Commercial insureds, especially those which hire drivers, often ask their insurance agent to furnish them with copies of MVRs on current or prospective employees. Under the federal Fair Credit Reporting Act (FCRA), there are strict guidelines governing the release of such information, and potentially serious penalties for violations.

In addition to federal penalties, agencies can face lawsuits from people whose MVRs they furnished to the commercial insured. Agencies must therefore be aware of requirements of the FCRA, and take appropriate precautions when handling requests for MVRs from commercial insureds.

The FCRA was originally passed in 1970, and amended several times since, primarily for the dual purposes of protecting the privacy and accuracy of certain defined “consumer reports,” which includes MVRs, and a wide variety of other information, such as credit reports, credit scores, etc. To that end, the FCRA: (1) restricts access and use of consumer reports; (2) requires certain prescribed disclosures; (3) requires the written permission of the consumer under certain circumstances; (4) provides a process for the consumer to dispute inaccurate information; and (5) provides for both civil and criminal penalties for noncompliance.

When any consumer report, including an MVR, is used for employment, the FCRA requires that the consumer (i.e., the employee or prospective employee in this case) must first grant written permission before a Consumer Reporting Agency (CRA), such as Equifax, Experian, Trans Union, etc., can release the information.

The next step required under the FCRA is for the consumer (employee) to receive from the CRA a federally prescribed document titled “Summary of Consumer Rights.” This document must be provided to each consumer (employee) anytime a consumer report/MVR is used in connection with employment.

In the event a consumer (employee) receives any “adverse action” (not hired, not promoted, fired, etc.) as a result of information contained in any consumer report (including an MVR), the FCRA requires that the consumer (employee) be given a “Notice of Adverse Action” by the employer.

Another duty of a CRA is to provide to the employer a copy of the federally prescribed document “Summary of User Responsibilities.” This document need only be provided once by a CRA to an entity requesting a consumer report/MVR (an employer, for example). Every employer who uses consumer reports/MVRs as a part of their employment screening process should carefully read this document.

Records must be maintained for two years.

If an insurance agency provides consumer reports/MVRs to commercial insureds for employment purposes, most authorities agree that the agency is functioning as a Consumer Reporting Agency, and must follow all the steps required of a CRA outlined above. Thus, while it can be “legal” for an insurance agency to provide MVRs to commercial insureds, the agency must understand and adhere to all the strict procedures required of a Consumer Reporting Agency. The agency is effectively acting as an employee screening service, not simply “underwriting insurance.”

Violations of the FCRA fall into two categories: (1) negligent noncompliance, and (2) willful noncompliance.

The penalties for negligent noncompliance include actual damages awarded by the court, attorney’s fees, and court costs.

The penalties for willful noncompliance, the more serious violation, include not only all three penalties assessed under negligent noncompliance, but can also include punitive damages, a fine from the Federal Trade Commission (FTC), and up to two years in prison.

Outside the myriad requirements of the FCRA, there are other restraints and concerns the agency must be aware of. First, most third-party providers of MVRs (such as ChoicePoint, etc.) strictly and expressly prohibit the agency from furnishing the MVRs to anyone other than the consumer. It is very important to note that while an agency may legally furnish MVRs to commercial insureds, provided that the agency follow all guidelines required under the FCRA, most third-party providers from whom the agency routinely obtains MVRs absolutely prohibit such practice.

A second concern agencies must be aware of is that many insurers also prohibit disclosure of MVRs to anyone other than the subject of the MVR.

A third concern is that agencies can be, and indeed some have been, sued by consumers when their protected, personal information has been furnished to others without their permission or knowledge.

While the FCRA requires that a consumer give written permission before a CRA can release any consumer report, including MVRs, that will be used for employment, there is no requirement for written permission if the purpose of the consumer report/MVR is for insurance underwriting. And herein lies a serious trap for agencies. When a commercial insured calls the agency and asks that an MVR be run on an employee/prospective employee, especially those that will be driving, the agency can do so via computer in a matter of minutes. Agencies obviously pull MVRs for insurance underwriting many times each day.

