The Consumer Financial Protection Board (CFPB) recently issued guidances titled Consumer Financial Protection Circular 2024-06: Background Dossiers and Algorithmic Scores for Hiring, Promotion, and Other Employment Decisions | Consumer Financial Protection Bureau and Consumer Financial Protection Circular 2023-03: Adverse action notification requirements and the proper use of the CFPB’s sample forms provided in Regulation B | Consumer Financial Protection Bureau. The guidances remind employers that certain decision-making tools and resources including tracking devices and AI algorithmic services used for employment purposes could create Fair Credit Reporting Act (FCRA) compliance issues.

Typically, FCRA applies when employers request a consumer report from a third-party consumer reporting agency (CRA) for an employment purpose. Actions considered an employment purpose have been broadly construed and can include hiring, promotions, disciplinary action, reassignment, and retention. Consumer reporting agencies are the companies that assemble or evaluate outside or public consumer data for a fee to furnish such reports.

FCRA may cover a broad spectrum of reports produced by a consumer reporting agency. An employer now needs to understand whether FCRA applies, given a variety of considerations including the origination of the data for the decision-making tool.

First, an easy example – an employer may decide to conduct a lawful credit check on a job candidate – this action typically implicates FCRA because credit checks can only be obtained from a CRA source.

On the other end of the spectrum, an employer may use third-party software to prepare reports summarizing employees’ sales performance. The third-party software merely summarizes internal company sales data into report form so the employer can more easily evaluate employee performance. In this case, the vendor is not a consumer reporting agency. While the employer is using the report for an employment purpose, the FCRA explicitly excludes “report[s] containing information solely as to transactions or experiences between the consumer and the person making the report.” Sales data solely from the employer likely fits under this exclusion.

Software that utilizes generative AI makes the question of the applicability of FCRA murkier. For example, some employers are turning to software vendors that utilize AI algorithms to generate employee performance reviews. Without careful consideration, employers may unknowingly implicate FCRA through their purchase and use of such software. Some of these considerations include:

• Data Sources: Employers must consider all the sources of data used to train the vendor’s AI tool, even if the data used to generate each individualized report only originates from the respective employee (or some or all of the employer’s other employees). For instance, if the AI tool generates a sales performance report based on the employee’s sales in comparison to or in consideration of public consumer data or public information about the employee, the vendor could be considered a consumer reporting agency.
• Vendor’s Intent: It is also important to consider whether the employer alters the performance review prior to delivery to the employee. A vendor is not a consumer reporting agency if it does not intend for its reports to be used as “consumer reports.” Kidd v. Thompson Reuters Corp., 925 F. 3d 99 (2d Cir. 2019). As such, tools that merely assist with report drafting, and only present draft reports intended for the employer to supplement and edit, may not fit under this broad definition of consumer reporting agency.
• Other Considerations: Utilizing software that incorporates AI may also implicate various state and federal laws. For instance, Colorado recently passed the AI Act, which creates a duty of reasonable care for deployers of “high-risk” AI systems to avoid algorithmic discrimination against Colorado residents. Colorado Enacts Artificial Intelligence Legislation Affecting AI Systems Developers, Deployers – Jackson Lewis

The CFPB’s guidances should act as a reminder to employers that FCRA coverage is just one more area to explore before purchasing from a vendor a decision-making tool or using AI for any employment-related purpose.