With increasing frequency, employers are being targeted by lawsuits alleging violations of state and federal consumer reporting statutes. Particularly when claims are brought on behalf of a class of claimants under the federal Fair Credit Reporting Act (FCRA) and/or similar state statutes, such litigation can result in significant losses for employers who fail to take steps to ensure compliance with federal and state consumer reporting laws.
Federal and State Requirements for Employment-Related Usage of Consumer Reports
A highly technical statute, the FCRA contains specific requirements for employers who use consumer reporting agencies (CRAs) to obtain credit and background reports for job applicants and/or existing employees. For example, before obtaining a consumer report, employers who use CRAs are required to comply with the FCRA’s “disclosure and authorization” requirements. Specifically, an employer must (1) give the applicant or employee a clear and conspicuous written disclosure notifying him or her that a consumer report may be obtained by the employer; and (2) obtain the applicant’s or employee’s prior written consent to the employer’s procurement of the consumer report. Moreover, when an employer intends to take an adverse employment action based in whole or in part on a consumer report, it is further required by the FCRA to comply with a two-part notification process. First, prior to any adverse employment action being taken (e.g., the denial of a job application or a promotion, or the reassignment or termination of an employee), the employer must provide the applicant or employee with a “pre-adverse action notice” indicating that the employer intends to take an adverse action based on the contents of that person’s consumer report, and also provide a copy of the report and a summary of the consumer’s rights under the FCRA.[1] Second, after adverse action is taken, the employer must provide a separate “adverse action notice” indicating that such action was taken, and providing certain other information relating to the CRA who provided the report and the person’s FCRA rights.
Because many employers are either unclear on, or unaware of, the FCRA’s highly technical dual-notice provisions, it is no surprise that the recent uptick in employment-related FCRA lawsuits has primarily involved alleged violations of the pre-adverse action notice requirement. In addition, many states have adopted FCRA-like statutes that regulate how employers use and conduct consumer reports related to their applicants and employees, and some states have imposed even more onerous requirements on employers in that context. For example, California’s Consumer Credit Reporting Agencies Act imposes an additional notice obligation on employers that use CRAs to screen applicants and employees. The employer must notify the individual in writing of the specific basis for permissibly using the consumer credit report before ordering the report.
Statutory Incentives for Class-Action Lawsuits Against Employers
The FCRA provides a private cause of action against an employer for either “negligently” or “willfully” failing to comply with any of the statute’s requirements. Employers who negligently fail to comply with the FCRA can be liable to consumers for actual damages, costs and attorneys’ fees. For willful FCRA violations, however, plaintiffs may elect to seek either actual damages or statutory damages of between $100 to $1000 per violation. In the latter case, courts have held that plaintiffs need not show that they suffered any actual damages in order to be able to pursue a statutory award, and employers who willfully violate the FCRA can also be liable for punitive damages, costs and attorneys’ fees. The pre-adverse action notice requirement can be an expensive trap for unwary employers.
The availability of statutory damages for willful FCRA violations makes the statute especially attractive to plaintiffs looking to bring large class-action lawsuits against employers who use CRAs to screen applicants and employees. Because there is no requirement to prove actual damages to recover for willful violations of the FCRA, plaintiffs can circumvent individual assessment for class-action purposes by asserting that an employer should be held liable regardless of whether the alleged willful violations resulted in actual losses for individual plaintiffs. Moreover, courts have set the “willfulness” bar relatively low for FCRA violations, and an employer’s FCRA violations can be considered “willful” where the employer repeatedly, systematically or typically violated the statute.[2] Unfortunately, such a standard is not a particularly onerous one for plaintiffs to meet. As such, an employer who regularly takes adverse actions against applicants or employees based on information discovered from a CRA background check without first notifying the person of its intention will most likely be found liable for “willful” violations, and thus be subject to statutory damages and other penalties and fees. Depending on the number of plaintiffs in a class, such damages of $100 to $1000 per violation can quickly add up. For all of these reasons, the FCRA’s pre-adverse action notice requirement can quickly become an expensive trap for the unwary employer, the fact of which the plaintiffs’ bar is certainly well-aware.
Another reason that FCRA claims against employers are gaining in popularity is the statute’s limitation period, which was recently amended to extend up to five years. Specifically, actions for liability under the FCRA must be brought no later than the earlier of (1) two years after the date when a plaintiff discovers the violation; or (2) five years after the date on which the violation occurred. Such a long statute of limitations is highly unusual for a federal statute, and has the potential to be devastating to employers who screen hundreds or thousands of job applicants each year. Also, state statutes like California’s Investigative Consumer Reporting Agencies Act provide additional avenues for the recovery of actual damages, costs and attorneys’ fees from employers who fail to comply with consumer report requirements, as well as the recovery of punitive damages for willful violations.
Suggestions for Employers
As noted above, the FCRA and similar state statutes are particularly appealing for plaintiffs’ counsel seeking to pursue a class action against employers who use CRAs to screen their applicants and employees, which today likely includes nearly all large employers to some degree. Accordingly, such employers should take careful steps to confirm that they are FCRA-compliant in their hiring, firing, reassignment and promotion of applicants and/or employees. As but one example, employers should implement procedures to ensure that pre-adverse action notices are sent at least five business days before taking any adverse action against an applicant or employee based on information obtained in a background check, and further ensure that separate adverse action letters are promptly sent after such action is taken. Employers may also want to consider conducting a privileged review of their background check consent forms, pre-adverse and adverse action notices, and any other policies or procedures they follow when conducting background and credit checks of their applicants and employees.
Overall, employers should be mindful that the FCRA and similar state statutes provide attractive class-action vehicles for plaintiffs to target employers who conduct background checks to assist with employment decisions. As such, the failure to ensure compliance with the technical requirements for using consumer reports creates a significant threat of potentially devastating damages being recovered, not to mention the legal fees associated with defending against large class-action lawsuits. Employers would thus be well-advised to head off potential claims by reviewing and revising their background check procedures as needed, and Alston & Bird would be more than happy to assist clients in the endeavor.
[1] The FCRA does not specify how much advance notice must be given to an applicant or employee before the adverse action is taken, but the requirement is generally understood as being intended to give the person a meaningful opportunity to review their report and to address any inaccuracies or otherwise respond. Accordingly, the Federal Trade Commission (FTC), which was the federal agency tasked with enforcing the FCRA before that task was recently taken over by the Consumer Financial Protection Bureau (CFPB), has suggested that five days is a reasonable amount of time to satisfy the pre-adverse action notice requirement, and at least one federal district court has agreed.
[2] Under U.S. Supreme Court precedent, “willfulness” under the FCRA includes reckless violations, and some courts have found willfulness based on only a handful of similar or repeated violations, with no requirement for a plaintiff to show that the defending employer was even aware of its FCRA obligations.
This advisory is published by Alston & Bird LLP’s Labor & Employment practice area to provide a summary of significant developments to our clients and friends. It is intended to be informational and does not constitute legal advice regarding any specific situation. This material may also be considered attorney advertising under court rules of certain jurisdictions.