Labor And Employment Alert - Fair Credit Reporting Act Is Applied To Data Broker Selling Personal Information Gleaned From Social Media For Employment Screening

In what the Federal Trade Commission ("FTC") touts as "the first Commission case to address the sale of Internet and social media data in the employment screening context," Spokeo, an on-line data broker, has agreed to settle charges by the FTC that its practices violated the Fair Credit Reporting Act ("FCRA"). Signing a consent decree endorsed on June 19 in the U.S. District Court in Los Angeles, and without admitting any claims or their underlying facts, Spokeo agreed to pay a fine of $800,000 and submit to injunctive relief chiefly aimed at compliance with the FCRA in the future.

The Fair Credit Reporting Act

The FCRA was enacted more than 40 years ago to regulate the practices of credit reporting agencies to require accuracy and privacy in assembling personal information on consumers and reporting that information in so-called "consumer reports" to users of that data.1 The law was extensively amended in the 1990s to impose reporting and disclosure requirements for users of consumer reports and the consumer reporting agencies ("CRA") that assemble and report the information reported. For employers, these mandates as a general matter imposed specific notice and authorization requirements on use of consumer reports which continue to apply, e.g., whenever an employer retains a third party to screen an applicant for employment or conduct a background check or an investigation of a current employee. The FCRA requires credit reporting agencies that obtain and assemble the information presented in consumer reports, in turn, to adhere to "reasonable procedures" to protect the confidentiality and ensure the accuracy and relevancy of the information that they report and to respond to assertions by consumers that information in a report is inaccurate — among other obligations.2

Employers today are familiar with the FCRA (as supplemented by the laws of certain states) as synonymous with employment screening and background checks. They tend to turn to well-established credit reporting agencies that are familiar with FCRA obligations and processes to handle employment screenings. The emergence of on-line data brokers coupled with the explosion of information that can be mined from relatively new social networks has created new challenges for employers and regulators alike in trying to apply "old" laws to new technologies and the businesses built around them. The Spokeo case is an example of regulators catching up.

The FTC Claims Against Spokeo

Spokeo is a privately held company headquartered in California. While it presently describes itself as a people search engine that does not permit its use for employment screenings or any other purpose covered by the Fair Credit Reporting Act, the FTC complaint quotes from materials prepared by Spokeo...