Consumer Financial Protection Circular 2024-06: Background Dossiers and Algorithmic Scores for Hiring, Promotion, and Other Employment Decisions, 88875-88877 [2024-26099]

Download as PDF 88875 Rules and Regulations Federal Register Vol. 89, No. 218 Tuesday, November 12, 2024 This section of the FEDERAL REGISTER contains regulatory documents having general applicability and legal effect, most of which are keyed to and codified in the Code of Federal Regulations, which is published under 50 titles pursuant to 44 U.S.C. 1510. The Code of Federal Regulations is sold by the Superintendent of Documents. CONSUMER FINANCIAL PROTECTION BUREAU 12 CFR Chapter X Consumer Financial Protection Circular 2024–06: Background Dossiers and Algorithmic Scores for Hiring, Promotion, and Other Employment Decisions Consumer Financial Protection Bureau. ACTION: Consumer financial protection circular. AGENCY: The Consumer Financial Protection Bureau (CFPB) has issued Consumer Financial Protection Circular 2024–06, titled, ‘‘Background Dossiers and Algorithmic Scores for Hiring, Promotion, and Other Employment Decisions.’’ In this circular, the CFPB responds to the question, ‘‘Can an employer make employment decisions utilizing background dossiers, algorithmic scores, and other third-party consumer reports about workers without adhering to the Fair Credit Reporting Act (FCRA)?’’ DATES: The CFPB released this circular on its website on October 24, 2024. ADDRESSES: Enforcers, and the broader public, can provide feedback and comments to Circulars@cfpb.gov. FOR FURTHER INFORMATION CONTACT: George Karithanom, Regulatory Implementation & Guidance Program Analyst, Office of Regulations, at 202– 435–7700 or at: https://reginquiries. consumerfinance.gov/. If you require this document in an alternative electronic format, please contact CFPB_ Accessibility@cfpb.gov. SUPPLEMENTARY INFORMATION: khammond on DSKJM1Z7X2PROD with RULES SUMMARY: Question Presented Can an employer make employment decisions utilizing background dossiers, algorithmic scores, and other third-party consumer reports about workers without adhering to the Fair Credit Reporting Act (FCRA)? VerDate Sep<11>2014 15:54 Nov 08, 2024 Jkt 265001 Response No. Similar to credit reports and credit scores used by lenders to make lending decisions, background dossiers—such as those that convey scores about workers—that are obtained from third parties and used by employers to make hiring, promotion, reassignment, or retention decisions are often governed by the FCRA. Many background dossiers that are compiled from databases collecting public records, employment history, collectivebargaining activity, or other information about a worker are ‘‘consumer reports’’ under the FCRA. Other types of consumer reports may include, for example, reports that convey scores assessing a current worker’s risk level or performance. Employers that use consumer reports—both initially when hiring workers and for subsequent employment purposes—must comply with FCRA obligations, including the requirement to obtain a worker’s permission to procure a consumer report, the obligation to provide notices before and upon taking adverse actions, and a prohibition on using consumer reports for purposes other than the permissible purposes described in the FCRA. The third-party providers furnishing these reports are ‘‘consumer reporting agencies’’ regulated by the FCRA, which (among other things) imposes an obligation to follow reasonable procedures to assure maximum possible accuracy, a requirement to disclose information in a worker’s file to the worker upon request, and a requirement to investigate worker disputes alleging inaccuracies. Consumer Reports for Employment Purposes Similar to how credit reports and credit scores are commonly used by lenders, employers commonly purchase consumer reports to make employment decisions about workers. The most traditional form of consumer report in use in the United States for employment purposes is a background dossier that checks a worker’s public records, including criminal history. Recent technological advances have resulted in a rapid increase in the monitoring of workers across many PO 00000 Frm 00001 Fmt 4700 Sfmt 4700 sectors.1 This has been compounded by an increase in remote work. Together, these phenomena have resulted in an increase in third-party technology companies that have made it easier and more cost effective to track, assess, and evaluate workers.2 Consumer reporting agencies and other background screening companies now offer a range of reports to employers, including those that record current workers’ activities, personal habits and attributes, and even their biometric information. For example, some employers now use third parties to monitor workers’ sales interactions, to track workers’ driving habits, to measure the time that workers take to complete tasks, to record the number of messages workers send and the quantity and duration of meetings they attend, and to calculate workers’ time spent offtask through documenting their web browsing, taking screenshots of computers, and measuring keystroke frequency.3 In some circumstances, this information might be sold by ‘‘consumer reporting agencies’’ to prospective or current employers. Some companies may analyze worker data 4 in order to provide reports containing assessments or scores of 1 Veena Dubal, On Algorithmic Wage Discrimination, UC San Francisco Research Paper No. Forthcoming (2023) https://papers.ssrn.com/ sol3/papers.cfm?abstract_id=4331080 (hereinafter Algorithmic Wage Discrimination); Merve Hickok & Nestor Maslej, A Policy Primer And Roadmap On AI Worker Surveillance And Productivity Scoring Tools (2023) AI Ethics 3, 673–687 (2023) (hereinafter Policy Primer) https:// link.springer.com/article/10.1007/s43681-02300275-8. 