However, if the agency then sends the MVR to the commercial insured, that probably goes beyond the bounds of “insurance underwriting.” In fact, most authorities agree that the agency is now acting as a Consumer Reporting Agency, by supplying a consumer report that will be used for employment. And, immediately, the agency has a potential legal problem since they in all likelihood don’t have the consumer’s written permission. In addition, as stated above, even obtaining written permission of the consumer is not the only requirement the agency must now meet if it provides MVRs to commercial insureds. Recall also that such practice is probably prohibited by the third-party provider from whom the agency obtained the MVR, as well as by many insurers, perhaps including the one writing the commercial auto insurance for this commercial insured.

In an attempt to side-step the FCRA requirements, some agencies might consider simply telling the manager or supervisor of the commercial lines insured what is on the MVR, without actually sending them a copy. Most authorities believe that this probably does not relieve the agency from meeting all its responsibilities under the FCRA, and could make the agency a target for litigation by the consumer for violation of privacy.

On the other hand, in cases where drivers will be excluded by the commercial auto insurer because of their MVR, informing the commercial insured of that fact, without revealing any specifics, probably still falls under “insurance underwriting.”

In cases where a commercial insured insists on finding out the specifics of why a driver will be excluded, the safest practice for the agency is to suggest that the employer obtain the MVR, and any other background information legally available, on their own. This can easily be done by the employer contacting any of the dozens of employee screening companies that provide this information for a fee.

It is vitally important that all agency staff which handle MVRs be informed about the distinction between using consumer reports/MVRs for insurance underwriting vs. employment.

While these strict guidelines and complicated procedures might seem unduly burdensome at first, keep in mind that the overall purpose of the FCRA is to protect the privacy and accuracy of consumer reports. Research suggests that there is a significant error rate found in consumer reports, and MVRs are not immune from mistakes. So if the agency sends the commercial insured/employer wrong information, and the consumer/employee gets fired, or not hired, the agency could well face litigation, with little defense.

In fact, most third-party providers require that an agency hold them harmless as a condition of doing business with the agency, so the agency would probably not be able to blame the third-party provider for supplying incorrect information. (In addition to which most third-party providers don’t permit the practice in the first place.)

But even if the information is accurate, the strict guidelines are also to protect a consumer’s privacy. Access to a consumer’s private information is restricted to very specific situations, such as credit, insurance underwriting, employment, and a few other circumstances permitted under the FCRA.

Whether or not the agency’s E&O carrier will defend the agency varies with each situation. However, some E&O carriers have indicated that while the mishandling of a consumer report/MVR that takes place during insurance underwriting is within the scope of an agency’s operations, providing MVRs to others for employment or other uses is not a part of an agency’s normal operations, and thus might not be covered by the E&O policy.

While the focus of this article deals with commercial lines situations, an agency must exercise equal care in how MVRs are handled in personal lines situations. Several cases have been reported recently which illustrate the need for clear guidelines in the use of MVRs in personal lines.

In one case, an insured was having a custody fight with her ex-husband. He routinely showed up drunk when picking up the kids for the weekend. Fearing for her kids’ safety, the woman mentioned this to the CSR handling her personal auto insurance. The woman said if she could show the court that her ex-husband was putting the kids at risk because of his drinking, she might be able to prevent him from taking them in his car unsupervised.

The CSR said she would see if the ex-husband had any drunk driving convictions on his MVR. The MVR did indeed have several drunk driving arrests and convictions, and the woman gave the court a copy of his MVR, which she had obtained from the CSR. The ex-husband was incensed, and successfully sued the agency for violations under the FCRA, winning a judgment of over $200,000.

Clearly, agencies should develop written procedures for the handling of all private information. It is recommended that the agency put these procedures into the agency’s procedures manual, and train all agency staff about the proper guidelines on handling all forms of protected information.

