HL Chronicle of Data Protection : Privacy Lawyers & Attorneys : Hogan Lovells Law Firm : Data Security, E-Commerce & Technology

In an 8-0 opinion (Justice Kagan recused herself), the Court held that even assuming the existence of a constitutional right to information privacy mentioned in Whalen and Nixon, such a right would not prevent NASA's ability as an employer to ask "reasonable, employment-related inquiries" about the backgrounds of its employees that "further the Government's interests in managing its internal operations," commenting that the questions at issue were "of the sort used by millions of private employers."  The Court noted that the federal Privacy Act, which restricts government disclosure of personal information, provided additional assurance that the information collected, though sensitive, would not be disclosed.

In so holding, the opinion was very similar to the Court's much-anticipated (but ultimately narrow) decision in City of Ontario v. Quon about six months prior.  In Quon, the Court assumed for the sake of argument that a public employee has a reasonable expectation of privacy in text messages sent from a pager issued by a government employer.  Nevertheless, as we observed when Quon was decided, the decision made clear that even in areas in which public employees have constitutional rights, if a government employer infringes on that right to accomplish a legitimate business objective, the government action is unlikely to be deemed unconstitutional.

Like Quon, the decision in Nelson only applies to public, and not private, employers.  Also like Quon, the Nelson opinion included some sparring between judges in the majority and Justice Scalia, who concurred in both opinions, regarding its scope.  In Nelson, Scalia lamented that the majority's decision, in assuming for the purposes of argument that a constitutional right existed, would "dramatically increase the number of lawsuits claiming violations of the right to informational privacy."  Though Scalia's concern involved lawsuits against government entities, his admonition merits further scrutiny going forward, as rulings in constitutional privacy cases have a tendency to be cited in lawsuits against private entities.

Still, private employers can be heartened that the Supreme Court has found that the methods of conducting background checks at issue in Nelson are sufficiently "reasonable" to trump even a constitutional right.  Nevertheless, all employers should be careful to conduct all background checks in compliance with all applicable federal and state law, including the Fair Credit Reporting Act.

1. reflects the terms of the relationship with the individual;
2. reflects the individual’s performance and other conduct with respect to the relationship; and
3. identifies the appropriate individual.

“Integrity” means that information furnished about an individual:

1. is substantiated by the data furnisher’s records at the time it is furnished;
2. is furnished in a form and manner that is designed to minimize the likelihood that the information may be incorrectly reflected in a report about the individual; and
3. includes any information in the furnisher’s possession that the Federal Trade Commission (“FTC”) has determined the absence of which would likely be materially misleading in evaluating the individual.  Regarding the last category, the FTC only has determined an individual’s credit limit with the furnisher, if applicable, must be reported, but it is possible that in the future the FTC could require furnishers to provide other categories of information.

Although this mandate is worded broadly, the regulation also specifically requires that data furnishers “consider” detailed guidelines (which are appended to the regulations) and “incorporate those guidelines that are appropriate.”  By requiring data furnishers to “consider” and “incorporate” these guidelines, the regulation requires data furnishers to conduct an audit of their current furnishing policies and procedures.  Moreover, the guidelines contain a list of specific components of policies and procedures that a furnisher “should address,” making these components de facto requirements of any written policies and procedures that result.  These components include:

• Using standard data reporting formats and standard procedures for compiling and furnishing data, where feasible, such as the electronic transmission of information about individuals to CRAs.
• Maintaining records for a reasonable period of time in order to substantiate the accuracy of any information about an individual that is subject to a direct dispute by the individual.
• Establishing and implementing appropriate internal controls to ensure accuracy and integrity, such as by implementing standard procedures and verifying random samples of information furnished to CRAs.
• Training staff that participates in activities related to data furnishing.
• Providing for appropriate and effective oversight of relevant service providers whose activities may affect the accuracy or integrity of furnished data.
• Deleting, updating, and correcting information in internal records, as appropriate, to avoid furnishing inaccurate information.
• Conducting reasonable investigations of disputes.
• Designing technological and other means of communication with CRAs to prevent duplicative reporting, erroneous association of information with the wrong individual(s), and other occurrences that may compromise the accuracy or integrity of data furnished.
• Providing CRAs with sufficient identifying information about each individual about whom information is furnished to enable the CRA to properly identify the individual.
• Conducting a periodic evaluation of internal practices, CRA practices of which the furnisher is aware, investigations of disputed information, corrections of inaccurate information, means of communication, and other factors that may affect the accuracy or integrity of data furnished.

The regulation also specifies that policies and procedures must be appropriate to the nature, size, complexity, and scope of each furnisher’s activities.  In addition, the regulation requires that furnishers review their policies and procedures “periodically” and update them as necessary to ensure their continued effectiveness.