2 Id. 3 See, e.g., Diego Areas Munhoz, ‘‘Robot Bosses’’ Spur Lawmaker Push to Police AI Job Surveillance, Bloomberg Law (Sept. 8, 2023) https:// news.bloomberglaw.com/daily-labor-report/robotbosses-spur-lawmaker-push-to-police-ai-jobsurveillance; Remarks of Benjamin Wiseman at the Harvard Journal of Law & Technology on Worker Surveillance and AI, FTC.gov (Feb. 8, 2024), Jolt-28-24-final.pdf (ftc.gov). 4 Companies may engage in such analysis by making inferences and determinations about worker behavior and performance using algorithms, or sets of rules in computer programming code for solving a problem or performing a task based on input data. The algorithmic models used may also include ‘‘artificial intelligence’’ or ‘‘AI’’ models, which often develop and train algorithms using ‘‘machine learning,’’ which is the process of gathering data and supplying it to the computer program to train the algorithm to find patterns or make predictions. Conventional algorithms and AI models may also set performance goals or other parameters based on external data—for instance, by comparing a worker’s output to an industry standard. E:\FR\FM\12NOR1.SGM 12NOR1 88876 Federal Register / Vol. 89, No. 218 / Tuesday, November 12, 2024 / Rules and Regulations worker productivity or risk to employers.5 Today, such scores are used to make automated recommendations or determinations related to worker pay; predict worker behavior, including potential union organizing activity and likelihood that a worker will leave their job; schedule shifts or job responsibilities; or issue warnings or other disciplinary actions.6 khammond on DSKJM1Z7X2PROD with RULES Analysis Congress passed the FCRA in response to concerns about companies that assemble detailed dossiers about consumers and sell this information.7 In doing so, Congress was particularly cognizant of the impact of so-called ‘‘credit reporting’’ on consumers’ employment. Indeed, the Senate Report accompanying the bill that would be enacted as the FCRA noted in particular how ‘‘a consumer’s future employment career could be jeopardized because of an incomplete credit report.’’ 8 To address those concerns, the FCRA regulates information in the form of ‘‘consumer reports,’’ a term defined to include ‘‘any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for’’ certain purposes, including ‘‘employment purposes.’’ 9 While all of the general obligations of the FCRA apply to consumer reports provided for employment purposes, there are a few additional obligations that apply only to this kind of consumer 5 See, e.g., Policy Primer; Diego Areas Munhoz, ‘‘Robot Bosses’’ Spur Lawmaker Push to Police AI Job Surveillance, Bloomberg Law (Sept. 8, 2023) https://news.bloomberglaw.com/daily-labor-report/ robot-bosses-spur-lawmaker-push-to-police-ai-jobsurveillance. 6 See, e.g., Algorithmic Wage Discrimination; Theara Coleman, The (ongoing) fight against workplace AI surveillance, The Week (Jan. 15, 2024) https://theweek.com/tech/workplace-aisurveillance. 7 See generally 115 Cong. Rec. S2410–11 (daily ed. Jan. 31, 1969) (statement of Sen. William Proxmire). 8 S. Rep. 91–517, at 4 (1970). 9 15 U.S.C. 1681(d)(1)(B). Under the FCRA, the ‘‘term ‘consumer’ means an individual.’’ 15 U.S.C. 1681a(c). Among other things, the FCRA excludes from the definition of ‘‘consumer report’’ certain communications made to employers in connection with investigations of ‘‘suspected misconduct relating to employment’’ or ‘‘compliance with Federal, State, or local laws and regulations, the rules of a self-regulatory organization, or any preexisting written policies of the employer.’’ 15 U.S.C. 1681a(d)(2)(D), (y). This Circular does not focus on such communications. VerDate Sep<11>2014 15:54 Nov 08, 2024 Jkt 265001 report. For example, section 604(b) includes additional requirements when a consumer report is used for employment purposes, including a requirement to get permission from the worker.10 It also generally requires employers to provide notice to workers and a copy of their report before taking adverse action.11 In addition, upon request by a worker, ‘‘consumer reporting agencies’’ must disclose the identity of anyone who has used a consumer report for employment purposes in the two-year period preceding the date the request is made, which is longer than the one-year period used for other purposes.12 And ‘‘consumer reporting agencies’’ must follow certain procedures when reporting public record information for employment purposes.13 Beyond the obligations that apply only to consumer reports used for employment purposes, the FCRA’s general obligations also provide important protections for workers. Among other things, the FCRA provides workers the right to know what is in their file at a ‘‘consumer reporting agency’’ and dispute incomplete or inaccurate information,14 requires such entities, in response to a consumer’s dispute, to correct or delete inaccurate, incomplete, or unverifiable information,15 and generally prohibits reporting of outdated negative information.16 In addition to requiring that most employers give workers notice before taking an adverse action, the FCRA also generally requires that any person taking adverse action based on a consumer report provide notice to the consumer upon taking the adverse action.17 Finally, the FCRA strictly limits ‘‘consumer reporting agencies’’ to providing consumer reports only for 10 15 U.S.C. 1681b(b)(1) (2). The issue of whether an employer can use dossiers, scores, or other surveillance on workers may also be a topic of negotiation at the individual or collective bargaining level. 