The Federal Trade Commission (FTC), which regulates the FCRA, has excellent information on its website. Of particular note are two brochures – one deals with employment and the FCRA (“What Every Employer Should Know”), and the other with insurance and the FCRA (“What Every Insurer Should Know”).

In addition, the two required documents referenced above are available at the FTC website. The documents are the “Summary of Consumer Rights” and “Notice of User Responsibilities.” Many other related documents are available at the FTC web site.

Copyright 2002 by the IIA of Louisiana. Used with permission.

Update...

To illustrate the possible prevalence of these circumstances, below is an "Ask an Expert" question we received and some faculty responses.

"I currently insure a very large trucking company (sand and gravel) that requires all job applicants to provide a current Motor Vehicle Report prior to being considered for hire.

"Recently an individual applying for a driving position completed an employment application and provided a copy of a newly issued Nevada MVR, the state our insured is located. (The employee moved here from California, where he had several tickets.) Since he was a new Nevada resident, his citations from California did not appear on the MVR he provided. The Nevada MVR indicated he had no citations.

"He was hired as a truck driver by the insured. I reported the new driver to our carrier, who ran an MVR. Enough time had passed that the new Nevada MVR indicated the driver had 5 citations, which prompted the carrier to send me a driver exclusion, indicating that if the insured did not sign the exclusion, they would cancel his policy. (They did not provide me, the agent, with the MVR, stating possible problems could result due to the Privacy Act). I delivered the exclusion to the insured, who, fearful that his insurance would be in jeopardy, immediately terminated the employee due to his MVR. (He was hired to drive and could no longer, per the insurance company.)

"The employee consulted with an attorney and is now suing the employer for wrongful termination. Additionally, as the agent that delivered the exclusion, they intend to include me in the suit, indicating I violated his privacy.

"I did not order his MVR, the carrier did. Furthermore, the employer requested a copy and the insured provided one, which was incorrect. When the actual MVR arrived, he no longer was qualified for the driving position, nor would he have been, had he provided a California MVR. He was terminated due to the companies exclusion and his driving record."

First of all, and needless to say, we can't provide any legal advice, but we can makes some observations based on the insurance aspects of the claim and the use of MVRs under the FCRA. Obviously, all parties concerned here need sound legal counsel. With that "disclaimer" in mind, below are some observations of our faculty that might help. If you have further questions, let me know.

As you pointed out, this seems to be a legal issue. Since the agent indicates he is being sued, my suggestion is that he IMMEDIATELY refer this to his E&O carrier and attorney. That being said here is a little background on the whole issue of terminating someone due to an MVR.

The Fair Credit Reporting Act (FCRA) classifies an MVR as a "consumer report." The Act states that if an employer refuses to hire someone, does not promote someone, or terminates someone based partially of wholly on information contained in a "consumer report" then that employee has suffered "adverse action" and certain notices must be provided to the employee. The Act says that the employer has the right to obtain the MVR (consumer report) on an employee to be used in an employment decision, but only after the employee has signed a disclosure approving such. The disclosure must be a completely separate document and may not be a part of the application for employment.

The question that I am not clear on is, "Did the employer ever see, or have discussed with them, the actual MVR itself, or was the decision to terminate made based solely on an insurance endorsement?" I think there is a difference because an insurance policy or endorsement is not a "consumer report" as defined by the FCRA. If the employer never saw the MVR and never had the agent or company discuss the contents of the MVR then proving a violation of FCRA seems more difficult than if the employer has seen or discussed the contents of the MVR.

To my simple mind, if the agent did not provide a copy of the MVR, did not discuss the contents of the MVR, and simply told the insured something like, "From an insurance underwriting standpoint this driver isn't acceptable to the company" then he has done all he could have done to avoid a FCRA problem.

But none of that may matter since it appears he may already have been sued. This calls for advice of his attorney.

First, the employer should have permission of the employee before acquiring a MVR. Under Texas law, as an example, the employer must check the record of regular operators, but federal law requires permission to pull that record. This permission should be granted as part of the application process, and the job offer should make it clear that hiring is contingent upon a "clean" driving record (if the insured doesn't know what "clean" means, he should talk to the insurance company underwriter and put those specifics in his job offer). I assume that this documentation is not in place. If it were, I doubt the attorney would have taken the case.

