Employers and consumer reporting agencies beware: a change to a commonly used form required by the Fair Credit Reporting Act (“FCRA”) becomes effective on September 21, 2018, and the price of non-compliance could be class action lawsuits.

On September 21, 2018, the Economic Growth, Regulatory Relief and Consumer Protection Act’s changes to the FCRA Summary of Rights form will take effect. The Act requires new language to be added to the form explaining a consumer’s right to obtain a security freeze.

While the Act specifically amends Section 1681c-1(c) of the FCRA, which is directed at consumer reporting agencies, the Act also requires the new language to be included “[a]t any time a consumer is required to receive a summary of rights required under section 609.”

How can a requirement under 609, which applies to consumer reporting agencies, create an obligation for users of consumer reports? Users are generally required to provide the FCRA Summary of Rights prior to taking any employment adverse action based upon the use of a consumer report. 15 U.S.C. § 1681b(b)(3)(A) requires that:

in using a consumer report for employment purposes, before taking any adverse action based in whole or in part on the report, the person intending to take such adverse action shall provide to the consumer to whom the report relates—


(ii) a description in writing of the rights of the consumer under this subchapter, as prescribed by the Bureau under section 1681g(c)(3) of this title.

Users of consumer reports should identify each situation in their pre-adverse action process where they provide an FCRA Summary of Rights form, so the new form can be substituted in a seamless way.

Likewise, entities that qualify as consumer reporting agencies will need to ensure their FCRA Summary of Rights form is updated. Consumer reporting agencies are required to provide the form at various times, including, for example, to consumers when making a file disclosure pursuant to 15 U.S.C. § 1681g(c)(2).

The new FCRA Summary of Rights form must include the following language:

Consumers Have The Right To Obtain A Security Freeze

You have a right to place a “security freeze” on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extensio of credit.

As an alternative to a security freeze, you have the right to place an initial or extended fraud alert on your credit file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting 7 years.

A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

The Federal Trade Commission (“FTC”) initially published the model Summary of Rights under 16 CFR Part 698, App. F. Starting July 21, 2011, the Consumer Financial Protection Bureau (“CFPB”) assumed responsibility for the Summary of Rights form. The FCRA requires the CFPB to actively publicize the availability of the summary of rights and “conspicuously post on its Internet website the availability of such summary of rights.” See 15 U.S.C. § 1681g(c)(1)(C)(i)-(ii). An official form is published on the CFPB website as Appendix K to Regulation V. However, as of this writing, the CFPB has not published a revised version of the official form with the new security freeze disclosure.

To minimize potential class-wide exposure, forms should be updated for use prior to September 21, 2018 to avoid any gaps in compliance with this new requirement. Improper use or non-use of the Summary of Rights form by users and consumer reporting agencies has been alleged as a basis for multiple class actions, so the risk of exposure from non-compliance is not hypothetical. Companies should seek advice from their legal counsel to ensure their form complies with the new requirement and is in use prior to September 21, 2018.