11 15 U.S.C. 1681b(3)(A). But see 15 U.S.C. 1681b(b)(3)(B) (C), (4) (exceptions from § 1681b(b)(3)(A) for workers in the transportation industry in certain circumstances and for consumer reports relevant to national security investigations in certain circumstances). 12 15 U.S.C. 1681g(a)(3)(A)(i). 13 15 U.S.C. 1681k. Subject to an exemption for national security investigations, CRAs that compile and report for employment purposes public record information that is likely to have an adverse effect on a consumer’s ability to obtain employment must (1) notify the consumer that the information is being reported and of the name and address of the recipient, or (2) maintain ‘‘strict procedures’’ to ensure that the public record information is complete and up to date. Id. 14 15 U.S.C. 1681g(a); 15 U.S.C. 1681i(a)(1). 15 15 U.S.C. 1681i(a)(5). 16 15 U.S.C. 1681c. 17 15 U.S.C. 1681b(b)(3)(A), 1681m(a). PO 00000 Frm 00002 Fmt 4700 Sfmt 4700 certain specified permissible purposes.18 That means the background screener could not share consumer reports containing workers’ data with employers or others, absent a FCRA permissible purpose.19 When looking at whether an employer that makes employment decisions based on a report from a third party is regulated by the FCRA, enforcers should consider two key questions: 1. Does the employer’s use of data qualify as a use for ‘‘employment purposes’’ under the FCRA? 2. Is the report obtained from a ‘‘consumer reporting agency,’’ meaning that the report-maker ‘‘assembled’’ or ‘‘evaluated’’ consumer information to produce the report? On the first question, the FCRA defines ‘‘employment purposes’’ to mean ‘‘a report used for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee.’’ 20 The FCRA thus applies both to information used for the purpose of evaluating a consumer for employment initially, and to information used for ongoing employment purposes—i.e., promotion, reassignment, or retention.21 On the second question, a third party could be a ‘‘consumer reporting agency’’ that assembles or evaluates consumer information if they collect consumer information in order to furnish reports to employers.22 A company that employers use to help make employment decisions could meet this standard in a number of ways. For example, similar to a ‘‘nationwide consumer reporting agency,’’ like 18 See 15 U.S.C. 1681b(a). example, courts have held that consumer reporting agencies generally cannot furnish consumer reports for targeted marketing. See Trans Union Corp. v. FTC, 81 F.3d 228, 233–34 (D.C. Cir. 1996). 20 15 U.S.C. 1681a(h). 21 The FCRA’s application to both prospective and current workers is confirmed by FCRA section 603(k), which provides that an ‘‘adverse action’’ under FCRA includes ‘‘a denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee.’’ 15 U.S.C. 1681a(k)(1)(B)(ii) (emphasis added). See also Ernst v. Dish Network, LLC, 49 F. Supp. 3d 377, 383 (S.D.N.Y. 2014) (background report was collected, expected to be used, and used for the employment purposes of ‘‘evaluat[ing] [the] Plaintiff for reassignment or retention as an employee’’). 22 The FCRA regulates consumer reports as furnished by ‘‘consumer reporting agencies,’’ which it defines as: ‘‘any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.’’ 15 U.S.C. 1681a(f). 19 For E:\FR\FM\12NOR1.SGM 12NOR1 Federal Register / Vol. 89, No. 218 / Tuesday, November 12, 2024 / Rules and Regulations khammond on DSKJM1Z7X2PROD with RULES Equifax, Experian, or TransUnion, some companies collect consumer data from third parties for dissemination to employers in background reports. Traditional background screening companies ‘‘assemble’’ or ‘‘evaluate’’ information about workers, often from public sources, such as criminal history records. Other firms might collect information from employers about workers’ collective bargaining activity, or job performance, and then sell it to other employers to make hiring decisions. In addition, an entity could ‘‘assemble’’ or ‘‘evaluate’’ consumer information within the meaning of the term ‘‘consumer reporting agency’’ if the entity collects consumer data in order to train an algorithm that produces scores or other assessments about workers for employers. For example, the developer of a phone app that monitors a transportation worker’s driving activity and provides driving scores to companies for employment purposes could ‘‘assemble’’ or ‘‘evaluate’’ consumer information if the developer obtains or uses data from sources other than an employer receiving the report, including from other employercustomers or public data sources, to generate the scores.23 23 That may be true even when the assessment is performed through a software program licensed to employers, because the software provider furnishes the reports. Federal Trade Commission (FTC) staff opined more than two decades ago that a seller of particular software that allowed users to compile and de-duplicate credit report information from the three major nationwide consumer reporting agencies was not itself a consumer reporting agency, reasoning that the software seller was not ‘‘assembling or evaluating’’ any information itself. FTC Advisory Opinion (Oct. 27, 1997), https:// www.ftc.gov/legal-library/browse/advisoryopinions/advisory-opinion-cast-10-27-97; see also FTC, 40 Years of Experience with the Fair Credit Reporting Act: An FTC Staff Report with Summary of Interpretations at 12–13, 29 (July 2011). The FTC’s guidance, however, focused on technology that was in existence at the time the guidance was drafted. Significant changes in the software and general technological landscape have taken place in the years