CFPB Urges Employers to Follow FCRA When Using Background Dossiers and Algorithmic Scores

The Consumer Financial Protection Bureau (CFPB) issued a recent policy statement advising employers to comply with the Fair Credit Reporting Act (FCRA) when using background dossiers or other algorithmic scores to make employment decisions. The guidance issued on October 24, 2024, addresses the need for employers to obtain consent from employees and to provide necessary notices before taking any adverse employment actions based on reports obtained from algorithmic scores and reports.

A quick overview of Circular 2024-06

The October 2024 Circular opens with the question, “Can an employer make employment decisions utilizing background dossiers, algorithmic scores, and other third-party consumer reports about workers without adhering to the Fair Credit Reporting Act (FCRA)?” The short answer – No.

Employers must comply with the FCRA when using a background report for employment purposes. The Circular observes that various types of reports generated and sold to employers may be used to make automated recommendations or determinations such as to worker pay, schedule work shifts or responsibilities, or handle other employment-related functions. Examples of data and behavior used to make adverse action decisions from generated reports include but are not exclusive to:

• Biometric information
• Interactions with customers
• Number and quality of meetings attended
• Web browsing history
• Keystroke frequency

The Circular advises that the use of this information for employment purposes must be compliant with the FCRA.

Simply put, the CFPB considers a background or third-party report a “consumer report” when used for hiring, promotion, reassignment, retention, or other employment purposes. To see the full details of the Consumer Financial Protection Circular, take a closer look here.

Employer obligations under the FCRA

Compliance with the FCRA includes various components, including, but not exclusive, to the following requirements:

Provide FCRA Notice and Obtain Employee Consent:

• Before purchasing third-party reports, employers must disclose to employees the possibility of obtaining such a report.
• Employers must obtain written authorization from employees.

Provide Pre-Adverse Action Notice and Copy of Report:

• Employers are required to notify the affected employee before taking any adverse action (including reassignment, denial of promotion, demotion, or termination).
• The notice must include a copy of the report and a description of rights under the FCRA, as prepared by the CFPB.

Provide Post-Adverse Action Notice:

• If an adverse action is taken after the pre-adverse action notice, employers must provide an additional notice that a decision has been made to follow through with adverse action.
• The notice must include details of the adverse action and explicitly state the right to contest the report’s contents with the third party that provided the report.

Relevant for all U.S. HR professionals

The guidance in Circular 2024-06 applies to all employers in the United States. Compliance with the FCRA helps protect employers' and employees' rights and maintains trust in the workplace. Employers in the U.S. with detailed questions about complying with FCRA regulations when using third-party reports to make employment decisions should consult their legal counsel.

This article is for informational purposes only and does not constitute legal advice. Hiring professionals, HR professionals, and administrators should consult their legal counsel to ensure all actions comply with the law.