connection with a business transaction that is initiated by the consumer; . . . .”

There are exclusions from the definitions of “consumer credit report” including Civil Code§1785.3(c) excluding “any report containing information solely as to transactions or experiencesbetween the consumer and the person making the report.”

D. “Investigative Consumer Report” (California Law)

The term "investigative consumer report" means “a consumer report in which information ona consumer's character, general reputation, personal characteristics, or mode of living is obtainedthrough any means. The term does not include a consumer report or other compilation ofinformation that is limited to specific factual information relating to a consumer's credit record ormanner of obtaining credit obtained directly from a creditor of the consumer or from a consumerreporting agency when that information was obtained directly from a potential or existingcreditor of the consumer or from the consumer. . . .” Civil Code §1786.2(c)

E. California / Federal Differences Re Types of Reports

A “consumer report,” then, under federal law is broadly defined. It is not restricted to creditinformation, and the term includes, for example, reports that are limited to criminal records,education, driving record and the like which contain no credit information at all. UnderCalifornia law, the term “consumer credit report” is restricted to reports that are credit-related.Under federal law, an “investigative consumer report” is a type of “consumer report” narrowlydefined to include reports containing information obtained through interviews. Under Californialaw an “investigative consumer report” is broadly defined to include reports containinginformation about a consumer's character, general reputation, personal characteristics, or mode ofliving, however obtained and is not restricted to information obtained through personalinterviews personal interviews.

Examples:

Report containing information concerning credit history – it is a “consumer report”under federal law and a “consumer credit report” under California law.

Report containing information from DMV and criminal convictions obtained fromcomputer checks or check of court records (no interviews) – it is a “consumer report”under federal law and an “investigative consumer report” under California law.

Report containing information about a prospective employee’s reputation and honestyobtained from interviews – it is an “investigative consumer report” which is a type ofconsumer report under federal law and an “investigative consumer report” underCalifornia law.

Report containing information about an investigation of a complaint of harassment byan employee in which interviews are conducted – it would be an “investigativeconsumer report” which is (i) a type of consumer report under federal law except that

5

it is excluded from the definition if certain conditions and procedures are followed asexplained infra in the post-FACTA discussion and (ii) an “investigative consumerreport” under California law but one treated differently than other “investigativeconsumer reports” which do not involve investigation of employee wrongdoing.

The distinction between “consumer reports” under federal law, “consumer credit reports”under California law, and “investigative consumer reports” under both federal and Californialaw, is important because of the differing rules that apply depending on the type of report.

F. “Consumer Reporting Agency” (Federal Law)

The term “consumer reporting agency” under FCRA means “any person which, for monetaryfees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in thepractice of assembling or evaluating consumer credit information or other information onconsumers for the purpose of furnishing consumer reports to third parties, and which uses anymeans or facility of interstate commerce for the purpose of preparing or furnishing consumerreports.” Section 603(e) [15 U.S.C. §1681a(e)]

G. “Investigative Consumer Reporting Agency” (California Law)

The term "investigative consumer reporting agency" means “any person who, for monetaryfees or dues, engages in whole or in part in the practice of collecting, assembling, evaluating,compiling, reporting, transmitting, transferring, or communicating information concerningconsumers for the purposes of furnishing investigative consumer reports to third parties, but doesnot include any governmental agency whose records are maintained primarily for traffic safety,law enforcement, or licensing purposes, or any licensed insurance agent, insurance broker, orsolicitor, insurer, or life insurance agent.” Civil Code §1786.2(d)

H. “Consumer Credit Reporting Agency” (California Law)

"Consumer credit reporting agency" means “any person who, for monetary fees, dues, or on acooperative nonprofit basis, regularly engages in whole or in part in the business of assemblingor evaluating consumer credit information or other information on consumers for the purpose offurnishing consumer credit reports to third parties, but does not include any governmental agencywhose records are maintained primarily for traffic safety, law enforcement, or licensingpurposes.“ Civil Code §1785.3(d)

III. INVESTIGATIONS AND FCRA

For investigators and clients to determine their obligations under FCRA it is important todetermine what type of investigation is being conducted – whether it is a backgroundinvestigation or whether it is an investigation into potential employee misconduct. It also must bedetermined whether it is being conducted by a “consumer reporting agency,” an “investigativeconsumer reporting agency” or a “consumer credit reporting agency.”

6

A. Historical Background Re Misconduct Investigations and OtherInvestigations

1. Pre-FACTA

Prior to the enactment of the Fair and Accurate Credit Transactions Act of 2003 (FACT Actor FACTA), FCRA did not distinguish between workplace investigations of potential employeewrongdoing and investigations for other purposes, e.g. screening / background investigations.

2. Vail Letter

This did not receive a great deal of attention until, in 1999, the FTC issued a staff opinionletter which became known as the “Vail Letter.” (FTC Opinion Letter to Judi A. Vail fromChristopher Keller dated April 5, 1999) In that letter, the author stated that FCRA’s notice anddisclosure rules applied when an employer hires outside investigators such as lawyers andprivate investigators to investigate allegations of workplace misconduct such as sexualharassment. Because advance disclosure can impede an investigation, because requiring consentenables an employee to prevent an investigation by refusing consent and because providing acopy of the report to the employee who is the subject of the investigation can chill theinvestigation, the Vail Letter resulted in much consternation among investigators and theemployment community.

3. FACTA Amendment

In response to the concerns raised, FACTA was enacted in 2003 [Public Law 108-59],amending FCRA to exclude from the definition of “consumer report,” a communication made toan employer in connection with an investigation of suspected misconduct relating toemployment, compliance with Federal, State, or local laws and regulations, the rules of a self-regulatory organization, or any preexisting written policies of the employer.” Section 603(y)(1)[15 U.S.C. § 1681a(y)(1)] [Originally the amendment was codified at section 603(x)(1) [15U.S.C. § 1681a(x)(1), but the subsection number changed as a result of later amendments.] Theterm “self-regulatory organization” includes “any self-regulatory organization (as defined insection 3(a)(26) of the Securities Exchange Act of 1934), any entity established under title I ofthe Sarbanes-Oxley Act of 2002, any board of trade designated by the Commodity FuturesTrading Commission, and any futures association registered with such Commission.” Section603(y)(3) [15 U.S.C. §1681a(y)(3)]

“Pre-existing written policies” means reasonable rules relating to the job. A report qualifiesunder this section only if it bears on compliance with the policy.” 40 Years, p.40

IMPORTANT: If an employer takes adverse action based upon such a report, it mustprovide the employee a summary of “the nature and substance of the information.” Section603(y)(2) [15 U.S.C. §1681a(y)(2)] This does not require that information sources be named.40 Years, p.40

7

B. “Consumer Reporting Agency”

Because “consumer reports” are reports prepared by a “consumer reporting agency,” it iscritical to determine whether the investigator in a particular case is a “consumer reportingagency” under FCRA. An in-house investigator employed by the employer is generally not a“consumer reporting agency,” and an outside private investigator generally is. The law is lessclear with respect to outside attorneys. The FTC appears to take the position that an attorneywho conducts a workplace investigation is a “consumer reporting agency.” However, substantialpublic policy arguments can be made that, at least in some circumstances, an outside attorney isnot a “consumer reporting agency;” at least one court has so held. This distinction is of lessimportance than it was pre-FACTA, since reports of investigations of misconduct andcompliance with written employer policy are now outside the scope of “consumer report” suchthat the issue of whether the investigator is a “consumer reporting agency” is not reached.

1. In-House Investigators

In-house human resource professionals and in-house counsel are not consumer reportingagencies under FCRA because they generally do not furnish consumer reports to “third parties.”“An agent or employee that obtains consumer reports does not become a CRA by sharing suchreports with its principal or employer in connection with the purposes for which the reports wereinitially obtained. 40 Years, p. 31

2. Outside Private Investigators

In 1998, in a Staff Opinion Letter, staff responded affirmatively to an inquiry from Cargill,Incorporated whether private investigators are “consumer reporting agencies” within themeaning of FCRA when they otherwise satisfy the applicable definitions. An excerpt from theStaff Opinion Letter follows:

“2. Are private investigators and court researchers considered a consumerreporting agency if they are obtaining information directly from the courts andreporting back to Cargill with the results?

Private investigators and records search firms that Cargill hires to report oncourt records are CRAs under the definition set forth in Section 603(f); individualresearchers hired by such firms are not. See the enclosed staff opinion letter(LeBlanc, 6/9/98), where we discuss the status of such parties in detail.

3. When using a private investigator or court researcher to conduct a search ofcriminal or civil court records on an individual as part of a company internalinvestigation (i.e. fraud, theft etc.) is it necessary to obtain authorization and asigned disclosure from the individual prior to the search?

Yes. If an employer obtains such information from any CRA (includingprivate investigators or record search firms, as discussed in item #2 above) as partof an internal investigation, it is "using consumer reports for employmentpurposes" and thus must comply with Section 604(b) that requires the employer tomake a disclosure and obtain a written consent before obtaining any consumer

8

report. See the enclosed staff opinion letter (Brisch, 6/11/98), where we respondto similar questions.

4. If a company hires a private investigator or court researcher to perform acriminal or civil records search and obtains copies of actual court documents,without generating their own report, is this considered a consumer report and dothe same requirements apply?

Yes. The term "consumer report" is defined by Section 603(d)(1) of the FCRAto mean any communication "bearing on a consumer's credit worthiness, creditstanding, credit capacity, character, general reputation, personal characteristics, ormode of living" by a CRA. (As discussed in item #2 above, a records search firmor private investigator hired by Cargill is a CRA.) In forwarding court documentsto a client in response to a request for a criminal or civil records search on anamed individual, the investigator is a CRA communicating information aboutsome or all of those factors as they relate to that person. At a minimum, theserecords bear on an individual's character and general reputation, and may bear oncredit factors as well.”

FTC Opinion Letter to Steven W. Slyter, Cargill, Incorporated from Clarke W.Brinkerhoff dated June 12, 1998)

The FTC provides the following example: “[W]hen a private investigator who compilesand provides court documents to employer clients requests criminal or civil records onemployees or job applicants, the investigator is a CRA providing a “consumer report.” 40 Years,p.22.

