[Federal Register Volume 89, Number 218 (Tuesday, November 12, 2024)]
[Rules and Regulations]
[Pages 88875-88877]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-26099]



========================================================================
Rules and Regulations
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains regulatory documents 
having general applicability and legal effect, most of which are keyed 
to and codified in the Code of Federal Regulations, which is published 
under 50 titles pursuant to 44 U.S.C. 1510.

The Code of Federal Regulations is sold by the Superintendent of Documents. 

========================================================================


Federal Register / Vol. 89, No. 218 / Tuesday, November 12, 2024 / 
Rules and Regulations

[[Page 88875]]



CONSUMER FINANCIAL PROTECTION BUREAU

12 CFR Chapter X


Consumer Financial Protection Circular 2024-06: Background 
Dossiers and Algorithmic Scores for Hiring, Promotion, and Other 
Employment Decisions

AGENCY: Consumer Financial Protection Bureau.

ACTION: Consumer financial protection circular.

-----------------------------------------------------------------------

SUMMARY: The Consumer Financial Protection Bureau (CFPB) has issued 
Consumer Financial Protection Circular 2024-06, titled, ``Background 
Dossiers and Algorithmic Scores for Hiring, Promotion, and Other 
Employment Decisions.'' In this circular, the CFPB responds to the 
question, ``Can an employer make employment decisions utilizing 
background dossiers, algorithmic scores, and other third-party consumer 
reports about workers without adhering to the Fair Credit Reporting Act 
(FCRA)?''

DATES: The CFPB released this circular on its website on October 24, 
2024.

ADDRESSES: Enforcers, and the broader public, can provide feedback and 
comments to <a href="/cdn-cgi/l/email-protection#16557f6475637a776465567570667438717960"><span class="__cf_email__" data-cfemail="67240e1504120b061514270401170549000811">[email protected]</span></a>.

FOR FURTHER INFORMATION CONTACT: George Karithanom, Regulatory 
Implementation & Guidance Program Analyst, Office of Regulations, at 
202-435-7700 or at: https://reginquiries.consumerfinance.gov/. If you 
require this document in an alternative electronic format, please 
contact <a href="/cdn-cgi/l/email-protection#d3909583918c92b0b0b6a0a0bab1babfbaa7aa93b0b5a3b1fdb4bca5"><span class="__cf_email__" data-cfemail="f6b5b0a6b4a9b795959385859f949f9a9f828fb695908694d8919980">[email protected]</span></a>.

SUPPLEMENTARY INFORMATION:

Question Presented

    Can an employer make employment decisions utilizing background 
dossiers, algorithmic scores, and other third-party consumer reports 
about workers without adhering to the Fair Credit Reporting Act (FCRA)?

Response

    No. Similar to credit reports and credit scores used by lenders to 
make lending decisions, background dossiers--such as those that convey 
scores about workers--that are obtained from third parties and used by 
employers to make hiring, promotion, reassignment, or retention 
decisions are often governed by the FCRA. Many background dossiers that 
are compiled from databases collecting public records, employment 
history, collective-bargaining activity, or other information about a 
worker are ``consumer reports'' under the FCRA. Other types of consumer 
reports may include, for example, reports that convey scores assessing 
a current worker's risk level or performance.
    Employers that use consumer reports--both initially when hiring 
workers and for subsequent employment purposes--must comply with FCRA 
obligations, including the requirement to obtain a worker's permission 
to procure a consumer report, the obligation to provide notices before 
and upon taking adverse actions, and a prohibition on using consumer 
reports for purposes other than the permissible purposes described in 
the FCRA.
    The third-party providers furnishing these reports are ``consumer 
reporting agencies'' regulated by the FCRA, which (among other things) 
imposes an obligation to follow reasonable procedures to assure maximum 
possible accuracy, a requirement to disclose information in a worker's 
file to the worker upon request, and a requirement to investigate 
worker disputes alleging inaccuracies.