The company has a right to an MVR for underwriting purposes. Since this is a commercial account, GLBA does not apply and no notice is required. The agent did nothing wrong here and should be dropped from the suit once the facts are known.

I think the attorney might be trying to weasel some money out of the employer. Things must be slow in Nevada if keeping an allegedly dangerous driver off the road is grounds for a wrongful termination claim.

A perfect example of why agents should NEVER provide MVRs to employers who are their commercial insureds. Luckily, this agent did not, so I don't see any violations of the Fair Credit Reporting Act (FCRA) on his part. The employer, however, probably is going to have a problem.

Under the FCRA, any employer who uses any "consumer report" (which includes MVRs) must provide certain written notices to the employee if that employer takes any "adverse action" against that employee based in whole or in part on any information in any "consumer report."

Suggest the agent and employer read IIABA's special report on the FCRA, posted on the IIABA web site. Also, the FTC, which regulates the FCRA, has an excellent brochure on their web site, called, "What Every Employer Needs to Know."

Since this risk appears to be some sort of trucking firm, there are slightly modified rules that could apply, in terms of getting written permission prior to obtaining an MVR for employment. However, even these firms must provide notice of "adverse action" to the employee.

One other wrinkle is that the MVR was originally used for insurance underwriting, but since the employee was fired, it may have ended up being used for employment. Another reason agents should never furnish MVRs. I believe they can tell an employer that a driver doesn't qualify for underwriting, and will be excluded from the auto policy. However, they should probably avoid telling the employer exactly what is on the MVR, due to privacy.

As an example, suppose the situation described here happened in reverse. Suppose the MVR showed 5 violations, but it was actually incorrect, and the driving record was clean. If the agent had provided that information, and the employer had fired the employee based on that erroneous information, the employer and agent could be in trouble.

Many agents routinely provide MVRs to commercial insureds on drivers/employees, and in effect, are acting as an employee screening service for employers. Agents need to tell employers to do their OWN employee screening, by using one of the many firms that do this work.

I believe that an agent's telling an employer that an employee does not qualify for underwriting, with no other information being provided, is probably OK under FCRA. But divulging anything else, either verbally, or by faxing over the MVR, is dangerous.

Also, most third-party providers of MVRs and other consumer reports such as insurance scores, absolutely prohibit the sharing of this information. It's in the contract the agency signed with the provider, although it's often innocently titled "Point of Sale Agreement," or "Agreement for Service" when the agents "signs up" to use the service. But agents need to read the fine print. They cannot share the information, and are usually required to hold the third party vendor harmless.

Employers need to understand the FCRA's requirements placed on employers. Agents need to review their procedures, and revise their employee manuals to lay down strict guidelines on the use and dissemination of private information.

There have been a number of lawsuits against insurance agencies, credit unions, etc., where an employee pulled the credit, or MVR, etc. on an ex-spouse, boyfriend/girlfriend, etc. Both the employee and the business get sued. That's why attorneys recommend that agencies develop a written procedure and guideline restricting the use of private information. It's a scary world, and people freak out about misuse of their private information.

Hopefully the agency agreement with the carrier agrees to defend the agent against FCRA issues like this...many do.

This is always a sticky-wicket. Not being an attorney, be advised that my opinions are just that, opinions. I believe that, in absence of any employment statements, a new employee is subject to a 90 day probation period, unless benefits are granted within that time period. That being the case the employer can have 90 days to evaluate the employee and terminate for any reason other than the usual discrimination type reasons. In addition, the applicant gave false information by not disclosing the additional violations that had not hit his MVR yet.

As far as the agent goes, if he disclosed to the employer that the employee had 5 violations, then he could be in violation of FCRA. We tell our agents that the only thing the can say is "I'm sorry, but this employee does not qualify due to eligibility reasons" and not to disclose anything that is on the MVR, not even the number of violations.