3. Attorneys As “Consumer Reporting Agencies”

In the pre-FACTA Vail Letter”(FTC Opinion Letter to Judi A. Vail from Christopher Kellerdated April 5, 1999), it is asserted that “outside organizations such as law firms and consultantswho conduct sexual harassment investigations are “consumer reporting agencies.’” StaffOpinion Letter to Judi A. Vail from Christopher Keller dated April 5, 1999 (“Vail Letter”) Thesame position was taken by the then-General Counsel of the FTC in “Prepared Statement of theFederal Trade Commission Before the House Banking and Financial Services CommitteeSubcommittee on Financial Institutions and Consumer Credit.” She stated:

9

“As a consequence of the 1996 amendments (and because the operative FCRAdefinitions are broad), an outside entity, such as a private investigator or law firm,that regularly conducts investigations of alleged workplace misconduct byemployees will generally qualify as a "consumer reporting agency" and thereports it makes to the employer will likely be "consumer reports" within themeaning of the FCRA. Indeed, because such investigations typically includeinterviews at the workplace, the resultant report is an "investigative consumerreport" within the meaning of the FCRA. Additional FCRA protections apply forinvestigative consumer reports, including notice to the consumer that aninvestigative consumer report may be obtained.” [citations omitted]

www.ftc.gov/os/2000/05/fcratestimony.htm

See also: Letter of Robert Pitofsky, Chairman, FTC to The Honorable Pete Sessions datedMarch 31, 2000 re H.R. 3408, the “Fair Credit Reporting Amendments Act of 1999.”www.ftc.gov/os/2000/03/sessionletterrehr3408.htm.

Of course, following FACTA, investigations of workplace misconduct are not “consumerreports,” such that the notice and disclosure rules of FCRA normally applicable to consumerreports for employment-related purposes do not apply. However, the question remains whetherattorney-conducted investigations that do not fall within the FACTA exclusion for investigationsre workplace misconduct are “investigative consumer reports” or “consumer reports” underFCRA. The FTC, at least pre-FACTA, seemed to have no difficulty including attorneys as“consumer reporting agencies” when a generally applicable exclusion didn’t otherwise apply.

However, this view has not been uniformly accepted. In Hartman v. Lisle Park District, 158F. Supp. 2d 869 (N.D. Ill. 2001), a pre-FACTA case, the court rejected the conclusions of theFTC in the Staff Opinion Letters. In Hartman, employee Hartman contended that FCRA wasviolated because her employer had retained an attorney who investigated her in the course ofinvestigating her complaints about financial wrongdoing of others. She contended that aconsumer report within the meaning of FCRA was prepared and that FCRA was violated becauseher employer did not notify her of the investigation, did not obtain her consent and did notprovide her with a copy of the report. The court granted summary judgment to the employer.First, the court found the FTC Opinion letters unpersuasive and rejected their construction of thestatute. It stated:

“There is nothing in the FCRA or its history that indicates that Congress intendedto abrogate the attorney-client or work-product privileges, as would be the effectof applying the FCRA's requirements (which include disclosure of the report) toreports of the type at issue in this case. Moreover, we think that a report preparedby an attorney about an employee's transactions or experiences with the attorney'sclient (the employer) qualifies as a "report containing information solely as totransactions or experiences between the consumer and the person making thereport" within the meaning of § 1681a(d)(2)(A)(i), even though the report isprepared by an entity other than the employer. Accord, Friend v. Ancillia SystemsInc., 68 F.Supp.2d 969, 974 (N.D.Ill.1999). An attorney is the agent of his client,Steffes v. Stepan Co., 144 F.3d 1070, 1075 (7th Cir.1998), and the client is bound

10

by the attorney's acts and statements made within the scope of their relationship.Diersen v. Chicago Car Exchange, 110 F.3d 481, 489 n. 8 (7th Cir.1997); UnitedStates v. 7108 West Grand Ave., Chicago, Illinois, 15 F.3d 632, 633 (7thCir.1994). Thus an attorney is not a "third party" in the same way that a creditbureau or a detective agency would be in this context. Unlike those types ofcontract workers, the attorney has a relationship of trust, confidence, andconfidentiality with his client and owes the client a duty of loyalty that amongother things precludes the attorney from taking on engagements that would giverise to a conflict with the client's interests. [citations omitted] When an attorneyconducts for an employer/client an investigation of an employee's dealings withthe employer, he is acting as the client, just as would be the case if the employerhad one of its employees conduct the investigation. This is qualitatively differentfrom the situation that exists when an employer contracts with an outside entitylacking a fiduciary and agency relationship like that of attorney and client.

158 F. Supp. 2d 869, 876-877

It is not clear how dependent the ruling is on the nature of the relationship between theemployer and attorney – whether the attorney needs to be conducting the investigation as oneprotected by the attorney-client privilege – at least initially. That this issue has not arisen morefrequently is probably due to the FACTA amendments carving out investigations of potentialemployee wrongdoing from the definition of a “consumer report.”

4. Employment Agencies

Section 603(o) exempt from the FCRA communications by employment agencies engaged inprocuring jobs. However, an employment agency that routinely obtains information on jobapplicants from their former employers and furnishes the information to prospective employers isa consumer reporting agency. 40 Years, p.24

5. Exception for “Transactions or Experiences” Between Consumer andInvestigator

As discussed supra, at III.B.3, in the Hartman case, 158 F. Supp. 2d 869, the court found thata report prepared by an attorney about an employee's transactions or experiences with theattorney's client (the employer) qualifies as a "report containing information solely as totransactions or experiences between the consumer and the person making the report." Thus, itwas not a “consumer report” based upon the exclusion from the definition of “consumer report”“any report containing information solely as to transactions and experiences between theconsumer and the person making the report. Section 603(d)(2)(A)(1) [15 U.S.C.§1681a(d)(2)(A)(1)]

This argument was also made in Salazar v. Golden State Warriors, 124 F.Supp.2d 1155(N.D.Cal. 2000), a pre-FACTA case in which a private investigator made a report aftersurveilling and videotaping an employee whose behavior suggested the use of cocaine. Hisemployment was terminated as a result, and he sued for violation of FCRA. The district court

11

granted summary judgment to the employer finding that the report contained information “solelyas to transactions or experiences between the consumer and the person making the report.”

The Salazar court relied on the 5th Circuit decision in Hodge v Texaco, 975 F.2d 1093 (5th

Cir. 1992) in which the court addressed the issue whether a report of the results of a drug testfrom a lab was a “consumer report.” The court concluded that the lab’s urinalysis report was a“transaction or experience” between the reporter (the lab) and the consumer (the employee)because the report only included the lab’s first-hand experience with the urine sample, with noreliance on information from a third party. It noted that its holding was consistent with theFTC’s interpretation, citing the Appendix to Part 600. It rejected the argument that thetransaction or experience needs to be directly between the consumer and the person issuing thereport – a mutual interaction. What is required is that the reporter has first-hand knowledge ofthe information included in the report. The FTC shares this view of drug test resultscommunicated directly to the employer. 40 Years, p.24.

In 40 Years, additional examples that fall within the exception are cited, including, acommunication by an employer describing the employee’s job performance and personalobservations of an investigator (for example, making a video of events). 40 Years, p.24.

6. “Regular” Report Preparation Required

If an individual does not regularly engage in the activity of preparing what would otherwisebe a “consumer report,” that individual is not a “consumer reporting agency.” Section 603(f) ofthe FCRA, 15 U.S.C. §1681a(f).

Given the fact that investigations of workplace misconduct are not “consumer reports,” if thestatutory criteria are met, application of this statutory provision should result in the conclusionthat one who exclusively performs investigations of workplace misconduct or who only rarelyprepares “consumer reports,” such as background screening, is not a “consumer reportingagency.”

C. “Employment Purposes”

The term “employment purposes” when used in connection with a consumer report means “areport used for the purpose of evaluating a consumer for employment, promotion, reassignmentor retention as an employee.” Section 603(h) of the FCRA, 15 U.S.C. §1681a(h).

1. Not Limited to Master / Servant Relationships

While the definition of “employment purposes” seems to be limited to traditional employer /employee relationships, the courts have interpreted the phrase to extend well beyond thecommon law concept of master / servant to include independent contractors and partners.

For example, in Hoke v. Retail Credit Corp., 521 F.2d 1079 (4th Cir. 1975), cert. denied 423U.S. 1087 (1976), the Fourth Circuit held that a “personal report” regarding a doctor issued by acredit reporting agency to the state board of medical examiners to assist the board in evaluatingthe doctor’s application for a medical license was a “consumer report” because it was furnishedfor “employment purposes.” Id. at 1081-82. The Fourth Circuit reversed the District Court

12

which had granted summary judgment to the credit reporting agency based upon its conclusionthat the report was not a “consumer report and was therefore not covered by FCRA. The FourthCircuit held that using information in connection with a decision to issue a medical license,which would impact a doctor’s ability to join a medical practice as an employee or partner, wasan employment purpose and therefore the report was covered by FCRA.

“If we were to apply the common law concept of employee, we wouldundoubtedly conclude that a physician who practiced his profession as a solepractitioner or as a member of a medical partnership was an independentcontractor, and not an employee because of the absence of control over themanner in which he afforded expert medical services. But in construing FCRA,we are cognizant of its broad remedial purposes, . . . , and we are not constrainedto limit its application by the common-law concept of master and servant.

Id. At 1082 n. 7

The FTC has also broadly interpreted the phrase “employment purposes” to includeindependent contractors. In a February 23, 1998 Staff Opinion Letter (FTC Opinion Letter toHerman Allison from Ronald G. Isaac dated February 23, 1998), the FTC opined that a truckingcompany’s use of information to evaluate whether to engage truckers as independent contractorswas an “employment purpose” under FCRA.

“Therefore, we conclude that a trucking operation that uses consumer reportsto evaluate whether to engage individuals as drivers must comply with theapplicable provisions of the FCRA pertaining to consumer reports obtained foremployment purposes, including the disclosure and authorization provisions ofSection 604(b), Section 606, and Section 615. If the trucking operation were notto obtain consumer reports on prospective drivers for "employment purposes," itwould appear to have no permissible purpose under the FCRA for obtaining suchreports, absent the drivers' written authorizations.”

