15 USC 1681-1681u

By Todd W. Grant and John A. Cook


In 1996, Congress amended the Fair Credit Reporting Act (FCRA), 15 USC 1681-1681u, with the Consumer Credit Reporting Reform Act of 1996. (1) These changes to the FCRA require an employer to follow procedures in situations that have nothing to do with "credit reports" as one typically thinks of them. The FCRA is implicated anytime an employer pays a fee to a third party to conduct pre-employment screenings or to investigate employees; for example, when an employer's agent (i) screens job candidates for theft and drug use, (ii) interviews candidates' references over the telephone, (iii) hires a forensic accountant to investigate a theft of company funds, or (iv) hires a private investigator to probe the background of a manager accused of sexually harassing an employee. Many employers rely on outside experts, such as investigators, headhunters, and outside counsel, to obtain information on prospective or current employees. Most would be surprised to find that the FCRA applies to such screenings and investigations when a fee is paid to the third party, which the FCRA calls a "consumer reporting agency" (CRA). Interpretations of the FCRA by the Federal Trade Commission's (FTC's) legal staff have employers and attorneys concerned that investigations of employee sexual harassment, drug problems, theft, and so on, may be hindered or compromised. (2) In many cases, reports cannot be redacted to protect the confidentiality of sources. (3) Prompt investigations are required by other federal laws, such as civil rights acts; yet the FCRA's requirements of advance notice, consent and giving copies of unredacted reports to the very employees who are the target of the investigations can make compliance with these laws difficult. How can an employer steer through these seemingly conflicting requirements and meet its need to hire the best employees it can? How can an attorney giving employment law advice or assisting in compliance planning protect his or her client?

All employers are covered.

No employer is exempt from the FCRA; an employer with a single employee is covered by the act. For example, "a homeowner who is considering hiring an individual to perform services for the homeowner is indeed required to comply with the FCRA when obtaining a 'consumer report' on that individual (which includes either a credit report or criminal background check ...) ... like any other employer." (4)


Because of its broad definitions, the FCRA governs an employer's actions in areas beyond what one would normally think of as credit background checks on potential employees. A "consumer" includes any individual, including one who is a job applicant or an employee.

The definition of "consumer report."

A "consumer report" includes much more than credit information. The term "consumer report" means:

... any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for... [among other things] employment purposes." (5)

An employer who utilizes a consumer report has certain legal obligations to notify an employee, to provide copies of the report, and to inform the employee of his or her legal rights to contest the report's findings. The term "employment purposes" is also broad and covers the hiring, promotion, reassignment, and retention of employees. (6)

The definition of an "investigative consumer report."

Any consumer report that involves, even in part, information about a consumer's "character, general reputation, personal characteristics, or mode of living ... obtained through personal interviews with neighbors, friends, or associates ... or with others with whom he is acquainted or who may have knowledge concerning any such items of information" becomes an "investigative consumer report" (emphasis added). (7) Such a report gives a consumer additional rights, (8) which are discussed below.

The definition of "consumer reporting agency" (CRA).

A CRA is "any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties [such as employers]." (9) Thus, any time an employer pays a third party for a personnel-related function, the FCRA may govern both the third party as a CRA and the employer. (10) "Assembling and evaluating" involves more than the mere receipt and retransmission of information. In the opinion of the FTC's legal staff, however, anything more than the mere receipt and transmission of information is enough to trigger the FCRA's provisions; simply reformatting information and deleting redundant information is included in the definition of "assembling and evaluating." For example, a CRA includes a business that uses a computer program to merge consumer information from the three main credit repositories - TransUnion, Equifax, and Experian - and then merely purges the duplicate information in order to produce a final consumer report. (11) If an intermediary contributes to (or takes any action that determines) the content of the information conveyed to an employer, we believe it is 'assembling or evaluating' the information and thus qualifies as a CRA." (12) As regards "regularly,"a single incident of "assembling and evaluating" consumer information and then sending it to a third party does not constitute "regularly" engaging, and will not make a person a CRA. See, Hodge v Texaco, Inc (drug rehabilitation counselor not a CRA when he recommended a testing laboratory for a second confirmatory drug test on a Texaco employee, forwarded the specimen, and received the results of the second drug test, because the FCRA exempts one whose activities might fall under the FCRA on a casual, one-time basis"). (13)

