20.1 Consumer Reports: Permissible Purpose and Employment Use

---

1. Statutory Scope and Core Definitions

Congress enacted the FCRA to promote accuracy, fairness, and the privacy of personal information assembled by consumer reporting agencies (CRAs). The statute imposes obligations across three operational participants: consumer reporting agencies that compile data, users of consumer reports (such as banks and lending institutions), and furnishers of consumer data.

Consumer Reports vs. First-Party Experience Information

Under 15 U.S.C. § 1681a(d), a consumer report is defined as any written, oral, or other communication of any information by a CRA bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for:

• Credit or insurance to be used primarily for personal, family, or household purposes;
• Employment purposes; or
• Any other permissible purpose authorized under FCRA § 604.

1. Specified exclusions: The statute excludes certain communications, such as an issuer’s authorization or approval of a specific extension of credit through a card or similar device, subject to the statutory terms. Joint lenders do not receive a blanket exemption for sharing every consumer report.

Consumer Reporting Agencies (CRAs)

A Consumer Reporting Agency (CRA) is defined under § 1681a(f) as any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties. CRAs encompass:

• Nationwide CRAs: Equifax, Experian, and TransUnion;
• Nationwide Specialty CRAs: Entities that compile specialty records, including ChexSystems and Early Warning Services (deposit account histories), LexisNexis (public records and insurance claims), and CoreLogic Teletrack (subprime and alternative credit histories).

---

2. Permissible Purposes Under FCRA § 604 (15 U.S.C. § 1681b)

The fundamental operational premise of FCRA is that a consumer report is confidential. A financial institution cannot obtain, pull, or use a consumer report for any purpose unless it has a specific statutory permissible purpose enumerated in FCRA § 604.

Enumerated Permissible Purposes (§ 604(a))

A CRA may furnish, and a user may obtain, a consumer report under the following circumstances:

1. Court Order or Subpoena: In response to an order of a court having jurisdiction or a federal grand jury subpoena.
2. Consumer Written Instruction: In accordance with the written instructions of the consumer to whom it relates.
3. Consumer-Initiated Credit Transactions: In connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer.
4. Employment Purposes: Evaluating a consumer for employment, promotion, reassignment, or retention, subject to strict procedural consent requirements.
5. Insurance Underwriting: In connection with the underwriting of insurance involving the consumer.
6. Government Licensing or Benefits: Determining eligibility for a license or benefit granted by a governmental instrumentality required by law to consider financial responsibility.
7. Assessment of Credit Risks: Evaluating credit or prepayment risks associated with an existing credit obligation by a potential investor, servicer, or secondary market participant.
8. Legitimate Business Need: In connection with a business transaction that is initiated by the consumer, or to review an existing account to determine whether the customer continues to meet terms.

• Spousal reports: Establish a permissible purpose for the actual person’s report. Marriage, authorized-user status or a shared address alone is insufficient. Joint liability, written instructions or an applicable community-property credit transaction may provide a basis, subject to the facts and law.

Employment Purpose Guardrails (§ 604(b))

When a financial institution uses consumer reports for hiring, background screening, or employee retention, it must follow a rigid two-step statutory workflow:

1. Pre-Procurement Requirements:
   • Standalone Written Disclosure: The employer must provide a clear and conspicuous written disclosure to the job applicant in a document that consists solely of the disclosure (the 'standalone document' rule; it cannot be embedded in an employment application or combined with liability waivers).
   • Written Authorization: The applicant must authorize the procurement in writing.
2. Adverse Action Workflow for Employment:
   • Pre-Adverse Action Notice: Before taking any adverse employment action (e.g., rejecting an applicant or revoking a conditional job offer), the employer must provide the individual with: (a) a Pre-Adverse Action Notice; (b) a copy of the actual consumer report; and (c) a written copy of the CFPB document titled A Summary of Your Rights Under the Fair Credit Reporting Act.
   • Reasonable Waiting Window: The employer must provide a reasonable period (standardly 5 business days) to allow the candidate to review the report and dispute inaccuracies with the CRA.
   • Final Adverse Action Notice: If adverse action is taken, the employer must issue a post-adverse action notice meeting § 615(a) standards.

Prescreened Credit Solicitations & Firm Offers of Credit (§ 604(c) & § 615(d))

Creditors may obtain prescreened lists from CRAs to solicit credit products without consumer initiation only under strict statutory conditions:

• Firm Offer of Credit: The creditor must make a bona fide 'firm offer of credit' to every consumer on the prescreened list who satisfies pre-established creditworthiness criteria.
• Opt-Out Notice: Every solicitation must include a prominent Opt-Out Notice (both a short-form and long-form disclosure under 12 CFR § 1022.54) informing the consumer of their statutory right to opt out of prescreened lists by calling the nationwide toll-free number (1-888-5-OPTOUT) or visiting the national opt-out website.

Civil and Criminal Penalties for Noncompliance

• Willful Noncompliance (§ 616): Any person who willfully fails to comply with FCRA is liable to the consumer for actual damages or statutory damages of $100 to $1,000 in an eligible consumer action, plus punitive damages and attorney's fees.
• Obtaining Reports Under False Pretenses (§ 619): Any person who knowingly and willfully obtains information on a consumer from a CRA under false pretenses faces criminal fines and up to two years imprisonment.
• Negligent Noncompliance (§ 617): Actual damages sustained by the consumer, court costs, and reasonable attorney's fees.

---