CFPB Says FCRA May Govern Background Report Providers and Users, Including Tech Companies

On October 24, 2024, the Consumer Financial Protection Bureau (CFPB) issued a consumer financial protection circular explaining that background reports, including scores, obtained from third parties and “used by employers to make hiring, promotion, reassignment, or retention decisions are often governed by” the Fair Credit Reporting Act (FCRA).

While the guidance is generally applicable to providers of background reports and scores, a large focus is on those that incorporate artificial intelligence (AI) tools, with algorithms trained on broad data sets, for use in the employment decision-making process. CFPB Director Rohit Chopra further emphasized concerns regarding the role of AI in employment decisioning during a joint field hearing held by the Department of Labor (DOL) and the CFPB on the day the circular was released.

The circular and field hearing follow a 2023 announcement that the CFPB and the National Labor Relations Board (NLRB) had entered into an information sharing agreement – which, among other things, was aimed at identifying and addressing possible FCRA violations by entities that collect and sell worker data to third parties for use in employment decisions.

FCRA compliance expectations

Consumer financial protection circulars, like the one issued by the CFPB on October 24, are intended to ensure that agencies responsible for enforcement of consumer financial protection laws, such as the FCRA, enforce those laws consistently.

This circular reflects the CFPB’s position that:

• Background reports assembled from databases containing “public records, employment history, collective-bargaining, or other information about a worker” or containing scores “assessing a current worker’s risk level or performance” may qualify as consumer reports under the FCRA.
• Entities that provide such reports to third parties for use in hiring and/or subsequent employment decisions may qualify as “consumer reporting agencies” and, if so, must comply with the FCRA.
• Employers who use such reports for hiring or subsequent employment decisions must comply with the FCRA, including by obtaining workers’ consent to procure a consumer report, providing notices before and when taking any adverse action with respect to a worker, and only using the consumer report information obtained for permissible purposes as outlined in the FCRA.

In the circular, the CFPB also offers guidance to enforcement personnel considering whether an “employer that makes employment decisions based on a report from a third party is regulated by the FCRA.” The CFPB suggests enforcers consider whether:

• The employer is using the report for “employment purposes,” meaning for purposes of “evaluating a consumer for employment, promotion, reassignment or retention” (and, thus, for either initial hiring or subsequent employment decisions).
• The report was obtained from a “consumer reporting agency,” meaning an entity that “assembled” or “evaluated” consumer information for purposes of providing the report – which the CFPB says may include companies, such as tech companies, that collect “consumer data in order to train an algorithm that produces scores or other assessments about workers for employers.”

On that point, the CFPB further explains, within a footnote, its position that a software provider could potentially meet the definition of a “consumer reporting agency” where the provider assembles or evaluates consumer report information to develop software that produces reports used by third parties to evaluate workers for “employment purposes” or the software itself assembles or evaluates information about a worker to provide reports to third parties to use for such purposes. In doing so, the CFPB rebuffs long-standing Federal Trade Commission (FTC) guidance providing that a seller of software that enables users to compile credit report information is not a “consumer reporting agency” – given it is not itself “assembling or evaluating” information – asserting that, in its view, the FTC guidance is “inapplicable to many of the kinds of technology used today.”

Notwithstanding, the CFPB acknowledges that not “all third parties that assemble or evaluate data will qualify as ‘consumer reporting agencies.’” Specifically, it highlights that the FCRA does not apply to a report containing only information as to the “transactions or experiences between the consumer and the person making the report.”

Looking ahead

The circular is the latest in a series of CFPB publications focused on ensuring compliance with the FCRA, across sectors and with respect to new technologies. For example, the CFPB published two advisory opinions in January 2024 addressing consumer reporting agency obligations under the FCRA related to background check reports, and in June 2024 it issued a proposed rule that would keep most medical debt information off consumer reports.

The circular also aligns with the CFPB’s broader focus on the use and impact of AI in consumer financial services. In the last year or so, the CFPB has:

1. Issued guidance concerning information that must be included in adverse action notices, under the Equal Credit Opportunity Act (ECOA), when AI or complex models are used in credit decisioning.
2. Approved a rule, developed with other federal agencies, to address the use of AI and complex algorithms in home appraisals.

In addition, the CFPB recently detailed its observations and concerns regarding the use of AI, in consumer financial services, in response to a US Department of the Treasury request for information (RFI) on the uses, opportunities, and risks presented by AI. In doing so, the CFPB emphasized that “[a]lthough institutions sometimes behave as if there are exceptions to the federal consumer financial protection laws for new technologies,” in its view “that is not the case.”

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.