Are government agencies CRAs? Typically, they are not. Court decisions have held that the FBI is not a consumer reporting agency under the act. See, Ricci v Key Bancshares of Maine, Inc, (14) and Ollestad v Kelley. (15) The opinions of the FTC legal staff state the same conclusion: "In general, information that is obtained by an employer directly from a federal, state or county record repository is not a 'consumer report' because the repository (such as a courthouse or a state law enforcement agency) is not normally a 'consumer reporting agency' and is itself not covered by the FCRA." (16)

Are private firms that collect public government records CRAs? The use of private firms requires compliance with the act. A private firm that merely lists the criminal convictions of job candidates is a CRA under the act. (17)

Are employment agencies and headhunters CRAs? Employment agencies and headhunters are partially exempt from the FCRA. (18) Excluded from the definition of investigative consumer report (but not from the definition of consumer report) are communications made to an employer that would otherwise be an investigative consumer report, if it is made for the purposes of hiring, promotion, or reassignment, and if it is made by someone who regularly performs such work. (19)

Are attorneys CRAs? For an attorney, who is encompassed in the definition of a "person" under the act, to be a CRA under the FCRA he or she must regularly engage in the business of furnishing to third parties consumer credit information that he or she has assembled or evaluated. (20) Thus, if an attorney were merely to look at, place in an envelope, and forward to a client any published information he or she found on a consumer without editing, evaluating, or otherwise changing the content of the material, he or she would not be acting as a CRA. (21) In Ditty v CheckRite, Ltd, Inc, the makers of dishonored checks brought suit against a collection agency, its law firm, and a partner in the law firm. (22) The court held that the law firm was not a CRA under FCRA, because "[t]here is no evidence that the law firm was in the business of assembling or evaluating consumer credit information. Rather, ... the firm simply notified CheckRite that a particular account had been settled. Merely furnishing information about a particular debt does not draw ... [the law firm] ... within the definition of a 'consumer reporting agency.'" (23) Nor does acting "merely as a conduit for debt-related information" make a law firm a CRA. (24) In contrast, a business or an attorney whose agents go to courthouses and collect all relevant criminal record information on individuals and then format this information into a report that is sent to a customer does "assemble" consumer information and, in deciding which court files are relevant, probably "evaluates" such information, and is, therefore, a CRA. (25) An attorney would not be a CRA if he or she were to merely look at and report on published information, or simply guide his or her client in how to investigate the facts without actually writing a report on the facts for the client. Thus, if an attorney merely directs a client as to how to the client should itself conduct an investigation, neither the attorney's nor the client's actions would be required to comply with the FCRA. (26)


Step #1: An employer must get the written permission from the consumer before ordering a report.

Consumer report: Before an employer asks a CRA to get a consumer report or to prepare one, it must notify the consumer that it may ask for a report and get his or her written permission. Specifically, an employer may not get a consumer report unless:

(i) a clear and conspicuous disclosure has been made in writing to the consumer at any time before the report is procured or caused to be procured, in a document that consists solely of the disclosure, that a consumer report may be obtained for employment purposes; and

(ii) the consumer has authorized in writing (which authorization may be made on the document referred to in clause (i)) the procurement of the report by that person. (27)

Therefore, the written permission may not be part of an employment application or employee handbook. In addition, an employer must certify to a CRA that it has taken these steps. (28) There are also special procedures that allow the trucking industry to deal with applications for employment by mail, telephone, and computer. (29)

