A MoFo Privacy Minute Q&A: CFPB Issues Guidance for Employers on Surveillance of Workers

This is a MoFo Privacy Minute, where we answer the questions that our clients are asking us in sixty seconds or less.

Question: My company uses an AI tool that scores employees based on numerous data sources. How does the CFPB’s recently issued guidance on employee surveillance affect my business?

Answer: The guidance issued by the Consumer Financial Protection Bureau (“CFPB”) serves as a reminder to all employers of their obligations under the Fair Credit Reporting Act (“FCRA”) when using “consumer reports” for employment purposes, while also highlighting potential FCRA-related implications of the use of AI tools for employment decisions.

The CFPB is a federal consumer financial services regulatory agency. In general, the CFPB has broad regulatory and enforcement authority with respect to certain “enumerated consumer laws,” including the FCRA. The CFPB’s FCRA enforcement authority is limited by law to certain participants in the consumer financial services marketplace that are consumer reporting agencies, that use consumer reports, and that furnish information to consumer reporting agencies. Nonetheless, the guidance may signal efforts by the CFPB to partner with state Attorneys General who have authority under the FCRA over other employers who use consumer reports.

At its core, the CFPB’s guidance highlights that the longstanding consumer protections under the FCRA extend beyond traditional background checks and credit reports and apply to technological advancements in employee surveillance that involve consumer report information. The guidance indicates that employers cannot utilize background dossiers, “black box” AI or algorithmic scores, or other information that would be considered a “consumer report” for purposes of the FCRA for hiring decisions or subsequent employment purposes without complying with FCRA.

According to the guidance, because technological advancements and the proliferation of remote work have allowed for increased monitoring of workers, consumer reporting agencies now offer a range of consumer reports beyond traditional background checks. These reports may include records of workers’ activities, personal habits and attributes, and even their biometric information. And many employers may use these new types of consumer reports for “employment purposes” under the FCRA, which is defined as “evaluating a consumer for employment, promotion, reassignment or retention as an employee.”

Key Points of the Guidance

The CFPB guidance does not restrict employee monitoring or employers’ use of consumer reports. Nonetheless, the CFPB clarifies that when an employer uses a consumer report for employment decisions, the employer must comply with the relevant obligations and limitations imposed by the FCRA on the use of consumer reports for “employment purposes,” including:

• Consent: When a consumer report will be used by an employer for an “employment purpose,” the employer must obtain the relevant individual’s written authorization.
• Notice: An employer must provide notice to a worker and a copy of a consumer report before taking an adverse action against the individual based on the report.

The CFPB guidance also highlights that the FCRA also imposes obligations on consumer reporting agencies providing consumer reports for employment purposes. For example, workers have the right under the FCRA to know what is in their consumer report file at a consumer reporting agency and dispute incomplete or inaccurate information. In addition, consumer reporting agencies must:

• disclose the identity of anyone who has used a consumer report for employment purposes in the two-year period preceding the date the request is made;
• follow certain procedures when reporting public record information for employment purposes; and
• provide consumer reports only for certain specified permissible purposes.

The CFPB guidance indicates that because of technological developments, companies providing consumer reports for employment purposes may include companies not traditionally thought of as consumer reporting agencies. The CFPB provides the example that a phone app developer that monitors a worker’s driving activity and provides driving scores to companies for employment purposes may be a consumer reporting agency if it “assembles” or “evaluates” consumer information that the developer obtains or uses data from sources other than an employer receiving the report to generate the scores.

Implications

While the guidance is not legally binding and while the CFPB is not a regulator for most employers, the guidance aligns with recent state and local legislative activity on employee monitoring, such as New York City’s Automated Employment Decision Tools (“AEDT”) law (Local Law 144 and its related rule). The New York AEDT law and related rule imposes requirements for employers using AI tools in making employment decisions. The CFPB’s guidance also follows the CFPB’s announcement that it will be proposing significant revisions to its FCRA rules, which are expected to be released before the end of the year.

While we await the CFPB’s rulemaking, all employers should review their current processes for complying with the FCRA when using consumer reports for employment purposes.