Direct Dispute Rules

In addition to the accuracy and integrity rules, the new regulations also contain rules requiring data furnishers in most cases to investigate disputes that individuals submit directly to them regarding the accuracy of information that the furnishers reported to a CRA.  Previously, the law encouraged individuals to submit their disputes through a CRA, rather than directly to data furnishers.

The new rules require data furnishers to conduct “a reasonable investigation” of any such dispute initiated by an individual over furnished data.  Data furnishers do not need to conduct such an investigation, however, if any of a number of exceptions apply, including if the dispute is about the consumer’s identifying information; the identity of past or present employers; inquiries or requests for a consumer report; information derived from public records; information related to fraud alerts or active duty alerts; or information provided to a CRA by another furnisher.

The rules require a data furnisher to respond to disputes received at any business address, unless the furnisher has previously specified an address to the individual submitting the dispute or a specific address is listed on the report of the CRA incorporating the disputed information.  After receiving a valid dispute notice from an individual, the data furnisher must conduct and complete an investigation within thirty days (unless the disputer provides additional information within that period).  If the investigation finds that the information reported was inaccurate, the data furnisher must promptly notify and provide corrections to each CRA to which the furnisher provided inaccurate information.

Compliance Steps

At minimum, data furnishers must establish written policies and procedures regarding the accuracy and integrity of the information relating to its employees that it provides to CRAs.  This will involve conducting a review of existing policies and procedures, both formal and informal, to determine if they comply with the guidelines appended to the regulations, and making modifications as needed.  Data furnishers also must consider the specific components of policies and procedures listed in the guidelines appended to the regulations, and include those specific components in written policies and procedures if applicable.  Further, data furnishers must adopt a process to review these policies and procedures periodically and update them as necessary to ensure their continued effectiveness.

To comply with the direct dispute rules, data furnishers should determine if they furnish any information to CRAs which is not subject to any of the exceptions in the regulation, and if they do, they must establish formal policies and procedures to ensure that they conduct a “reasonable investigation” of all direct disputes about individuals’ information provided CRAs.

The further delay comes as FTC Chairman Leibowitz acknowledges the agency’s Rule’s shortcomings: “Congress needs to fix the unintended consequences of the legislation establishing the Red Flags Rule – and to fix this problem quickly.”

As previously covered in the Chronicle, the last delay occurred on October 30, 2009 when the FTC announced it would not begin enforcing the rule until June 1, 2010. That delay followed U.S. District Court for the District of Columbia's ruling that the Red Flags Rule does not apply to lawyers (for analysis of that decision, click here). It also followed the House of Representatives' unanimous passage in late October of HR 3763, which proposes to amend FCRA to exempt certain small businesses from the Red Flags Rule. Subsequently, in November 2009, the American Institute of Certified Public Accountants (AICPA) filed a lawsuit against the FTC challenging the applicability of the Red Flag Rule to Certified Public Accountants. 

Now the Red Flag Rule is facing a new legal challenge. On May 21, 2010, the American Medical Association (AMA), the American Osteopathic Association and the Medical Society of the District of Columbia filed a lawsuit against the FTC in the U.S. District Court for the District of Columbia challenging the Red Flag Rule and citing the court’s earlier decision regarding the applicability of the Rule to lawyers. In the latest lawsuit, these medical organizations argue that the Rule, which is applicable to financial institutions and creditors, unjustifiably "treats physician practices like banks, credit card companies and mortgage lenders."

Data Broker Provisions are Substantially Similar to the FCRA

The obligations the draft legislation places on data brokers largely mirror those contained in the FCRA.  For example, under the proposed legislation data brokers must make records containing personally identifiable information (“PII”) maintained for disclosure to third parties available to consumers upon request at a reasonable fee. See PDPSA § 201(c).  Such disclosures must include instructions for correcting inaccurate information.  In addition, the proposed law would obligate users of data broker services to provide notice to individuals when they take any adverse actions based upon data broker records. See PDPSA § 201(d).  Adverse action notices would include contact information for the data broker and instructions on the steps needed to correct inaccurate information.    

FTC and State Attorneys General Authorized to Pursue Civil Enforcement Actions

The draft legislation authorizes the Federal Trade Commission (“FTC”) and state Attorneys General to bring civil enforcement actions against entities that violate the data broker requirements.  See PDPSA § 202.  The civil remedies set forth in the bill include equitable relief and monetary penalties of up to $1,000 per violations up to a maximum of $250,000.  The FTC also would be able to seek double monetary penalties for violations that demonstrated to be willful or intentional.