Investigative consumer report: If the consumer report will involve, even in small part, information about the consumer's "character, general reputation, personal characteristics, or mode of living ... obtained through personal interviews with neighbors, friends, or associates," (30) then in addition to all of the rights that a consumer has with respect to a "consumer report," an employer must within three days of asking the consumer's permission, give him or her (i) written advance notice of the type of information it wants to obtain, (ii) the FTC's summary of his or her rights as a consumer, (31) and (iii) a statement that he or she may request "a complete and accurate disclosure of the nature and scope of the investigation requested." Anytime an employer requests a CRA to interview a consumer's references about his or her character traits, honesty, and habits, such as possible drug use, it will need to comply with these additional requirements. (32) Then, upon the consumer's written affirmative reply to the above disclosure, an employer must provide a full description of the nature and scope of the investigation it is requesting within five calendar days of the later of either the date of the consumer's reply or the date of an employer's request for the report. (33)

Step #2: Before taking adverse action, such as denying a job position, promotion, or reassignment, an employer must give the consumer a pre-adverse action notice.

After an employer has a CRA's report, but before taking any adverse action based in whole or in part on the report, an employer must give the consumer (i) a pre-adverse action disclosure statement, stating that before any adverse action can be taken against him or her a copy of the report and a summary of rights under the law must be provided to him or her, (ii) a copy of the consumer report, and (iii) the FTC's summary of rights. (34) "Adverse action" includes not being selected for a job or being denied a promotion or reassignment. (35) (Since 1998, the trucking industry has not needed to provide pre-adverse action disclosure statements. (36))

Step #3: After taking adverse action, an employer must give the consumer a post-adverse action notice.

After an employer decides to take adverse action based on the report, then, within a reasonable period of time, it must, in written, electronic, or oral form, (i) tell the consumer of the adverse action; (ii) give him or her the CRA's name, address and phone number; (iii) tell him or her that the CRA simply supplied the report and cannot give the reasons for the adverse decision; (iv) tell him or her that he or she can get a free copy of the report from the CRA within the next sixty days; and (v) tell him or her that he or she has a right to dispute with the CRA the accuracy or completeness of the report. (37)


Checking a job applicant's references.

In general, anytime a third party checks a job applicant's references on behalf of an employer, such information will likely come under the definition of an investigative consumer report. The FTC legal staff considers that the following information in a consumer report, even if volunteered, turns the consumer report into an "investigative" consumer report: (i) a rating of the consumer's prior job performance, (ii) disciplinary actions or termination for cause, or (iii) opinions about whether the consumer had a drug habit. (38) Mere "fact-checking questions" such as dates of employment, titles and salary would not constitute an investigative consumer report. The FCRA does not distinguish between internal company records and records outside of an employer's offices, so that interviews of other company employees by an outside third party also constitute investigative consumer reports.

When performed by an employee of the employer. Where an employer has one of its own employees, such as a human resources specialist or a hiring manager, perform the investigating and interviewing of neighbors, previous supervisors, or acquaintances, then the information assembled and gathered is not under the definition of a consumer report, because an employer is not a CRA, and the FCRA is not implicated. (39) It is only when an employer uses a third party and pays money to this third party to handle the background check on a job applicant that the FCRA is triggered.

When performed by an employment agency. There is a special exemption for reference checks if performed by employment agencies or headhunters. (40) However, the consumer's written or oral permission is still required. Within five business days of the consumer's request, an employment agency or headhunter must disclose "the nature and substance of all the information in the consumer's file" except that the sources of the information may be kept confidential. (41)

Giving references about a former or current employee.

