Back in October, the FTC announced with great fanfare a delay until May 1, 2009 for enforcing the FACTA Red Flag rules. Those rules require financial institutions and creditors to establish written programs for identifying, detecting, and responding to patterns, practices, or specific activities that are warning signs of identity theft. In contrast, the infrequently discussed Address Discrepancy rules that were issued at the same time as the Red Flag rules quietly went into effect as originally scheduled on November 1, 2008. The Address Discrepancy rules, found at 16 C.F.R. §681.1, apply not only to financial institutions and creditors but, potentially, to all employers that use consumer reporting agencies to conduct background checks on applicants and employees.
In a nutshell, the Address Discrepancy rules require the nationwide consumer reporting agencies (CRA) — Experian, Equifax and Trans Union — to provide users of consumer reports (including employers) with a notice of address discrepancy when there is a "substantial difference" between the address the agency has on file for a consumer and the address provided by the employer when requesting the report. The regulation also requires users of consumer reports (including employers doing background checks on applicants) to establish policies that permit them to form a reasonable belief as to whether addresses provided by applicants are correct and to notify the CRA when they have confirmed applicant addresses.
Though most employers do not obtain consumer reports directly from the nationwide CRAs, many of the CRA’s that resell nationwide CRA reports appear to be forwarding the nationwide CRA’s notices of address discrepancy to employers. In those cases, employers would be wise to ensure that they are creating and following policies to confirm the addresses of those individuals for whom they obtain consumer reports. Address verification will not only confirm for the employer that it is hiring who it thinks it is hiring, but will also allow job-hunting victims of identity theft to avoid issues frequently encountered when background checks return erroneous negative information about them.
The Address Discrepancy rules provide specific guidelines to enable an employer to establish practices that will permit it to form a reasonable belief as to whether a consumer report relates to the person on whom the report was obtained. Those rules also provide criteria for when employers have an obligation to provide confirmed addresses to the nationwide CRA.
FACTA authorizes the FTC to file a civil action in federal district court to enforce these rules and to obtain statutory damages on behalf of injured consumers, including punitive damages for willful violations. In addition, state attorneys general are also authorized to enforce these actions and obtain statutory damages up to $1,000 per violation.