Clients, especially Commercial clients who hire drivers, often ask their agent to furnish them with copies of MVRs on current or prospective employees. This document by Mike Edwards addresses the perils of providing such delicate information.
The federal Fair Credit Reporting Act (FCRA) sets strict guidelines governing the release of MVRs and other consumer information, with potentially serious penalties for violations. In addition to federal penalties, agencies can face lawsuits from people whose MVRs they furnished to a Commercial client. This means that agencies must be aware of requirements of the FCRA, and take appropriate precautions when handling requests for MVRs from Commercial clients.
The FCRA was passed to protect the privacy and accuracy of certain defined 'consumer reports,' which includes MVRs, and a wide variety of other information, such as credit reports, credit scores, etc. To that end, the FCRA: (1) restricts access and use of consumer reports; (2) requires certain disclosures; (3) requires the written permission of the consumer under certain circumstances; (4) provides a process for the consumer to dispute inaccurate information; and (5) imposes both civil and criminal penalties for noncompliance.
When any consumer report, including an MVR, is used for employment, the FCRA requires that the consumer (the employee or prospective employee in this case) first grant written permission before a Consumer Reporting Agency (CRA), such as Equifax, Experian, or Trans Union can release the information.
The FCRA also requires the CRA to provide the consumer (employee) with a 'Summary of Consumer Rights' whenever a consumer report/MVR is used in connection with employment.
If a consumer (employee) suffers any 'adverse action' (not hired, not promoted, fired, etc.) as a result of information in any consumer report — including an MVR— the FCRA requires the employer to give the employee a 'Notice of Adverse Action.'
The CRA must provide the employer with a 'Summary of User Responsibilities.' Every employer who uses consumer reports/MVRs as a part of their employment screening process should read this document carefully.
Records must be maintained for two years.
If an insurance agency provides consumer reports/MVRs to Commercial clients for employment purposes, most authorities agree that the agency is functioning as a Consumer Reporting Agency, and must follow all the steps required of a CRA. Thus, although it might be 'legal' for an insurance agency to provide MVRs to Commercial clients, the agency must be aware that it’s acting as an employee screening service, not just 'underwriting insurance.'
Violations of the FCRA fall into two categories: (1) negligent noncompliance, and (2) willful noncompliance.
The penalties for negligent noncompliance include actual damages, attorney’s fees, and court costs.
The penalties for willful noncompliance — the more serious violation — can include all of the above, as well as punitive damages, a fine from the Federal Trade Commission, and up to two years in prison.
In addition to the myriad requirements of the FCRA, an agency must also beware of other restraints and concerns.
First, most third-party providers of MVRs (such as ChoicePoint, etc.) expressly prohibit agents from furnishing MVRs to anyone other than the consumer. It’s essential to note that although an agency may legally furnish MVRs to Commercial clients as long as it follows all FCRA guidelines, most third-party providers from whom the agency routinely obtains MVRs prohibit such practices.
A second concern is that many insurers also prohibit disclosure of MVRs to anyone other than the subject of the MVR.
A third concern is that agencies can be — and have been — sued by consumers for allegedly furnishing protected, personal information to others without their permission or knowledge.
Although FCRA requires a consumer to give written permission before a CRA can release any consumer report (including MVRs) that will be used for employment, there’s no requirement for written permission if the consumer report/MVR is for insurance underwriting. And therein lies a dangerous trap for agencies. When a Commercial client calls an agency and asks that an MVR be run on an employee/prospective employee, especially those that will be driving, the agency can meet this request by computer in a matter of minutes. Agencies pull MVRs for underwriting many times each day.
However, in sending the MVR to the Commercial client, the agency probably goes beyond the bounds of 'underwriting.' Most legal experts agree that the agency is acting as a Consumer Reporting Agency, by supplying a consumer report that will be used for employment. This can create an immediate legal problem for the agency because the chances are overwhelming that they don’t have the consumer’s written permission.
What’s more, the consumer’s written permission isn’t the only requirement the agency must now meet if it provides MVRs to Commercial clients. Bear in mind that such practices are probably prohibited by the third-party provider of the MVR, as well as by many insurers (perhaps including the carrier who wrote the Commercial Auto policy for the agency’s client).
In an attempt to sidestep the FCRA requirements, some agencies might consider simply giving the manager or supervisor of the Commercial client verbal information on the MVR, without actually sending them a copy. Most authorities believe that this probably does not relieve the agency from meeting its responsibilities under the FCRA, and could make it a target for a violation of privacy lawsuit.
On the other hand, if the information on the MVR would cause the Commercial Auto insurer to exclude drivers from coverage, informing the Commercial client of that fact without revealing any specifics, probably still falls under 'underwriting.' If the client insists on finding out the specifics of why a driver will be excluded, the safest practice for the agency is to suggest that the employer obtain the MVR, and any other background information legally available, on their own. This can easily be done by contacting any of the dozens of employee screening companies that provide this information for a fee.