It also opined:

“Incidentally, a homeowner who is considering hiring an individual to performservices for the homeowner is indeed required to comply with the FCRA whenobtaining a "consumer report" on that individual (which includes either the creditreport or criminal background check you mentioned), and thus must abide by theapplicable disclosure and authorization provisions of Section 604(b), Section 606,and Section 615 like any other employer.”

In 40 Years, it states:

“Because the term ‘employment purposes’ is interpreted liberally to effectuate thebroad remedial purposes of the FCRA, it may apply to situations where an entityuses individuals who are not technically employees to perform duties [footnoteomitted]. Thus, it includes a trucking company that obtains consumer reports onindividual drivers who own and operate their own equipment [footnote omitted]; a titleinsurance company that obtains consumer reports on individuals with whom it frequently

13

enters into contracts to sell its insurance, examine title, and close its real propertytransactions [footnote omitted]; or a nonprofit organization that is staffed in whole or inpart by volunteers.” 40 Years, p. 32

D. Background / Screening Investigations -- Procedures

A “consumer report” in the nature of a background investigation is as defined, supra, at II.A.Employers commonly use them to screen for matters such as credit history, driving history,education, prior employment, criminal background, workers’ compensation claims, and litigationhistory.

1. Employers’ Obligations

a) Advance Disclosure/Consent

(1) An employer must make a clear and conspicuous disclosureto the employee/applicant in writing at any time before the reportis procured or caused to be procured that a consumer report may beobtained for employment purposes. The document must consistsolely of the disclosure; Section 604(b)(2)(A)(i) [15 U.S.C.§1681b(b)(2)(A)(i)] and

(2) The employee/applicant must authorize the report inwriting. The authorization may be made on the same document asthe disclosure document. Section 604(b)(2)(A)(ii) [15 U.S.C.§1681b(b)(2)(A)(ii)]

(3) NOTE: There are alternatedisclosure/authorization/adverse action procedures for truckingjobs over which the Secretary of Transportation has the power toestablish qualifications and maximum hours of service pursuant tothe provisions of section 31502 of title 49, or a position subject tosafety regulation by a State transportation agency, if certaincircumstances exist. Section 604(b)(2)(B), (C) [15 U.S.C.§1681b(b)(2)(B), (C)]; Section 604(b)(3)(B), (C) [15 U.S.C.§1681b(b)(3)(B), (C)] There are other exceptions as well, e.g. fornational security investigations. Section 604(b)(4), (C) [15 U.S.C.§1681b(b)(4)]

b) Pre-Adverse Action Notice

Before taking any adverse action based in whole or in part on thereport, an employer intending to take adverse action must provideto the employee / applicant to whom the report relates a copy ofthe report and a copy of “A Summary of Your Rights Under theFair Credit Reporting Act” available from the FTC. Section604(b)(3)(A) [15 U.S.C. §1681b(b)(3)(A)] With respect toemployment, “adverse action” means “a denial of employment or

14

any other decision for employment purposes that adversely affectsany current or prospective employee.” Section 603(k)(1)(B)(ii)[15 U.S.C. §1681a(k)(1)(B)(ii)]

c) Post-Adverse Action Notice

After the adverse action is taken, the employer must provide thefollowing under Section 615(a)(1) – (4) [15 U.S.C. §1681m(a)(1) –(4)];

(1) Oral, written or electronic notice of the adverse action,

(2) Written or electronic notice of any numerical credit scoreused in taking the adverse action together with specifiedinformation about credit scores;

(3) Oral, written or electronic notice of the name, address andtelephone number of the consumer reporting agency (including atoll-free number established by the agency if it compiles andmaintains files on consumers on a nationwide basis) that furnishedthe report and a statement that the consumer reporting agency didnot make the decision to take the adverse action and is unable toprovide the specific reasons why the adverse action was taken;and

(4) oral, written or electronic notice of (i) the right to obtain,under section 612 [15 U.S.C. §1681j], a free copy of the consumerreport from the consumer reporting agency, which notice mustinclude an indication of the 60-day period for obtaining the copy,and (ii) the right to dispute the accuracy or completeness of anyinformation in the report under section 611 [15 U.S.C. §1681i].

2. Consumer Reporting Agencies’ Obligations

a) Certification

A consumer reporting agency is able to furnish a consumer reportfor employment purposes only if it obtains a certification from theperson obtaining the report –usually the employer or theemployer’s agent – that:

15

(1) The person has complied with the disclosure /authorization requirements outlined, supra, at III.D.1.a),and will comply with the pre-adverse action requirementsoutlined, supra, at III.D.1.b), with respect to the consumerreport if it becomes applicable (Section 604(b)(1)(A)(i) [15U.S.C. §1681b(b)(1)(A)(i)]) and

(2) The information from the consumer report will notbe used in violation of any applicable federal or state equalemployment opportunity law or regulation. (Section604(b)(1)(A)(ii) [15 U.S.C. §1681b(b)(1)(A)(ii)]) and

(3) The consumer reporting agency must provide withthe report, or have previously provided, a summary of theconsumer's rights. Section 604(b)(1)(B) [15 U.S.C.§1681b(b)(1)(B)])

b) Permissible Purposes

The consumer reporting agency must also have reason to believethat the user intends to use the information for a permissiblepurpose or otherwise has a legitimate business need for theinformation (i) in connection with a business transaction that isinitiated by the consumer; or (ii) to review an account to determinewhether the consumer continues to meet the terms of the account.Section 604(a)(3)(B), (F) [15 U.S.C. §1681a(a)(3)(B), (F)]

c) Allowed and Disallowed Content

(1) Medical information may be furnished for employmentpurposes if (i) the information to be furnished is relevant to processor effect the employment transaction; and (ii) the consumerprovides specific written consent for the furnishing of the reportthat describes in clear and conspicuous language the use for whichthe information will be furnished. Section 604(g) [15 U.S.C.§1681b(g)]

(2) No consumer reporting agency may make any consumerreport containing any of the following items of information:

“(1) Cases under title 11 [United States Code] or under theBankruptcy Act that, from the date of entry of the order forrelief or the date of adjudication, as the case may be,antedate the report by more than 10 years.

(2) Civil suits, civil judgments, and records of arrest thatfrom date of entry, antedate the report by more than seven

16

years or until the governing statute of limitations hasexpired, whichever is the longer period.

(3) Paid tax liens which, from date of payment, antedate thereport by more than seven years.

(4) Accounts placed for collection or charged to profit andloss which antedate the report by more than seven years[with certain exceptions].

(5) Any other adverse item of information, other thanrecords of codes that do not identify, or provideinformation sufficient to infer, the specific provider or thenature of such services, products, or devices to a personother than the consumer; or

(6) The report is being provided to an insurance companyfor a purpose relating to engaging in the business ofinsurance other than property and casualty insurance.”

Section 605(a), (b), [15 U.S.C. §1681c(a), (b)]

There are exceptions to the prohibitions above. For example, Nos.1-5 are not applicable to the employment of any individual at anannual salary which equals or may reasonably be expected to equal$75,000 or more.

d) Public Record Information

A consumer reporting agency which furnishes a consumer reportfor employment purposes and compiles and reports items ofinformation which are matters of public record and are likely tohave an adverse effect upon the consumer's ability to obtainemployment must:

17

(1) at the time such public record information isreported to the user of such consumer report, notify theconsumer of the fact that public record information is beingreported by the consumer reporting agency, together withthe name and address of the person to whom suchinformation is being reported; or

(2) maintain strict procedures designed to insure thatwhenever public record information which is likely to havean adverse effect on a consumer's ability to obtainemployment is reported, it is complete and up to date.Items of public record relating to arrests, indictments,convictions, suits, tax liens, and outstanding judgments areconsidered up to date if the current public record status ofthe item at the time of the report is reported.

Section 613(a), [15 U.S.C. §1681k(a)]

There is a national security exemption. Section 613(b), [15 U.S.C.§1681k(b)]

e) Compliance Procedures

(1) Every consumer reporting agency must maintainreasonable procedures designed to avoid violations ofsection 605 [15 U.S.C. §1681c] relating to content ofconsumer reports and to limit the furnishing of consumerreports to the permissible purposes listed under section 604[15 U.S.C. §1681b]. These procedures require thatprospective users of the information identify themselves,certify the purposes for which the information is sought,and certify that the information will be used for no otherpurpose. Every consumer reporting agency must make areasonable effort to verify the identity of a new prospectiveuser and the uses certified by such prospective user prior tofurnishing such user a consumer report. No consumerreporting agency may furnish a consumer report to anyperson if it has reasonable grounds for believing that theconsumer report will not be used for a permissible purpose.Section 607(a) [15 U.S.C. §1681e(a)]

(2) Whenever a consumer reporting agency prepares aconsumer report it must follow reasonable procedures toassure maximum possible accuracy of the informationconcerning the individual about whom the report relates.Section 613(b) [15 U.S.C. §1681k(b)]

18

(3) A consumer reporting agency may not prohibit auser of a consumer report furnished by the agency on aconsumer from disclosing the contents of the report to theconsumer, if adverse action against the consumer has beentaken by the user based in whole or in part on the report. .Section 613(c) [15 U.S.C. §1681k(c)]

(4) A consumer reporting agency shall provide to anyperson who regularly and in the ordinary course of businessfurnishes information to the agency with respect to anyconsumer or to whom a consumer report is provided by theagency, a notice of such person's responsibilities. Section613(d) [15 U.S.C. §1681k(d)]

f) Disclosure of Information on File to Consumers

There is a general requirement that consumer reporting agenciesclearly and accurately disclose all information in their files to aconsumer who requests it including sources of information (exceptfor investigative consumer reports), persons who procured a reportfor employment purposes during the preceding 2 years (1 year fornon-employment purposes. FCRA contains exemptions and otherdetails concerning the disclosure. Sections 609(a), 610 [15 U.S.C.§§1681g(a), 1681h]

g) Procedures in Cases of Disputed Accuracy

If a consumer disputes the completeness or accuracy ofinformation in a consumer report, a reinvestigation is required.Section 611 [15 U.S.C. §§1681i]

3. Record Disposal

Under FACTA (at section 628 (15 U.S.C. §1681w)), the FTC was directed to prepareregulations regarding the proper disposal of consumer report information and records. Theregulations are found at 16 CFR Part 682. (See 69 FR 68690Nov. 24, 2004) for commentary rethe regulations.)