since, rendering the FTC’s prior guidance inapplicable to many of the kinds of technology used today. For example, software developers today often take a more active role in providing ongoing services to clients, such as by performing ongoing maintenance of the software, or by licensing services to clients instead of selling software as a point-in-time product. Accordingly, a third-party software provider could meet the definition of a consumer reporting agency where it assembles or evaluates consumer information to develop software that produces reports used to evaluate a worker ‘‘for employment, promotion, reassignment or retention,’’ or where the software itself assembles or evaluates information about a worker to produce reports used for those purposes. Judicial decisions declining to find software providers to be CRAs are likewise distinguishable. For instance, in Zabriskie v. Fed. Nat’l Mortg. Ass’n, 940 F.3d 1022, 1029 (9th Cir. 2019), the court determined that Fannie Mae did not act as a CRA by licensing a proprietary software that allowed lenders to determine whether VerDate Sep<11>2014 15:54 Nov 08, 2024 Jkt 265001 Not all third parties that assemble or evaluate data will qualify as ‘‘consumer reporting agencies.’’ For example, section 603(d)(2)(A)(i) of the FCRA excludes from the definition of ‘‘consumer report’’ any ‘‘report containing information solely as to transactions or experiences between the consumer and the person making the report.’’ But this exception applies only to reports containing information solely about transactions or experiences between the consumer and the reportmaker. The exception by its own terms does not apply to a report containing information not about transactions or experiences between the report-maker and the consumer, such as when the report includes algorithmic scores, as described above. About Consumer Financial Protection Circulars Consumer Financial Protection Circulars are intended to promote consistency in approach across the various enforcement agencies and parties, pursuant to the CFPB’s statutory objective to ensure Federal consumer financial law is enforced consistently. 12 U.S.C. 5511(b)(4). Consumer Financial Protection Circulars are also intended to provide transparency to partner agencies regarding the CFPB’s intended approach when cooperating in enforcement actions. See, e.g., 12 U.S.C. 5552(b) (consultation with CFPB by State attorneys general and regulators); 12 U.S.C. 5562(a) (joint investigatory work between CFPB and other agencies). Consumer Financial Protection Circulars are general statements of policy under the Administrative Procedure Act. 5 U.S.C. 553(b). They provide background information about applicable law, articulate considerations relevant to the Bureau’s exercise of its authorities, and, in the interest of maintaining consistency, advise other parties with authority to enforce Federal consumer financial law. They do not restrict the Bureau’s exercise of its authorities, impose any legal requirements on external parties, or create or confer any rights on external parties that could be enforceable in any administrative or civil proceeding. The CFPB Director is instructing CFPB staff as described herein, and the CFPB will their loans met requirements for Fannie Mae to purchase, but relied on reasoning inapplicable to third-party software developers that analyze worker data that companies use for employment purposes. Id. (reasoning that Congress intended to exclude Fannie Mae from the definition of a ‘‘consumer reporting agency’’ and that Fannie Mae did not have the purpose of furnishing consumer reports to a third party, but rather to determine the loans’ eligibility for purchase). PO 00000 Frm 00003 Fmt 4700 Sfmt 4700 88877 then make final decisions on individual matters based on an assessment of the factual record, applicable law, and factors relevant to prosecutorial discretion. Rohit Chopra, Director, Consumer Financial Protection Bureau. [FR Doc. 2024–26099 Filed 11–8–24; 8:45 am] BILLING CODE 4810–AM–P FEDERAL RESERVE SYSTEM 12 CFR Part 209 [Regulation I; Docket No. R–1844] RIN 7100—AG 85 Federal Reserve Bank Capital Stock Board of Governors of the Federal Reserve System. ACTION: Final rule. AGENCIES: The Board of Governors (Board) is publishing a final rule that applies an inflation adjustment to the threshold for total consolidated assets in Regulation I. Federal Reserve Bank (Reserve Bank) stockholders that have total consolidated assets above the threshold receive a different dividend rate on their Reserve Bank stock than stockholders with total consolidated assets at or below the threshold. The Federal Reserve Act requires that the Board annually adjust the total consolidated asset threshold to reflect the change in the Gross Domestic Product Price Index, published by the Bureau of Economic Analysis (BEA). Based on the change in the Gross Domestic Product Price Index as of September 26, 2024, the total consolidated asset threshold will be $12,841,000,000 through December 31, 2025. SUMMARY: DATES: Effective date: December 12, 2024. Applicability date: The adjusted threshold for total consolidated assets will apply beginning on January 1, 2025. FOR FURTHER INFORMATION CONTACT: Benjamin Snodgrass, Senior Counsel (202/263–4877), Legal Division; or Kelsey Cassidy, Senior Financial Institutions Policy Analyst (202/465– 6817), Reserve Bank Operations and Payments Systems Division. For users of TTY–TRS, please contact 711 from any telephone, anywhere in the United States or (202) 263–4869. SUPPLEMENTARY INFORMATION: I. Background Regulation I governs the issuance and cancellation of capital stock by the E:\FR\FM\12NOR1.SGM 12NOR1

