Should this rule be finalized, the CFPB would be empowered to enforce the FCRA’s privacy protections and consumer safeguards in connection with data brokers who leverage emerging technologies that became prevalent after FCRA’s enactment.

What are some of the implications of the new rule?

• Data Brokers are Now Considered CRAs. The proposed rule defines the circumstances under which companies handling consumer data would be considered CRAs by clarifying the definition of “consumer reports.” The rule specifies that data brokers selling any of four types of consumer information—credit history, credit score, debt payments, or income/financial tier data—would generally be considered to be selling a consumer report.
• Assembling Information About Consumers Means You are a CRA. Under the rule, an entity is a CRA if it assembles or evaluates information about consumers, including by collecting, gathering, or retaining; assessing, verifying, validating; or contributing to or altering the content of such information. This view is in step with the Bureau’s recent Circular on AI-based background dossiers of employees. (See our prior discussion here.)
• Header Information is Now a Consumer Report. Under the proposed rule, communications from consumer reporting agencies of certain personal identifiers that they collect—such as name, addresses, date of birth, Social Security numbers, and phone numbers—would be consumer reports. This would mean that consumer reporting agencies could only sell such information (typically referred to as “credit header” data) if the user had a permissible purpose under the FCRA.
• Marketing is Not a Legitimate Business Need. The proposed rule emphasizes that marketing is not a “legitimate business need” under the FCRA. Accordingly, CRAs could not use consumer reports to decide for an advertiser which consumers should receive ads and would not be able to send ads to consumers on an advertiser’s behalf.
• Enhanced Disclosure and Consent Requirements. Under the FCRA, consumers can give their consent to share data. Under the proposed rule, the Bureau clarified that consumers must be provided a clear and conspicuous disclosure stating how their consumer report will be used. It would also require data brokers to acknowledge a consumer’s right to revoke their consent. Finally, the proposed rule requires a new and separate consumer authorization for each product or service authorized by the consumer. The Bureau is focused on instances where a customer signs up for a specific product or service, such as credit monitoring, but then receives targeted marketing for a completely different product.

Comments on the rule must be received on or before March 3, 2025.

Putting It Into Practice: With the release of the rule so close to the end of Director Chopra’s term, it will be interesting to see what a new administration does with it. We expect a new CFPB director to scale back and rescind much of the informal regulatory guidance that was issued by the Biden administration. However, some aspects of the data broker rule have bipartisan support so we may see parts of it finalized in 2025.

The post CFPB Takes Aim at Data Brokers in Proposed Rule Amending FCRA appeared first on The National Law Forum.

The post Eleventh Circuit Affirms Dismissal of FCRA Claims Since Alleged Inaccurate Information Was Not Objectively and Readily Verifiable appeared first on The National Law Forum.

A hotly contested ruling in a Fair Credit Reporting Act (“FCRA”) class action case will soon be appealed to the Supreme Court of the United States.  The Ninth Circuit in Ramirez v. TransUnion LLC, Case No. 17-17244, recently granted the parties’ Joint Motion to Stay the Mandate, seeking to stay the Ninth Circuit’s mandate pending TransUnion’s filing of a petition for writ of certiorari in the Supreme Court.  The Motion to Stay comes soon after the court denied TransUnion’s Petition for Rehearing or Rehearing En Banc regarding the Ninth Circuit’s decision in Ramirez v. TransUnion LLC, 951 F.3d 1008 (9th Cir. 2020).

In Ramirez, the Ninth Circuit held for the first time that every class member in a class action lawsuit needs “standing” to recover damages at the final judgment stage.  The 8,185 member class alleged that TransUnion, knowing that its practice was unlawful, violated the FCRA by incorrectly placing terrorist alerts on the front page of consumers’ credit reports and later sending the consumers misleading and incomplete disclosures about the alerts and how to remove them.  The court held that each class member was required to, and did, have standing, even though the credit reports of over 75% of the class were not actually disclosed to a third party because TransUnion’s alleged violation of the consumers’ statutory rights under the FCRA, by itself, constituted a concrete injury.  The Ninth Circuit also found that the jury’s punitive damages award of 6.45 times the statutory damages award was unconstitutional, and reduced it to 4 times the statutory damages award.  The Ramirez decision is discussed in more detail here.

