By Lorene D. Park, J.D.
In a Fair Credit Reporting Act (FCRA) case with clear implications for employers who rely on consumer reporting agencies to run background checks (and so must follow the Act’s notice requirements), the Supreme Court held that the Ninth Circuit erred in analyzing whether a plaintiff suing over inaccuracies in his credit report had Article III standing. Specifically, the appeals court analyzed whether the alleged injury (a statutory violation) was particularized but failed to also consider if the injury was “concrete”—both
are required. Remanding for further analysis, the High Court noted that “bare” procedural statutory violations will not automatically confer standing, but they may be enough if there is a risk of real harm (Spokeo, Inc. v. Robins
, May 16, 2016, Alito, S.).
Spokeo, a consumer reporting agency, operates a “people search engine” which searches various databases to gather and provide personal information about individuals to a variety of users, including employers wanting to evaluate prospective employees. According to the plaintiff, Spokeo violated the FCRA by generating a personal profile for him that contained inaccurate information (for example, it stated that he is married, with children, in his 50s, and has a job, all of which was incorrect). He filed a federal class action alleging the company willfully failed to follow reasonable procedures to assure maximum possible accuracy of consumer reports.
Dismissing the suit, the district court held that the plaintiff did not allege injury in fact as required to establish standing to sue under Article III. The Ninth Circuit reversed. Based on the plaintiff’s allegation that “Spokeo violated his
statutory rights” and the fact that his “personal interests in the handling of his credit information are individualized
,” the appeals court found that he adequately alleged injury in fact.
Standing requires “concrete and particularized” injury.
Reversing, the Supreme Court found that the Ninth Circuit’s injury-in-fact analysis was incomplete because it focused only on whether the alleged injury was “particularized” and left out the independent requirement that the injury be “concrete.” The High Court explained that a “concrete” injury need not be a “tangible,” but a plaintiff will not automatically satisfy the injury-in-fact requirement whenever a statute grants a right and purports to authorize a suit to vindicate it. Thus, while Congress plays an important role in identifying injuries and creating causes of action, there must still be a concrete injury, even in the context of a statutory violation. Thus a plaintiff cannot show a concrete injury by alleging a bare procedural violation, divorced from any concrete harm.
Risk of injury may be enough.
That said, the High Court further explained that a risk of real harm can in some circumstances satisfy the requirement that an injury be concrete. Thus, a plaintiff in that type of case would not need to allege any additional
harm beyond the one that Congress identified.
More information needed.
As to the FCRA, Congress plainly sought to curb dissemination of false information by adopting procedures to reduce that risk. On the other hand, the plaintiff could not satisfy Article III by alleging “bare” procedural violations, because a violation of one of the Act’s procedural requirements might result in no harm. For example, wrote the Court, “even if a consumer reporting agency fails to provide the required notice to a user of the agency’s consumer information, that information regardless may be entirely accurate. In addition, not all inaccuracies cause harm or present any material risk of harm.” Because the Ninth Circuit failed to fully analyze whether the alleged injury was both particularized and
concrete, the case was remanded.
Justice Ginsburg, with whom Justice Sotomayor joined, agreed with “much of the Court’s opinion,” but parted ways as to the necessity of remand. Judging by what the Court said about “concreteness” as a reference to “the reality of an injury, harm that is real,” though not necessarily tangible, the plaintiff’s allegations crossed that threshold, found the dissent. He did more than allege a “bare” procedural violation—he complained of misinformation about his education, family situation, and economic status that affected his ability to find a job, including making it appear that he was overqualified for work he was seeking.
Experts react: “Mixed bag” ruling? Employment Law Daily
reached out to advisory board member and experienced labor and employment attorney Chris Bourgeacq (The Chris Bourgeacq Law Firm
) for his reaction: “The Court’s ruling may prove to be a mixed bag for employers and employees alike. Instead of bright-lining for both parties what is or is not a ‘concrete’ injury sufficient to satisfy Article III standing, the Court leaves us to guess in future cases—except where the only alleged violation is an incorrect zip code! The takeaway does not appear to strongly favor either side for FCRA claims, although we will certainly see some really creative descriptions of ‘intangible’ harm in future cases.”
