Fair Credit Reporting Act Litigation: Emerging Trends Under a - PowerPoint PPT Presentation

Fair Credit Reporting Act Litigation: Emerging Trends Under a Dangerous Statute Teleseminar 25 September 2013

Sherri A. Affrunti Paul Bond Wanda G. Holloway Partner, Princeton Partner, Princeton Partner, Houston +1 609 514 5950 +1 609 520 6393 +1 713 469 3814 saffrunti@reedsmith.com pbond@reedsmith.com wholloway@reedsmith.com Timothy P. Law Travis P. Nelson Partner, Philadelphia Counsel, Washington, D.C. +1 215 241 1262 +1 202 412 9200; tlaw@reedsmith.com +1 609 524 2038 tnelson@reedsmith.com 2

Topics • Examinations and Enforcement: Because of the policy implications and political sensitivities of consumer information sharing, federal regulators have increased their scrutiny of users and distributors of consumer information. We will review recent FTC and CFPB enforcement actions, regulators’ expectations for FCRA compliance, and how to survive a regulatory examination or enforcement action. • Big Data: In the age of predictive analytics, more information than ever before can be used – or misused – to make key employment, credit, and insurance decisions. We will explain the regulatory drive to expand the FCRA and what it means to businesses that have never before considered themselves consumer reporting agencies. • Employee Screening Processes: Every company has employees, and most companies use and/or contribute to employment screening processes. These processes have become flashpoints for litigation and regulation. We will discuss the issues, liability theories, and best practices. • Insurance: We will also address the insurance coverage potentially available when faced with an investigation or litigation arising from alleged FCRA violations. 3

Examinations & Enforcement 4

Federal Agencies – Who are the Players? • Federal Trade Commission • “Vigorous enforcement of the FCRA is a high priority for the Commission.” – Maneesha Mithal, Assoc. Director, Div. of Privacy and Identity Protection, FTC (May 7, 2013) • Consumer Financial Protection Bureau • “To ensure compliance, the agency pursues an aggressive enforcement program aimed at the main players in the credit reporting system – credit reporting agencies, those who send them information, and consumer report users .” • Shared enforcement scheme • Overlapping jurisdiction • Memorandum of Understanding 5

Federal Trade Commission • Scope of enforcement authority • Who is covered? What relief can agencies seek? • U.S. v. HireRight Solutions • In re Filiquarian Publishing, LLC • “ Test- Shopping” Operation 6

Consumer Financial Protection Bureau • Scope of enforcement authority • Who is covered? What relief can agencies seek? • Credit reporting agencies as “larger participants” • “Credit reporting companies exert great influence over the lives of consumers. They help determine eligibility for loans, housing, and sometimes jobs. Consumers need an avenue of recourse when they feel they have been wronged.” – Richard Cordray, Director, CFPB • CFPB Bulletin 2013-09 (Sept. 2013) – Supervisory expectations • Furnishers of Information – Duty to Investigate • Distinctions: Disputes through a CRA vs. Direct disputes 7

Surviving an Examination or Enforcement Action • Understand the law and agency expectations • Design and implement a robust compliance system • Identify and remediate problems • Cooperate with agency examiners and enforcement counsel 8

Big Data 9

What is ‘Big Data’? • Roughly 90 percent of all the digital data in the world has been created in the past two years • These data sets are: • Very large, even by modern standards • Diverse, encompassing many data elements, often relating to different topics • Unstructured – frequently, the data sets are really data dumps 10

What is ‘Big Data’? (cont.) The term “ Big Data ” encompasses: • Any use of improved analytic tools . . . • To draw actionable information . . . • From very large, diverse, and/or unstructured data sets • The term “ Predictive Analytics ” refers to a subset of Big Data projects – just those that aim to forecast what choices people will make 11

What Kinds of Human Behavior Are Possible to Predict? • Whether a customer will switch from one type of credit card to another if made the offer • Whether a customer is likely to discuss a company on social media following a favorable transaction • How likely a customer is to research a big-ticket item after a neighbor buys one 12

What Kinds of Human Behavior Are Now Possible to Predict? • Whether a customer will default on his or her credit card payments • Whether the customer is likely to get a divorce in the immediate future • Whether the customer is looking for a new job, and/or is afraid of losing a current job 13

How Do Big Data and Predictive Analytics Intersect with the FCRA? • Consumer Reports are at the heart of the FCRA • A Consumer Report is defined as: “any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living” 15 USC § 1681a (emphasis added) • More and more information can be used to draw conclusions on those issues 14

How Will the FTC Adapt to the Age of Big Data? • Expanded enforcement of FCRA • Policing of known CRAs • Mystery shopping to identify new alleged CRAs • Urging broad understanding of what “consumer reports” mean • Attacking anonymization as an “out” from data qualifying as a Consumer Report • Relying as a backup on FTC Act to police data brokers whose data impact decisions important to people’s lives 15

Employee Screening Processes 16

Complying with FCRA in the Employment Context • FCRA requires employers to follow notice and disclosure procedures when obtaining or using Consumer Reports or Investigative Consumer Reports from third-party Consumer Reporting Agencies • “Consumer Reports” may include information related to criminal background checks, credit checks, educational history, employment history, driving and other license records, and general reputation or character that is used as a factor when considering an individual’s eligibility for hire, promotion or other employment actions, including investigations • “Investigative Consumer Reports” are a specific type of Consumer Report containing information on these subjects that is obtained through personal interviews with neighbors, friends, or other people who may have knowledge concerning any such items of information • Many types of Consumer Reporting Agencies, including credit bureaus as well as data collection agencies mining the internet through social media 17

Complying with FCRA – Before Obtaining a Consumer Report • Notify employee or applicant in writing that a Consumer Report may be obtained and used for employment purposes (hiring, retention, promotion, reassignment) • Obtain conspicuous written authorization from employee or applicant prior to requesting a Consumer Report • Provide certification of compliance to the Consumer Reporting Agency • Note special rules for requesting Investigative Consumer Reports and for using Reports during Investigations 18

Complying with FCRA – Before Taking an Adverse Action • Notify employee or applicant that a Consumer Report has been obtained and that adverse action may be taken on the contents of the report • Provide FCRA Summary of Rights and a copy of the Report upon which the decision may be based • Allow for reasonable opportunity for candidate or employee to notify company of inaccuracies or otherwise dispute the Report contents 19

Complying with FCRA – After Taking an Adverse Action • Notify employee or applicant in writing that adverse action has been taken based upon the full or partial contents of a Consumer Report • Include name, address, telephone number of the Consumer Reporting Agency that furnished the Consumer Report • Inform employee or applicant of his or her rights under FCRA, including the right to dispute accuracy or completeness of the Consumer Report • Inform employee or applicant of right to obtain a free copy of the Consumer Report from the Consumer Reporting Agency if requested within 60 days • Provide a statement that the Consumer Reporting Agency did not make the adverse action decision and cannot provide information as to the reasons for the adverse action 20

FCRA Remedies for Non-Compliance • Private cause of action against an employer for “willfully” or “negligently” failing to comply with FCRA • Potential Damages: • Negligent violations: (i) actual damages; and (ii) attorneys’ fees and costs • Willful violations: (i) actual damages or statutory damages between $100 and $1,000; (ii) punitive damages; and (iii) attorneys’ fees and costs • Statute of Limitations: earlier of (i) two years after date on which employee discovered a violation; or (ii) five years after date of alleged violation • The Consumer Financial Protection Bureau, Federal Trade Commission, other agencies, and the states may sue employers for non-compliance and obtain civil penalties available under various statutory schemes 21