Recent FCRA Updates
The Fair Credit Reporting Act (FCRA) has been in the news lately due to the changes from the Economic Growth, Regulatory Relief and Consumer Protection Act, which amended sections of the Dodd-Frank Act. One of the amendments, The Security Freeze Notice, which went into effect on September 21, 2018, has required Consumer Reporting Agencies (CRA), to update documentation. In our Q3 FCRA Quarterly Update webinar, compliance expert, Joe Rotondo, discussed recent and anticipated changes in state and local legislation as it relates to the FCRA including the Security Freeze Notice.
Highly Regulated Industry
The background screening industry is highly regulated by federal, state and local laws. The Fair Credit Reporting Act (FCRA) is a federal consumer protection law dating back to the 1970’s that governs consumer background checks. The FCRA mandates:
The responsibilities of third parties who collect information about consumers called CRAs
The requirements for users of this information called End Users
The requirements for the entities that furnish information to the CRA’s, who are called Furnishers.
There are four procedures required by FCRA to be compliant:
End User Certification
Disclosure & Authorization
CRA’s are required to obtain a certification of compliance by the user that the user will abide by the FCRA and other applicable laws. Users must certify that it has a permissible purpose, that every individual who is screened has given consent in the form of a written authorization and disclosure prior to running the background check, and that the user will follow the adverse action process.
Disclosure and Authorization
The Disclosure and Authorization process are two different forms that are required to obtain an employment background check. Employers must disclose in a separate document that a consumer report may be obtained. Organizations must obtain written authorization from the individual before ordering the background check report. A Federal Summary of Consumer Rights should be distributed with the Disclosure and Authorization as well as any state-specific Summary of Rights. A stand-alone Disclosure and Authorization form should be utilized, meaning that these are two separate forms and should not be combined or added to other onboarding forms.
Credit Freeze Notice
As mentioned earlier, The Economic Growth, Regulatory Relief, and Consumer Protection Act amended the FCRA to require that any time a consumer is required to receive the Summary of Rights, a new notice must be provided to the consumer regarding their right to obtain a security credit freeze. The law requires all consumer reporting agencies to provide the security freeze notice when a Summary of Rights is required by the FCRA. The consumer is entitled to receive copies of federal notices when a consumer report is produced by a consumer reporting agency for employment purposes and the inclusion of the security freeze notice is required by all CRAs regardless if the CRA provides a credit report to an employer or not. It is important to remember that the security freeze is only applicable to a credit report.
The amended law increases consumer credit protection under the FCRA in two ways. First, the update allows a consumer one year to submit a fraud alert, notifying credit bureaus that the consumer has been or is about to become a victim of fraud. Secondly, the law implements a national security freeze that allows a consumer free of charge to prohibit credit bureaus from disclosing the contents of a consumer report.