What about mere “technical” FCRA violations?
Asked about the impact of Spokeo
on cases against employers that involve only technical violations—such as those involving non-substantive extraneous language in a pre-background check notice, which the FCRA requires must consist solely
of a disclosure that a background check may be used in employment decisions—Bourgeacq opined that “[p]arties will continue to debate whether the plaintiff has alleged or can prove any
concrete injury, even if only intangible, from a technical violation of the FCRA.” He suggested that examples can be gleaned from class actions involving data breaches, where plaintiffs argue numerous tangible and intangible harms due to a breach, including emotional distress, and time and money spent correcting credit reports.
Attorney Stephen Woods
, chair of Ogletree Deakins’ Background Check Practice Group, found a slightly more positive effect for employers: “The Spokeo
decision helps employers—by making it harder for plaintiffs’ lawyers simply to point to either extraneous information in a background check disclosure form/screen or an adverse action without the required pre-adverse action letter and attachments, and by doing so, automatically establish a "concrete" harm. The decision, however, leaves the door open on what the Ninth Circuit and other courts will decide qualifies as a concrete harm. A court may find the inclusion of a ‘liability release’ sentence satisfies the requirement if, for example, a plaintiff alleges the sentence distracted her from the required disclosure.”
Woods also cautioned: “Employers also should remember that Spokeo
does not diminish state and local mini-FCRA requirements (e.g., the California ICRAA, New York's Article 23-A, and New York City's Fair Chance Act); as with the federal FCRA (especially until we see how lower courts will interpret Spokeo
), employers should continue to be vigilant in complying with these local, state, and federal requirements.”
Expect more creative plaintiffs, not fewer FCRA cases.
Bourgeacq gave this takeaway: “Don’t expect FCRA class actions to subside anytime soon as a result of today’s Spokeo
decision. If nothing else, the decision calls for even more creativity in establishing intangible harms from hyper-technical missteps in FCRA compliance. Perhaps the real fix should be correcting the FCRA and eliminating the pitfalls for technicalities? But as a wise jurist once said, ‘One man’s technicality is another’s substantive right.’ And so it seems.”
Meanwhile . . . comply with FCRA requirements.
While the effects of Spokeo
play out, employers that rely on credit reporting agencies will justifiably remain concerned with the hyper-technical notice requirements of the Act. Briefly, the key FCRA provisions that seem to lead to lawsuits include the following requirements for employers:
- Before obtaining a consumer report with credit or criminal background info: In a stand-alone document, state that the information may be used for employment decisions. Do not put the notice in an application, and avoid extraneous language in the notice. Importantly: present any release form in a separate document to be read separately. If seeking an “investigative report” (based on personal interviews) disclose the individual’s right to a description of the nature and scope of the investigation. In a separate document get written permission to do the background check. Certify to the company supplying the report that you gave notice; got permission; complied with FCRA requirements; and will not violate federal or state laws.
- Before taking an adverse action based on the report: Provide a copy of the consumer report and “A Summary of Your Rights Under the Fair Credit Reporting Act.” Give the individual a chance to challenge or explain negative information.
- After taking the adverse action: tell the individual (orally, in writing, or electronically) that he or she was rejected because of information in the report; provide the name, address, and phone number of the company that sold the report; and state that he or she has a right to dispute the accuracy or completeness of the report, and to get an additional free report from the reporting company within 60 days.
Additional information on the FCRA’s requirements can be found in a joint publication from the EEOC and FTC: “Background Checks: What Employers Need to Know
.” The FTC has also provided a summary of FCRA requirements in “Using Consumer Reports: What Employers Need to Know
,” as well as information on recordkeeping requirements and proper disposal of background reports in “Disposing of Consumer Report Information? Rule Tells How
.” Obviously, employers are well advised to seek the advice of an experienced employment law attorney before relying on consumer reports for background checks.