LABOR & EMPLOYMENT NEWSLETTER - A Red Flag for Employers: New Duties and Potential Liabilities Under the FTC's Red Flag Rule on Address Discrepancies

If you use background reports for job applicants and employees, you may be subject to new Federal Trade Commission ("FTC") rules. As the incidence of identity theft continues to rise, the FTC has enacted new rules ("Red Flag Rules") to reduce its occurrence. Most of the Rules are directed at financial institutions that provide credit to consumers and do not go into effect until May 2009. However, one of the Red Flag Rules has been in effect since November 1, 2008, and applies to a potentially large number of employers.

The Red Flag Rule on Address Discrepancies applies to any employer who uses third parties to furnish consumer reports for current or prospective employees. While some employers have mistakenly believed that the Address Discrepancy Rule applies only when credit reports are obtained, "consumer report" is defined broadly to include not only credit reports but also criminal background checks.

The Address Discrepancy Rule, found at 16 C.F.R. 681.1, comes into play for an employer when it receives notice of an address discrepancy from a credit reporting agency in response to a request by the employer for a consumer report on an individual. An address discrepancy exists when there is a "substantial difference" between the address provided by the employee or job applicant and the address identified on the consumer report. While "substantial difference" is not defined, it likely refers to something more than slight typographical variations.

To comply with the Rule, an employer must develop and implement reasonable policies and procedures to identify address discrepancies and to work to resolve the discrepancy with the employee or job applicant. We would recommend the following steps be put into place as part of your policy:

First, upon receipt of a consumer report, the employer should compare the information in the consumer report to information the employer maintains in its records.
If the information does not match, the employer should then ask the employee or job applicant for government-issued photo identification to compare the addresses.
The employer should also discuss the discrepancy with the employee or job applicant.
All of these efforts should be documented and maintained in the employee's file or the job applicant's file if the applicant is hired.

The ultimate goal of these procedures is to enable the employer to form a "reasonable belief" that the consumer report relates to the consumer about whom the report was requested. Otherwise, the employer cannot use the consumer report.

If the employer is able to form a reasonable belief that the consumer report relates to the consumer, the employer might then be subject to an additional duty under the Address Discrepancy Rule. If the employer has a continuing relationship with the consumer and if the employer regularly furnishes information to the consumer reporting agency that furnished the consumer report, the employer is then obligated to provide notice of the address discrepancy to the consumer reporting agency.

While the Rule does not define a "continuing relationship with the consumer," it likely refers to any instance in which an employer hires or retains an individual as an employee after obtaining the employee's consumer report. Conversely, the duty likely does not extend to an address discrepancy for a job applicant not hired by the employer because there is no continuing relationship.

Assuming the duty exists, we would recommend that the employer draft correspondence to the consumer reporting agency, clearly identifying the discrepancy between the address(es) listed on the consumer report and the address verified with the consumer and outlining the process by which such discrepancy was identified. A copy of the correspondence should be sent to the consumer and maintained in the consumer's personnel file.

While the Red Flag Rules do not create a private cause of action against employers, the FTC is authorized to bring civil actions against employers with potential penalties of up to $2,500 for each violation. The attorney general of the employer's state is also authorized to bring similar civil actions, with penalties of up to $1,000 per violation.

To learn more about FACTA's Red Flag Rules, please contact one of the other attorneys in Strasburger & Price, LLP's Labor and Employment Practice Group.