If you are an investigator or a business owner who gets involved with running background checks credit checks any type of, research on consumers, be aware that the Consumer Financial Protection Bureau CFPB has issued some clarification on existing rules. It’s not technically a new rule, but it is a clarification of existing rules which might as well be a new rule and this opinion came out within the last couple of days. It’s being posted to the federal register and it’s what’s called an advisory opinion. It’s issuing this opinion to outline certain obligations of consumer reporting agencies and the users of those records. So if you’re a company that uses background checks that uses credit checks let’s say you’re a landlord or you issue credit, it’s very important to understand the clarification of these rules.
First of all, it reiterates that you cannot make false representations to obtain these sensitive records. You can’t make up a reason that you’re using it that’s not true. However, the big news is that consumer information reporting bureaus and background checks have to be very careful that you’re giving information only on the specific person and not other people that may be similar not with the same name. You will not provide a consumer report to a user unless it has reason to believe that all of the consumer report information pertains to the consumer who was the subject of the user’s request. This means that some credit reports will say, this may be the same person. Maybe they have the same name and a similar address. You can’t guess, you can’t say this might be the person, and more importantly, disclaimers will not cure a failure to reason.
So you can’t just do a blanket report and say well here’s a bunch of information on John Smith. It might be your John Smith It might be somebody else, right? So that’s something that’s very important to mix in. This is the official release from the CFPB. It was an article in a publication that has to do with automotive financing that breaks it down a little bit more and it says that consumers have the right to privacy, which we know, but a plain English language description of it (when I say the English language is not legalese like in the release) it says credit reporting agency uses name only matching procedures. The items that information on a credit report may not all correspond to a single individual. That means that the user of a credit report could be provided a report about a person for whom the user does not have a permissible purpose. Their concern is not so much that you’re going to make a decision based on the wrong information although that’s part of it. It’s more that you might get information about another third party that you don’t have a legitimate purpose to get information from.
So let’s say your party’s name is John Smith. And you run a credit report or background check on John Smith. If you’re getting information on another John Smith that let’s say has some criminal record or other credit maybe they owe a debt or a mortgage. You might not have permission to get that information even if you don’t use it in your case because you realize look this is not the same John Smith because this record is from Alabama and I’m an Oregon. It doesn’t make any sense. So, it’s more about getting information on the wrong person. It is unlawful to provide credit reports on multiple people as possible matches. There’s a smoking gun right there. If you’re a credit report provider, you cannot provide credit reports with multiple possible matches. Credit reporting companies may not provide reports on multiple individuals where the requestor only has permission to report on one. That’s key. And the case you’re getting, you know some clever ideas, you can’t put a disclaimer saying it might be a different person. Disclaimers will not cure a failure to take reasonable steps to ensure the information contained in a credit report is only about the individual. Think about that. How many times have you used a credit reporting agency or a background check or something else that says, Hey maybe a different person? You can’t do that unless you take reasonable steps.
What are reasonable steps? Well, that’s going to be a little bit subjective. So this applies to both providers and users. So if you’re a user and you receive this, you might be in a tight spot. How serious is this? The CFPB outlines there’s criminal liability for providers or users. Covered entities can face criminal liability for obtaining background reports on an individual under false pretenses or providing a background port to an unauthorized individual. So let’s say that you are a credit reporting agency and you provide multiple matching. Well, this might not be the person but here it is just in case you could use it. You’re technically providing credit information about somebody not authorized to your client. How does this affect background checks? Well, it depends upon what you’re talking about for a background check. There are different definitions of what a background check is. A background check could be: stalking you on Facebook to see what you’re all about. It could mean looking at your LinkedIn profile to see where you work. It also could mean looking in public records to see if you have any judgments against you. It could mean running a credit report. It could mean running a criminal report could be all of the above. Background checks have different scopes. And obviously, as you know, the use of a background check for certain things even if it’s obtained legally has some limitations in some states. You cannot run a background check for certain job applications. In some states, you can’t run a background check for things like housing. If you’re renting an apartment you can’t run a background check, as crazy as that sounds, there are some jurisdictions that don’t allow that. So you have to know what your permissible use is in your jurisdiction for what you’re using it for.
So if you are a licensed private investigator be aware of these laws. If you are a client, a business that is using background checks or credit reports for anything, lending consumers, client interactions, and employment contracts make sure that you understand what the permissible use is and make sure your provider is following not only the previous CFPB rules but also the new clarification because one of the things that this could create a problem. It’s not a new rule So if your attorney or your corporate counsel is monitoring for new consumer finance protection bureau laws, there are none. This is the same law. It’s just a clarification of what it means. In this advisory, if you’re not paying attention, this could in effect make your previous use illegal, if you’re not aware of this new advisory.