Rule2024-26099
Consumer Financial Protection Circular 2024-06: Background Dossiers and Algorithmic Scores for Hiring, Promotion, and Other Employment Decisions
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
November 12, 2024
Issuing agencies
Consumer Financial Protection Bureau
Abstract
The Consumer Financial Protection Bureau (CFPB) has issued Consumer Financial Protection Circular 2024-06, titled, "Background Dossiers and Algorithmic Scores for Hiring, Promotion, and Other Employment Decisions." In this circular, the CFPB responds to the question, "Can an employer make employment decisions utilizing background dossiers, algorithmic scores, and other third-party consumer reports about workers without adhering to the Fair Credit Reporting Act (FCRA)?"
Full Text
<html>
<head>
<title>Federal Register, Volume 89 Issue 218 (Tuesday, November 12, 2024)</title>
</head>
<body><pre>
[Federal Register Volume 89, Number 218 (Tuesday, November 12, 2024)]
[Rules and Regulations]
[Pages 88875-88877]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2024-26099]
========================================================================
Rules and Regulations
Federal Register
________________________________________________________________________
This section of the FEDERAL REGISTER contains regulatory documents
having general applicability and legal effect, most of which are keyed
to and codified in the Code of Federal Regulations, which is published
under 50 titles pursuant to 44 U.S.C. 1510.
The Code of Federal Regulations is sold by the Superintendent of Documents.
========================================================================
Federal Register / Vol. 89, No. 218 / Tuesday, November 12, 2024 /
Rules and Regulations
[[Page 88875]]
CONSUMER FINANCIAL PROTECTION BUREAU
12 CFR Chapter X
Consumer Financial Protection Circular 2024-06: Background
Dossiers and Algorithmic Scores for Hiring, Promotion, and Other
Employment Decisions
AGENCY: Consumer Financial Protection Bureau.
ACTION: Consumer financial protection circular.
-----------------------------------------------------------------------
SUMMARY: The Consumer Financial Protection Bureau (CFPB) has issued
Consumer Financial Protection Circular 2024-06, titled, ``Background
Dossiers and Algorithmic Scores for Hiring, Promotion, and Other
Employment Decisions.'' In this circular, the CFPB responds to the
question, ``Can an employer make employment decisions utilizing
background dossiers, algorithmic scores, and other third-party consumer
reports about workers without adhering to the Fair Credit Reporting Act
(FCRA)?''
DATES: The CFPB released this circular on its website on October 24,
2024.
ADDRESSES: Enforcers, and the broader public, can provide feedback and
comments to <a href="/cdn-cgi/l/email-protection#c487adb6a7b1a8a5b6b784a7a2b4a6eaa3abb2"><span class="__cf_email__" data-cfemail="6a290318091f060b18192a090c1a08440d051c">[email protected]</span></a>.
FOR FURTHER INFORMATION CONTACT: George Karithanom, Regulatory
Implementation & Guidance Program Analyst, Office of Regulations, at
202-435-7700 or at: <a href="https://reginquiries.consumerfinance.gov/">https://reginquiries.consumerfinance.gov/</a>. If you
require this document in an alternative electronic format, please
contact <a href="/cdn-cgi/l/email-protection#3a797c6a78657b59595f494953585356534e437a595c4a58145d554c"><span class="__cf_email__" data-cfemail="4b080d1b09140a28282e383822292227223f320b282d3b29652c243d">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION:
Question Presented
Can an employer make employment decisions utilizing background
dossiers, algorithmic scores, and other third-party consumer reports
about workers without adhering to the Fair Credit Reporting Act (FCRA)?
Response
No. Similar to credit reports and credit scores used by lenders to
make lending decisions, background dossiers--such as those that convey
scores about workers--that are obtained from third parties and used by
employers to make hiring, promotion, reassignment, or retention
decisions are often governed by the FCRA. Many background dossiers that
are compiled from databases collecting public records, employment
history, collective-bargaining activity, or other information about a
worker are ``consumer reports'' under the FCRA. Other types of consumer
reports may include, for example, reports that convey scores assessing
a current worker's risk level or performance.
Employers that use consumer reports--both initially when hiring
workers and for subsequent employment purposes--must comply with FCRA
obligations, including the requirement to obtain a worker's permission
to procure a consumer report, the obligation to provide notices before
and upon taking adverse actions, and a prohibition on using consumer
reports for purposes other than the permissible purposes described in
the FCRA.