While many Michigan employers operate on a principle of responding to questions only with "yes, he or she worked here and here are the dates of employment," this approach is, arguably, too conservative. Employers giving references should not be fearful of running afoul of the FCRA. Excluded from the definition of consumer report are reports "containing information solely as to transactions or experiences between the consumer and the person making the report; (42) An employer who reports its own evaluations regarding its own experiences about a customer's buying habits, or about a current or former employee's work performance, character, and habits is not furnishing a consumer report and is not a CRA. See, DiGianni v Stern's (retail department stores who furnish consumer information to CRAs are not themselves CRAs). (43) In addition, to be a CRA, an employer must (i) regularly engage in gathering or evaluating information, (ii) for fees, (iii) and for the purpose of distributing this information to third parties, (iv) by means of interstate commerce. (44)

Even if an employer provides false information about a current or former employee, it is protected from defamation lawsuits.

Except as provided in sections 616 and 617 of this title, no consumer may bring any action or proceeding in the nature of defamation, invasion of privacy, or negligence with respect to the reporting of information against any consumer reporting agency, any user of information, or any person who furnishes information to consumer reporting agency ... except as to false information furnished with malice or willful intent to injure such consumer. (45)

A recent Michigan law, 1996 PA 90, effective February 27, 1996, provides Michigan employers with immunity from civil liability from defamation for good faith disclosures about a current or former employee's job performance. (46)

Performing drug tests on job applicants or on current employees.

In general. Drug tests and past and current drug usage may be within the purview of the FCRA. (47) Illegal drug usage certainly goes toward a prospective employer's assessment of a job applicant's reputation, personal character, and mode of living, or toward a current employee's fitness for a promotion or reassignment.

When an employer hires a drug testing laboratory. Excluded from the definition of a consumer report, however, is "any report containing information solely as to the transactions or experiences between the consumer and the person making the report." (48) Therefore, when an employer hires a drug testing laboratory to perform a test on a consumer, and the laboratory reports the results of its own testing directly to the employer, its report is not a consumer report, because the laboratory is reporting its own experience and application of scientific testing regarding the testing of the urine, blood, or hair sample.

When an employer hires a CRA or other intermediary to perform or report on a drug test. When a CRA reports the results of a test, such report falls within the definition of a consumer report. When a drug counselor or some other intermediary reports such information to an employer, whether or not the information is a consumer report depends upon whether the intermediary has "assembled or evaluated" the information, in which case the FCRA applies, or whether the intermediary has only acted as a passive collector of the sample or transmitter of the information, in which case the FCRA does not apply. (49)

An outside investigator is hired to assist an employer to investigate the sexual harassment of current employees.

The specific situation of an outside investigator (including outside legal counsel) being hired to assist an employer in a sexual harassment investigation of current employees was addressed in a recent FTC legal staff letter. (50) The information gathered in a sexual harassment investigation will go beyond a "consumer report" to become an "investigative consumer report," because the investigation will include information about employees character, general reputation, and personal characteristics obtained from interviews with fellow employees and associates. If an employer conducts the investigation using its own employees as investigators, then the FCRA is not implicated, because, as stated above, the information assembled and gathered is not under the definition of a consumer report. (51)

Protecting the confidentiality of sources.

Protecting the confidentiality of sources for an investigative consumer report may be important in order not only to obtain candid opinions in the first place but also to protect the sources from possible harassment or even physical danger in some situations. The FCRA requires that the full report be disclosed. (52) It is, however, possible for an employer to protect these sources by requesting that a CRA provide it with a report that does not specifically identity the sources for the information. The FCRA's only requirement is that the full report be disclosed. (53)

Legitimate purpose in requesting a consumer report.

