Recent Case: Syed v. M-I, LLC
SYED V. M-I, LLC
On Issue of First Impression, Ninth Circuit Holds No Extraneous Information Allowed in Fair Credit Reporting Act Disclosure; Such Violation is Willful Under Statute
The Fair Credit Reporting Act (FCRA) was enacted to protect consumers by ensuring the accuracy and fairness of reports provided by consumer reporting agencies. The statute governs not only consumers’ interactions with credit card companies but also, inter alia, reports obtained on prospective employees as part of the employment application and screening process. Among other provisions, the statute requires that employers who intend to obtain such a report on an applicant or employee disclose the fact that a report will be sought, as well as secure the applicant’s authorization to do so.
Syed v. M-I, LLC occurred in the employment context; the issue arose when M-I, LLC (“M-I”) received authorization to obtain a consumer report on a prospective employee and later obtained a report through a third party consumer reporting agency, PreCheck, Inc. (“PreCheck”). When employers use third party services for background checks, as M-I did, the FCRA specifically requires the disclosure of the information sought and authorization to obtain it. It further requires that the disclosure and authorization be in a document that consists “solely” of the disclosure and authorization.
In a case of first impression for the federal appellate courts, the Ninth Circuit Court of Appeals held that when a liability waiver is included in the document that contains the disclosure and authorization information, the FCRA is violated based on Section 1681b(b)(2)(A)’s mandate that the document consist “solely” of the disclosure and authorization. More importantly, the court held that including such a liability waiver was a willful violation of the statute, potentially resulting in increased penalties.
A. Fair Credit Reporting Act
The FCRA provision at issue here applies to a “person,” which is defined as “any individual, partnership, corporation, trust, estate, cooperative, association, government or governmental subdivision or agency, or other entity,” obtaining a consumer report. Therefore, an employer falls under this broad definition.
The statute applies in a variety of circumstances when “consumer reports” are obtained. A “consumer report” is defined as:
[A]ny written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for—
(A) credit or insurance to be used primarily for personal, family, or household purposes;
(B) employment purposes; or
(C) any other purpose authorized under section 1681b of this title.
At issue in this case was the provision relating to obtaining a consumer report for “employment purposes,” defined as “a report used for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee.”
In order to be a “consumer report” for “employment purposes,” the report must be created by a consumer reporting agency. A “consumer reporting agency” is defined as:
[A]ny person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.
Thus, the FCRA applies only to employers who use a third party consumer reporting agency to obtain consumer reports on a consumer. “Consumer” means “an individual.” If an employer does not use a third party service, but instead conducts the check themselves, the FCRA does not apply because they, by definition, would not have secured a “consumer report.”
The FCRA’s requirements are triggered when a person will be obtaining (or causing to be obtained) a consumer report from a consumer reporting agency for employment purposes. This includes the disclosure to consumer requirement, which is at the heart of this case. That requirement provides:
Except as provided in subparagraph (B), a person may not procure a consumer report, or cause a consumer report to be procured, for employment purposes with respect to any consumer, unless—
(i) a clear and conspicuous disclosure has been made in writing to the consumer at any time before the report is procured or caused to be procured, in a document that consists solely of the disclosure, that a consumer report may be obtained for employment purposes; and
(ii) the consumer has authorized in writing (which authorization may be made on the document referred to in clause (i)) the procurement of the report by that person.
In Syed, the employer (a “person”) caused a consumer report (a background check) to be procured (by requesting PreCheck to procure one). Thus, the requirements in section 1681b(b)(2)(A)(i)–(ii) were triggered, and it is these requirements on which the court focused.
B. Summary of the Facts and Procedural History
Sarmad Syed applied for employment with M-I in 2011. M-I provided Syed with a “Pre-employment Disclosure Release,” permitting PreCheck to obtain a consumer report on Syed, which Syed signed. The document contained not only a disclosure about the type of background check that would be conducted and authorization to obtain such a report, but also a release (or “waiver”) of liability, the function of which was to limit liability in the event the information obtained was inaccurate. The relevant release portion stated:
I hereby discharge, release and indemnify prospective employer, PreCheck, Inc., their agents, servants and employees, and all parties that rely on this release and/or the information obtained with this release from any and all liability and claims arising by reason of the use of this release and dissemination of information that is false and untrue if obtained by a third party without verification.