The rules apply to “any person that, for a business purpose, maintains or otherwise possessesconsumer information, or any compilation of consumer information. The entities covered by therule would include consumer reporting agencies, resellers of consumer reports, lenders, insurers,employers, landlords, government agencies, mortgage brokers, automobile dealers, wastedisposal companies, and any other business that possesses or maintains consumer information.”69 FR 68695-96 “Consumer information” means “any record about an individual, whether inpaper, electronic, or other form, that is a consumer report or is derived from a consumer report.”16 CFR §682.1(b) The basic rule is as follows:

19

“(a) Standard. Any person who maintains or otherwise possesses consumerinformation for a business purpose must properly dispose of such information by takingreasonable measures to protect against unauthorized access to or use of the information inconnection with its disposal.

(b) Examples. Reasonable measures to protect against unauthorized access to or useof consumer information in connection with its disposal include the following examples.These examples are illustrative only and are not exclusive or exhaustive methods forcomplying with the rule in this part.

(1) Implementing and monitoring compliance with policies and procedures thatrequire the burning, pulverizing, or shredding of papers containing consumerinformation so that the information cannot practicably be read or reconstructed.

(2) Implementing and monitoring compliance with policies and procedures thatrequire the destruction or erasure of electronic media containing consumerinformation so that the information cannot practicably be read or reconstructed.

(3)After due diligence, entering into and monitoring compliance with a contractwith another party engaged in the business of record destruction to dispose ofmaterial, specifically identified as consumer information, in a manner consistent withthis rule . . . .

(4) For persons or entities who maintain or otherwise possess consumerinformation through their provision of services directly to a person subject to thispart, implementing and monitoring compliance with policies and procedures thatprotect against unauthorized or unintentional disposal of consumer information, anddisposing of such information in accordance with examples (b)(1) and (2) of thissection.

* * * *”

16 CFR §682.3

20

E. Investigative Consumer Reports -- Additional Requirements

1. Additional Employer Obligations

a) Employer’s Disclosure

An employer must make a clear and accurate disclosure to theemployee/applicant that an investigative consumer report includinginformation as to his character, general reputation, personalcharacteristics and mode of living, whichever are applicable, maybe made. The disclosure must be in a writing that is mailed orotherwise delivered to the consumer not later than 3 days after thedate on which the report was first requested and must include astatement informing the consumer of his right to request additionaldisclosures as set forth in the immediately following subsectionand include “A Summary of Your Rights Under the Fair CreditReporting Act” available from the FTC. The employer mustcertify that it has made the required disclosures and will complywith the requirements of Section 606(b) [15 U.S.C. §1681d(b)],referenced in the immediately succeeding paragraph. Section606(a)(1), (2) [15 U.S.C. §1681d(a)(1), (2)]

b) Employer’s Further Disclosure Upon Request Re Nature andScope of Investigation.

Upon written request made by the employee/applicant within areasonable period of time after the receipt by him of the disclosurerequired by Section 606(a)(1), (2) [15 U.S.C. §1681d(a)(1), (2)](see immediately preceding paragraph), the employer must make acomplete and accurate disclosure of the nature and scope of theinvestigation requested. This disclosure must be made in a writingmailed, or otherwise delivered, to the employee / applicant notlater than five days after the date on which the request for suchdisclosure was received from the employee / applicant or suchreport was first requested, whichever is later. Section 606(b) [15U.S.C. §1681d(b)]

c) Reasonable Procedures Defense

FCRA does provide a defense for violation of the above disclosurerequirements. It provides that “[n]o person may be held liable forany violation . . . if he shows by a preponderance of the evidencethat at the time of the violation he maintained reasonableprocedures to assure compliance . . . . Section 606(c) [15 U.S.C.§1681d(c)]

21

2. Additional Consumer Reporting Agency Obligations

a) Certificate of Compliance / No Unlawful Inquiries

The consumer reporting agency must obtain a certificate ofcompliance from the employer re compliance with the additionalobligations imposed as discussed supra and may not make anyinquiries if the making of the inquiry by an employer orprospective employer would violate any applicable federal or stateequal employment opportunity law. Section 606(d)(1),(2) [15U.S.C. §1681d(d) (1),(2)].

b) Certain Public Record Information

Except as otherwise provided at Section 613 [15 U.S.C. §1681k], aconsumer reporting agency may not furnish an investigativeconsumer report that includes public record information and thatrelates to an arrest, indictment, conviction, civil judicial action, taxlien, or outstanding judgment, unless the agency has verified theaccuracy of the information during the 30-day period ending on thedate on which the report is furnished. Section 606(d)(3) [15U.S.C. §1681d(d)(3)]

c) Certain Adverse Information.

A consumer reporting agency may not prepare or furnish aninvestigative consumer report on a consumer that containsinformation that is adverse to the interest of the consumer and thatis obtained through a personal interview with a neighbor, friend, orassociate of the consumer or with another person with whom theconsumer is acquainted or who has knowledge of such item ofinformation, unless (A) the agency has followed reasonableprocedures to obtain confirmation of the information, from anadditional source that has independent and direct knowledge of theinformation; or (B) the person interviewed is the best possiblesource of the information. Section 606(d)(4) [15 U.S.C.§1681d(d)(4)]

d) Reusing Adverse Information

Whenever a consumer reporting agency prepares an investigativeconsumer report, no adverse information in the consumer report(other than information which is a matter of public record) may beincluded in a subsequent consumer report unless such adverseinformation has been verified in the process of making suchsubsequent consumer report, or the adverse information wasreceived within the three-month period preceding the date thesubsequent report is furnished. Section 614 [15 U.S.C. §1681l]

22

F. Workplace Misconduct Investigations Post-FACTA – Procedures

As noted above, communications made to an employer in connection with an investigation ofsuspected misconduct relating to employment, compliance with Federal, State, or local laws andregulations, the rules of a self-regulatory organization, or any preexisting written policies of theemployer are excluded from the definition of “consumer report” and, accordingly, from thedefinition of “investigative consumer report,” such that the notice and disclosure requirementsaddressed above do not need to be followed, provided the statutory requirements madespecifically applicable to the excluded communications are met.

1. Not Related To Credit

The communication cannot be made for the purpose of investigating a consumer's creditworthiness, credit standing, or credit capacity. Section 603(y)(1)(C) [15 U.S.C.§1681a(y)(1)(C)]

2. Restricted Access

“The communication may not be provided to any person except:

(i) to the employer or an agent of the employer;

(ii) to any Federal or State officer, agency, or department, or any officer, agency, ordepartment of a unit of general local government;

(iii) to any self-regulatory organization with regulatory authority over the activitiesof the employer or employee;

(iv) as otherwise required by law; or

(v) pursuant to section 608.” [Section 608 provides that a consumer reportingagency may furnish identifying information respecting any consumer, limited to his name,address, former addresses, places of employment, or former places of employment, to agovernmental agency.” [15 U.S.C. §1681f] ]]

Section 603(y)(1)(D) [15 U.S.C. § 1681a(y)(1)(D)]

Thus, before an employer provides a copy of the investigation to anyone not specificallyenumerated, an analysis needs to be made whether the disclosure is required by law.

3. Subsequent Limited Disclosure Required

While disclosure of the report is not permitted, after taking adverse action based in whole orin part on a communication as described in FACTA, the employer “shall disclose to theconsumer a summary containing the nature and substance of the communication upon which theadverse action is based, except that the sources of information acquired solely for use inpreparing what would be but for subsection (d)(2)(D) [FACTA exclusion] an investigativeconsumer report need not be disclosed.” Section 603(y)(2) [15 U.S.C. § 1681a(y)(2)]

23

G. FCRA Notice Forms

As discussed above, the CFPB has issued revised notice forms, effective January 1, 2013,found in appendices to 12 CFR Part 1022. These include, among others: 1) Summary ofConsumer Rights under the FCRA (Appendix K): Consumer reporting agencies must providethis form to employers, and employers must provide it to applicants/employees when consumerreports are requested; (2) Notice to Users of Consumer Reports of their Obligations underthe FCRA (Appendix N): Consumer reporting agencies must provide users with this notice; and3) Notice to Furnishers of Information of their Obligations under the FCRA (Appendix M):Consumer reporting agencies provide this notice to designated furnishers of information.

Previously the forms were found at 16 C.F.R. Part 698.

H. Potential Civil Liability

1. Willful Noncompliance

Any person who willfully fails to comply with FCRA with respect to any consumer is liableto the consumer for:

a) Actual damages of not less than $100 and not more than $1000; or(ii) for obtaining a consumer report under false pretenses orknowingly without a permissible purpose, actual damages or$1000, whichever is greater;

b) Punitive damages; and

c) Costs and attorney fees.

Section 616(a) [15 U.S.C. § 1681n(a)]

2. Negligent Noncompliance

Any person who is negligent in failing to comply with any FCRA requirement with respect toa consumer is liable to the consumer for:

a) Actual damages sustained by the consumer as a result of thefailure; and

b) Costs and attorneys' fees

Section 617 [15 U.S.C. § 1681o]

I. Potential Criminal Liability

“Any person who knowingly and willfully obtains information on a consumer from aconsumer reporting agency under false pretenses shall be fined under title 18, United StatesCode, imprisoned for not more than 2 years, or both.” Section 619 [15 U.S.C. § 1681q]

24

“Any officer or employee of a consumer reporting agency who knowingly and willfullyprovides information concerning an individual from the agency's files to a person not authorizedto receive that information shall be fined under title 18, United States Code, imprisoned for notmore than 2 years, or both.” Section 620 [15 U.S.C. §1681r]

J. Administrative Enforcement

The FTC is authorized to enforce compliance with FCRA. Violations constitute an unfair ordeceptive act or practice in commerce. The FTC may file a civil action in cases where a patternor practice of violations exists, seeking penalties of up to $3500 per violation. Section 620 [15U.S.C. §1681s]

IV. INVESTIGATIONS AND CALIFORNIA LAW

A. California Investigative Consumer Reporting Agencies Act (Civil Code §1786et. seq.)

This law is broader than FCRA and, as noted above, applies to information obtained on aconsumer’s “character, general reputation, personal characteristics, or mode of living obtainedthrough any means.” Civil Code §1786.2(c) It does not include information concerning aconsumer’s credit record. Thus, for example, under ICRA, if a person, who otherwise meets thedefinition of an investigative consumer reporting agency, obtains information for a report on anemployee from social networking sites, it has prepared an investigative consumer report. Notefurther that under ICRA the definition of an investigative consumer reporting agency, unlikeFCRA, does not contain language restricting the definition to one who “regularly” preparesreports. However, the statute does state that the term means one who engages “in the practice ofcollecting, assembling, evaluating, . . . information concerning consumers . . “ Whether oneshould infer from the use of the word “practice” that the activity needs to be regularly engaged inis unclear. ICRA also provides:

“Nothing in this chapter is intended to change or supersede existing lawrelated to privileged attorney-client communications or attorney work product, orrequire the production or disclosure of that information.

