We still occasionally run across employers who do not realize that if they use third-party consumer reporting agencies (CRAs) to obtain criminal, credit, and other historical background data on prospective employees or existing employees, they must comply with the procedural requirements of the Fair Credit Reporting Act (FCRA) and utilize mandated forms. CRAs should provide you all of the legally compliant forms you need to fulfill your obligations. Here’s what you will need:

• Authorization and Consent: This form grants you permission to obtain historical background information on the applicant or employee through a CRA.
• Summary of Consumer Rights: This form notifies the applicant or employee of their rights under the FCRA and should be given to applicants and employees who may be subject to a CRA background check. It must be disclosed to those who are the subject of an investigative consumer report and as part of the pre-adverse action process. CRAs are required to give this form to employers, but we have encountered situations with clients where the CRA did not fulfill this obligation.
• Notice to Users of Consumer Reports of their Obligations: CRAs must provide a copy of this notice to employers.
• Notice to Furnishers of Information of their Obligations: CRAs are required to issue this notice to certain furnishers of information in specific situations.
• Preliminary Notice of Adverse Action: This form is used to notify an applicant that a preliminary decision has been made not to consider the applicant further for employment based on the employer’s hiring criteria and information obtained from the investigative background report. It also should include a Summary of Consumer Rights and the foregoing Notices. It allows the applicant or employee five days to challenge the accuracy of the information provided to the employer.
• Final Notice of Adverse Action: This form is used to provide the applicant or employee final notice of an adverse action decision.

Pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”), the Consumer Financial Protection Bureau (“CFPB”) has taken over enforcement of the FCRA from the Federal Trade Commission (“FTC”) effective July, 2011. CFPB has rulemaking authority for most of the provisions of the FCRA. The CFPB has published an interim rule establishing a new regulation for implementing the provisions of the FCRA.

As a result, employers and CRAs must update their forms by January 2013 to reflect that the CFPB has taken over for the FTC. The required modifications to the notices simply replace references to the FTC with references to the newly formed CFPB. The interim rule imposes no substantive changes to the forms at this time. Nor does the interim rule require any modification to the current consent form, pre-adverse and adverse action notices.

By Christopher S. Thrutchely, cthrutchley@dsda.com