Agencies

CONSUMER FINANCIAL PROTECTION BUREAU

[Federal Register Volume 89, Number 218 (Tuesday, November 12, 2024)]
[Rules and Regulations]
[Pages 88875-88877]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-26099]



========================================================================
Rules and Regulations
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains regulatory documents 
having general applicability and legal effect, most of which are keyed 
to and codified in the Code of Federal Regulations, which is published 
under 50 titles pursuant to 44 U.S.C. 1510.

The Code of Federal Regulations is sold by the Superintendent of Documents. 

========================================================================


Federal Register / Vol. 89, No. 218 / Tuesday, November 12, 2024 / 
Rules and Regulations

[[Page 88875]]



CONSUMER FINANCIAL PROTECTION BUREAU

12 CFR Chapter X


Consumer Financial Protection Circular 2024-06: Background 
Dossiers and Algorithmic Scores for Hiring, Promotion, and Other 
Employment Decisions

AGENCY: Consumer Financial Protection Bureau.

ACTION: Consumer financial protection circular.

-----------------------------------------------------------------------

SUMMARY: The Consumer Financial Protection Bureau (CFPB) has issued 
Consumer Financial Protection Circular 2024-06, titled, ``Background 
Dossiers and Algorithmic Scores for Hiring, Promotion, and Other 
Employment Decisions.'' In this circular, the CFPB responds to the 
question, ``Can an employer make employment decisions utilizing 
background dossiers, algorithmic scores, and other third-party consumer 
reports about workers without adhering to the Fair Credit Reporting Act 
(FCRA)?''

DATES: The CFPB released this circular on its website on October 24, 
2024.

ADDRESSES: Enforcers, and the broader public, can provide feedback and 
comments to [email protected].

FOR FURTHER INFORMATION CONTACT: George Karithanom, Regulatory 
Implementation & Guidance Program Analyst, Office of Regulations, at 
202-435-7700 or at: https://reginquiries.consumerfinance.gov/. If you 
require this document in an alternative electronic format, please 
contact [email protected].

SUPPLEMENTARY INFORMATION:

Question Presented

    Can an employer make employment decisions utilizing background 
dossiers, algorithmic scores, and other third-party consumer reports 
about workers without adhering to the Fair Credit Reporting Act (FCRA)?

Response

    No. Similar to credit reports and credit scores used by lenders to 
make lending decisions, background dossiers--such as those that convey 
scores about workers--that are obtained from third parties and used by 
employers to make hiring, promotion, reassignment, or retention 
decisions are often governed by the FCRA. Many background dossiers that 
are compiled from databases collecting public records, employment 
history, collective-bargaining activity, or other information about a 
worker are ``consumer reports'' under the FCRA. Other types of consumer 
reports may include, for example, reports that convey scores assessing 
a current worker's risk level or performance.
    Employers that use consumer reports--both initially when hiring 
workers and for subsequent employment purposes--must comply with FCRA 
obligations, including the requirement to obtain a worker's permission 
to procure a consumer report, the obligation to provide notices before 
and upon taking adverse actions, and a prohibition on using consumer 
reports for purposes other than the permissible purposes described in 
the FCRA.
    The third-party providers furnishing these reports are ``consumer 
reporting agencies'' regulated by the FCRA, which (among other things) 
imposes an obligation to follow reasonable procedures to assure maximum 
possible accuracy, a requirement to disclose information in a worker's 
file to the worker upon request, and a requirement to investigate 
worker disputes alleging inaccuracies.

Consumer Reports for Employment Purposes

    Similar to how credit reports and credit scores are commonly used 
by lenders, employers commonly purchase consumer reports to make 
employment decisions about workers. The most traditional form of 
consumer report in use in the United States for employment purposes is 
a background dossier that checks a worker's public records, including 
criminal history.
    Recent technological advances have resulted in a rapid increase in 
the monitoring of workers across many sectors.\1\ This has been 
compounded by an increase in remote work. Together, these phenomena 
have resulted in an increase in third-party technology companies that 
have made it easier and more cost effective to track, assess, and 
evaluate workers.\2\
---------------------------------------------------------------------------

    \1\ Veena Dubal, On Algorithmic Wage Discrimination, UC San 
Francisco Research Paper No. Forthcoming (2023) https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4331080 (hereinafter 
Algorithmic Wage Discrimination); Merve Hickok & Nestor Maslej, A 
Policy Primer And Roadmap On AI Worker Surveillance And Productivity 
Scoring Tools (2023) AI Ethics 3, 673-687 (2023) (hereinafter Policy 
Primer) https://link.springer.com/article/10.1007/s43681-023-00275-8.
    \2\ Id.
---------------------------------------------------------------------------

    Consumer reporting agencies and other background screening 
companies now offer a range of reports to employers, including those 
that record current workers' activities, personal habits and 
attributes, and even their biometric information. For example, some 
employers now use third parties to monitor workers' sales interactions, 
to track workers' driving habits, to measure the time that workers take 
to complete tasks, to record the number of messages workers send and 
the quantity and duration of meetings they attend, and to calculate 
workers' time spent off-task through documenting their web browsing, 
taking screenshots of computers, and measuring keystroke frequency.\3\ 
In some circumstances, this information might be sold by ``consumer 
reporting agencies'' to prospective or current employers.
---------------------------------------------------------------------------