It is expressly understood that the information obtained through the use of this release will not be verified by PreCheck, Inc.
It was the above-printed release that Syed challenged because the statute explicitly states the document should contain “solely” the disclosure, with the exception of an authorization, which is expressly authorized by the statute.
Syed filed a class action lawsuit against M-I and PreCheck in May 2014 in the Eastern District of California. Syed’s first complaint was dismissed for failure to state a claim, and his first amended complaint was also dismissed on the same basis, without leave to amend. The appeal to the Ninth Circuit followed. The district court judge approved a settlement between PreCheck and all class members on January 26, 2016. The Ninth Circuit ordered oral argument for November 2016, and the court issued its original decision on January 20, 2017. Shortly thereafter, M-I petitioned for rehearing en banc, which the Ninth Circuit denied. This resulted in an amended opinion, which was published March 20, 2017.
A. Plaintiff Had Standing
In May 2016, the Supreme Court decided Spokeo, Inc. v. Robins. Indeed, it was likely Spokeo that alerted M-I, and in turn potentially the Ninth Circuit, to the standing issue. In Spokeo, the plaintiff alleged that an online profile generated by Spokeo contained inaccurate information. The Court analyzed the complaint under the traditional test for Article III standing. To establish standing under Article III of the Constitution, a “plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” To satisfy the “injury in fact” requirement, the injury must be “‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” The Supreme Court held that the Ninth Circuit did not sufficiently analyze the injury element, remanding the case. However, the Spokeo Court did note that “intangible” injuries can establish standing, so long as the injury is still “concrete [and particularized].” The Court also seemed to leave the door open for Congress to “elevat[e]” an otherwise “inadequate” injury “to the status of [a] legally cognizable injur[y]” because “Congress has the power to define injuries.”
The Syed court also addressed the issue of standing in both its original opinion and the amended one, acknowledging the Supreme Court’s recently announced standard that “[a] plaintiff who alleges a ‘bare procedural violation’ of the FCRA, ‘divorced from any concrete harm,’ fails to satisfy Article III’s injury-in-fact requirement.” However, the Ninth Circuit reasoned that Syed did not allege a “bare procedural violation.” Rather, the statute “creates a right to privacy by enabling applicants to withhold permission to obtain the report from the prospective employer, and a concrete injury when applicants are deprived of their ability to meaningfully authorize the credit check.” The court wrote that Congress provided a cause of action and “recognized the harm such violations cause, thereby articulating a ‘chain of causation that will give rise to a case or controversy’” under Article III. Therefore, the court concluded that Syed had standing.
After the Ninth Circuit’s first opinion, commentators were surprised and confused that Syed had standing, in light of the Supreme Court’s decision in Spokeo. It is not exactly clear what injury Syed suffered and how this was not a “bare procedural violation.” For example, there is no evidence that any inaccurate information was ever obtained or that he was harmed in any way by the consumer report. Indeed, in another section of the opinion, the court seems to contradict the proposition that Syed suffered an injury.
The only substantive change in the court’s amended opinion was an additional paragraph on the standing issue. In M-I’s petition for panel rehearing or rehearing en banc, standing took center stage. M-I argued that the standing question was an easy one and that “Syed has pled no real-world injury aside from a technical violation of the Act” and that “[w]hatever the metes and bounds of Article III jurisdiction, Syed’s claims fall outside them.”
The court rejected M-I’s arguments in the amended opinion and maintained that Syed established Article III standing. The court added that Syed was deprived of his right of privacy by unknowingly signing the waiver along with the authorization. The court also pointed out that inferences are drawn in favor of Syed at the motion to dismiss stage and that “what suffices at the Rule 12(b)(6) stage may not suffice at later stages of the proceedings when the facts are tested.” It is not clear that the additional paragraph will satisfy those critical of the Ninth Circuit’s standing analysis, but it does show the court’s awareness of the potential problems with its conclusion.