Consumer Reports for Employment Purposes

    Similar to how credit reports and credit scores are commonly used 
by lenders, employers commonly purchase consumer reports to make 
employment decisions about workers. The most traditional form of 
consumer report in use in the United States for employment purposes is 
a background dossier that checks a worker's public records, including 
criminal history.
    Recent technological advances have resulted in a rapid increase in 
the monitoring of workers across many sectors.\1\ This has been 
compounded by an increase in remote work. Together, these phenomena 
have resulted in an increase in third-party technology companies that 
have made it easier and more cost effective to track, assess, and 
evaluate workers.\2\
---------------------------------------------------------------------------

    \1\ Veena Dubal, On Algorithmic Wage Discrimination, UC San 
Francisco Research Paper No. Forthcoming (2023) https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4331080 (hereinafter 
Algorithmic Wage Discrimination); Merve Hickok & Nestor Maslej, A 
Policy Primer And Roadmap On AI Worker Surveillance And Productivity 
Scoring Tools (2023) AI Ethics 3, 673-687 (2023) (hereinafter Policy 
Primer) https://link.springer.com/article/10.1007/s43681-023-00275-8.
    \2\ Id.
---------------------------------------------------------------------------

    Consumer reporting agencies and other background screening 
companies now offer a range of reports to employers, including those 
that record current workers' activities, personal habits and 
attributes, and even their biometric information. For example, some 
employers now use third parties to monitor workers' sales interactions, 
to track workers' driving habits, to measure the time that workers take 
to complete tasks, to record the number of messages workers send and 
the quantity and duration of meetings they attend, and to calculate 
workers' time spent off-task through documenting their web browsing, 
taking screenshots of computers, and measuring keystroke frequency.\3\ 
In some circumstances, this information might be sold by ``consumer 
reporting agencies'' to prospective or current employers.
---------------------------------------------------------------------------

    \3\ See, e.g., Diego Areas Munhoz, ``Robot Bosses'' Spur 
Lawmaker Push to Police AI Job Surveillance, Bloomberg Law (Sept. 8, 
2023) https://news.bloomberglaw.com/daily-labor-report/robot-bosses-spur-lawmaker-push-to-police-ai-job-surveillance; Remarks of 
Benjamin Wiseman at the Harvard Journal of Law & Technology on 
Worker Surveillance and AI, FTC.gov (Feb. 8, 2024), Jolt-2-8-24-
final.pdf (ftc.gov).
---------------------------------------------------------------------------

    Some companies may analyze worker data \4\ in order to provide 
reports containing assessments or scores of

[[Page 88876]]

worker productivity or risk to employers.\5\ Today, such scores are 
used to make automated recommendations or determinations related to 
worker pay; predict worker behavior, including potential union 
organizing activity and likelihood that a worker will leave their job; 
schedule shifts or job responsibilities; or issue warnings or other 
disciplinary actions.\6\
---------------------------------------------------------------------------

    \4\ Companies may engage in such analysis by making inferences 
and determinations about worker behavior and performance using 
algorithms, or sets of rules in computer programming code for 
solving a problem or performing a task based on input data. The 
algorithmic models used may also include ``artificial intelligence'' 
or ``AI'' models, which often develop and train algorithms using 
``machine learning,'' which is the process of gathering data and 
supplying it to the computer program to train the algorithm to find 
patterns or make predictions. Conventional algorithms and AI models 
may also set performance goals or other parameters based on external 
data--for instance, by comparing a worker's output to an industry 
standard.
    \5\ See, e.g., Policy Primer; Diego Areas Munhoz, ``Robot 
Bosses'' Spur Lawmaker Push to Police AI Job Surveillance, Bloomberg 
Law (Sept. 8, 2023) https://news.bloomberglaw.com/daily-labor-report/robot-bosses-spur-lawmaker-push-to-police-ai-job-surveillance.
    \6\ See, e.g., Algorithmic Wage Discrimination; Theara Coleman, 
The (ongoing) fight against workplace AI surveillance, The Week 
(Jan. 15, 2024) https://theweek.com/tech/workplace-ai-surveillance.
---------------------------------------------------------------------------

