On May 24, 2018, the President signed the Economic Growth, Regulatory Relief, and Consumer Protection Act (the “Act”) into law, adding new Fair Credit Reporting Act (“FCRA”) required notices.  The changes primarily impact consumer reporting agencies (“CRAs”) rather than employers, but one change adds a new required notice whenever a Summary of Consumer Rights is required by the FCRA’s Section 609.

The Act mandates that whenever the FCRA requires a consumer to receive either the Summary of Consumer Rights or the Summary of Consumer Identity Theft Rights, a notice regarding the new security freeze rights must also be included.

The Summary of Consumer Rights is a summary of consumer’s rights to obtain and dispute information in consumer reports and to obtain credit scores.  Employers are required to provide the Summary of Consumer Rights along with a Pre-Adverse Action notice and a copy of the relevant consumer report to an applicant or employee if the employer may take adverse action based on the results of a consumer report (third party background check) for employment purposes. 

Most employers are currently using the model Summary of Consumer Rights provided by the Consumer Financial Protection Bureau. The new notice of security freeze rights does not appear in the model forms currently in Appendices I and K, which were published on November 14, 2012.  The Consumer Financial Protection Bureau issued an interim final rule updating the model Summary of Consumer Rights in Appendix K to part 1022 and the Summary of Consumer Identity Theft Rights in Appendix I.  Employers and CRAs must now use the new model notices or their own substantially similar forms.  To mitigate the impact of these changes on users of the existing model forms, the interim final rule also allows the use of the old forms with a separate attached notice including the new security freeze text supplied below:

"Consumers Have the Right To Obtain a Security Freeze

"You have a right to place a 'security freeze' on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit.

"As an alternative to a security freeze, you have the right to place an initial or extended fraud alert on your credit file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer's credit file. Upon seeing a fraud alert display on a consumer's credit file, a business is required to take steps to verify the consumer's identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting 7 years.

"A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements."

The Act also amends the FCRA to extend the minimum time that CRAs must include an initial fraud alert in a consumer's file from 90 days to one year and requires a notice of this change in the Summary of Consumer Identity Rights.  In addition, the Act adds a new FCRA section 605A(i), which requires CRAs to provide free national security freezes to consumers.

The interim final rule is effective September 21, 2018 and the Consumer Financial Protection Bureau is soliciting comment on the rule's amendments to the notices through November 19, 2018.