Civil Code §1786.55

There is no further guidance re how this provision applies to attorney-conducted investigationsunder ICRA.

The following are the basic rules that an employer must follow when procuring aninvestigative consumer report. (Note: As discussed below, there are exceptions to therequirements under ICRA for investigations for employment purposes into suspicion ofwrongdoing or misconduct.)

25

1. Employer Obligations

a) Prior to Requesting the Report

Pursuant to Civil Code §1786.12, any person obtaining aninvestigative consumer report for employment purposes:

(1) Must have a permissible purpose. (A report foremployment purposes is a permissible purpose; it means areport used for the purpose of evaluating a consumer foremployment, promotion, reassignment or retention as anemployee. Civil Code §1786.2(f));

(2) Must provide “a clear and conspicuous disclosure inwriting to the consumer at any time before the report isprocured or caused to be made in a document that consistssolely of the disclosure,” that:

(a) An investigative consumer report may be obtained;

(b) What the permissible purpose of the report is;

(c) The disclosure may include information on theconsumer's character, general reputation, personalcharacteristics, and mode of living;

(d) Identifies the name, address, and telephone number ofthe investigative consumer reporting agency conductingthe investigation;

(e) Notifies the consumer in writing of the nature andscope of the investigation requested, including asummary of the provisions of Civil Code Section1786.22;

(f) Notifies the consumer of the Internet Web site addressof the investigative consumer reporting agencyidentified in (d), above, or of the agency has nowebsite address, the telephone number of the agencywhere the consumer may find information about theinvestigative reporting agency’s privacy practices,including whether the consumer’s personalinformation will be sent outside the United States or itsterritories and information; and information thatcomplies with additional privacy requirements foundat Civil Code section 1786.20(d).2

2 Civil Code section 1786.20(d) provides:

26

(3) Must obtain the consumer’s authorization in writing.

(4) Must certify to the investigative consumer reporting agencythat the employer has made the disclosures to the consumeroutlined above and that the employer will comply with theobligations set forth below.

(5) Must provide the consumer a means by which theconsumer may indicate on a written form, by means of abox to check, that the consumer wishes to receive a copy ofany report that is prepared. If the consumer wishes toreceive a copy of the report, the employer must send a copyof the report to the consumer within three business days ofthe date that the report is provided to the recipient. Theemployer may contract out this obligation.) The notice torequest the report may be contained on either the disclosureform or a separate consent form. The copy of the reportmust contain the name, address, and telephone number ofthe person who issued the report and how to contact them.

(6) Must agree to provide a copy of the report as described in(5), supra.

(7) Comply with Civil Code Section 1786.40, if the taking ofadverse action is a consideration.

Note: The above requirements do not apply to an investigativeconsumer report procured or caused to be prepared by anemployer, if the report is sought for employment purposes due tosuspicion held by an employer of wrongdoing or misconduct bythe subject of the investigation. Civil Code §1786.12(c)

“(1) An investigative consumer reporting agency doing business in this state shall conspicuously post, asdefined in subdivision (b) of Section 22577 of the Business and Professions Code, on its primary Internet Website information describing its privacy practices with respect to its preparation and processing of investigativeconsumer reports. If the investigative consumer reporting agency does not have an Internet Web site, it shall,upon request, mail a written copy of the privacy statement to consumers. The privacy statement shallconspicuously include, but not be limited to, both of the following:

“(A) A statement entitled "Personal Information Disclosure: United States or Overseas," that indicateswhether the personal information will be transferred to third parties outside the United States or itsterritories.(B) A separate section that includes the name, mailing address, e-mail address, and telephone number ofthe investigative consumer reporting agency representatives who can assist a consumer with additionalinformation regarding the investigative consumer reporting agency's privacy practices or policies in theevent of a compromise of his or her information.

(2) For purposes of this subdivision, "third party" shall include, but not be limited to, a contractor, foreignaffiliate, wholly owned entity, or an employee of the investigative consumer reporting agency.”

27

b) Adverse Action Requirements

Whenever employment is denied, under circumstances in which areport regarding the consumer was obtained from an investigativeconsumer reporting agency, the employer must advise theconsumer and supply the name and address of the investigativeconsumer reporting agency making the report. Civil Code§1786.40(a)

Note: FCRA’s preemption provisions provide that the states may not impose any requirement orprohibition with respect to the subject matter regulated by FCRA section 615(a)[15 U.S.C.§1681m(a)] which relates to duties of users of consumer reports taking adverse action.Thus, Civil Code §1786.40(a) above is preempted by FCRA. This is of little import, however,since the FCRA section imposes the same plus additional requirements on users.

2. Obligations of Investigative Consumer Reporting Agency

a) Certification

An investigative consumer reporting agency is able to furnish aconsumer report for employment purposes only if it obtains acertification from the person obtaining the report –usually theemployer or the employer’s agent – containing the certificationsdescribed above at IV.A.1.a).(1). Civil Code §1786.12(e)

b) Permissible Purposes

The consumer reporting agency must also have reason to believethat the user intends to use the information for a permissiblepurpose which includes for employment purposes. Civil Code§1786.12 (d)(1); . Civil Code §1786.20(a)

c) Allowed and Disallowed Content

(1) Medical information may not be furnished in a report foremployment purposes unless the consumer consents to thefurnishing of the report. Civil Code §1786.12 (f) The term"medical information" means “information on a person's medicalhistory or condition obtained directly or indirectly from a licensedphysician, medical practitioner, hospital, clinic, or other medical ormedically related facility.” Civil Code §1786.2(g)

(2) An investigative consumer reporting agency may notprepare or furnish an investigative consumer report on a consumerthat contains information that is adverse to the interest of theconsumer and that is obtained through a personal interview with aneighbor, friend, or associate of the consumer or with anotherperson with whom the consumer is acquainted or who has

28

knowledge of the item of information, unless either (1) theinvestigative consumer reporting agency has followed reasonableprocedures to obtain confirmation of the information, from anadditional source that has independent and direct knowledge of theinformation, or (2) the person interviewed is the best possiblesource of the information. Civil Code §1786.18(d)

(3) Pursuant to Civil Code §1786.18, no investigativeconsumer reporting agency may make any report containing any ofthe following items of information:

“(a) Bankruptcies that, from the date of entry of the orderfor relief, antedate the report by more than 10 years.

(b) Suits that, from the date of filing, and satisfiedjudgments that, from the date of entry, antedate the reportby more than seven years.

(c) Unsatisfied judgments that, from the date of entry,antedate the report by more than seven years.

(d) Unlawful detainer actions where the defendant was theprevailing party or where the action is resolved bysettlement agreement.

(e) Paid tax liens that, from date of payment, antedate thereport by more than seven years.

(f) Accounts placed for collection or charged to profit andloss that antedate the report by more than seven years.

(g) Records of arrest, indictment, information,misdemeanor complaint, or conviction of a crime that, fromthe date of disposition, release, or parole, antedate thereport by more than seven years. These items ofinformation shall no longer be reported if at any time it islearned that, in the case of a conviction, a full pardon hasbeen granted or, in the case of an arrest, indictment,information, or misdemeanor complaint, a conviction didnot result; except that records of arrest, indictment,information, or misdemeanor complaints may be reportedpending pronouncement of judgment on the particularsubject matter of those records.

(h) Any other adverse information that antedates the reportby more than seven years.

29

There are exceptions to the prohibitions above. Forexample, the prohibitions do not apply if the report is to beused by an employer who is explicitly required by agovernmental regulatory agency to check for records thatare otherwise prohibited. Civil Code §1786.18(b)(2)

Note: FCRA’s preemption provision (see section V, below) provides that states may not imposeany requirement or prohibition with respect to subject matter regulated under FCRA section 605[15 U.S.C.§1681c] relating to allowable information in consumer reports but also providing thatthe exception does not apply to state laws in effect on the date of enactment of the ConsumerCredit Reporting Reform Act of 1996.]