The third-party providers furnishing these reports are ``consumer
reporting agencies'' regulated by the FCRA, which (among other things)
imposes an obligation to follow reasonable procedures to assure maximum
possible accuracy, a requirement to disclose information in a worker's
file to the worker upon request, and a requirement to investigate
worker disputes alleging inaccuracies.
Consumer Reports for Employment Purposes
Similar to how credit reports and credit scores are commonly used
by lenders, employers commonly purchase consumer reports to make
employment decisions about workers. The most traditional form of
consumer report in use in the United States for employment purposes is
a background dossier that checks a worker's public records, including
criminal history.
Recent technological advances have resulted in a rapid increase in
the monitoring of workers across many sectors.\1\ This has been
compounded by an increase in remote work. Together, these phenomena
have resulted in an increase in third-party technology companies that
have made it easier and more cost effective to track, assess, and
evaluate workers.\2\
---------------------------------------------------------------------------
\1\ Veena Dubal, On Algorithmic Wage Discrimination, UC San
Francisco Research Paper No. Forthcoming (2023) <a href="https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4331080">https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4331080</a> (hereinafter
Algorithmic Wage Discrimination); Merve Hickok & Nestor Maslej, A
Policy Primer And Roadmap On AI Worker Surveillance And Productivity
Scoring Tools (2023) AI Ethics 3, 673-687 (2023) (hereinafter Policy
Primer) <a href="https://link.springer.com/article/10.1007/s43681-023-00275-8">https://link.springer.com/article/10.1007/s43681-023-00275-8</a>.
\2\ Id.
---------------------------------------------------------------------------
Consumer reporting agencies and other background screening
companies now offer a range of reports to employers, including those
that record current workers' activities, personal habits and
attributes, and even their biometric information. For example, some
employers now use third parties to monitor workers' sales interactions,
to track workers' driving habits, to measure the time that workers take
to complete tasks, to record the number of messages workers send and
the quantity and duration of meetings they attend, and to calculate
workers' time spent off-task through documenting their web browsing,
taking screenshots of computers, and measuring keystroke frequency.\3\
In some circumstances, this information might be sold by ``consumer
reporting agencies'' to prospective or current employers.
---------------------------------------------------------------------------
\3\ See, e.g., Diego Areas Munhoz, ``Robot Bosses'' Spur
Lawmaker Push to Police AI Job Surveillance, Bloomberg Law (Sept. 8,
2023) <a href="https://news.bloomberglaw.com/daily-labor-report/robot-bosses-spur-lawmaker-push-to-police-ai-job-surveillance">https://news.bloomberglaw.com/daily-labor-report/robot-bosses-spur-lawmaker-push-to-police-ai-job-surveillance</a>; Remarks of
Benjamin Wiseman at the Harvard Journal of Law & Technology on
Worker Surveillance and AI, <a href="http://FTC.gov">FTC.gov</a> (Feb. 8, 2024), Jolt-2-8-24-
final.pdf (ftc.gov).
---------------------------------------------------------------------------
Some companies may analyze worker data \4\ in order to provide
reports containing assessments or scores of
[[Page 88876]]
worker productivity or risk to employers.\5\ Today, such scores are
used to make automated recommendations or determinations related to
worker pay; predict worker behavior, including potential union
organizing activity and likelihood that a worker will leave their job;
schedule shifts or job responsibilities; or issue warnings or other
disciplinary actions.\6\
---------------------------------------------------------------------------
\4\ Companies may engage in such analysis by making inferences
and determinations about worker behavior and performance using
algorithms, or sets of rules in computer programming code for
solving a problem or performing a task based on input data. The
algorithmic models used may also include ``artificial intelligence''
or ``AI'' models, which often develop and train algorithms using
``machine learning,'' which is the process of gathering data and
supplying it to the computer program to train the algorithm to find
patterns or make predictions. Conventional algorithms and AI models
may also set performance goals or other parameters based on external
data--for instance, by comparing a worker's output to an industry
standard.
\5\ See, e.g., Policy Primer; Diego Areas Munhoz, ``Robot
Bosses'' Spur Lawmaker Push to Police AI Job Surveillance, Bloomberg
Law (Sept. 8, 2023) <a href="https://news.bloomberglaw.com/daily-labor-report/robot-bosses-spur-lawmaker-push-to-police-ai-job-surveillance">https://news.bloomberglaw.com/daily-labor-report/robot-bosses-spur-lawmaker-push-to-police-ai-job-surveillance</a>.