An employer needs a legitimate purpose under the FCRA to request a consumer report, including using the information "for employment purposes" or for another "legitimate business need" as long as that need is "in connection with a business transaction that is initiated by the consumer." (54)


Damages for violation of the FCRA include (i) the consumer's actual damages for negligent violations or actual damages of up to $1,000 for willful violations, (ii) punitive damages for "willful"violations, (55) (iii) costs, and (iv) the consumer's attorney fees. (56) As a practical matter, an employer's biggest exposure for violation of the FCRA in most cases is going to be the payment of the plaintiff's "reasonable attorney fees." There is also no precise upper limit on punitive damages. While "[p]unitive damages are permitted even without malice or evil motive, ... they must be realistic rather than fanciful." (57) Jurisdiction is proper in federal court, and lawsuits may be brought by the consumer or the FTC. (58) The defendant may win attorney fees if a court determines that the lawsuit was brought in bad faith or for purposes of harassment. (59)

Attorneys can be liable under the act for actual and punitive damages and for the plaintiff's reasonable attorney fees. (60) Requesting a report from a CRA in knowing violation of the act and under false pretenses, such as misstating the real purpose for the request or misstating the intended use of the consumer report, subjects the requestor to criminal penalties. (61)


Todd W. Grant and John A. Cook are an associate and a partner, respectively, in the law firm of Cook, Goetz, Rogers & Lukey, P.C. The law firm specializes in the field of health care law and related business, litigation, labor, and tax matters.


1. Public Law 104-208, 110 Stat, 3009-426 (Sept 30, 1996).

2. FTC staff opinions are persuasive authority, and function as a replacement for regulations In a staff attorney letter, the FTC noted that it "does not have the authority to issue substantive regulations implementing the amended FCRA,"and instead is issuing "staff opinions" to assist in the interpretation of the act. Letter from Thomas Kane, FTC staff attorney, to Michael Cast (Oct 27,1997) p. 3. This and other staff attorney letters have a standard disclaimer at the end, stating that "[t]he views set forth in this opinion are those of the staff, and are not binding on the Commission." Id. Nevertheless, while not binding, the opinions would be persuasive authority in court. Staff letters are available on the World Wide Web at

3. FCRA 604(b)(3)(A); 15 USC 1681b(b)(3)(A); letter from William Haynes, FTC staff attorney, to Douglas Hahn (July 8, 1998).

4. Letter from Ronald Isaac, FTC staff attorney, to Herman Allison (Feb 23, 1998) p. 2.

5. FCRA 603(d)(1); 15 USC 1681a(d)(1) (emphasis added).

6. FCRA 603(h); 15 USC 1681a(h).

7. FCRA 603(e); 15 USC 1681a(e).

8. Primarily at FCRA 606; 15 USC 1681d.

9. FCRA 603(f); 15 USC 1681a(f) (emphasis added).

10. Also see R. Seep, What Constitutes [a] "Consumer Reporting Agency" Within [the] Meaning of 15 USCA 1681a(f), 101 ALR Fed 751 (1991).

11. Letter from Thomas Kane, FTC staff attorney, to Michael Cast (October 27, 1997) p. 1.

12. Letter from William Haynes, FTC staff attorney, to David Islinger (June 9, 1998) p. 2.

13. 975 F2d 1093, 1096 (CA5, 1992).

14. 768 F2d 456, 466 (CA1, 1985).

15. 573 F2d 1109, 1111 (CA9, 1978).

16. Letter from William Haynes, FTC staff attorney, to Richard Hauxwell (June 12, 1998) at p. 2. Concur: "[A] state agency that is providing information that is generally available to the public should not be considered a 'consumer reporting agency' (CRA) under the FCRA, and the communication of that data by such an agency to an employer or other party should not be considered a 'consumer report.'" Letter from Clarke Brinckerhoff, FTC staff attorney, to Gail Goeke (June 9, 1998) p. 1 (opinion in the context of hospitals requesting criminal background checks on employees within two working days of their hiring in accordance with Missouri law).

17. Letter from Mr. Brinckerhoff to Steven Slyter (June 12, 1998) (responses to questions #3 & #4) pp. 3-4.

18. FCRA 603(o)("excluded communications"); 15 USC 1681a(o).

19. "... that is made to a prospective employer for the purpose of (A) procuring an employee for the employer; or (B) procuring an opportunity for a natural person to work for the employer;" Id. Arguably, "procuring" encompasses more than initial hiring. This language also seems to cover independent contractors and contracts with outside sales representatives.