Further, except as otherwise provided in Civil Code§1786.28, an investigative consumer reporting agency maynot furnish an investigative consumer report that includesinformation that is a matter of public record and that relatesto an arrest, indictment, conviction, civil judicial action, taxlien, or outstanding judgment, unless the agency hasverified the accuracy of the information during the 30-dayperiod ending on the date on which the report is furnished.

d) Public Record Information

(1) Each investigative consumer reporting agency that collects,assembles, evaluates, compiles, reports, transmits, transfers, orcommunicates items of information concerning consumers whichare matters of public record must specify in any report containingpublic record information the source from which this informationwas obtained, including the particular court, if applicable, and thedate that this information was initially reported or publicized.Civil Code §1786.28(a)

(2)`An investigative consumer reporting agency which furnishes aconsumer report for employment purposes and compiles, collects,assembles, evaluates reports, transmits, transfers or communicatesitems of information which are matters of public record and arelikely to have an adverse effect upon the consumer's ability toobtain employment must maintain strict procedures designed toinsure that whenever public record information which is likely tohave an adverse effect on a consumer's ability to obtainemployment is reported, it is complete and up to date. Items ofpublic record relating to arrests, indictments, convictions, suits, taxliens, and outstanding judgments are considered up to date if thecurrent public record status of the item at the time of the report isreported. Civil Code §1786.28(b)

30

e) Compliance Procedures

(1) Every consumer reporting agency must maintain reasonableprocedures designed to avoid violations of section 1786.18 relatingto content of reports and to limit the furnishing of consumerreports to permissible purposes as set forth in section 1786.12.These procedures require that prospective users of the informationidentify themselves, certify the purposes for which the informationis sought, and certify that the information will be used for no otherpurpose. It must inform the user that the user must notify theagency of any change in the purpose for which information will beused. Every consumer reporting agency must make a reasonableeffort to verify the identity of a new prospective user and the usescertified by such prospective user prior to furnishing such user aconsumer report. Civil Code §1786.20(a)

(2) Whenever an investigative consumer reporting agencyprepares a consumer report it must follow reasonable procedures toassure maximum possible accuracy of the information concerningthe individual about whom the report relates. The report must bekept for two years. Civil Code §1786.20(b)

(3) An investigative consumer reporting agency may not makean inquiry for the purpose of preparing an investigative consumerreport on a consumer for employment purposes if the making ofthe inquiry by an employer or prospective employer of theconsumer would violate applicable federal or state equalemployment opportunity law or regulation. Civil Code§1786.20(c)(4) An investigative consumer reporting agency mustconspicuously post (as described in B&P Code section 22577(b))on its Internet web page a description of its privacy practices withrespect to its preparation and processing of investigativeconsumer reports. If the investigative consumer reportingagency does not have an Internet Web site, it must, uponrequest, mail a written copy of the privacy statement toconsumers. The privacy statement must conspicuously include:(i) a statement entitled "Personal Information Disclosure:United States or Overseas," that indicates whether the personalinformation will be transferred to third parties outside theUnited States or its territories; and (ii) A separate section thatincludes the name, mailing address, e-mail address, andtelephone number of the investigative consumer reportingagency representatives who can assist a consumer withadditional information regarding the investigative consumer

31

reporting agency's privacy practices or policies in the event ofa compromise of his or her information(2) For purposes of this subdivision, "third party" shall include, butnot be limited to, a contractor, foreign affiliate, wholly ownedentity, or an employee of the investigative consumer reportingagency.”

f) Disclosure of Information on File to Consumers

There is a general requirement that investigative consumerreporting agencies allow consumers to visually inspect all filesmaintained regarding the consumer upon request. However,sources of information, other than public records and records fromdatabases available for sale, acquired solely for use in preparing aninvestigative consumer report and actually used for no otherpurpose need not be disclosed. (However, if an action is broughtunder FCRA, those sources shall be available to the consumerunder appropriate discovery procedures in the court in which theaction is brought.) Information disclosed must also include theidentity of persons who procured a report for employmentpurposes during the preceding 3 years. Civil Code §1786.10;Civil Code §1786.22

Consumers also have a right to a copy of any investigativeconsumer report made for a period of two years. Civil Code§1786.11

g) Procedures in Cases of Disputed Accuracy

If a consumer disputes the completeness or accuracy ofinformation in a consumer report, a reinvestigation is required.Civil Code §1786.24

h) Notices on First Page of Investigative Consumer Report

The first page of an investigative consumer report must state thefollowing:

(1) A notice in at least 12-point boldface type setting forth that thereport does not guarantee the accuracy or truthfulness of theinformation as to the subject of the investigation, but only that it isaccurately copied from public records, and information generatedas a result of identity theft, including evidence of criminal activity,may be inaccurately associated with the consumer who is thesubject of the report.

32

(2) An investigative consumer reporting agency shall provide aconsumer seeking to obtain a copy of a report or making a requestto review a file, a written notice in simple, plain English andSpanish setting forth the terms and conditions of his or her right toreceive all disclosures, as provided in [Civil Code] Section1786.26.

Civil Code §1786.29

B. Investigative Consumer Reports for Suspicion of Wrongdoing or Misconduct

California has an exception similar to FCRA’s from the usual rules re notice / consent /disclosure for employment-related investigations for suspicion of wrongdoing or misconduct.However, unlike federal law which excludes employment investigations from the definition of“consumer report” altogether, California law instead specifically exempts the reports fromspecific provisions of ICRA. Moreover, unlike FCRA, in California the exclusion does notinclude investigations of compliance with an employer’s written policies; it is restricted toinvestigations involving suspicion of wrongdoing or misconduct.

1. Notice and Consent Not Required

When an investigative consumer report is sought for an employment purpose for suspicion ofwrongdoing or misconduct, the advance notice / consent rules otherwise applicable to employersseeking investigative consumer reports do not apply. Civil Code §1786.16(a)(2), (c)

2. Report Copy Need Not Be Given To Consumer

The otherwise applicable requirement that consumers who check the box that they wish toreceive a copy of the report, does not apply to investigative consumer reports sought for anemployment purpose for suspicion of wrongdoing or misconduct. Civil Code §1786.16(a)(2)

3. Adverse Action Notice Need Not Be Given

Ordinarily, under Civil Code §1786.40(a), when employment is denied under circumstancesin which an investigative consumer report was requested, notice must be given and the namesand address of the investigative consumer reporting agency who prepared the report be given tothe consumer. This is not the case with employment-related investigations for suspicion ofwrongdoing or misconduct. Civil Code §1786.16(c)

4. Right to Inspect Files of Investigative Consumer Reporting Agency

Note that files of employment-related investigations for suspicion of wrongdoing ormisconduct are not excepted out from the rules concerning a person’s ability to inspect the filesof an investigative consumer reporting agency. Whether this applies to reports of wrongdoing ormisconduct is unclear. However, as discussed supra at IV.A.2.f), source information need not beproduced for inspection.

33

5. Right to Obtain Report Copies from Investigative ConsumerReporting Agency

Similarly, there is no express exception for reports of employment-related investigations forsuspicion of wrongdoing or misconduct contained in Civil Code §1786.11 which provides thatconsumers also have a right to a copy of any investigative consumer report made for a period oftwo years. Whether this applies to reports of wrongdoing or misconduct is unclear.

6. Delayed Disclosure of Public Records In Internal Investigations ForSuspicion Of Wrongdoing Or Misconduct.

As discussed below, there are disclosure requirements when public records, as defined, areused in internal investigations. However, where the investigation is for suspicion of wrongdoingor misconduct and no consumer reporting agency is used by the employer, the information maybe withheld until the completion of the investigation; upon completion, a copy of the publicrecord is to be provided unless the consumer waived his or her rights by checking the box on theapplication / other form. Civil Code §1786.53(b)(3)

C. Obligations of Direct User of Public Records (Without Use of InvestigativeConsumer Reporting Agency)

a) Copy to be Provided

Pursuant to Civil Code §§1786.53(a), 1786.53(b)(1), anyone “whocollects, assembles, evaluates, compiles, reports, transmits,transfers, or communicates information on a consumer's character,general reputation, personnel characteristics, or mode of living, foremployment purposes, which are matters of public record, anddoes not use the services of an investigative consumer reportingagency,” must provide a copy of the public record to the consumerwithin seven days after receiving the information, regardless ofwhether the information is received in a written or oral form.“

(1) Exception. On a job application form or any other writtenform, a box must be included, which, if checked, by the consumerwaives the right to receive a copy of the public records. CivilCode §§1786.53(a), 1786.53(b)(1)

(a) Exception to Exception. If any person takes anyadverse action as a result of the public records information,the person shall provide the consumer with a copy of thepublic records, regardless of whether the consumer waivedhis or her rights. Civil Code §1786.53(b)(4)

34

b) Public Records Definition. "Public records" for these purposesmeans “records documenting an arrest, indictment, conviction,civil judicial action, tax lien, or outstanding judgment.” CivilCode §1786.53(a)(3) This is a narrow definition which does notinclude many types of public records.

c) Adverse Action. "Adverse action" for these purposes means “adenial of employment or any decision made for an employmentpurpose that adversely affects any current or prospectiveemployee.” Civil Code §1786.53(a)(1)

d) Delayed Disclosure In Investigation For Suspicion OfWrongdoing Or Misconduct. If the public record is obtained forthe purpose of conducting an investigation for suspicion ofwrongdoing or misconduct by the subject of the investigation, theinformation may be withheld until the completion of theinvestigation. Upon completion, a copy of the public record is tobe provided unless the consumer waived his or her rights bychecking the box on the application / other form. Civil Code§1786.53(b)(3)

D. Consumer Credit Reporting Agencies Act (Civil Code §1785.1 et. seq.)

This law applies only to written, oral or other communication of any information by aconsumer credit reporting agency bearing on a consumer’s credit worthiness, credit standing, orcredit capacity . . . “ Civil Code §1785.3(c). The Act is quite detailed and its numerousprovisions are without the scope of this paper. With respect to employment purposes, theprovisions of the Act are quite similar to those set forth above concerning investigative consumerreports. The key provisions with respect to use of a consumer credit report for employmentpurposes are Civil Code §1785.20 and Civil Code §1785.20.5.

Civil Code §1785.20.5 provides:

“(a) Prior to requesting a consumer credit report for employment purposes,the user of the report shall provide written notice to the person involved. Thenotice shall inform the person that a report will be used and the source of thereport, and shall contain a box that the person may check off to receive a copy ofthe credit report. If the consumer indicates that he or she wishes to receive a copyof the report, the user shall request that a copy be provided to the person when theuser requests its copy from the credit reporting agency. The report to the user andto the subject person shall be provided contemporaneously and at no charge to thesubject person.

(b) Whenever employment involving a consumer is denied either wholly orpartly because of information contained in a consumer credit report from aconsumer credit reporting agency, the user of the consumer credit report shall soadvise the consumer against whom the adverse action has been taken and supply

35

the name and address or addresses of the consumer credit reporting agencymaking the report. No person shall be held liable for any violation of this sectionif he or she shows by a preponderance of the evidence that, at the time of thealleged violation, he or she maintained reasonable procedures to assurecompliance with this section.”

Note: FCRA’s preemption provisions provide that the states may not impose any requirement orprohibition with respect to the subject matter regulated by FCRA section 615(a) [15U.S.C.§1681m(a)] which relates to duties of users of consumer reports taking adverse action.Thus, the first sentence of subsection (b) above is preempted by FCRA. This is of little import,however, since the FCRA section imposes the same plus additional requirements on users.