In its Petition for Rehearing, TransUnion claimed that the dissent had the correct view, and the majority’s decision “not only conflicts with Supreme Court teachings, but puts the Ninth Circuit on the wrong side of a lopsided circuit split.”  TransUnion argued that the class of consumers did not have standing for their FCRA claims unless their credit reports were disclosed to a third party.  TransUnion further alleged that the class should have been decertified because Ramirez, the named plaintiff, “was radically atypical of the class he purported to represent” since there was no evidence that any other class member’s credit report was disseminated.  Finally, TransUnion disputed the court’s punitive damages award because a reduction to 4 times the statutory damages award was not enough.  According to TransUnion, the Supreme Court requires, at a maximum, a punitive damages award “equal to compensatory damages . . . when compensatory damages are substantial.”

TransUnion concluded its Petition for Rehearing by stating:

It is no exaggeration to say that, for many class members, the first indication that they were injured at all will be when they receive a $4,925.10 check in the mail. That absurd result is the product of ignoring basic requirements of Article III, Rule 23, and due process.

As of the date this article is published, TransUnion has not yet filed its petition for writ of certiorari in the Supreme Court, but we will continue to monitor the case for updates.

The post TransUnion to Seek Supreme Court Review After Ninth Circuit Finds Class Members Had Standing and Partially Upholds Punitive Damages Award appeared first on The National Law Forum.

The post House Financial Services Committee Passes Credit Reporting Bills appeared first on The National Law Forum.

A recent federal court filing in the Northern District of California against LinkedIn Corp. provides yet another example of the growing interaction between online personas and real-world employment law implications. There, in Sweet, et al v. LinkedIn Corp., the plaintiffs sought to expand the application of the Fair Credit Reporting Act (“FCRA”) by alleging that LinkedIn’s practice of providing “reference reports” to members that subscribe to LinkedIn’s program for a fee, brought LinkedIn within the coverage of the FCRA as a Credit Reporting Agency (“CRA”). Briefly, the FCRA (and relevant state statutes like it) imposes specific requirements on an employer when working with “any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.” In other words, there are rules – such as providing requisite disclosures and obtaining prior authorization – that apply when an employer engages a CRA to perform background checks, reference checks and related inquiries.

In the lawsuit, the plaintiffs alleged that LinkedIn was a CRA – and that these various rules should apply – because LinkedIn collected and distributed consumer information to third parties and the resulting reference reports “bear on a consumer’s character, general reputation, mode of living, or personal characteristics, and/or other factors listed in 15 U.S.C. § 1681a(d).” Further, according to the complaint, LinkedIn violated the FCRA because it should have provided FCRA compliant disclosure and followed the reporting obligations applicable to CRAs.

LinkedIn, which is touted as the “world’s largest professional network,” does not portray itself as a CRA and moved to dismiss the complaint. LinkedIn argued that the plaintiffs’ interpretation of the statute was too broad and, moreover, was inconsistent with the facts. A federal judge agreed and dismissed the complaint (although the plaintiffs have the opportunity to file another complaint). The Court ruled that these reference searches could not be considered “consumer reports” under the law – and LinkedIn was not acting as a CRA – because, in part, the plaintiffs had voluntarily provided their information to LinkedIn with the intention of it being published online. (The FCRA excludes from the definition of a consumer report a report that contains “information solely as to transactions or experiences between the consumer and the person making the report.”) The Court also noted that the allegations suggested that LinkedIn “gathers the information about the employment histories of the subjects of the Reference Searches not to make consumer reports but to ‘carry out consumers’ information-sharing objectives.’”

The LinkedIn case should still serve as a reminder of several important and interrelated trends. First, as it concerns the FCRA, the statute is broadly worded to cover “any written, oral or other communication of any information by a consumer reporting agency . . .” and the equally expansive definition of a CRA can apply in numerous situations that extend beyond the traditional notion of a consumer reporting agency. If applicable, the requirements of the FCRA must be followed. Second, employers need to continue to be mindful of the fact that their online activity can have real-world employment law implications. Third, as the law governing traditional employment law continues to evolve in response to online developments, the challenges to that activity will evolve as well.

Authored by: Ian Gabriel Nanos and Maxine Adams of Epstein Becker & Green, P.C.

©2015 Epstein Becker & Green, P.C. All rights reserved.

The post LinkedIn, the Fair Credit Reporting Act, and the Real-World Implications of Online Activity appeared first on The National Law Forum.

The question will be decided by the U.S. Supreme Court in Spokeo, Inc. v. Robins, 742 F.3d 409 (9th Cir. 2014), cert. granted, 2015 U.S. LEXIS 2947 (U.S. Apr. 27, 2015) (No. 13-1339). The Court’s decision will have far-reaching implications for suits under the FCRA and other statutes that regulate privacy and consumer credit information.