Analysis

    Congress passed the FCRA in response to concerns about companies 
that assemble detailed dossiers about consumers and sell this 
information.\7\ In doing so, Congress was particularly cognizant of the 
impact of so-called ``credit reporting'' on consumers' employment. 
Indeed, the Senate Report accompanying the bill that would be enacted 
as the FCRA noted in particular how ``a consumer's future employment 
career could be jeopardized because of an incomplete credit report.'' 
\8\ To address those concerns, the FCRA regulates information in the 
form of ``consumer reports,'' a term defined to include ``any written, 
oral, or other communication of any information by a consumer reporting 
agency bearing on a consumer's credit worthiness, credit standing, 
credit capacity, character, general reputation, personal 
characteristics, or mode of living which is used or expected to be used 
or collected in whole or in part for the purpose of serving as a factor 
in establishing the consumer's eligibility for'' certain purposes, 
including ``employment purposes.'' \9\
---------------------------------------------------------------------------

    \7\ See generally 115 Cong. Rec. S2410-11 (daily ed. Jan. 31, 
1969) (statement of Sen. William Proxmire).
    \8\ S. Rep. 91-517, at 4 (1970).
    \9\ 15 U.S.C. 1681(d)(1)(B). Under the FCRA, the ``term 
`consumer' means an individual.'' 15 U.S.C. 1681a(c). Among other 
things, the FCRA excludes from the definition of ``consumer report'' 
certain communications made to employers in connection with 
investigations of ``suspected misconduct relating to employment'' or 
``compliance with Federal, State, or local laws and regulations, the 
rules of a self-regulatory organization, or any pre-existing written 
policies of the employer.'' 15 U.S.C. 1681a(d)(2)(D), (y). This 
Circular does not focus on such communications.
---------------------------------------------------------------------------

    While all of the general obligations of the FCRA apply to consumer 
reports provided for employment purposes, there are a few additional 
obligations that apply only to this kind of consumer report. For 
example, section 604(b) includes additional requirements when a 
consumer report is used for employment purposes, including a 
requirement to get permission from the worker.\10\ It also generally 
requires employers to provide notice to workers and a copy of their 
report before taking adverse action.\11\ In addition, upon request by a 
worker, ``consumer reporting agencies'' must disclose the identity of 
anyone who has used a consumer report for employment purposes in the 
two-year period preceding the date the request is made, which is longer 
than the one-year period used for other purposes.\12\ And ``consumer 
reporting agencies'' must follow certain procedures when reporting 
public record information for employment purposes.\13\
---------------------------------------------------------------------------

    \10\ 15 U.S.C. 1681b(b)(1) (2). The issue of whether an employer 
can use dossiers, scores, or other surveillance on workers may also 
be a topic of negotiation at the individual or collective bargaining 
level.
    \11\ 15 U.S.C. 1681b(3)(A). But see 15 U.S.C. 1681b(b)(3)(B) 
(C), (4) (exceptions from Sec.  1681b(b)(3)(A) for workers in the 
transportation industry in certain circumstances and for consumer 
reports relevant to national security investigations in certain 
circumstances).
    \12\ 15 U.S.C. 1681g(a)(3)(A)(i).
    \13\ 15 U.S.C. 1681k. Subject to an exemption for national 
security investigations, CRAs that compile and report for employment 
purposes public record information that is likely to have an adverse 
effect on a consumer's ability to obtain employment must (1) notify 
the consumer that the information is being reported and of the name 
and address of the recipient, or (2) maintain ``strict procedures'' 
to ensure that the public record information is complete and up to 
date. Id.
---------------------------------------------------------------------------

    Beyond the obligations that apply only to consumer reports used for 
employment purposes, the FCRA's general obligations also provide 
important protections for workers. Among other things, the FCRA 
provides workers the right to know what is in their file at a 
``consumer reporting agency'' and dispute incomplete or inaccurate 
information,\14\ requires such entities, in response to a consumer's 
dispute, to correct or delete inaccurate, incomplete, or unverifiable 
information,\15\ and generally prohibits reporting of outdated negative 
information.\16\ In addition to requiring that most employers give 
workers notice before taking an adverse action, the FCRA also generally 
requires that any person taking adverse action based on a consumer 
report provide notice to the consumer upon taking the adverse 
action.\17\ Finally, the FCRA strictly limits ``consumer reporting 
agencies'' to providing consumer reports only for certain specified 
permissible purposes.\18\ That means the background screener could not 
share consumer reports containing workers' data with employers or 
others, absent a FCRA permissible purpose.\19\
---------------------------------------------------------------------------