\6\ See, e.g., Algorithmic Wage Discrimination; Theara Coleman,
The (ongoing) fight against workplace AI surveillance, The Week
(Jan. 15, 2024) <a href="https://theweek.com/tech/workplace-ai-surveillance">https://theweek.com/tech/workplace-ai-surveillance</a>.
---------------------------------------------------------------------------
Analysis
Congress passed the FCRA in response to concerns about companies
that assemble detailed dossiers about consumers and sell this
information.\7\ In doing so, Congress was particularly cognizant of the
impact of so-called ``credit reporting'' on consumers' employment.
Indeed, the Senate Report accompanying the bill that would be enacted
as the FCRA noted in particular how ``a consumer's future employment
career could be jeopardized because of an incomplete credit report.''
\8\ To address those concerns, the FCRA regulates information in the
form of ``consumer reports,'' a term defined to include ``any written,
oral, or other communication of any information by a consumer reporting
agency bearing on a consumer's credit worthiness, credit standing,
credit capacity, character, general reputation, personal
characteristics, or mode of living which is used or expected to be used
or collected in whole or in part for the purpose of serving as a factor
in establishing the consumer's eligibility for'' certain purposes,
including ``employment purposes.'' \9\
---------------------------------------------------------------------------
\7\ See generally 115 Cong. Rec. S2410-11 (daily ed. Jan. 31,
1969) (statement of Sen. William Proxmire).
\8\ S. Rep. 91-517, at 4 (1970).
\9\ 15 U.S.C. 1681(d)(1)(B). Under the FCRA, the ``term
`consumer' means an individual.'' 15 U.S.C. 1681a(c). Among other
things, the FCRA excludes from the definition of ``consumer report''
certain communications made to employers in connection with
investigations of ``suspected misconduct relating to employment'' or
``compliance with Federal, State, or local laws and regulations, the
rules of a self-regulatory organization, or any pre-existing written
policies of the employer.'' 15 U.S.C. 1681a(d)(2)(D), (y). This
Circular does not focus on such communications.
---------------------------------------------------------------------------
While all of the general obligations of the FCRA apply to consumer
reports provided for employment purposes, there are a few additional
obligations that apply only to this kind of consumer report. For
example, section 604(b) includes additional requirements when a
consumer report is used for employment purposes, including a
requirement to get permission from the worker.\10\ It also generally
requires employers to provide notice to workers and a copy of their
report before taking adverse action.\11\ In addition, upon request by a
worker, ``consumer reporting agencies'' must disclose the identity of
anyone who has used a consumer report for employment purposes in the
two-year period preceding the date the request is made, which is longer
than the one-year period used for other purposes.\12\ And ``consumer
reporting agencies'' must follow certain procedures when reporting
public record information for employment purposes.\13\
---------------------------------------------------------------------------
\10\ 15 U.S.C. 1681b(b)(1) (2). The issue of whether an employer
can use dossiers, scores, or other surveillance on workers may also
be a topic of negotiation at the individual or collective bargaining
level.
\11\ 15 U.S.C. 1681b(3)(A). But see 15 U.S.C. 1681b(b)(3)(B)
(C), (4) (exceptions from Sec. 1681b(b)(3)(A) for workers in the
transportation industry in certain circumstances and for consumer
reports relevant to national security investigations in certain
circumstances).
\12\ 15 U.S.C. 1681g(a)(3)(A)(i).
\13\ 15 U.S.C. 1681k. Subject to an exemption for national
security investigations, CRAs that compile and report for employment
purposes public record information that is likely to have an adverse
effect on a consumer's ability to obtain employment must (1) notify
the consumer that the information is being reported and of the name
and address of the recipient, or (2) maintain ``strict procedures''
to ensure that the public record information is complete and up to
date. Id.