Civil Code §1785.20 provides, inter alia:

“(a) If any person takes any adverse action with respect to any consumer, and theadverse action is based, in whole or in part, on any information contained in aconsumer credit report, that person shall do all of the following:

(1) Provide written notice of the adverse action to the consumer.

(2) Provide the consumer with the name, address, and telephone number of theconsumer credit reporting agency which furnished the report to the person.

(3) Provide a statement that the credit grantor's decision to take adverse actionwas based in whole or in part upon information contained in a consumer credit report.

(4) Provide the consumer with a written notice of the following rights of theconsumer:

(A) The right of the consumer to obtain within 60 days a free copy of theconsumer's consumer credit report from the consumer credit reporting agencyidentified pursuant to paragraph (2) and from any other consumer credit reportingagency which compiles and maintains files on consumers on a nationwide basis.

(B) The right of the consumer under Section 1785.16 to dispute theaccuracy or completeness of any information in a consumer credit report furnished bythe consumer credit reporting agency.

* * *”

Note: FCRA’s preemption provisions provide that the states may not impose any requirement orprohibition with respect to the subject matter regulated by FCRA section 615(a) [15U.S.C.§1681m(a)] which relates to duties of users of consumer reports taking adverse action.Thus, the provisions immediately above are preempted by FCRA. This is of little import,however, since the FCRA section imposes the same requirements on users.

36

E. Potential Civil Liability

1. Noncompliance with ICRA

Any consumer who suffers damages as a result of a violation may bring an action under CivilCode §1786.50 to recover the following:

a) Actual damages or, except in the case of class actions, $10,000,whichever is greater.

b) Costs of the action plus reasonable attorney’s fees.

c) If the act was grossly negligent or willful, punitive damages

2. Noncompliance with Consumer Credit Reporting Agencies Act

Any consumer who suffers damages as a result of a violation may bring an action under CivilCode §1785.31 to recover the following:

a) Negligent Violations

The consumer may recover actual damages including court costs,loss of wages, attorney’s fees and, when applicable pain andsuffering.

b) Willful Violations

The consumer may recover actual damages as provided fornegligent violations plus punitive damages of not less than $100nor more than $5000 for each violation as the court deems proper.

c) Obtaining Report by False Pretenses

If a natural person has obtained a consumer credit report underfalse pretenses or knowingly without a permissible purpose, theconsumer may recover an award of actual damages as provided fornegligent violations in an amount not less than $2500.00

d) Injunctive Relief

Injunctive relief is available.

e) Class Actions

Any person who willfully violates any requirement imposed underthe Consumer Credit Reporting Agencies Act may be liable forpunitive damages in the case of a class action, in an amount thatthe court may allow. In determining the amount of award in anyclass action, the court shall consider among relevant factors the

37

amount of any actual damages awarded, the frequency of theviolations, the resources of the violator and the number of personsadversely affected.

V. PREEMPTION

FCRA specifically addresses the relationship between FCRA and state laws. Section 625 [15U.S.C.§1681t].

A. General Principle

Although there are enumerated exceptions, FCRA “does not annul, alter, affect, or exemptany person subject to the provisions of this title from complying with the laws of any State withrespect to the collection, distribution, or use of any information on consumers, or for theprevention or mitigation of identity theft, except to the extent that those laws are inconsistentwith any provision of this title, and then only to the extent of the inconsistency.” Section 625(a)[15 U.S.C.§1681t(a)]. The Appendix to Part 600 “Commentary on the Fair Credit ReportingAct,” with respect to then section 622 states: “State law is pre-empted by the FFCRA only wheninconsistent State law would result in violation of the FCRA.”

B. Exceptions

However, FCRA does provide that “(b) [N]o requirement or prohibition may be imposedunder the laws of any state (1) with respect to any subject matter regulated under . . enumeratedsections].” Section 625(b) [15 U.S.C.§1681t(b)]

Among the enumerated sections are section 615(a) [15 U.S.C.§1681m(a)] relating to dutiesof users taking adverse action, section 605 [15 U.S.C.§1681c] relating to allowable informationin consumer reports but also providing that the exception does not apply to state laws in effect onthe date of enactment of the Consumer Credit Reporting Reform Act of 1996.]

VI. TRAPS FOR THE UNWARY USING REPORTS

In addition to the possibility of violating FCRA, ICRA and CCRAA, use of reports alsoimplicates other statutes. Just because it may be lawful to obtain and review information underFCRA, ICRA and CCRAA does not necessarily mean that obtaining and/or considering theinformation is not forbidden under other federal and state laws.

A. Inquiries Into / Use of Information re Protected Status

Both federal and state laws generally prohibit inquiries into an applicant’s / employee’sprotected status. See, e.g. the regulations of the California Fair Employment and HousingCommission. 2 CCR §7287.3 Even if no inquiry is made, the fact that such information is in thepossession of the employer can be used in litigation alleging that race, national origin etc. wereimpermissibly used in making an employment decision.

38

B. Credit Reports

1. California

The use of consumer credit reports for employment purposes is now severely restricted inCalifornia. Civil Code §1785.20.5; Labor Code §1024.5. Generally speaking, reports may nowbe obtained only if the position is one of the following:

(1) A managerial position.

(2) A position in the state Department of Justice.

(3) That of a sworn peace officer or other law enforcement position.

(4) A position for which the information contained in the report is required by law to bedisclosed or obtained.

(5) A position that involves regular access, for any purpose other than the routine solicitation andprocessing of credit card applications in a retail establishment, to all of the following types ofinformation of any one person:

(A) Bank or credit card account information.

(B) Social security number.

(C) Date of birth.

(6) A position in which the person is, or would be, any of the following:

(A) A named signatory on the bank or credit card account of the employer.

(B) Authorized to transfer money on behalf of the employer.

(C) Authorized to enter into financial contracts on behalf of the employer.

(7) A position that involves access to confidential or proprietary information, including aformula, pattern, compilation, program, device, method, technique, process or trade secret that (i)derives independent economic value, actual or potential, from not being generally known to, andnot being readily ascertainable by proper means by, other persons who may obtain economicvalue from the disclosure or use of the information, and (ii) is the subject of an effort that isreasonable under the circumstances to maintain secrecy of the information.

(8) A position that involves regular access to cash totaling ten thousand dollars ($10,000) ormore of the employer, a customer, or client, during the workday.

Even then, written notice must be provided that specifies the specific reason for the report, thatis, which one of the above situations applies, and that specifies the source of the report. Theremust be an opportunity for the employee or applicant to check a box to obtain a copy of the

39

report, and, if the person is denied the position in whole or in part because of the report, theemployer must advise the person of this fact.

2. Washington

Under Washington law, a consumer report for employment purposes may not be procuredwhere any information contained in the report bears on the consumer's creditworthiness, creditstanding, or credit capacity, unless the information is either (i) Substantially job related and theemployer's reasons for the use of such information are disclosed to the consumer in writing or(ii) required by law. RCW 19.182.020

3. Oregon

Operative July 1, 2010, Oregon SB 1045 prohibits the use of credit history for employmentpurposes including hiring, discharge, promotion, and compensation. There are exceptions, e.g.for financial institutions, public safety offices, and other employment situations where credithistory is job-related and the use is disclosed to applicant or employee.

4. Hawaii

Hawaiian passed a law effective July 1, 2009 that limits use of employment credit history orcredit reports unless it “directly related to a bona fide occupations qualification,” or falls underanother exception. Hawaii Revised Statues Sec. 378-2(8)

It is an unlawful discriminatory practice for any employer to refuse to hire or employ, continueemployment or to bar or discharge from employment, or otherwise to discriminate against anyindividual in compensation or in the terms, conditions, or privileges of employment of anyindividual because of the individual's credit history or credit report, unless the information in theindividual's credit history or credit report directly relates to a bona fide occupationalqualification. Even then the report can be used only after a conditional job offer is made.Hawaii Revised Statues Sec. 378-2(8).

There are exceptions including where an employer is permitted to inquire into credit history or acredit report by federal or state law, for managerial and supervisory employees (as defined) andfor financial institutions that are insured by a federal agency.

5. Illinois

On August 10, 2010, Illinois enacted H.B. 4658, the Employee Credit Privacy Act, making itunlawful for an employer to fail to hire or recruit, discharge, or otherwise discriminate against anindividual because of the individual’s credit history, to inquire about an applicant’s oremployee’s credit history, or to obtain an applicant’s or employee’s credit report from aconsumer reporting agency. There is an exception if a satisfactory credit history is an establishedbona fide occupational requirement. This includes situations where the employee has access toconfidential information (e.g., personal or financial information), where state or federal lawrequires bonding or other security covering an individual holding the position, where there isunsupervised access to business assets valued over a certain amount, or where the position is a

40

managerial position that involves setting the direction or control of the company. The law iseffective January 1, 2011.

C. Adverse Impact of Credit History

Use of employment selection devices that have an adverse impact on protected groups canviolate the discrimination laws.

The use of credit history has come under increasing scrutiny as potentially violating thediscrimination laws. A private opinion letter was released by the Equal Employment OpportunityCommission's Office of Legal Counsel dated March 9, 2010 addressing the issue. The letterstates:

“In particular, Title VII prohibits an employment practice thatdisproportionately screens out racial minorities, women, or another protectedgroup unless the practice is job related and consistent with business necessity.Thus, if an employer’s use of credit information disproportionately excludesAfrican-American and Hispanic candidates, the practice would be unlawful unlessthe employer could establish that the practice is needed for it to operate safely orefficiently. At an EEOC meeting in May 2007 on employment testing andscreening, attorney Adam Klein testified that credit checks have not been shownto be a valid measure of job performance. Testimony of Adam T. Klein, Esq.,EEOC Commission Meeting (May 17, 2007),http://www.eeoc.gov/eeoc/meetings/archive/5-16-07/klein.html.”

The letter does note, however, that:

“Some courts, however, have determined that credit checks are appropriate forcertain positions, such as where an employee handles large amounts of cash. SeeEEOC v. United Virginia Bank/Seaboard Nat’l, 1977 WL 15340, 21 FEP Cases1392 (E.D. Va. 1977) (even if the defendant bank’s credit check policydisproportionately screened out African-American job applicants, the bank had abusiness need to conduct pre-employment credit checks because employeeshandle large amounts of cash).”

