Frequently, a business that is considering extending credit to a closely held corporation will want to run a credit check on related individuals such as the business owner or a guarantor. The mere fact that a business is the source that initially requested credit is no exception to compliance with FCRA’s requirements when the credit report of an individual is pulled. Consider these examples of situations that can expose a business to claims of a FCRA violation:

• Pulling the credit report on an officer of a corporation when the corporation has applied for credit or on an individual partner of a partnership when the partnership has applied for credit. Written authorization from the individual or another permissible purpose under FCRA is required.

• Pulling the credit report of the spouse of an applicant for credit, insurance or employment. Generally, FCRA does not authorize pulling a spouse’s report unless the spouse will be liable on a credit account.

• Taking a copy of an individual’s credit report that was pulled for a permissible purpose and using it later for an impermissible purpose (such as to identify new marketing opportunities or offer unrelated products or services), or sharing it with someone who does not have a permissible purpose.

• Pulling the credit report of an individual to get information useful to potential or ongoing litigation. FCRA does not list litigation as a permissible purpose for obtaining or using a credit report. Therefore, unless the litigation is of such a nature that one of the enumerated purposes under FCRA applies, it is generally impermissible to pull a credit report for use in litigation. 

Because credit reports contain confidential information about an individual’s credit history, FCRA only allows an individual’s credit report to be released for certain purposes. Whether obtaining a credit report from one of the “Big Three” nationwide agencies (Equifax, Experian and Trans Union) or a different agency or bureau, FCRA requires that you certify the purpose for which the report is being obtained and that the report will not be used for any other purpose. Some of the permissible purposes for obtaining a consumer credit report under FCRA include:

• As instructed by the individual in writing (e.g., a dated, written authorization designating who is to send and receive the credit report). Such a written instruction is always sufficient to create a permissible purpose, and is sometimes the only method of pulling a credit report in compliance with FCRA when no other permissible purpose exists. However, if a different FCRA enumerated permissible purpose applies, it is not always necessary to obtain written instructions from the individual.

• For the extension of credit as a result of an application from an individual or for review or collection of the individual’s account (e.g., “skip tracing”). 

• When there is a legitimate business need to review an individual’s existing account to determine whether he or she continues to meet the terms of the account or to evaluate the current credit risk. This purpose may apply to deposit or other non-credit accounts.

• For employment purposes, including hiring and promotion decisions, where the individual candidate has given prior written permission to obtain the report.

Having a permissible purpose is not necessary when pulling a credit report on the business entity itself. However, when a report on an individual business owner, proprietor, officer, partner, guarantor or spouse is desired in addition to the business report, a permissible purpose or written authorization is required. 

The prudent practice is to obtain an individual’s written authorization prior to pulling a credit report whenever possible, even if another permissible purpose exists under FCRA. Upon request, we will provide you with an authorization form that meets the requirements of FCRA. Obviously, obtaining such authorization is impractical for purposes such as collection of an existing credit account in default. In other situations, though, having a record evidencing the individual’s consent will be of tremendous benefit in defending against claims that there was no permissible purpose for pulling the report. 

When obtained, it is advisable to retain written authorizations for a period of five (5) years. The statute of limitations period for claims based on FCRA violations is two (2) years from the date of discovery of the violation, but in no event longer than five (5) years from the date of the violation.

Finally, FCRA was amended by the Fair and Accurate Credit Transactions Act of 2003. A key reason for the amendment was to protect consumers from identity theft. The amendment did not materially change the law regarding obtaining and using credit reports, but report users are well-advised to pay renewed attention to their procedures for ensuring that the individual for whom they seek to pull a credit report is, in fact, the same as the individual seeking credit.

Lisa Sumner is a Partner with our Bankruptcy and Creditors’ Rights practice group representing secured and unsecured creditors, creditors’ committees and debtors in business bankruptcy cases and negotiations regarding workouts. For further information or questions regarding compliance with the Fair Credit Reporting Act or related issues, please contact Lisa Sumner at 919.783.2869 or lsumner@poynerspruill.com.

This electronic publication is published by Poyner & Spruill LLP to provide general information about significant legal developments. Because the facts in each situation vary, the legal precedents noted herein may not be applicable to individual circumstances.