As of Sept. 21, 2018, employers that conduct background checks to screen job applicants or employees must use updated notices to comply with the Fair Credit Reporting Act (FCRA). On Sept. 12, 2018, the U.S. Bureau of Consumer Financial Protection (Bureau) issued an interim final rule that includes new models for these required notices. The new models reflect changes to the FCRA that were enacted in May 2018. Specifically, the Economic Growth, Regulatory Relief, and Consumer Protection Act amended the FCRA to:
→Provide consumers the right to place “national security freezes” on their credit reports without charge; and
→Require that consumers be notified of this new right as part of a background check process.
Employers that use consumer reporting agencies to conduct credit or other background checks to screen applicants or employees must ensure that they (and their consumer reporting agencies) use the updated models or substantially similar notices.
The FCRA is a federal law that restricts how consumer information may be gathered, shared and used. While one of its main purposes is to promote accuracy in consumer credit reports maintained by consumer reporting agencies, the FCRA also:
→Regulates entities (including employers) that use consumer information; and
→Requires that certain notices be provided to individuals who undergo background checks by their employers or prospective employers.
On May 24, 2018, Congress passed the Economic Growth, Regulatory Relief, and Consumer Protection Act to amend the FCRA as follows, effective Sept. 21, 2018:
→Nationwide consumer reporting agencies must provide national security freezes (which protect against identity theft by restricting prospective lenders’ access to a consumer’s credit report) free of charge to consumers who request them; and
→Whenever the FCRA requires that a consumer receive either the Summary of Consumer Rights or the Summary of Consumer Identity Theft Rights, a notice regarding the new security freeze right must also be provided.
The changes also extend the amount of time a “fraud alert” must remain in a consumer’s file with a nationwide credit reporting agency, from 90 days to one year. A fraud alert informs prospective lenders that a consumer may have been an identity theft victim and requires them to take steps to verify the identity of anyone seeking credit in the consumer’s name.
New Model Notices
On Sept. 12, 2018, the Bureau issued model notices that incorporate the newly required information about national security freezes. Employers must use these new models, or notices that are substantially similar to them, as of Sept. 21, 2018. The table below lists the new models and provides an overview of the events that trigger the requirement to provide them to a consumer.
Substantially Similar Forms
According to the Bureau’s interim final rule, an alternative form for either of the two notices listed above will be considered substantially similar to the new models (and therefore compliant with the FCRA) if it includes all the same information shown on the appropriate new model form but has the security freeze notice placed in a location that is different from where it is located on the new model form.
In addition, an alternative form for the Summary of Consumer Rights will be considered substantially similar to the new model (and therefore compliant with the FCRA) if it includes both:
→The Bureau’s old model form (published on Nov. 14, 2012) or a substantially similar form; and
→A separate page that includes the notice of security freeze rights (as stated on the new model form).
These two conditions also apply to an alternative form for the Summary of Consumer Identity Theft Rights, except that, for this notice, the separate page must also state the following before or after the notice of security freeze rights: “The minimum duration of initial fraud alerts changed from 90 days to one year effective September 21, 2018.” The interim final rule also allows an alternative form for the Summary of Consumer Identity Theft Rights to exclude the following sentence, which appears before the security freeze notice on the new model form: “The following FCRA right applies with respect to nationwide consumer reporting agencies.”
Considerations for Employers
Because both of the new models include updated contact information for certain FCRA enforcement agencies, employers that use alternative forms should also ensure that they update that information on their forms.
Furthermore, employers should consider any requirements that may apply to them under state consumer protection laws that are similar to the FCRA.