    \3\ See, e.g., Diego Areas Munhoz, ``Robot Bosses'' Spur 
Lawmaker Push to Police AI Job Surveillance, Bloomberg Law (Sept. 8, 
2023) https://news.bloomberglaw.com/daily-labor-report/robot-bosses-spur-lawmaker-push-to-police-ai-job-surveillance; Remarks of 
Benjamin Wiseman at the Harvard Journal of Law & Technology on 
Worker Surveillance and AI, FTC.gov (Feb. 8, 2024), Jolt-2-8-24-
final.pdf (ftc.gov).
---------------------------------------------------------------------------

    Some companies may analyze worker data \4\ in order to provide 
reports containing assessments or scores of

[[Page 88876]]

worker productivity or risk to employers.\5\ Today, such scores are 
used to make automated recommendations or determinations related to 
worker pay; predict worker behavior, including potential union 
organizing activity and likelihood that a worker will leave their job; 
schedule shifts or job responsibilities; or issue warnings or other 
disciplinary actions.\6\
---------------------------------------------------------------------------

    \4\ Companies may engage in such analysis by making inferences 
and determinations about worker behavior and performance using 
algorithms, or sets of rules in computer programming code for 
solving a problem or performing a task based on input data. The 
algorithmic models used may also include ``artificial intelligence'' 
or ``AI'' models, which often develop and train algorithms using 
``machine learning,'' which is the process of gathering data and 
supplying it to the computer program to train the algorithm to find 
patterns or make predictions. Conventional algorithms and AI models 
may also set performance goals or other parameters based on external 
data--for instance, by comparing a worker's output to an industry 
standard.
    \5\ See, e.g., Policy Primer; Diego Areas Munhoz, ``Robot 
Bosses'' Spur Lawmaker Push to Police AI Job Surveillance, Bloomberg 
Law (Sept. 8, 2023) https://news.bloomberglaw.com/daily-labor-report/robot-bosses-spur-lawmaker-push-to-police-ai-job-surveillance.
    \6\ See, e.g., Algorithmic Wage Discrimination; Theara Coleman, 
The (ongoing) fight against workplace AI surveillance, The Week 
(Jan. 15, 2024) https://theweek.com/tech/workplace-ai-surveillance.
---------------------------------------------------------------------------

Analysis

    Congress passed the FCRA in response to concerns about companies 
that assemble detailed dossiers about consumers and sell this 
information.\7\ In doing so, Congress was particularly cognizant of the 
impact of so-called ``credit reporting'' on consumers' employment. 
Indeed, the Senate Report accompanying the bill that would be enacted 
as the FCRA noted in particular how ``a consumer's future employment 
career could be jeopardized because of an incomplete credit report.'' 
\8\ To address those concerns, the FCRA regulates information in the 
form of ``consumer reports,'' a term defined to include ``any written, 
oral, or other communication of any information by a consumer reporting 
agency bearing on a consumer's credit worthiness, credit standing, 
credit capacity, character, general reputation, personal 
characteristics, or mode of living which is used or expected to be used 
or collected in whole or in part for the purpose of serving as a factor 
in establishing the consumer's eligibility for'' certain purposes, 
including ``employment purposes.'' \9\
---------------------------------------------------------------------------

    \7\ See generally 115 Cong. Rec. S2410-11 (daily ed. Jan. 31, 
1969) (statement of Sen. William Proxmire).
    \8\ S. Rep. 91-517, at 4 (1970).
    \9\ 15 U.S.C. 1681(d)(1)(B). Under the FCRA, the ``term 
`consumer' means an individual.'' 15 U.S.C. 1681a(c). Among other 
things, the FCRA excludes from the definition of ``consumer report'' 
certain communications made to employers in connection with 
investigations of ``suspected misconduct relating to employment'' or 
``compliance with Federal, State, or local laws and regulations, the 
rules of a self-regulatory organization, or any pre-existing written 
policies of the employer.'' 15 U.S.C. 1681a(d)(2)(D), (y). This 
Circular does not focus on such communications.
---------------------------------------------------------------------------

    While all of the general obligations of the FCRA apply to consumer 
reports provided for employment purposes, there are a few additional 
obligations that apply only to this kind of consumer report. For 
example, section 604(b) includes additional requirements when a 
consumer report is used for employment purposes, including a 
requirement to get permission from the worker.\10\ It also generally 
requires employers to provide notice to workers and a copy of their 
report before taking adverse action.\11\ In addition, upon request by a 
worker, ``consumer reporting agencies'' must disclose the identity of 
anyone who has used a consumer report for employment purposes in the 
two-year period preceding the date the request is made, which is longer 
than the one-year period used for other purposes.\12\ And ``consumer 
reporting agencies'' must follow certain procedures when reporting 
public record information for employment purposes.\13\
---------------------------------------------------------------------------