FCRA

Enacted in 1970, the Fair Credit Reporting Act obligates consumer reporting agencies to maintain procedures to assure the “maximum possible accuracy” of any consumer report it creates. Under the statute, consumer reporting agencies are persons who regularly engage “in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties.” Information about a consumer is considered to be a consumer report when a consumer reporting agency has communicated that information to another party and “is used or expected to be used or collected” for certain purposes, such as extending credit, underwriting insurance, or considering an applicant for employment. The information in a consumer report must relate to a “consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.”

Under the FCRA, consumers may bring a private cause of action for alleged violations of their FCRA rights resulting from a consumer reporting agency’s negligent or willful actions. For a negligent violation, the consumer may recover the actual damages he or she may have sustained. For a “willful” or “knowing” violation, a consumer may recover either actual damages or statutory monetary damages of $100 to $1,000.

Background

Spokeo is a website that aggregates personal data from public records that it sells for many purposes, including employment screening. The information provided on the site may include an individual’s contact information, age, address, income, credit status, ethnicity, religion, photographs, and social media use.

Spokeo, Inc., has the dubious distinction of receiving the first fine ($800,000) from the Federal Trade Commission (“FTC”) for FCRA violations involving the sale of Internet and social media data in the employment screening context. The FTC alleged that the company was a consumer reporting agency and that it failed to comply with the FCRA’s requirements when it marketed consumer information to companies in the human resources, background screening, and recruiting industries.

Conflict in Circuit Courts

In Robins v. Spokeo, Inc., Thomas Robins had alleged several FCRA violations, including the reckless production of false information to potential employers. Robins did not allege he had suffered or was about to suffer any actual or imminent harm resulting from the information that was produced, raising only the possibility of a future injury.

The U.S. Court of Appeals for the Ninth Circuit, based in San Francisco, held that allegations of willful FCRA violations are sufficient to confer Article III standing to sue upon a plaintiff who suffers no concrete harm, and who therefore could not otherwise invoke the jurisdiction of a federal court, by authorizing a private right of action based on a bare violation of the statute. In other words, the consumer need not allege any resulting damage caused by a violation; the “knowing violation” of a consumer’s FCRA rights alone, the Ninth Circuit held, injures the consumer. The Ninth Circuit’s holding is consistent with other circuits that have addressed the issue. See e.g., Beaudry v. TeleCheck Servs., Inc., 579 F.3d 702, 705-07 (6th Cir. 2009). It refused to follow the U.S. Court of Appeals for the Eighth Circuit in finding that one “reasonable reading of the [FCRA] could still require proof of actual damages but simply substitute statutory rather than actual damages for the purpose of calculating the damage award.” Dowell v. Wells Fargo Bank, NA, 517 F.3d 1024, 1026 (8th Cir. 2008).

The constitutional question before the U.S. Supreme Court is the scope of Congress’ authority to confer Article III standing, particularly, whether a violation of consumers’ statutory rights under the FCRA are the type of injury for which Congress may create a private cause of action to redress. In Beaudry, the Sixth Circuit identified two limitations on Congress’ ability to confer standing:

The post Supreme Court to Decide Who Can Sue Under Privacy Law appeared first on The National Law Forum.

Another interesting case filed in California recently highlights the myriad risks employers face when using social media as part of their hiring process.

A class action lawsuit was filed in the Central District of California against LinkedIn based on allegations that thereference reports LinkedIn generates for premium subscribers, including many employers, violate the Fair Credit Reporting Act(“FCRA”). According to the plaintiffs in Sweet, et. al. v. LinkedIn Corporation, an employer who is a premium subscriber can generate a report containing the names, locations, employment areas, current employers, and current positions of all persons in a user’s network who may have worked with a job applicant and also contact the applicant’s “references.” An employer, according to the allegations, can run such a “reference report” on a job applicant without the applicant receiving any notification whatsoever. Thus, as the complaint alleges, “any potential employer can anonymously dig into the employment history of any LinkedIn member, and make hiring and firing decisions based upon the information they gather, without the knowledge of the member, and without any safeguards in place as to the accuracy of the information that the potential employer has obtained.” The complaint claims this activity potentially violates both the FCRA’s purposes, which include safeguards as to the accuracy, fairness, and privacy of the information that a potential employer obtains, and the FCRA’s customer notification requirements.

This latest lawsuit against LinkedIn serves as another example of the complex legal issues and risks that an employer faces when using social media to make recruiting and hiring decisions.

The post California Class Action Suit Alleges LinkedIn Violated Fair Credit Reporting Act (FCRA) By Providing Employers With Reference Reports appeared first on The National Law Forum.