B. Defendant Violated the Fair Credit Reporting Act
The court held that, by including the release with the authorization and disclosure, M-I violated the FCRA. The court began with the plain meaning of the text. The word “solely” means “‘[a]lone; singly’ or ‘[e]ntirely; exclusively.’” The court rejected the employer’s argument that that the statutory provisions in Sections 1681b(b)(2)(A)(i) and (ii) are inconsistent because the authorization (a statement including language authorizing the report and the actual signature) is permitted on the same document as the disclosure. Thus, the defendant argued, this is inconsistent with the “solely” requirement. However, the court found the two provisions consistent because the allowance of the authorization with the disclosure is an express exception to the “solely” language. Indeed, Section 1681b(b)(2)(A)(ii) of the statute specifically states that “authorization may be made on the [disclosure] document referred to in clause (i).”
The court further concluded that “[a]llowing an authorization on the same document as the disclosure is consistent with the purpose of the statute.” The disclosure and authorization provisions work “hand in glove,” the court reasoned, by telling applicants what they are authorizing and giving applicants control over whether or not to authorize the procurement of such a report. This helps to “protect consumers from ‘improper invasion[s] of privacy,’” which is the purpose of the FCRA. “Congress’s purpose would have been frustrated” by having a disclosure without an authorization, or vice versa. Therefore, based on the purpose and plain meaning of the statute, the court rejected M-I’s argument that the provisions were inconsistent.
The court next rejected M-I’s argument that the statute “implicitly” authorizes the release to be included with the disclosure. Because Congress specifically included one explicit exception, allowing for the authorization to be placed on the same document as the disclosure, all other exceptions are necessarily precluded as a matter of statutory interpretation. The court again looked to the statute’s purpose and concluded that implicitly allowing a waiver to be included with the disclosure would not comport with the FCRA’s purpose, because it would “pull the applicant’s attention away from his privacy rights protected by the FCRA by calling his attention to the rights he must forego if he signs the document.”
The court similarly rejected M-I’s argument that an explicit exception allows the inclusion of a waiver because a waiver is an “authorization” and falls under the one explicit exception. The court relied on the fact that “Congress told us exactly what it meant when it described the authorization as encompassing only ‘the procurement of [a consumer] report.’” Thus, an authorization is not a waiver. Even if that was not so explicitly stated, the court said that a “release” could not be interpreted as an “authorization” because the two words have fundamentally distinct meanings. “Authorize” means to “grant authority or power to,” and “waive” means to “‘give up . . . voluntarily’ or ‘relinquish.’” Therefore, the statute does not explicitly permit a waiver to be included with the disclosure.
Finally, the court rejected as “irrelevant” the argument that because the disclosure was “clear and conspicuous,” the statutory requirement was still satisfied. The court said the “clear and conspicuous” issue is distinct from the “solely” requirement. The court further found “inexplicable” the Western District of North Carolina’s decision to which M-I cited, which dismissed a plaintiff’s FCRA claim with prejudice on summary judgment. There, the court determined:
[I]nclusion of the waiver provision was statutorily impermissible and . . . the waiver is therefore invalid. However, while invalid, the waiver—a single sentence within the authorization, which was kept markedly distinct from the disclosure language—was not so great a distraction as to discount the effectiveness of the disclosure and authorization statements. Accordingly, the disclosure and authorization are otherwise adequate.
C. The Violation Was Willful
Perhaps more surprisingly, the court found the violation to be willful. This is significant because the penalties assigned to willful violations under the statute can be drastically higher than penalties for negligent violations. Under the FCRA, an employer who negligently fails to comply is liable to the consumer (i.e., the applicant) only for actual damages and attorney’s fees. If an employer is willfully non-compliant, they are liable for statutory damages from $100 to $1000 or actual damages, attorney’s fees and costs, and punitive damages. Because these damages are assessed for each consumer, a judgment in a class action could result in significant penalties for an employer.