---------------------------------------------------------------------------
Beyond the obligations that apply only to consumer reports used for
employment purposes, the FCRA's general obligations also provide
important protections for workers. Among other things, the FCRA
provides workers the right to know what is in their file at a
``consumer reporting agency'' and dispute incomplete or inaccurate
information,\14\ requires such entities, in response to a consumer's
dispute, to correct or delete inaccurate, incomplete, or unverifiable
information,\15\ and generally prohibits reporting of outdated negative
information.\16\ In addition to requiring that most employers give
workers notice before taking an adverse action, the FCRA also generally
requires that any person taking adverse action based on a consumer
report provide notice to the consumer upon taking the adverse
action.\17\ Finally, the FCRA strictly limits ``consumer reporting
agencies'' to providing consumer reports only for certain specified
permissible purposes.\18\ That means the background screener could not
share consumer reports containing workers' data with employers or
others, absent a FCRA permissible purpose.\19\
---------------------------------------------------------------------------
\14\ 15 U.S.C. 1681g(a); 15 U.S.C. 1681i(a)(1).
\15\ 15 U.S.C. 1681i(a)(5).
\16\ 15 U.S.C. 1681c.
\17\ 15 U.S.C. 1681b(b)(3)(A), 1681m(a).
\18\ See 15 U.S.C. 1681b(a).
\19\ For example, courts have held that consumer reporting
agencies generally cannot furnish consumer reports for targeted
marketing. See Trans Union Corp. v. FTC, 81 F.3d 228, 233-34 (D.C.
Cir. 1996).
---------------------------------------------------------------------------
When looking at whether an employer that makes employment decisions
based on a report from a third party is regulated by the FCRA,
enforcers should consider two key questions:
1. Does the employer's use of data qualify as a use for
``employment purposes'' under the FCRA?
2. Is the report obtained from a ``consumer reporting agency,''
meaning that the report-maker ``assembled'' or ``evaluated'' consumer
information to produce the report?
On the first question, the FCRA defines ``employment purposes'' to
mean ``a report used for the purpose of evaluating a consumer for
employment, promotion, reassignment or retention as an employee.'' \20\
The FCRA thus applies both to information used for the purpose of
evaluating a consumer for employment initially, and to information used
for ongoing employment purposes--i.e., promotion, reassignment, or
retention.\21\
---------------------------------------------------------------------------
\20\ 15 U.S.C. 1681a(h).
\21\ The FCRA's application to both prospective and current
workers is confirmed by FCRA section 603(k), which provides that an
``adverse action'' under FCRA includes ``a denial of employment or
any other decision for employment purposes that adversely affects
any current or prospective employee.'' 15 U.S.C. 1681a(k)(1)(B)(ii)
(emphasis added). See also Ernst v. Dish Network, LLC, 49 F. Supp.
3d 377, 383 (S.D.N.Y. 2014) (background report was collected,
expected to be used, and used for the employment purposes of
``evaluat[ing] [the] Plaintiff for reassignment or retention as an
employee'').
---------------------------------------------------------------------------
On the second question, a third party could be a ``consumer
reporting agency'' that assembles or evaluates consumer information if
they collect consumer information in order to furnish reports to
employers.\22\ A company that employers use to help make employment
decisions could meet this standard in a number of ways. For example,
similar to a ``nationwide consumer reporting agency,'' like
[[Page 88877]]
Equifax, Experian, or TransUnion, some companies collect consumer data
from third parties for dissemination to employers in background
reports. Traditional background screening companies ``assemble'' or
``evaluate'' information about workers, often from public sources, such
as criminal history records. Other firms might collect information from
employers about workers' collective bargaining activity, or job
performance, and then sell it to other employers to make hiring
decisions.
---------------------------------------------------------------------------
\22\ The FCRA regulates consumer reports as furnished by
``consumer reporting agencies,'' which it defines as: ``any person
which, for monetary fees, dues, or on a cooperative nonprofit basis,
regularly engages in whole or in part in the practice of assembling
or evaluating consumer credit information or other information on
consumers for the purpose of furnishing consumer reports to third
parties, and which uses any means or facility of interstate commerce
for the purpose of preparing or furnishing consumer reports.'' 15
U.S.C. 1681a(f).
