The Consumer Financial Protection Bureau (CFPB) has a worker tracking and surveillance policy clarifying that employers that use third-party data and algorithmic scores for hiring, firing, and other employment decisions must adhere to federal consumer protection laws, such as the Fair Credit Reporting Act (FCRA).
Many modern-day background dossiers, for example, are compiled from databases that collect public records, employment history, collective-bargaining activity, or other information about a worker, including reports that convey scores assessing a current worker’s risk level or performance. The CFPB’s policy establishes these are “consumer reports” under the FCRA.
Concerns Over Worker Privacy and Fairness
The CFPB expresses serious concerns about the use of worker data, dossiers, and algorithmic scores by employers, particularly when it comes to hiring, promotion, and reassignment decisions. “With the rise of artificial intelligence, the data harvested about us can be used to power models that score us and put us into different categories,” explained CFPB Director Rohit Chopra. Further, “this data, the dossiers assembled about us, and the algorithmic scores about us may be sold for profit,” he said.
There are concerns about privacy and fairness, especially if the data and scores are based on factors such as union activity, family leave usage, benefits program participation, or performance assessments that may be derived from incomplete or flawed data or converted into some sort of score using an “opaque” algorithm.
Employers Must Ensure FCRA Compliance
One thing is clear. Companies using any third-party consumer reports to make employment decisions—including background dossiers that provide algorithmic, reputation, or performance scores about workers—must follow FCRA rules.
You should thus review your background check process for FCRA compliance:
- Disclose. Provide a clear and conspicuous written disclosure to the applicant or employee before obtaining a consumer report, informing them that the report may be used for employment purposes. This disclosure must be in a standalone document that contains only the disclosure and no extraneous information.
- Authorize. Obtain the applicant’s or employee’s written authorization before procuring the report.
- Notify. If you intend to take any adverse action based on the consumer report, such as not hiring the applicant or terminating an employee, you must first provide the individual with a copy of the report and a written summary of their rights under the FCRA.
- Dispute. Workers have the right to review the report and contest any inaccurate information before the adverse action is taken.
- Protect. Companies must protect and cannot misuse worker reports for illegal purposes, such as selling them or using them for marketing financial products to workers.
You should also be aware of and comply with any additional state-specific requirements that may apply to your background check process.
Bottom Line
Work with reputable background check providers and legal counsel to ensure full compliance with the FCRA and state laws, and avoid potential liability for noncompliance, which can include civil penalties, damages, and attorneys’ fees.
Brit Merrill is an attorney with Holland & Hart LLP in Salt Lake City and can be reached at bjmerrill@hollandhart.com.