The EEOC letter can be found at www.eeoc.gov/eeoc/foia/letters/2010/titlevii-employer-creditck.html.

See also, e g, Howard v. Continental Ill. Natl. Bank & Trust Co. , 1983 U.S. Dist. LEXIS 11923(N.D. Ill. Nov. 7, 1983) ("upon a proper showing, the plaintiff could establish that the use ofcredit ratings in hiring decisions has an unlawful disparate impact on minority job applicants").The EEOC's decision to post this letter on its Web site may be an example of the increasedattention this issue is garnering.

D. Adverse Impact of Criminal Background Checks

On April 25, 2012, the EEOC issued Enforcement Guidance No. 915.002 addressing the useby employers of criminal background checks. The EEOC reiterates its longstanding position that

41

such checks have an adverse impact on minorities and states that national data, standing alone, ifnot rebutted, is sufficient for a finding of disparate impact. An employer must then prove thatthe requirement is job-related and consistent with business necessity. The Guidance iscomprehensive and describes in detail how the job-relatedness burden can be met.

http://www.eeoc.gov/eeoc/foia/letters/2007/arrest_and_conviction_records.html

E. Potential Aider / Abettor Liability

A consumer reporting agency and investigative consumer reporting agency with knowledgeof intended unlawful use under the FEHA of information provided to an employer couldpotentially be sued under the aider and abettor provisions of the FEHA. The regulations of theFair Employment and Housing Commission provide:

“7287.7. Aiding and Abetting.

(a) Prohibited Practices.

(1) It is unlawful to assist any person or individual in doing any act knownto constitute unlawful employment discrimination.

(2) It is unlawful to solicit or encourage any person or individual to violatethe Act, whether or not the Act is in fact violated.

(3) It is unlawful to coerce any person or individual to commit unlawfulemployment discrimination with offers of cash, other consideration, or anemployment benefit, or to impose or threaten to impose any penalty,including denial of an employment benefit.

(4) It is unlawful to conceal or destroy evidence relevant to investigationsinitiated by the Commission or the Department or their staffs.

(5) It is unlawful to advertise for employment on a basis prohibited in theAct.”

2 CCR 7287.2

F. Arrests / Certain Convictions – Specific Prohibitions

1. Arrest Records

Arrest records are permitted to be included in consumer reports and investigative consumerreports. However, Labor Code §432.8 generally prohibits consideration of arrests which did notresult in convictions.

“No employer, whether a public agency or private individual or corporation,shall ask an applicant for employment to disclose, through any written form orverbally, information concerning an arrest or detention that did not result inconviction, or information concerning a referral to, and participation in, any

42

pretrial or posttrial diversion program, nor shall any employer seek from anysource whatsoever, or utilize, as a factor in determining any condition ofemployment including hiring, promotion, termination, or any apprenticeshiptraining program or any other training program leading to employment, anyrecord of arrest or detention that did not result in conviction, or any recordregarding a referral to, and participation in, any pretrial or posttrial diversionprogram. As used in this section, a conviction shall include a plea, verdict, orfinding of guilt regardless of whether sentence is imposed by the court. Nothing inthis section shall prevent an employer from asking an employee or applicant foremployment about an arrest for which the employee or applicant is out on bail oron his or her own recognizance pending trial.”

2. FEHC Regulations

The regulations of the Fair Employment and Housing Commission provide:

“Criminal Records. Except as otherwise provided by law (e.g., 12 U.S.C. 1829;Labor Code Section 432.7), it is unlawful for an employer or other covered entityto inquire or seek information regarding any applicant concerning:

(A) Any arrest or detention which did not result in conviction;

(B) Any conviction for which the record has been judicially ordered sealed,expunged, or statutorily eradicated (e.g., juvenile offense records sealed pursuantto Welfare and Institutions Code Section 389 and Penal Code Sections 851.7 or1203.45); any misdemeanor conviction for which probation has been successfullycompleted or otherwise discharged and the case has been judicially dismissedpursuant to Penal Code Section 1203.4; or

(C) Any arrest for which a pretrial diversion program has been successfullycompleted pursuant to Penal Code Sections 1000.5 and 1001.5.”

2 CCR 7287.4(d)(1)

3. Marijuana-related Convictions

Labor Code §432.8 generally prohibits consideration of certain marijuana-related convictionsthat are more than 2 years old.

4. “Rap Sheets”

“Rap sheets” containing summary criminal histories maintained by law enforcement agenciesare generally not available to employers. Except as otherwise authorized by statute, Penal Code§11125 prohibits any person from requesting or requiring another person to furnish a copy of a“rap sheet” or notice that such a record does or does not exist.

43

G. Medical Information

Not only do FCRA and ICRA themselves regulate the reporting of medical information, thedissemination and use of medical information for employment purposes is regulated by a numberof statutes including the Confidentiality of Medical Information Act (Civil Code §56 et. seq.),disability discrimination laws (ADA and FEHA), HIPPAA, and the California Constitution,Article 1, section 1.

H. Unfair Business Practices Claims

Violation of the reporting statutes can form the predicate for claims under the CaliforniaUnfair Business Practices Act. Cisneros v. U.D. Registry, 39 Cal. App. 4th 233 (1995).

1

APPENDIX 1

CHECKLIST FOR INVESTIGATORS PERFORMING WORKPLACEMISCONDUCT INVESTIGATIONS UNDER ICRAA

Obtain certification (written agreement) with required elements from employer

Report will be used only for permissible purpose.

The purpose for which information is sought.

Report will be used for no other purpose.

Employer has/will comply with employer-required notice/consent rules. Civil Code§1786.12(e), 1786.20(a) (However, to the extent employer is excused from notice andconsent requirements, presumably certification re those requirements is not required.Suggestion: Notice can refer to those requirements, adding “to the extent applicable.”)

Advise employer that employer is obligated to notify investigator of any change in purposefor which report requested. Civil Code §1786.20(a) (Suggestion: Include on certificationform.)

Must also have reason to believe that the user intends to use the information for a permissiblepurpose which includes for employment purposes. Civil Code §1786.12 (d)(1). I

Investigator must make reasonable effort to verify identity of new prospective user and theuses certified by prospective user. Civil Code §1786.20(a)

Make no inquiries that would violate applicable federal or state equal employmentopportunity law or regulation. Civil Code §1786.2(c)

No report can contain information adverse to employee that is obtained through personalinterview of employee’s neighbor, friend, associate or acquaintance or with person who hasknowledge of the item of information, unless (1) investigator has followed reasonableprocedures to obtain confirmation of the information from an additional source that hasindependent and direct knowledge of the information, or (2) the person interviewed is thebest possible source of the information. Civil Code §1786.18(d)

No report can contain information on (a) Bankruptcies more than 10 years old;(b) Suits and satisfied judgments more than 7 years old; (c) Unsatisfied judgments more than7years old; (d) Unlawful detainer actions where defendant was prevailing party or where theaction is resolved; (e) Paid tax liens more than 7 years old; (f) Accounts placed for collectionor charged to profit and loss more than 7 years old; (g) Records of arrest, indictment,information, misdemeanor complaint, or conviction of a crime that, from the date ofdisposition, release, or parole, antedate the report by more than 7 years. No report if a fullpardon granted or, if conviction did not result from arrest, except that arrests indictments,informations, or misdemeanor complaints may be reported pending pronouncement of

2

judgment; and (h) Any other adverse information on the particular subject matter of thoserecords that antedates the report by more than seven years. Civil Code §1786.18

Must maintain reasonable procedures designed to avoid violations of rules re disallowedcontent. Civil Code §1786.20(a)

Medical information may not be furnished in a report unless the employee consents. CivilCode §1786.12 (f) "Medical information" means “information on a person's medical historyor condition obtained directly or indirectly from a licensed physician, medical practitioner,hospital, clinic, or other medical or medically related facility.” Civil Code §1786.2(g)

Further, except as otherwise provided in Civil Code §1786.28 (see 2 bullet pointsimmediately below), report may not include information that is a matter of public record andthat relates to an arrest, indictment, conviction, civil judicial action, tax lien, or outstandingjudgment, unless investigator has verified the accuracy of the information during the 30-dayperiod ending on the date on which the report is furnished. Civil Code §1786.18(c)

Must specify the source of public record information contained in report, including particularcourt, if applicable, and the date information was initially reported or publicized. Civil Code§1786.28(a)

If report has information which are matters of public record and are likely to have an adverseeffect upon consumer's ability to obtain employment, investigator must maintain strictprocedures designed to insure that the information is complete and up to date. Items ofpublic record relating to arrests, indictments, convictions, suits, tax liens, and outstandingjudgments are considered up to date if the current public record status of the item at the timeof the report is reported. Civil Code §1786.28(b)

If a consumer disputes the completeness or accuracy of information in report, areinvestigation is required. (Detailed requirements) Civil Code §1786.24

First page of report must contain notice in at least 12-point boldface type setting forth that thereport does not guarantee the accuracy or truthfulness of the information as to the subject ofthe investigation, but only that it is accurately copied from public records, and informationgenerated as a result of identity theft, including evidence of criminal activity, may beinaccurately associated with the consumer who is the subject of the report. Civil Code§1786.29(a) (Suggestion: If public record information not used, so state.)

Investigator must conspicuously post on its primary Internet Website information describingits privacy practices with respect to its preparation and processing of investigative consumerreports, or, if it does not have an Internet Website, to mail a written copy of the privacystatement to consumers upon request. Certain statements must be included. Civil Code§1786.20(d)

An employee has the right to inspect files of agency (except sources) Civil Code §§1786.10,1786.22, and employee has the right to obtain copies of reports under Civil Code §1786.11.

3

But query re whether this is intended with respect to reports of misconduct, since evenemployers are required to provide only a summary and even that only if adverse action taken.

Must provide consumer seeking to obtain a copy of a report or making a request to review afile, a written notice in simple, plain English and Spanish setting forth the terms andconditions of his or her right to receive all disclosures, as provided in [Civil Code] Section1786.26.“ Civil Code §1786.29. But see immediately preceding bullet point.