    \10\ 15 U.S.C. 1681b(b)(1) (2). The issue of whether an employer 
can use dossiers, scores, or other surveillance on workers may also 
be a topic of negotiation at the individual or collective bargaining 
level.
    \11\ 15 U.S.C. 1681b(3)(A). But see 15 U.S.C. 1681b(b)(3)(B) 
(C), (4) (exceptions from Sec.  1681b(b)(3)(A) for workers in the 
transportation industry in certain circumstances and for consumer 
reports relevant to national security investigations in certain 
circumstances).
    \12\ 15 U.S.C. 1681g(a)(3)(A)(i).
    \13\ 15 U.S.C. 1681k. Subject to an exemption for national 
security investigations, CRAs that compile and report for employment 
purposes public record information that is likely to have an adverse 
effect on a consumer's ability to obtain employment must (1) notify 
the consumer that the information is being reported and of the name 
and address of the recipient, or (2) maintain ``strict procedures'' 
to ensure that the public record information is complete and up to 
date. Id.
---------------------------------------------------------------------------

    Beyond the obligations that apply only to consumer reports used for 
employment purposes, the FCRA's general obligations also provide 
important protections for workers. Among other things, the FCRA 
provides workers the right to know what is in their file at a 
``consumer reporting agency'' and dispute incomplete or inaccurate 
information,\14\ requires such entities, in response to a consumer's 
dispute, to correct or delete inaccurate, incomplete, or unverifiable 
information,\15\ and generally prohibits reporting of outdated negative 
information.\16\ In addition to requiring that most employers give 
workers notice before taking an adverse action, the FCRA also generally 
requires that any person taking adverse action based on a consumer 
report provide notice to the consumer upon taking the adverse 
action.\17\ Finally, the FCRA strictly limits ``consumer reporting 
agencies'' to providing consumer reports only for certain specified 
permissible purposes.\18\ That means the background screener could not 
share consumer reports containing workers' data with employers or 
others, absent a FCRA permissible purpose.\19\
---------------------------------------------------------------------------

    \14\ 15 U.S.C. 1681g(a); 15 U.S.C. 1681i(a)(1).
    \15\ 15 U.S.C. 1681i(a)(5).
    \16\ 15 U.S.C. 1681c.
    \17\ 15 U.S.C. 1681b(b)(3)(A), 1681m(a).
    \18\ See 15 U.S.C. 1681b(a).
    \19\ For example, courts have held that consumer reporting 
agencies generally cannot furnish consumer reports for targeted 
marketing. See Trans Union Corp. v. FTC, 81 F.3d 228, 233-34 (D.C. 
Cir. 1996).
---------------------------------------------------------------------------

    When looking at whether an employer that makes employment decisions 
based on a report from a third party is regulated by the FCRA, 
enforcers should consider two key questions:
    1. Does the employer's use of data qualify as a use for 
``employment purposes'' under the FCRA?
    2. Is the report obtained from a ``consumer reporting agency,'' 
meaning that the report-maker ``assembled'' or ``evaluated'' consumer 
information to produce the report?
    On the first question, the FCRA defines ``employment purposes'' to 
mean ``a report used for the purpose of evaluating a consumer for 
employment, promotion, reassignment or retention as an employee.'' \20\ 
The FCRA thus applies both to information used for the purpose of 
evaluating a consumer for employment initially, and to information used 
for ongoing employment purposes--i.e., promotion, reassignment, or 
retention.\21\
---------------------------------------------------------------------------

    \20\ 15 U.S.C. 1681a(h).
    \21\ The FCRA's application to both prospective and current 
workers is confirmed by FCRA section 603(k), which provides that an 
``adverse action'' under FCRA includes ``a denial of employment or 
any other decision for employment purposes that adversely affects 
any current or prospective employee.'' 15 U.S.C. 1681a(k)(1)(B)(ii) 
(emphasis added). See also Ernst v. Dish Network, LLC, 49 F. Supp. 
3d 377, 383 (S.D.N.Y. 2014) (background report was collected, 
expected to be used, and used for the employment purposes of 
``evaluat[ing] [the] Plaintiff for reassignment or retention as an 
employee'').
---------------------------------------------------------------------------

    On the second question, a third party could be a ``consumer 
reporting agency'' that assembles or evaluates consumer information if 
they collect consumer information in order to furnish reports to 
employers.\22\ A company that employers use to help make employment 
decisions could meet this standard in a number of ways. For example, 
similar to a ``nationwide consumer reporting agency,'' like

[[Page 88877]]

Equifax, Experian, or TransUnion, some companies collect consumer data 
from third parties for dissemination to employers in background 
reports. Traditional background screening companies ``assemble'' or 
``evaluate'' information about workers, often from public sources, such 
as criminal history records. Other firms might collect information from 
employers about workers' collective bargaining activity, or job 
performance, and then sell it to other employers to make hiring 
decisions.
---------------------------------------------------------------------------

    \22\ The FCRA regulates consumer reports as furnished by 
``consumer reporting agencies,'' which it defines as: ``any person 
which, for monetary fees, dues, or on a cooperative nonprofit basis, 
regularly engages in whole or in part in the practice of assembling 
or evaluating consumer credit information or other information on 
consumers for the purpose of furnishing consumer reports to third 
parties, and which uses any means or facility of interstate commerce 
for the purpose of preparing or furnishing consumer reports.'' 15 
U.S.C. 1681a(f).
---------------------------------------------------------------------------

