Employers and consumer reporting agencies beware: a change to a commonly used form required by the Fair Credit Reporting Act (“FCRA”) becomes effective on September 21, 2018, and the price of non-compliance could be class action lawsuits.

On September 21, 2018, the Economic Growth, Regulatory Relief and Consumer Protection Act’s changes to the FCRA Summary of Rights form will take effect. The Act requires new language to be added to the form explaining a consumer’s right to obtain a security freeze.

While the Act specifically amends Section 1681c-1(c) of the FCRA, which is directed at consumer reporting agencies, the Act also requires the new language to be included “[a]t any time a consumer is required to receive a summary of rights required under section 609.”

How can a requirement under 609, which applies to consumer reporting agencies, create an obligation for users of consumer reports? Users are generally required to provide the FCRA Summary of Rights prior to taking any employment adverse action based upon the use of a consumer report. 15 U.S.C. § 1681b(b)(3)(A) requires that:

in using a consumer report for employment purposes, before taking any adverse action based in whole or in part on the report, the person intending to take such adverse action shall provide to the consumer to whom the report relates—

….

(ii) a description in writing of the rights of the consumer under this subchapter, as prescribed by the Bureau under section 1681g(c)(3) of this title.

Users of consumer reports should identify each situation in their pre-adverse action process where they provide an FCRA Summary of Rights form, so the new form can be substituted in a seamless way.

Likewise, entities that qualify as consumer reporting agencies will need to ensure their FCRA Summary of Rights form is updated. Consumer reporting agencies are required to provide the form at various times, including, for example, to consumers when making a file disclosure pursuant to 15 U.S.C. § 1681g(c)(2).

The new FCRA Summary of Rights form must include the following language:

Consumers Have The Right To Obtain A Security Freeze

You have a right to place a “security freeze” on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extensio of credit.

As an alternative to a security freeze, you have the right to place an initial or extended fraud alert on your credit file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting 7 years.

A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

The Federal Trade Commission (“FTC”) initially published the model Summary of Rights under 16 CFR Part 698, App. F. Starting July 21, 2011, the Consumer Financial Protection Bureau (“CFPB”) assumed responsibility for the Summary of Rights form. The FCRA requires the CFPB to actively publicize the availability of the summary of rights and “conspicuously post on its Internet website the availability of such summary of rights.” See 15 U.S.C. § 1681g(c)(1)(C)(i)-(ii). An official form is published on the CFPB website as Appendix K to Regulation V. However, as of this writing, the CFPB has not published a revised version of the official form with the new security freeze disclosure.

To minimize potential class-wide exposure, forms should be updated for use prior to September 21, 2018 to avoid any gaps in compliance with this new requirement. Improper use or non-use of the Summary of Rights form by users and consumer reporting agencies has been alleged as a basis for multiple class actions, so the risk of exposure from non-compliance is not hypothetical. Companies should seek advice from their legal counsel to ensure their form complies with the new requirement and is in use prior to September 21, 2018.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of David M. Gettings David M. Gettings

Dave is a partner of the firm who focuses on defending clients in consumer class actions and complex commercial litigation nationwide, particularly cases involving a variety of federal and state laws and regulations, including the Fair Credit Reporting Act (FCRA), the Telephone Consumer

Dave is a partner of the firm who focuses on defending clients in consumer class actions and complex commercial litigation nationwide, particularly cases involving a variety of federal and state laws and regulations, including the Fair Credit Reporting Act (FCRA), the Telephone Consumer Protection Act (TCPA) and associated FCC regulations, the Fair Debt Collection Practices Act, the Truth in Lending Act, the Electronic Fund Transfer Act, and many similar state consumer protection statutes.

Photo of Ethan G. Ostroff Ethan G. Ostroff

Ethan Ostroff’s practice focuses on financial services litigation and consumer law compliance counseling. Ethan is part of the firm’s national practice representing consumer-facing companies of all types in defense of individual and class action claims and counseling them on compliance with federal and

Ethan Ostroff’s practice focuses on financial services litigation and consumer law compliance counseling. Ethan is part of the firm’s national practice representing consumer-facing companies of all types in defense of individual and class action claims and counseling them on compliance with federal and state laws.

Photo of Ronald I. Raether, Jr. Ronald I. Raether, Jr.

Ron leads the firm’s Privacy + Cyber team. Drawing from nearly 30 years of experience, he provides comprehensive services to companies in all aspects of privacy, security, data use, and risk mitigation. Clients rely on his in-depth understanding of technology and its application

Ron leads the firm’s Privacy + Cyber team. Drawing from nearly 30 years of experience, he provides comprehensive services to companies in all aspects of privacy, security, data use, and risk mitigation. Clients rely on his in-depth understanding of technology and its application to their business to solve their most important challenges — from implementation and strategy to litigation and incident response. Ron and his team have redefined the boundaries of typical law firm privacy and cyber services in offering a 360 degree approach to tackling information governance issues. Their holistic services include drafting and implementing bespoke privacy programs, program implementation, licensing, financing and M&A transactions, incident response, privacy and cyber litigation, regulatory investigations, and enforcement experience.

Photo of Tim J. St. George Tim J. St. George

Tim defends institutions nationwide facing class actions and individual lawsuits. He has particular experience litigating consumer class actions, including industry-leading expertise in cases arising under the Fair Credit Reporting Act and its state law counterparts, as well as litigation arising from data breaches.

Photo of Julie D. Hoffmeister Julie D. Hoffmeister

Julie is a partner primarily focusing on financial services litigation. She defends consumer-facing companies of all types in individual claims and class actions, including claims under the Fair Credit Reporting Act (FCRA), the Driver’s Privacy Protection Act (DPPA), and the Telephone Consumer Protection…

Julie is a partner primarily focusing on financial services litigation. She defends consumer-facing companies of all types in individual claims and class actions, including claims under the Fair Credit Reporting Act (FCRA), the Driver’s Privacy Protection Act (DPPA), and the Telephone Consumer Protection Act (TCPA). Julie also applies her litigation knowledge in assisting businesses in developing compliance processes and procedures for the myriad federal consumer protection laws.

Photo of Meagan Mihalko Meagan Mihalko

Meagan Mihalko’s national practice includes defending both class action and individual matters involving federal consumer protection statutes like the Fair Credit Reporting Act (FCRA), the Fair Debt Collection Practices Act and the Telephone Consumer Protection Act.

Photo of Alan D. Wingfield Alan D. Wingfield

Alan Wingfield helps consumer-facing clients navigate compliance, litigation and regulatory risks posed by the complex web of state and federal consumer protection laws. He is a trusted advisor and tireless advocate, helping clients develop practical compliance and dispute-resolution strategies.

Photo of John C. Lynch John C. Lynch

John is a first-chair litigator with a distinguished defense record in class action matters and other high-stakes litigation. He is sought after for his trial-to-verdict experience in state and federal courts throughout the U.S., effective strategies, and practical advice.