    \14\ 15 U.S.C. 1681g(a); 15 U.S.C. 1681i(a)(1).
    \15\ 15 U.S.C. 1681i(a)(5).
    \16\ 15 U.S.C. 1681c.
    \17\ 15 U.S.C. 1681b(b)(3)(A), 1681m(a).
    \18\ See 15 U.S.C. 1681b(a).
    \19\ For example, courts have held that consumer reporting 
agencies generally cannot furnish consumer reports for targeted 
marketing. See Trans Union Corp. v. FTC, 81 F.3d 228, 233-34 (D.C. 
Cir. 1996).
---------------------------------------------------------------------------

    When looking at whether an employer that makes employment decisions 
based on a report from a third party is regulated by the FCRA, 
enforcers should consider two key questions:
    1. Does the employer's use of data qualify as a use for 
``employment purposes'' under the FCRA?
    2. Is the report obtained from a ``consumer reporting agency,'' 
meaning that the report-maker ``assembled'' or ``evaluated'' consumer 
information to produce the report?
    On the first question, the FCRA defines ``employment purposes'' to 
mean ``a report used for the purpose of evaluating a consumer for 
employment, promotion, reassignment or retention as an employee.'' \20\ 
The FCRA thus applies both to information used for the purpose of 
evaluating a consumer for employment initially, and to information used 
for ongoing employment purposes--i.e., promotion, reassignment, or 
retention.\21\
---------------------------------------------------------------------------

    \20\ 15 U.S.C. 1681a(h).
    \21\ The FCRA's application to both prospective and current 
workers is confirmed by FCRA section 603(k), which provides that an 
``adverse action'' under FCRA includes ``a denial of employment or 
any other decision for employment purposes that adversely affects 
any current or prospective employee.'' 15 U.S.C. 1681a(k)(1)(B)(ii) 
(emphasis added). See also Ernst v. Dish Network, LLC, 49 F. Supp. 
3d 377, 383 (S.D.N.Y. 2014) (background report was collected, 
expected to be used, and used for the employment purposes of 
``evaluat[ing] [the] Plaintiff for reassignment or retention as an 
employee'').
---------------------------------------------------------------------------

    On the second question, a third party could be a ``consumer 
reporting agency'' that assembles or evaluates consumer information if 
they collect consumer information in order to furnish reports to 
employers.\22\ A company that employers use to help make employment 
decisions could meet this standard in a number of ways. For example, 
similar to a ``nationwide consumer reporting agency,'' like

[[Page 88877]]

Equifax, Experian, or TransUnion, some companies collect consumer data 
from third parties for dissemination to employers in background 
reports. Traditional background screening companies ``assemble'' or 
``evaluate'' information about workers, often from public sources, such 
as criminal history records. Other firms might collect information from 
employers about workers' collective bargaining activity, or job 
performance, and then sell it to other employers to make hiring 
decisions.
---------------------------------------------------------------------------

    \22\ The FCRA regulates consumer reports as furnished by 
``consumer reporting agencies,'' which it defines as: ``any person 
which, for monetary fees, dues, or on a cooperative nonprofit basis, 
regularly engages in whole or in part in the practice of assembling 
or evaluating consumer credit information or other information on 
consumers for the purpose of furnishing consumer reports to third 
parties, and which uses any means or facility of interstate commerce 
for the purpose of preparing or furnishing consumer reports.'' 15 
U.S.C. 1681a(f).
---------------------------------------------------------------------------

    In addition, an entity could ``assemble'' or ``evaluate'' consumer 
information within the meaning of the term ``consumer reporting 
agency'' if the entity collects consumer data in order to train an 
algorithm that produces scores or other assessments about workers for 
employers. For example, the developer of a phone app that monitors a 
transportation worker's driving activity and provides driving scores to 
companies for employment purposes could ``assemble'' or ``evaluate'' 
consumer information if the developer obtains or uses data from sources 
other than an employer receiving the report, including from other 
employer-customers or public data sources, to generate the scores.\23\
---------------------------------------------------------------------------