Syed was seeking statutory damages, meaning he had to prove willfulness. In Safeco Insurance Co. v. Burr, the Supreme Court defined willfulness as a knowing violation or an act committed in “reckless disregard of statutory duty.” The Syed court relied on Safeco for the following proposition:
A party does not act in reckless disregard of the FCRA “unless the action is not only a violation under a reasonable reading of the statute’s terms, but shows that the company ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless.”
First, the court addressed M-I’s argument that its interpretation of the statute was not objectively unreasonable. The court said this is the standard for negligence, writing that “negligent actions are those which do not meet the standard of objective reasonableness” and that there could be “an interpretation of 15 U.S.C. § 1681b(b)(2)(A) that would be objectively unreasonable without rising to the level of recklessness.” Nonetheless, the court addressed this argument and concluded that M-I’s interpretation was objectively unreasonable. M-I’s primary bases in support of this argument were that the statute was not clear and that there was no guidance on point, such as from a court or administrative agency, on which M-I could have relied. The court reiterated that the statute is unambiguous. It agreed there was no binding authority on point, but Syed entered into evidence three opinion letters by the Federal Trade Commission (FTC). The three letters each supported Syed’s argument—one even specifically stated that including a waiver with a disclosure violates the statute. The court, however, stated that those letters were not authoritative since they were only informal opinion letters, citing Safeco. Despite having no authoritative guidance, the court still held that M-I’s interpretation was objectively unreasonable because, according to the court, no guidance was necessary to see that M-I’s view “comport[ed] with no reasonable interpretation of [the statute].”
Next, the court briefly addressed whether M-I’s interpretation “crossed the ‘negligence/recklessness line,’” such that the violation was, in fact, willful and not merely negligent. Because the provision is unambiguous, the court said, M-I’s subjective interpretation was irrelevant. Again focusing on the clarity of the provision at issue (“not subject to a range of plausible interpretations”), the court concluded that “M-I ran an ‘unjustifiably high risk of violating the statute.’” Therefore, the violation was willful.
D. Statute of Limitations
Finally, the court held that Syed filed his lawsuit within the statute of limitations. The statute of limitations under the FCRA is the earlier of either “(1) 2 years after the date of discovery by the plaintiff of the violation that is the basis for [the employer’s] liability; or (2) 5 years after the date on which the violation that is the basis for such liability occurs.” Syed did not discover the violation until he was looking through his personnel file. The court reasoned that because a violation does not occur until a consumer report is procured, the violation did not occur when the waiver was included with the disclosure, and, thus, was not discoverable at that time. Instead, the violation only occurred once a report was obtained after including the waiver on the disclosure, and was only discovered once Syed reviewed his file “within the last two years.”
A. Implications for Employers
In light of this ruling, employers who use consumer reporting agencies for background screens should review their disclosure forms to ensure no extraneous information is on the document, with the exception of an authorization statement and signature line. Those employers who do not review their forms risk the possibility of a significant class action with statutory penalties of up to $1000 per violation, given the holding that such a violation is willful. This is true even though a third party consumer reporting agency procures the report, since the statute applies to any “person” who causes a consumer report to be obtained. Thus, the employer who requires the background check is potentially liable. Employers should further be aware of the myriad of state laws that may have requirements in addition to the FCRA.
Employers may attack standing going forward, in light of the Supreme Court’s decision in Spokeo. By doing so, they could preclude large class actions in which there may be a technical violation of the statute, but no real injury suffered by any of the plaintiffs. The likelihood of success is dependent on the circuit in which the lawsuit is pending, with circuits such as the Ninth and others likely to find standing.
B. Implications for Applicants
This ruling does not necessarily have much immediate impact for applicants. Applicants will now likely receive a disclosure and authorization without a waiver. Applicants who do not sign any waiver would later be able to sue for injury resulting from an inaccurate background check. The court did not address whether a liability waiver could be provided separate from the disclosure and authorization, with the same effect of limiting an applicant’s right to sue later.
