In a recent opinion, the Eleventh Circuit joined the Sixth Circuit in holding that verifying the identity of a consumer is a “legitimate business need” under the Fair Credit Reporting Act (“FCRA”). Domante v. Dish Networks, LLC, 8:17-cv-00472 (11th Cir. Sept. 9, 2020).
The consumer had alleged that a television service provider negligently and willfully violated the FCRA by requesting and obtaining the consumer’s consumer report without a permissible purpose. According to the television service provider, it requested and obtained the consumer’s consumer report from a credit reporting agency (“CRA”) pursuant to its normal business practice after receiving a request for service submitted in the consumer’s name in connection with an event of identity theft that used some of the consumer’s personal information to submit the request for service. Online applicants are only asked to provide the last four digits of his or her social security number. To verify the online applicant’s identity and eligibility for servicing, the television service provider’s system automatically sends the applicant’s information to a CRA. If the CRA determines the submitted information matches, it provides a consumer report to the television service provider. After the television service provider learned that the request submitted in the consumer’s name was fraudulent, it requested that the CRA remove the inquiry.
In determining whether the television service provider violated the FCRA, the court reviewed the permissible purposes in for which a person may obtain a consumer report. The court determined that the exhaustive list of permissible purposes includes where a person has a legitimate business need for the information in connection with a business transaction that is initiated by the consumer.
The court noted that the Eleventh Circuit had not previously weighed in on what constitutes a “legitimate business need” in connection with a business transaction for FCRA purposes and turned to the Sixth Circuit for guidance. In Bickley v. Dish Network, LLC, 751 F.3d 724 (6th Cir. 2014), the Sixth Circuit held that the term “legitimate business need” includes verifying the identity of a consumer and assessing his or her eligibility for service. The Eleventh Circuit agreed with the Sixth Circuit and determined that the television service provider had a permissible purpose in obtaining the consumer’s consumer report and did not violate the FCRA.
In response to the consumer’s argument that the television service provider should have done more to verify the consumer’s identity before requesting a consumer report, the court stated that the FCRA does not explicitly require a user of consumer reports to confirm beyond doubt the identity of potential consumers before requesting a report.
The full text of the FCRA, as well as state fair credit reporting statutes, can be found in our Marketing and Privacy Digest https://www.dltlaw.com/multistate-digests/. Let us know if you have any questions.