Background screening reports and the FCRA: Just saying you're not a consumer reporting agency isn't enough

You know that phrase “If it quacks like a duck. . . “?  It’s applicable in the Fair Credit Reporting Act context, too.  If a company meets the legal definition of a “consumer reporting agency,” it’s a consumer reporting agency.  Including a disclaimer that says, in effect, “But we’re not a CRA!” won’t change that.  That’s one important takeaway tip from the FTC’s settlement with Filiquarian Publishing, the agency’s first FCRA case involving mobile apps.

Filiquarian advertised that people who bought its apps — available for 99 cents from app stores like iTunes and Google Android (now GooglePlay) — could conduct a “quick criminal background check for convictions” in specific states.  Filiquarian also said that its apps could access hundreds of thousands of criminal records, and that users could conduct searches on potential employees as part of the hiring process.  But according to the FTC, Filiquarian, owner Joshua Linsk, and Choice Level, LLC (a related company that provided the criminal records) made a major mistake: They failed to comply with the FCRA.

A company is a “consumer reporting agency” under the law if it assembles and evaluates consumer report information for the purpose of providing those reports to third parties.  Reports include information that relate to a person’s character, reputation, or personal characteristics.  Typically, they’re used — or are expected to be used — for employment, housing, credit, or the like.  That’s what triggers a company’s obligations under the FCRA.  But a business that uses consumer reports for employment purposes has to comply with the FCRA, too.  Failing to implement any of the accuracy, dispute, or other safeguards required by the law could harm people’s reputations and employment prospects.

So how does the FTC determine if a business has reason to believe that its information is being used for employment or other FCRA purposes?  Lots of factors may be relevant, but one approach is to look at what the company says in its own ads.  In Filiquarian’s case, it specifically advertised that its reports could be used for hiring decisions on potential employees:

Are you hiring somebody and wanting to quickly find out if they have a record? Then Texas Criminal Record Search is the perfect application for you.

Here’s an interesting point for disclaimer mavens.  Filiquarian and Choice Level included statements in their apps and on their website that their background screening reports weren’t to be considered screening products for insurance, employment, loans, and credit applications (among other things) and that they weren’t FCRA-compliant.  That disclaimer didn’t cut much ice with the FTC, especially since it contradicted express representations in Filiquarian’s ads urging people to use the reports to screen potential employees.  Just saying that the info can’t be used for FCRA purposes doesn’t absolve a company from liability, concluded the FTC.

If you’ve been following  mobile apps and the FCRA, you should feel a sense of déjà vu.  Last year the FTC sent public warning letters to developers of six apps telling them:

If you have reason to believe that your reports are being used for employment or other FCRA purposes, you and your customers who are using the reports for such purposes must comply with the FCRA. This is true even if you have a disclaimer on your website indicating that your reports should not be used for employment or other FCRA purposes.

Sound familiar?

According to the FTC, what Filiquarian produced were “consumer reports” under the FCRA.  Specifically, the complaint charged three key FCRA violations:  failure to maintain reasonable procedures to verify who their users are and that the information would be used for a permissible purpose; failure to have procedures to ensure that the information they provided in consumer reports was accurate; and failure to provide notices to users and to those who furnished Filiquarian with information that was included in consumer reports.

The consent order contains provisions designed to ensure future compliance and requires the respondents to circulate the order to staffers with FCRA responsibilities.

What should businesses take from the case?  The mobile app angle offers a 21st century twist, but the message remains the same:  Companies offering background screening products for employment or other FCRA purposes — and the businesses that use them — have to stay in line with the law.  Another tip:  It’s wise to pay attention to what the FTC says in warning letters to other companies.

For more information, visit the BCP Business Center’s Credit Reporting page.

 

4 Comments

>> Leave a Comment | Commenting Policy

There is no question about it that there is a warm fuzzy feeling that comes with knowing that we are protected as consumers. Unfortunately, not every independent agency out there is following the rules. Use caution and report anybody you suspect is involved in wrong doing to the FTC. Thanks. For some good related information, please go here [link deleted]

That is good for the consumer....

The topic seems fairly straight forward. When a company seeks background information for any reason, on an individual, then they're acting in a capacity as a CRA. But not all marketers are aware of this fact, or even that they need to be in compliance with the FTC's regulation. Perhaps the FTC should create an app...I do have a concern about the distribution of information on directory sites by individuals. Companies have started using systems and processes for Reputation Marketing but individuals are at the mercy of CRAs and other sources which may be flawed. I am concerned that big brother, while watching, may be missing quite a bit.

That is FANTASTIC that the FTC protects consumers info and how its used. The FTC catching companies like that really show just how much they do. The FTC is all about the ppl, which is an awesome feeling. Ty

Leave A Comment

Don't use this blog to report fraud or deceptive practices. To file a complaint with the Federal Trade Commission, please use the FTC Complaint Assistant.

PRIVACY ACT STATEMENT: It is your choice whether to submit a comment. If you do, you must create a user name, or we will not post your comment. The Federal Trade Commission Act and the Federal Information Security Management Act authorize this information collection for purposes of managing online comments. Comments and user names are part of our public records system, and user names are also part of our computer user records system. We may routinely use these records as described in our Privacy Act system notices. For more information on how we handle information that we collect, please read our privacy policy.