Nonetheless, this does provide plaintiffs’ attorneys new ground on which to base class action lawsuits alleging what defense attorneys will likely argue is a “bare procedural violation.” Plaintiffs’ attorneys who find an employer who used the same illegal disclosure form throughout the United States, for example, could amass a large number of plaintiffs stemming from the use of a single illegal form.
© 2017 Lowell Ritter. Individuals and nonprofit institutions may reproduce and distribute copies of this Case Comment in any format, at or below cost, for educational purposes, so long as each copy identifies the author, provides a citation to the Notre Dame Law Review Online, and includes this provision and copyright notice.
* Candidate for Juris Doctor, University of Notre Dame Law School, 2017. Thanks to Professor Barbara Fick for her invaluable feedback and suggestions.
 Id. The court seems to use the terms “waiver” and “release” interchangeably. Some commentators suggest there is a difference between these terms. See Bernard A. Bianchino, Practical Considerations in Negotiating Employee Separation Agreements, 1 Am. Corp. Counsel Ass’n Docket 50, 55 (1994) (“Generally at common law, a waiver of rights may be either retrospective or prospective in nature. However, in general, a release refers to the forgiveness of accrued rights by one party. A waiver may generally be implied from circumstances and does not require the receipt of consideration. Releases, on the other hand, usually are formally given and require some consideration be paid to the releasor.”). This is separate and distinct from a “covenant not to sue,” which is not at issue here. See Syverson v. Int’l Bus. Machs. Corp., 472 F.3d 1072, 1084 (9th Cir. 2007) (explaining the difference between a “release” and a “covenant not to sue”).
 M-I filed its original brief with the Ninth Circuit before the Supreme Court issued its decision in Spokeo and addressed standing in a footnote, writing that “a decision by the Supreme Court that the Spokeo plaintiff lacks standing would similarly mean that Syed lacks standing to pursue his lawsuit and that the lawsuit should be dismissed.” Answering Brief of Appellee at 13 n.4, Syed, No. 14-17186, 2017 WL 1050586. The plaintiff did not address standing in his opening brief or reply brief. See generally id.
 Id. To be precise, the correct term is “consumer report,” not “credit check.” A credit report could be included in a consumer report, but a consumer report encompasses much more than just a credit report. See supra notes 11–17 and accompanying text. The FCRA refers only to “consumer reports,” not “credit checks,” and the court seems to mean “consumer report.”
 See Elaina Al-Nimri & David Esquivel, In Bizarre Procedural Posture, Ninth Circuit Finds FCRA Willful Violation, JDSupra (Jan. 31, 2017), http://www.jdsupra.com/legalnews/in-bizarre-procedural-posture-ninth-40373/ (“Also perplexing is the Ninth Circuit’s cursory discussion of standing under the Supreme Court’s recent decision in Spokeo Inc. v. Robins.”); Kevin McGowan, No Waiver Allowed in Background Check Disclosure Form, 208 Lab. Rel. Rep. 94, 94 (Feb. 13, 2017) (paraphrasing Morrison Foerster attorney Angela Kleine in saying that “the court’s conclusions that an M-I LLC employee who wasn’t actually harmed by the form still has standing to sue and that M-I can be sued for a ‘willful’ violation are surprising”). In an interesting twist, the plaintiff in Spokeo, whose case was remanded after the Supreme Court’s decision and is still pending in the Ninth Circuit, wrote a letter to the Ninth Circuit in January after the Syed decision was released, arguing that the Syed decision now compels the Ninth Circuit to rule in his favor. See Steven Trader, Spokeo User Says 9th Circ. Ruling Gives Him FCRA Standing, Law360 (Jan. 23, 2017), https://www.law360.com/media/articles/883961/spokeo-user-says-9th-circ-ruling-gives-him-fcra-standing?about=media.