---------------------------------------------------------------------------
In addition, an entity could ``assemble'' or ``evaluate'' consumer
information within the meaning of the term ``consumer reporting
agency'' if the entity collects consumer data in order to train an
algorithm that produces scores or other assessments about workers for
employers. For example, the developer of a phone app that monitors a
transportation worker's driving activity and provides driving scores to
companies for employment purposes could ``assemble'' or ``evaluate''
consumer information if the developer obtains or uses data from sources
other than an employer receiving the report, including from other
employer-customers or public data sources, to generate the scores.\23\
---------------------------------------------------------------------------
\23\ That may be true even when the assessment is performed
through a software program licensed to employers, because the
software provider furnishes the reports. Federal Trade Commission
(FTC) staff opined more than two decades ago that a seller of
particular software that allowed users to compile and de-duplicate
credit report information from the three major nationwide consumer
reporting agencies was not itself a consumer reporting agency,
reasoning that the software seller was not ``assembling or
evaluating'' any information itself. FTC Advisory Opinion (Oct. 27,
1997), <a href="https://www.ftc.gov/legal-library/browse/advisory-opinions/advisory-opinion-cast-10-27-97">https://www.ftc.gov/legal-library/browse/advisory-opinions/advisory-opinion-cast-10-27-97</a>; see also FTC, 40 Years of Experience
with the Fair Credit Reporting Act: An FTC Staff Report with Summary
of Interpretations at 12-13, 29 (July 2011). The FTC's guidance,
however, focused on technology that was in existence at the time the
guidance was drafted. Significant changes in the software and
general technological landscape have taken place in the years since,
rendering the FTC's prior guidance inapplicable to many of the kinds
of technology used today. For example, software developers today
often take a more active role in providing ongoing services to
clients, such as by performing ongoing maintenance of the software,
or by licensing services to clients instead of selling software as a
point-in-time product. Accordingly, a third-party software provider
could meet the definition of a consumer reporting agency where it
assembles or evaluates consumer information to develop software that
produces reports used to evaluate a worker ``for employment,
promotion, reassignment or retention,'' or where the software itself
assembles or evaluates information about a worker to produce reports
used for those purposes. Judicial decisions declining to find
software providers to be CRAs are likewise distinguishable. For
instance, in Zabriskie v. Fed. Nat'l Mortg. Ass'n, 940 F.3d 1022,
1029 (9th Cir. 2019), the court determined that Fannie Mae did not
act as a CRA by licensing a proprietary software that allowed
lenders to determine whether their loans met requirements for Fannie
Mae to purchase, but relied on reasoning inapplicable to third-party
software developers that analyze worker data that companies use for
employment purposes. Id. (reasoning that Congress intended to
exclude Fannie Mae from the definition of a ``consumer reporting
agency'' and that Fannie Mae did not have the purpose of furnishing
consumer reports to a third party, but rather to determine the
loans' eligibility for purchase).
---------------------------------------------------------------------------
Not all third parties that assemble or evaluate data will qualify
as ``consumer reporting agencies.'' For example, section
603(d)(2)(A)(i) of the FCRA excludes from the definition of ``consumer
report'' any ``report containing information solely as to transactions
or experiences between the consumer and the person making the report.''
But this exception applies only to reports containing information
solely about transactions or experiences between the consumer and the
report-maker. The exception by its own terms does not apply to a report
containing information not about transactions or experiences between
the report-maker and the consumer, such as when the report includes
algorithmic scores, as described above.
About Consumer Financial Protection Circulars
Consumer Financial Protection Circulars are intended to promote
consistency in approach across the various enforcement agencies and
parties, pursuant to the CFPB's statutory objective to ensure Federal
consumer financial law is enforced consistently. 12 U.S.C. 5511(b)(4).
Consumer Financial Protection Circulars are also intended to
provide transparency to partner agencies regarding the CFPB's intended
approach when cooperating in enforcement actions. See, e.g., 12 U.S.C.
5552(b) (consultation with CFPB by State attorneys general and
regulators); 12 U.S.C. 5562(a) (joint investigatory work between CFPB
and other agencies).
Consumer Financial Protection Circulars are general statements of
policy under the Administrative Procedure Act. 5 U.S.C. 553(b). They
provide background information about applicable law, articulate
considerations relevant to the Bureau's exercise of its authorities,
and, in the interest of maintaining consistency, advise other parties
with authority to enforce Federal consumer financial law. They do not
restrict the Bureau's exercise of its authorities, impose any legal
requirements on external parties, or create or confer any rights on
external parties that could be enforceable in any administrative or
civil proceeding. The CFPB Director is instructing CFPB staff as
described herein, and the CFPB will then make final decisions on
individual matters based on an assessment of the factual record,
applicable law, and factors relevant to prosecutorial discretion.
Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2024-26099 Filed 11-8-24; 8:45 am]
BILLING CODE 4810-AM-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on November 12, 2024.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.