It’s essential to inform all agency employees who handle MVRs about the distinction between using consumer reports/MVRs for insurance underwriting vs. employment.
Although these strict guidelines and complicated procedures might seem unduly burdensome at first, bear in mind that the overall purpose of the FCRA is to protect the privacy and accuracy of consumer reports. Research suggests that there’s a significant error rate in consumer reports and MVRs aren’t immune from mistakes. So if the agency sends the Commercial client/employer wrong information, and the consumer/employee gets fired, or not hired, the agency could easily face litigation, with little defense.
In fact, most third-party providers require that an agency hold them harmless as a condition of doing business with the agency — so the agency would probably not be able to blame the third-party provider for supplying incorrect information (most third-party providers don’t permit the practice in the first place).
But even if the information is accurate, the strict guidelines also protect consumer privacy. Access to a consumer’s private information is restricted to very specific situations, such as credit, insurance underwriting, employment, and a few other circumstances permitted under the FCRA.
Whether or not the agency’s E&O carrier will defend it varies with each situation. However, some E&O carriers have indicated that although the mishandling of a consumer report/MVR that takes place during insurance underwriting is within the scope of an agency’s operations, providing MVRs to others for employment or other uses is not a part of an agency’s normal operations, and thus might not be covered by the E&O policy.
Although this article focuses on Commercial Lines situations, an agency should exercise equal care in handling Personal Lines MVRs. Several recent cases illustrate the need for caution.
In one case, a client was having a custody fight with her ex-husband. He routinely showed up drunk when picking up their kids for the weekend. Fearing for her children’s safety, the woman mentioned her concerns to the CSR handling her Personal Auto insurance. The woman said that if she could show the court that her ex-husband was putting the kids at risk because of his drinking, she might be able to prevent him from taking them in his car unsupervised.
The CSR said she would see if the ex-husband had any drunk driving convictions on his MVR. The MVR did indeed have several DUI arrests and convictions, and the woman gave the court a copy of his MVR, which she had obtained from the CSR. The ex-husband was incensed, and successfully sued the agency for violations under the FCRA, winning a judgment of more than $200,000.
The bottom line: develop written procedures for the handling of all private information, add these procedures to the agency’s manual, and train all agency staff on guidelines for handling all forms of protected information.
The Federal Trade Commission, which regulates the FCRA, has excellent information on its Web site. Check out the brochures 'What Every Employer Should Know' — which deals with employment and 'What Every Insurer Should Know' — which discuses the FCRA and the insurance industry.
The FTC Web site also offers a 'Summary of Consumer Rights' and 'Notice of User Responsibilities,' together with a number of related documents.
UPDATE
To illustrate the prevalence of these privacy concerns, here’s an 'Ask an Expert' question we received, followed by four responses from IIAA Virtual University Faculty members:
'I currently insure a very large trucking company (sand and gravel) that requires all job applicants to provide a current Motor Vehicle Report before being considered for hire.
'Recently an individual applying for a driving position completed an employment application and provided a copy of a newly issued MVR from Nevada, the state where our client is located. (The employee moved here from California, where he had several tickets.) Since he was a new Nevada resident, his citations from California didn’t appear on the MVR he provided. The Nevada MVR indicated he had no citations.
'He was hired as a truck driver by the client. I reported the new driver to our carrier, who ran an MVR. Enough time had passed that the new Nevada MVR indicated the driver had five citations, which prompted the carrier to send me a driver exclusion, indicating that if the client did not sign the exclusion, they would cancel his policy. (They did not provide me, the agent, with the MVR, stating that possible problems could result due to the Privacy Act). I delivered the exclusion to the client, who, fearful that his insurance would be in jeopardy, immediately terminated the employee due to his MVR. (He was hired to drive and could no longer do so, according to the insurance company.)
'The employee consulted with an attorney and is now suing the employer for wrongful termination. Additionally, as the agent who delivered the exclusion, they intend to include me in the suit, indicating I violated his privacy.
'I did not order his MVR — the carrier did. Furthermore, the employer requested a copy and the client provided one that was inaccurate. When the actual MVR arrived, the employee was no longer qualified for the driving position, nor would he have been, had he provided a California MVR. He was terminated due to the company’s exclusion and his driving record.'
Although we can’t provide any legal advice, we can make some observations based on the insurance aspects of the claim and the use of MVRs under the FCRA. Obviously, all the parties need sound legal counsel. With that disclaimer in mind, here are observations from four faculty members that might help. If you have further questions, please let me know'
FACULTY RESPONSE NO. 1
As you pointed out, this seems to be a legal issue. Since the agent indicates he is being sued, my suggestion is that he immediately refer this to his E&O carrier and attorney. That being said, here’s a little background on the issue of terminating someone due to an MVR.
The Fair Credit Reporting Act (FCRA) classifies an MVR as a 'consumer report.' The Act states that if an employer refuses to hire someone, does not promote someone, or terminates someone based partially of wholly on information contained in a 'consumer report' then that employee has suffered 'adverse action' and certain notices must be provided to the employee. The Act says that the employer has the right to obtain the MVR (consumer report) on an employee to be used in an employment decision, but only after the employee has signed a disclosure approving this action. The disclosure must be a completely separate document and may not be a part of the application for employment.