 Id. at *5. The court here seems to conflate terms when it writes that Syed signed “a waiver authorizing the credit check.” Id. The whole point of the case is that a waiver and authorization are two distinct things; one cannot authorize something by signing a waiver.
 Id.; see also 15 U.S.C. § 1681b(b)(2)(A) (“[A] person may not procure a consumer report, or cause a consumer report to be procured, for employment purposes with respect to any consumer, unless . . . (i) a clear and conspicuous disclosure has been made in writing to the consumer . . . .”).
 Smith v. Waverly Partners, LLC, No. 3:10-CV-00028, 2012 WL 3645324, at *6 (W.D.N.C. Aug. 23, 2012). The Ninth Circuit is not the only court to take issue with this result, as a number of district courts have rejected this reasoning. See Doe v. Sentech Emp’t Servs., Inc., 186 F. Supp. 3d 732, 738–39 (E.D. Mich. 2016); Milbourne v. JRK Residential Am., LLC, 92 F. Supp. 3d 425, 432 (E.D. Va. 2015); Reardon v. ClosetMaid Corp., No. 2:08-cv-01730, 2013 WL 6231606, at *8–9 (W.D. Pa. Dec. 2, 2013).
 Id. at *8 n.6. The FCRA was historically enforced by the Federal Trade Commission, but is now enforced by the Consumer Financial Protection Bureau (CFPB). See Fed. Trade Comm’n, 40 Years of Experience with the Fair Credit Reporting Act: An FTC Staff Report with Summary of Interpretations 1–2 (2011), https://www.ftc.gov/sites/default/files/documents/reports/40-years-experience-fair-credit-reporting-act-ftc-staff-report-summary-interpretations/110720fcrareport.pdf (indicating that “[t]he CFPB also will take on primary regulatory and interpretive roles under the FCRA”). The Syed court, in this part of the opinion, did not mention district court cases that are on point. See Harris v. Home Depot U.S.A., Inc., 114 F. Supp. 3d 868 (N.D. Cal. 2015); Singleton v. Domino’s Pizza, LLC, No. DKC 11-1823, 2012 WL 245965 (D. Md. Jan. 25, 2012).
 See Letter from William Haynes, Attorney, Div. of Credit Practices, Fed. Trade Comm’n, to Richard W. Hauxwell, CEO, Accufax Div., Southwest (June 12, 1998), 1998 WL 34323756 (F.T.C.); Letter from William Haynes, Attorney, Div. of Credit Practices, Fed. Trade Comm’n, to Harold R. Hawkey, Emp’rs Ass’n of N.J. (Dec. 18, 1997), 1997 WL 33791224 (F.T.C.); Letter from Cynthia Lamb, Investigator, Div. of Credit Practices, Fed. Trade Comm’n, to Richard L. Steer, Jones Hirsch Connors & Bull, P.C. (Oct. 21, 1997), 1997 WL 33791227 (F.T.C.).
 Id. at *9. The court also analogized to the qualified immunity context where no existing case law is necessary to find a constitutional violation “when an officer’s conduct is so patently violative of the constitutional right that reasonable officials would know without guidance from the courts that the action was unconstitutional.” Id. at *8 (quoting Boyd v. Benton City, 374 F.3d 773, 781 (9th Cir. 2004)).
 Id. The court recognized that the facts alleged must be taken as true at the motion to dismiss stage. Id. Evidence might later prove Syed actually discovered the violation earlier, calling the statute of limitations issue into question. See id.
 See In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 640 (3d Cir. 2017) (reversing the district court by holding that plaintiffs had standing for violations of the FCRA where plaintiffs “allege[d] . . . the unauthorized dissemination of their own private information—the very injury that FCRA is intended to prevent” (footnote omitted)); Strubel v. Comenity Bank, 842 F.3d 181, 191 (2d Cir. 2016) (holding that plaintiff who alleged a bank violated the disclosure provision of the Truth in Lending Act had standing, writing that the plaintiff “sufficiently alleged that she is at a risk of concrete and particularized harm from these two challenged disclosures”).