    In addition, an entity could ``assemble'' or ``evaluate'' consumer 
information within the meaning of the term ``consumer reporting 
agency'' if the entity collects consumer data in order to train an 
algorithm that produces scores or other assessments about workers for 
employers. For example, the developer of a phone app that monitors a 
transportation worker's driving activity and provides driving scores to 
companies for employment purposes could ``assemble'' or ``evaluate'' 
consumer information if the developer obtains or uses data from sources 
other than an employer receiving the report, including from other 
employer-customers or public data sources, to generate the scores.\23\
---------------------------------------------------------------------------

    \23\ That may be true even when the assessment is performed 
through a software program licensed to employers, because the 
software provider furnishes the reports. Federal Trade Commission 
(FTC) staff opined more than two decades ago that a seller of 
particular software that allowed users to compile and de-duplicate 
credit report information from the three major nationwide consumer 
reporting agencies was not itself a consumer reporting agency, 
reasoning that the software seller was not ``assembling or 
evaluating'' any information itself. FTC Advisory Opinion (Oct. 27, 
1997), https://www.ftc.gov/legal-library/browse/advisory-opinions/advisory-opinion-cast-10-27-97; see also FTC, 40 Years of Experience 
with the Fair Credit Reporting Act: An FTC Staff Report with Summary 
of Interpretations at 12-13, 29 (July 2011). The FTC's guidance, 
however, focused on technology that was in existence at the time the 
guidance was drafted. Significant changes in the software and 
general technological landscape have taken place in the years since, 
rendering the FTC's prior guidance inapplicable to many of the kinds 
of technology used today. For example, software developers today 
often take a more active role in providing ongoing services to 
clients, such as by performing ongoing maintenance of the software, 
or by licensing services to clients instead of selling software as a 
point-in-time product. Accordingly, a third-party software provider 
could meet the definition of a consumer reporting agency where it 
assembles or evaluates consumer information to develop software that 
produces reports used to evaluate a worker ``for employment, 
promotion, reassignment or retention,'' or where the software itself 
assembles or evaluates information about a worker to produce reports 
used for those purposes. Judicial decisions declining to find 
software providers to be CRAs are likewise distinguishable. For 
instance, in Zabriskie v. Fed. Nat'l Mortg. Ass'n, 940 F.3d 1022, 
1029 (9th Cir. 2019), the court determined that Fannie Mae did not 
act as a CRA by licensing a proprietary software that allowed 
lenders to determine whether their loans met requirements for Fannie 
Mae to purchase, but relied on reasoning inapplicable to third-party 
software developers that analyze worker data that companies use for 
employment purposes. Id. (reasoning that Congress intended to 
exclude Fannie Mae from the definition of a ``consumer reporting 
agency'' and that Fannie Mae did not have the purpose of furnishing 
consumer reports to a third party, but rather to determine the 
loans' eligibility for purchase).
---------------------------------------------------------------------------

    Not all third parties that assemble or evaluate data will qualify 
as ``consumer reporting agencies.'' For example, section 
603(d)(2)(A)(i) of the FCRA excludes from the definition of ``consumer 
report'' any ``report containing information solely as to transactions 
or experiences between the consumer and the person making the report.'' 
But this exception applies only to reports containing information 
solely about transactions or experiences between the consumer and the 
report-maker. The exception by its own terms does not apply to a report 
containing information not about transactions or experiences between 
the report-maker and the consumer, such as when the report includes 
algorithmic scores, as described above.

About Consumer Financial Protection Circulars

    Consumer Financial Protection Circulars are intended to promote 
consistency in approach across the various enforcement agencies and 
parties, pursuant to the CFPB's statutory objective to ensure Federal 
consumer financial law is enforced consistently. 12 U.S.C. 5511(b)(4).
    Consumer Financial Protection Circulars are also intended to 
provide transparency to partner agencies regarding the CFPB's intended 
approach when cooperating in enforcement actions. See, e.g., 12 U.S.C. 
5552(b) (consultation with CFPB by State attorneys general and 
regulators); 12 U.S.C. 5562(a) (joint investigatory work between CFPB 
and other agencies).
    Consumer Financial Protection Circulars are general statements of 
policy under the Administrative Procedure Act. 5 U.S.C. 553(b). They 
provide background information about applicable law, articulate 
considerations relevant to the Bureau's exercise of its authorities, 
and, in the interest of maintaining consistency, advise other parties 
with authority to enforce Federal consumer financial law. They do not 
restrict the Bureau's exercise of its authorities, impose any legal 
requirements on external parties, or create or confer any rights on 
external parties that could be enforceable in any administrative or 
civil proceeding. The CFPB Director is instructing CFPB staff as 
described herein, and the CFPB will then make final decisions on 
individual matters based on an assessment of the factual record, 
applicable law, and factors relevant to prosecutorial discretion.

Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2024-26099 Filed 11-8-24; 8:45 am]
BILLING CODE 4810-AM-P

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.