Employers’ Use of AI Tracking or Monitoring Reports May Trigger Obligations Under FCRA
In light of companies’ increasing use of AI technologies to track worker productivity and activity, the Consumer Finance Protection Bureau asserts that it is “tak[ing] action to curb unchecked worker surveillance.” On October 24, 2024, it issued guidance to warn employers that their use of certain data reports from third-party monitoring and reporting agencies – including surveillance-based, “black box” AI or algorithmic scores about their employees – to make employment decisions could fall within the coverage of the Fair Credit Reporting Act and require compliance with FCRA’s technical requirements.
FCRA requires employers to provide certain notices and communications to, and to obtain authorization from, an applicant or employee when using a third-party provider to prepare a consumer report or investigative consumer report. In the employment context, this has traditionally meant a third-party background check, including checks on credit, criminal background, references, education, driving records, and social media activity. Recent technological developments, however, allow the monitoring of employee performance and activity, and the CFPB identifies examples such as monitoring sales interactions, tracking driving habits, measuring time for task completion, documenting web browsing, and measuring keystroke frequency, among other things. In its announcement of the guidance, the CFPB asserts that third-party reports of such monitoring might be used for employment purposes such as:
- Predicting worker behavior, including union organizing or preparing for departures, that could impact management decisions on employee retention and engagement.
- Reassigning workers, based on data about performance, availability and patterns.
- Issuing automated disciplinary actions, where consumer reports flag potential performance issues.
- Evaluating social media activity, and basing hiring or other decisions on such activity.
The CFPB cautions employers that, in such cases, they must comply with FCRA’s requirements.
FCRA’s General Notice Requirements. Under FCRA, a “consumer report” is any communication containing information about an individual’s credit history, character, general reputation, personal characteristics, or mode of living. An “investigative consumer report” is a consumer report in which information is obtained, at least in part, through personal interviews with neighbors, friends, or associates.
When any consumer report or investigative consumer report is being procured for employment purposes, the employer must do the following:
- Provide the applicant/employee with a clear and conspicuous written advance disclosure in a stand-alone document, stating that a consumer report or investigative consumer report may be obtained for employment purposes.
- Obtain the applicant’s/employee’s written authorization for the procurement of the consumer report or investigative consumer report, which may be combined with the stand-alone document referred to in the prior paragraph.
- Certify, to the entity providing the report, that the company has complied with the above notice requirements and that the information from the report will not be used in violation of any applicable federal or state equal employment opportunity law or regulation.
- If the report is going to be used as the basis, in whole or in part, for any adverse employment action (such as a refusal to hire or a decision to terminate), provide the applicant/employee with a pre-adverse action notice letter, along with a copy of both the report and a copy of the CFPB’s “A Summary of Your Rights Under the Fair Credit Reporting Act” before taking the action.
- After waiting a “reasonable” amount of time (not specified by the statute or the CFPB), advise the applicant/employee of the adverse employment action. We recommend at least 5 business days. The letter must explain the adverse action, provide the name and contact information for the consumer reporting agency, state that the consumer reporting agency did not make the decision to take the adverse action and will not be able to provide an explanation for the action, state that the individual has the right to request a free copy of the report from the agency within 60 days, and state that the individual has the right to dispute with the agency the accuracy or completeness of the information in the report.
Additional Requirements for Investigative Consumer Reports. Employers that use third party providers to prepare investigative consumer reports have further obligations, as follows:
- Sometime before but not later than three days after requesting a report, provide the applicant/employee with written disclosure that an investigative consumer report may be obtained. Note that this requirement is satisfied by the initial disclosure/authorization form referenced above, which is provided to the applicant/employee before requesting the report.
- The disclosure must include a statement that the investigative consumer report may include information about the individual’s character, general reputation, personal characteristics, or mode of living.
- The disclosure must inform the applicant/employee of their right to request a complete and accurate disclosure of the nature and scope of the investigation.
- The disclosure must also inform the individual that the employer is required to make a written disclosure of the nature and scope of the investigation within five days after receiving the individual’s request for disclosure or the date the employer requests the investigative consumer report, whichever is later.
- With the disclosure, provide the CFPB’s “A Summary of Your Rights Under the Fair Credit Reporting Act.”
- Certify to the third-party reporting company that the Company has and will comply with all notice and disclosure requirements for investigative consumer reports, and further certify that the Company will disclose the nature and scope of the investigation to the individual upon request and within the required five-day period.
- Upon written request by the applicant/employee made within a “reasonable time,” provide complete written disclosure of the nature and scope of the investigation that was requested, within the five-day period noted above.
Special Rules for Employee Investigations. If an employer uses a third-party consumer reporting agency (such as a human resources consulting firm that regularly does investigations) to conduct an investigation into suspected employee misconduct, or compliance with laws, regulations or the employer’s policies, the employer does not need to provide the notices and disclosures or obtain the authorization described above. However, the employer must provide a summary describing the nature and scope of the investigation to the employee if adverse action is taken based on the investigation.