The question that I’m not clear on is, 'Did the employer ever see, or have discussed with them, the actual MVR itself, or was the decision to terminate made based solely on an insurance endorsement?' I think there’s a difference, because an insurance policy or endorsement is not a 'consumer report' as defined by the FCRA. If the employer never saw the MVR and never had the agent or company discuss the contents of the report, then proving a violation of FCRA seems more difficult than if the employer saw or discussed the contents of the MVR.
In my opinion, if the agent didn’t provide a copy of the MVR or discuss its contents, but simply told the client something like, 'From an insurance underwriting standpoint, this driver isn’t acceptable to the company' then he’s done all he could have to avoid a FCRA problem.
But none of that matters since it appears he might already have been sued. This calls for the advice of his attorney.
FACULTY RESPONSE NO. 2
First, the employer should have permission of the employee before acquiring a MVR. Under Texas law, for example, the employer must check the record of regular operators. However, federal law requires permission to pull that record. This permission should be granted as part of the application process, and the job offer should make it clear that hiring is contingent on a clean driving record (if the client doesn’t know what 'clean' means, he should talk to the insurance company underwriter and put those specifics in his job offer). I assume that this documentation is not in place. If it were, I doubt if the attorney would have taken the case.
The company has a right to an MVR for underwriting purposes. Since this is a Commercial account, the Gramm-Leach-Bliley Act provisions don’t apply and no notice is required. The agent did nothing wrong here and should be dropped from the suit once the facts are known.
FACULTY RESPONSE NO. 3
This is a perfect example of why agents should never provide MVRs to employers who are their Commercial clients. Luckily, this agent did not, so I don’t see any violations of the Fair Credit Reporting Act (FCRA) on his part. The employer, however, is probably going to have a problem.
Under the FCRA, any employer who uses any 'consumer report' (which includes MVRs) must provide certain written notices to the employee if that employer takes any 'adverse action' against that employee based in whole or in part on any information in any consumer report.
I’d suggest that the agent and employer read IIABA special report on the FCRA, posted on the IIABA Web site.
Since this risk appears to be some sort of trucking firm, there are slightly modified rules that might apply, in terms of getting written permission before obtaining an MVR for employment. However, even these firms must provide notice of 'adverse action' to the employee.
Another wrinkle is that although the MVR was originally used for insurance underwriting, because the employee was fired, it might have ended up being used for employment. This is another reason that agents should never furnish MVRs. I believe they can tell an employer that a driver doesn’t qualify for underwriting, and will be excluded from the Auto policy. However, they should probably avoid telling the employer exactly what’s on the MVR, due to privacy regulations.
For example, suppose the situation described here happened in reverse: although the MVR showed five violations, it was actually incorrect, and the driver had a clean record. If the agent had provided this information, and the employer had fired the employee based on it, both the employer and the agent could be in trouble.
Many agents routinely provide MVRs to Commercial clients on drivers/employees, and in effect, are acting as an employee screening service for employers. Agents need to tell employers to do their own employee screening, by using one of the many firms that do this work.
An agent telling an employer that an employee doesn’t qualify for underwriting, without providing any specific information, is probably OK under FCRA. But divulging anything else, either verbally or by faxing over the MVR, is dangerous.
Also, most third-party providers of MVRs and other consumer reports such as insurance scores, absolutely prohibit sharing this information. It’s in the contract the agency signed with the provider, although it’s often innocently titled 'Point of Sale Agreement,' or 'Agreement for Service.' Agents need to read the fine print: they can’t share the information they receive from the vendors, and are usually required to hold them harmless.
Employers need to understand the FCRA requirements placed on them. Agents need to review their procedures, and revise their employee manuals to set strict guidelines on the use and dissemination of consumer information.
There have been a number of lawsuits against insurance agencies, credit unions, etc., in which an employee pulled the credit report MVR, etc. on an ex-spouse, boyfriend/girlfriend, etc. Both the employee and the business get sued. That’s why attorneys recommend that agencies develop written guidelines restricting the use of private information. It’s a scary world, and people freak out about misuse of their private information.
FACULTY RESPONSE NO. 4
This is always a sticky wicket. Although I’m not an attorney, I believe that, in the absence of any employment statements, a new employee is subject to a 90-day probation period, unless benefits are granted within that period. This means the employer has 90 days to evaluate the employee and terminate them. What’s more, the applicant gave false information by not disclosing the additional violations that hadn’t hit his MVR yet.
If the agent disclosed to the employer that the employee had five violations, he could be in violation of FCRA. We tell our agents that the only thing they can tell Commercial clients is, 'I’m sorry, but this employee doesn’t qualify due to eligibility reasons.' We don’t allow them to disclose anything on the MVR, not even the number of violations.