20. FCRA 603(f); 15 USC 1681a(f).

21. Letter from Mr. Brinckerhoff, FTC staff attorney, to Stacy Lee (June 26, 1998) p. 1 (a business that simply receives medical records and attending physician statements for insurance underwriting purposes, places them in envelopes, and mails them to insurers for their evaluation does not become a CRA, because the business's action is "is entirely mechanical and does not in any way determine the content of the material sent to the client").

22. 973 F Supp 1320 (CD Utah, 1997).

23. Id. at 1333 (citations omitted) (the law firm was handling over 9,000 dishonored checks for CheckRite, which made up over one-third of the firm's business).

24. Id.

25. Letter from William Haynes, FTC staff attorney, to Richard LeBlanc (June 9, 1998) pp. 1-2.

26. Attorneys need to be aware that, in general, trial preparation is not a legitimate purpose under FCRA 604(a); 15 USC 1681b(a) for requesting a CRA to supply a consumer report. See Duncan v Handmaker, 149 F3d 424, 427 (CA6, 1997). However, an attorney may request a consumer report to collect a debt owed to a client. See Allen v Kirkland & Ellis, 1992 WESTLAW 206285 (ND Ill 1992). See note 60, infra.

27. FCRA 604(b)(2)(A); 15 USC 1681b(b)(2)(A).

28. FCRA 604(b)(1)(A); 15 USC 1681b(b)(1)(A).

29. FCRA 604(b)(2)(B), (C); 15 USC 1681b(b)(2)(B), (C).

30. FCRA 603(e); 15 USC 1681a(e).

31. A Summary of Your Rights Under the Fair Credit Reporting Act, which is available from a CRA. It is also found at 16 CFR Part 601, Appendix A. This prescribed summary of rights may be downloaded from the FTC's site on the World Wide Web at . The summary describes the consumer's rights to (i) access his or her file, (ii) dispute the accuracy of the information in the file, (iii) correct or delete inaccurate information, (iv) prevent the release of outdated information, (v) consent before information is released, and (vi) sue violators.

32. Letter of Thomas Kane, FTC staff attorney, to Carolann Hinkle (July 9, 1998) pp. 1-2 (interpreting FCRA 603(d)(2)(A); 15 USC 1681a(d)(2)(A). See also letter of William Haynes, FTC staff attorney to John Beaudette (June 9, 1998) p. 3.

33. FCRA 606(b); 15 USC 1681d(b).

34. FCRA 604(b); 15 USC 1681b(b) (stating the consumer's rights).

35. FCRA 603(k)(1)(B)(ii); 15 USC 1681a(k)(1)(B)(ii) (defined as "a denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee."

36. For applicants for jobs and for employees in the trucking industry, no pre-adverse action disclosure is necessary; instead, within three days after an employer makes an adverse decision, it must provide a written, electronic, or just an oral statement including the name of the CRA and that the consumer may get a copy of the report from the CRA. FCRA 604(b)(3)(A); 15 USC 1681b(b)(3)(A) (part of Public Law 105-347 (Nov 2, 1998)).

37. FCRA 615(a); 15 USC 1681m(a). See letter of Clarke Brinckerhoff, FTC staff attorney, to Eric Weisberg (June 27, 1997) (summarizes obligations of employers taking adverse action under the FCRA).

38. Letter of Thomas Kane, FTC staff attorney, to Carolann Hinkle (July 9, 1998) p. 2 (interpreting FCRA 604(b)(3); 15 USC 1681b(b)(3).

39. FCRA 603(d), (e) & (f); 15 USC 1681a(d), (e) & (f).

40. FCRA 603(o)("excluded communications"); 15 USC 1681a(o). Such communication must be for the purpose of "procuring an employee" and made by a person who regularly does such work. Disclosure still requires the consumer's consent. See note 19, supra.