    \23\ That may be true even when the assessment is performed 
through a software program licensed to employers, because the 
software provider furnishes the reports. Federal Trade Commission 
(FTC) staff opined more than two decades ago that a seller of 
particular software that allowed users to compile and de-duplicate 
credit report information from the three major nationwide consumer 
reporting agencies was not itself a consumer reporting agency, 
reasoning that the software seller was not ``assembling or 
evaluating'' any information itself. FTC Advisory Opinion (Oct. 27, 
1997), https://www.ftc.gov/legal-library/browse/advisory-opinions/advisory-opinion-cast-10-27-97; see also FTC, 40 Years of Experience 
with the Fair Credit Reporting Act: An FTC Staff Report with Summary 
of Interpretations at 12-13, 29 (July 2011). The FTC's guidance, 
however, focused on technology that was in existence at the time the 
guidance was drafted. Significant changes in the software and 
general technological landscape have taken place in the years since, 
rendering the FTC's prior guidance inapplicable to many of the kinds 
of technology used today. For example, software developers today 
often take a more active role in providing ongoing services to 
clients, such as by performing ongoing maintenance of the software, 
or by licensing services to clients instead of selling software as a 
point-in-time product. Accordingly, a third-party software provider 
could meet the definition of a consumer reporting agency where it 
assembles or evaluates consumer information to develop software that 
produces reports used to evaluate a worker ``for employment, 
promotion, reassignment or retention,'' or where the software itself 
assembles or evaluates information about a worker to produce reports 
used for those purposes. Judicial decisions declining to find 
software providers to be CRAs are likewise distinguishable. For 
instance, in Zabriskie v. Fed. Nat'l Mortg. Ass'n, 940 F.3d 1022, 
1029 (9th Cir. 2019), the court determined that Fannie Mae did not 
act as a CRA by licensing a proprietary software that allowed 
lenders to determine whether their loans met requirements for Fannie 
Mae to purchase, but relied on reasoning inapplicable to third-party 
software developers that analyze worker data that companies use for 
employment purposes. Id. (reasoning that Congress intended to 
exclude Fannie Mae from the definition of a ``consumer reporting 
agency'' and that Fannie Mae did not have the purpose of furnishing 
consumer reports to a third party, but rather to determine the 
loans' eligibility for purchase).
---------------------------------------------------------------------------

    Not all third parties that assemble or evaluate data will qualify 
as ``consumer reporting agencies.'' For example, section 
603(d)(2)(A)(i) of the FCRA excludes from the definition of ``consumer 
report'' any ``report containing information solely as to transactions 
or experiences between the consumer and the person making the report.'' 
But this exception applies only to reports containing information 
solely about transactions or experiences between the consumer and the 
report-maker. The exception by its own terms does not apply to a report 
containing information not about transactions or experiences between 
the report-maker and the consumer, such as when the report includes 
algorithmic scores, as described above.

About Consumer Financial Protection Circulars

    Consumer Financial Protection Circulars are intended to promote 
consistency in approach across the various enforcement agencies and 
parties, pursuant to the CFPB's statutory objective to ensure Federal 
consumer financial law is enforced consistently. 12 U.S.C. 5511(b)(4).
    Consumer Financial Protection Circulars are also intended to 
provide transparency to partner agencies regarding the CFPB's intended 
approach when cooperating in enforcement actions. See, e.g., 12 U.S.C. 
5552(b) (consultation with CFPB by State attorneys general and 
regulators); 12 U.S.C. 5562(a) (joint investigatory work between CFPB 
and other agencies).
    Consumer Financial Protection Circulars are general statements of 
policy under the Administrative Procedure Act. 5 U.S.C. 553(b). They 
provide background information about applicable law, articulate 
considerations relevant to the Bureau's exercise of its authorities, 
and, in the interest of maintaining consistency, advise other parties 
with authority to enforce Federal consumer financial law. They do not 
restrict the Bureau's exercise of its authorities, impose any legal 
requirements on external parties, or create or confer any rights on 
external parties that could be enforceable in any administrative or 
civil proceeding. The CFPB Director is instructing CFPB staff as 
described herein, and the CFPB will then make final decisions on 
individual matters based on an assessment of the factual record, 
applicable law, and factors relevant to prosecutorial discretion.

Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2024-26099 Filed 11-8-24; 8:45 am]
BILLING CODE 4810-AM-P


</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>