Privacy & Cybersecurity Law Blog

On August 8, 2012, the Federal Trade Commission settled with HireRight Solutions, Inc. (“HireRight”) for failure to comply with certain Fair Credit Reporting Act (“FCRA”) requirements. At first blush, the case may appear to be a simple FCRA matter – the FTC alleged that HireRight functioned as a consumer reporting agency when providing employment screening services to companies, but then failed to take steps to assure the accuracy of those reports and prevented consumers from dispute inaccurate information. Despite initial appearances, however, the case has broader geopolitical implications.

For years, the United States has argued that the FCRA is the foundation of a privacy regime aimed at preventing harm to individuals. The FCRA requires consumer reporting agencies to comply with fair information practice principles, such as accuracy, access and correction, and imposes strong penalties for violations. In addition, FTC enforcement actions establish a basis for consumer private rights of action when companies fail to comply with the Act.

Organizations such as the Centre for Information Policy Leadership at Hunton & Williams LLP have repeatedly argued in international settings that the FCRA is a very broad law giving the FTC authority in almost all cases where companies aggregate information for the purpose of substantive decision making. However, many non-U.S. privacy policymakers believe that the FCRA is narrowly focused on preventing harm in credit-related decisions. The FTC’s two employment-related enforcement actions this year (the HireRight and Spokeo cases) make clear that employment is fully covered under the FCRA. By emphasizing the FCRA’s applicability in the employment context, the FTC helps strengthen the case for interoperability between very different privacy regimes. The more FCRA enforcement actions the FTC files against non-traditional consumer reporting agencies, the stronger the U.S. government’s arguments regarding interoperability with respect to information aggregation issues, and the more likely that discussions about interoperability will bear fruit.