New FCRA Notices Apply for Employment Credit Checks

As of Sept. 21, 2018, employers that conduct credit background checks to screen job applicants or employees must use updated notices to comply with the Fair Credit Reporting Act (FCRA). On Sept. 12, 2018, the U.S. Bureau of Consumer Financial Protection (Bureau) issued an interim final rule that includes new models for these required notices. The new models reflect changes to the FCRA that were enacted in May 2018. Specifically, the Economic Growth, Regulatory Relief, and Consumer Protection Act amended the FCRA to: 

• Provide consumers the right to place “national security freezes” on their credit reports without charge; and 
• Require that consumers be notified of this new right as part of a credit background check process.     

Employers that conduct credit background checks to screen applicants or employees must ensure that they (and the credit reporting agencies they use to conduct the credit checks) use the updated models or substantially similar notices.

Background

The FCRA is a federal law that restricts how consumer credit information may be gathered, shared and used. While one of its main purposes is to promote accuracy in consumer credit reports maintained by consumer reporting agencies, the FCRA also:

• Regulates entities that use consumer credit information (such as employers); and
• Requires that certain notices be provided to individuals who undergo consumer credit background checks by their employers or prospective employers.

On May 24, 2018, Congress passed the Economic Growth, Regulatory Relief, and Consumer Protection Act to amend the FCRA as follows, effective Sept. 21, 2018: 

• Nationwide consumer reporting agencies must provide national security freezes (which protect against identity theft by restricting prospective lenders’ access to a consumer’s credit report) free of charge to consumers who request them; and
• Whenever the FCRA requires that a consumer receive either the Summary of Consumer Rights or the Summary of Consumer Identity Theft Rights, a notice regarding the new security freeze right must also be provided.

The changes also extend the amount of time a “fraud alert” must remain in a consumer’s file with a nationwide credit reporting agency, from 90 days to one year. A fraud alert informs prospective lenders that a consumer may have been an identity theft victim and requires them to take steps to verify the identity of anyone seeking credit in the consumer’s name.

New Model Notices

On Sept. 12, 2018, the Bureau issued model notices that incorporate the newly required information about national security freezes. Employers must use these new models, or notices that are substantially similar to them, as of Sept. 21, 2018. The table below lists the new models and provides an overview of the events that trigger the requirement to provide them to a consumer. 

Updated Model	Must be provided:
Summary of Consumer Rights (also available in Spanish)	Before a background credit check is conducted; and When considering any potential adverse action based on the background credit check.
Summary of Consumer Identity Theft Rights (also available in Spanish)	Any time a consumer notifies a consumer reporting agency that he or she is a victim of identity theft (although the requirement to provide this notice does not apply to employers in general, an employer that uses a credit reporting agency to conduct credit checks should ensure that the agency uses the updated notice).

Substantially Similar Forms

According to the Bureau’s interim final rule, an alternative form for either of the two notices listed above will be considered substantially similar to the new models (and therefore compliant with the FCRA) if it includes all the same information shown on the appropriate new model form but has the security freeze notice placed in a location that is different from where it is located on the new model form.
In addition, an alternative form for the Summary of Consumer Rights will be considered substantially similar to the new model (and therefore compliant with the FCRA) if it includes both:

• The Bureau’s old model form (published on Nov. 14, 2012) or a substantially similar form; and
• A separate page that includes the notice of security freeze rights (as stated on the new model form).

These two conditions also apply to an alternative form for the Summary of Consumer Identity Theft Rights, except that, for this notice, the separate page must also state the following before or after the notice of security freeze rights: “The minimum duration of initial fraud alerts changed from 90 days to one year effective September 21, 2018.” The interim final rule also allows an alternative form for the Summary of Consumer Identity Theft Rights to exclude the following sentence, which appears before the security freeze notice on the new model form: “The following FCRA right applies with respect to nationwide consumer reporting agencies.”

Considerations for Employers

Because both of the new models include updated contact information for certain FCRA enforcement agencies, employers that use alternative forms should also ensure that they update that information on their forms.
Furthermore, employers should consider any requirements that may apply to them under state consumer protection laws that are similar to the FCRA.