41. FCRA 603(o)(5)(C)(i); 15 USC 1681a(o)(5)(C)(i). See letter of William Haynes, FTC Staff Attorney, to Douglas Hahn (July 8, 1998) p. 2 (a CRA may provide employer with a report that does not identify sources).

42. FCRA 603(d)(2)(A); 15 USC 1681a(d)(2)(A).

43. 26 F3d 346, 348 (CA2, 1994) (and cases cited therein).

44. This four-point test is described in Todd v Associated Credit Bureau Services, Inc, 451 F Supp 447 (ED PA, 1977) (store and collection agency are not CRAs).

45. FCRA 610(e); 15 USC 1681h(e). Sections 616 and 617 (15 USC 1681n, 1681o) deal with penalties for willful and negligent violations of the FCRA. See, infra. This sub-section has been interpreted as not creating a separate cause of action where the information is not part of a consumer report. See, Melendez v Citibank, 705 F Supp 67, 69 (DC PR, 1988).

46. MCLA 423.452. Before this statute, Michigan employers had a qualified privilege to make reference statements as long as they were made without knowing of their falsity or without a reckless disregard for their truth. See, Dalton v Herbruck Egg Sales Corp, 164 Mich App 543; 417 NW2d 496 (1987) (statement that former employee was not reliable did not constitute slander).

47. Hodge, supra, 975 F2d at 1095 (citing Peller v Retail Credit Co, 359 F Supp 1235 (ND Ga 1973) (marijuana use a consumer report if released to prospective employers)).

48. FCRA 603(d)(2)(A)(i); 15 USC 1681a(d)(2)(A)(i).

49. See letter of William Haynes, FTC staff attorney, to David Islinger (June 9, 1998) pp. 1-2.

50. See letter of Christopher Keller, FTC Staff Attorney, to Judi Vail (Apr 5, 1999).

51. FCRA 603(d)(2)(A), (e) & (f); 15 USC 1681a(d)(2)(A), (e) & (f).

52. FCRA 604(b)(3)(A), 609(a); 15 USC 1681b(b)(3)(A), 1681g(a).

53. See letter of Mr. Haynes, FTC staff attorney, to Mr. Hahn (July 8, 1998), p. 2 (suggesting this solution to protect the confidentiality of sources).

54. FCRA 604(a), (b); 15 USC 1681b(a), (b). See, Russell v Shelter Financial Services, 604 F Supp 201, 202-203 (WD MO, 1984) (acquiring consumer report to determine whether former employee had embezzled funds was not a permissible purpose).

55. "Willfulness" under the FCRA means "knowingly and intentionally committing an act in conscious disregard for the rights of others;" it does not require a showing of maliciousness. Philbin v Trans Union Corp, 101 F3d 957, 970 (CA 3, 1996).

56. FCRA 616, 617; 15 USC 1681n, 1681o.

57. Pinner v Schmidt, 805 F2d 1258, 1263, 1265 (CA 5, 1986) (remittitur to $25,000 where $100,000 in punitive damages plus $100,000 in compensatory damages excessive where plaintiff showed no actual damages and where CRA's violation was in overstating an overdue account's balance by $49.50).

58. FCRA 618; 15 USC 1681p.

59. FCRA 616, 617; 15 USC 1681n, 1681o.

60. See, Bakker v McKinnon, 152 F3d 1007 (CA 8,1998) ($500 actual and $5,000 punitive damages for each of three plaintiffs because of attorney's willful violation of the FCRA in ordering credit reports on opposing party in dental malpractice action and on his two adult daughters, despite attorney's alleged purpose of seeking information concerning defendant's ability to satisfy a judgment and defendant's alleged efforts to transfer assets).

61. FCRA 619; 15 USC 1681q. See discussion in Duncan v Handmaker, 149 F3d 424, 427 (CA6, 1997) at 426.