Employers’ use of AI requires them to pay attention to the harvesting methods they use to gather information in recruiting, hiring, and managing employees. Third-party vendors who process this information must also reevaluate their role in using AI tools to generate and process information that impacts an employer’s hiring decisions.
The labor and employment attorneys at MehaffyWeber offer experienced guidance on FCRA obligations employers and vendors have when using AI tools. Our Texas labor and employment lawyers have experience in state and federal courts, providing local, state, and regional counsel.
Clarification on Compliance When Using AI Tools
Recently, the Consumer Financial Protection Bureau (CFPB) has provided information on how technology vendors may be responsible for compliance with the Fair Credit Reporting Act (FCRA) when utilizing AI tools to gather personal information for employers. The CFPB clarifies what qualifies vendors as a Consumer Reporting Agency (CRA) and what that obligates employers to do before obtaining AI-generated information.
The most recent guidance on employers using AI-driven vendor services reminds employers that if vendors assemble or evaluate consumer information to use for employment purposes, then a vendor may fall under the guidelines of a CRA. The data analyzed by an AI tool to determine employability is equivalent to the information employers traditionally use in background checks, which must meet FCRA obligations. Using AI tools under the same legal parameters as other consumer reports is necessary to strive for accuracy, equity, and appropriate handling of data.
AI Tools and Data Used By Employers
Employers using AI tools may be obligated to comply with the FCRA when monitoring or assessing the following employee actions:
- Documenting how long workers take to finish tasks
- Evaluating a worker’s sales interactions
- Documenting the number of messages sent by an employee
- Monitoring the meetings they attend and meeting duration
- Tracking driving habits
- Documenting an employee’s time use off-task by monitoring web browsing and keystroke frequency
- Analyzing employee risk to an employer, such as the likelihood to engage in union organizing or to terminate employment
The FCRA obligates employers to take specific steps before obtaining a consumer report and adversely acting against an employee based on AI-generated data.
Actions Prompting FCRA Compliance
Even when information collected by vendors funnels through a closed loop and siphons directly to an employer requesting data, the information collected may qualify vendors as a consumer reporting agency. Employers using AI-generated information should be aware of these actions in gathering information that requires them to meet FCRA obligations:
- The use of collected or assembled data by a vendor that an employer will use to evaluate an employee and to determine employment decisions
- Making decisions to reject, promote, or assess employees or job applicants based on collected vendor data
- Including information such as consumer-related data, credit histories, or criminal records in analyses that AI performs
Employers who fail to recognize these triggers when using AI tools to hire and meet FCRA obligations may be subject to violations.
An Employer’s Obligations Before Obtaining a Consumer Report
Under the FCRA, an employer must take these actions:
- Inform an applicant or employee in writing in a stand-alone document that they may obtain and use a consumer report’s information to make decisions about their employability.
- Obtain written permission to use the information compiled in a consumer report.
- Certify the purpose of gathering the information with the vendor compiling the data.
An employer must also certify the following with the vendor:
- The applicant or employee has been informed about obtaining a consumer report and has given their permission to get the report.
- They will meet compliance with notice obligations for pre-adverse and adverse actions when the FCRA requires it.
- They will meet federal and state equal opportunity requirements and not misuse information or discriminate against an employee or applicant based on information gathered in a consumer report.
Employers using the information in a consumer report must meet additional obligations before taking adverse action against an applicant or employee.
Employer Obligations Before Taking an Adverse Action
Employers must give a pre-adverse action notice, including a copy of the consumer report triggering the action, before taking any of the following actions:
- Rejecting a job application
- Reassigning an employee
- Withdrawing conditional offers
- Taking other adverse actions against an employee or applicant based on a consumer report generated by a vendor
They must also provide a copy of the Summary of Rights Under the FCRA. Giving notice allows the impacted applicant or employee to review a consumer report and provide additional information they deem vital to an employer’s decision or to challenge a report’s accuracy.
Employer Obligations When Taking an Adverse Action
Employers must notify individuals of the actions they will take against them either verbally, in writing, or electronically. The notification should provide information about their rights to review the information and to correct inaccurate documentation. The FCRA outlines information an employer must include in a notice of an adverse action.
Consumer Reporting Agency Obligations Under the FCRA
Vendors using AI tools who qualify as consumer reporting agencies must meet the following FCRA obligations:
- Refrain from reporting outdated, harmful data, generally more than seven years old, or bankruptcies occurring more than ten years ago.
- Maintain procedures to strive for accuracy in data compiled in consumer reports.
- Respond to file disclosure requests, identifying anyone obtaining a report within the preceding two years who use the report for employment purposes.
- Reinvestigate disputed information.
- Only share reports for FCRA-permissible purposes.
- Obtain certifications from entities using the reports they generate.
As a vendor using AI tools to generate consumer reports, you are likely subject to additional obligations. Evaluating your services can identify whether you qualify as a consumer reporting agency and will enable you to meet your obligations under the FCRA. Vendors must also identify state laws and local ordinances that apply.
Discuss Your FCRA Obligations as an Employer or Vendor With a Texas Labor and Employment Attorney
Staying current with FCRA obligations requires employers and vendors to audit their current practices using AI tools, understand the products used in data gathering, and update their procedures. Vendors may have additional obligations and must first know if they qualify as a consumer reporting agency.
The team at MehaffyWeber possesses the tools to provide professional workplace training to ensure your business meets FCRA obligations. Contact us today at one of our Texas locations.