If your business uses reports from consumer reporting agencies like background or credit checks, you must comply with both federal and state requirements to avoid legal liability. The federal Fair Credit Reporting Act and its state equivalents govern the gathering, maintenance and sharing of consumers information such as their credit history, rental history and other personal data.
The Fair Credit Reporting Act was enacted in 1970 and has since been amended several times. Its purpose is to ensure fair and accurate credit reporting, promote efficiency in the banking system and to protect consumer privacy. The FCRA also grants states the authority to enforce the statute and to pass their own laws to regulate the collection and handling of consumers’ information. On June 28, the Consumer Financial Protection Bureau issued clarifying guidance that the FCRA’s preemption of state laws is narrow and targeted, and the guidance affirmed states’ broad authority to enact regulations which provide their consumers with more protection.
Based on this interpretation, it is important to understand your state-specific consumer report requirements as they will vary across the country. For example, Massachusetts prohibits reports from including records of all criminal activity older than seven years. Several states including Maryland, Colorado and Illinois passed laws prohibiting an employer from considering an applicant’s credit history when evaluating employment except in certain situations. And in California, a proposed law would require housing providers to give applicants an opportunity to offer mitigating information about past criminal convictions before taking adverse action.
Regardless of jurisdiction, consumer reports must only be used for a permissible purpose which include evaluations connected with credit, employment, insurance and rental housing.
Here are some best practices to ensure you avoid liability when using consumer reports:
Be sure to provide notice that you’ll be obtaining a background or credit check as a part of your decision-making process.
Get written consent before ordering the background or credit check, especially if it’s used for employment purposes.
If adverse action is being considered based on the report, provide the consumer or applicant adequate notice and an opportunity to review a copy of the information.
Establish consistent procedures to properly dispose of background and credit reports. The FCRA does not require any specific retention periods, so you’ll want to review your document retention policy and consult your local counsel to comply with applicable laws.
For further information about federal requirements, guidance is available through the Federal Trade Commission and the Consumer Financial Protection Bureau, the federal agencies responsible for FCRA enforcement. For information about your state’s consumer reporting laws, contact your jurisdiction’s attorney general, consumer protection agency or a local attorney.