By David Thompson, CPCU
Commercial employers in the process of hiring employees who will be driving company vehicles routinely contact their insurance agent to have the drivers added to the Business Auto Policy.
Typically, the commercial insured will provide the agency with the new employee's driver's license number, so that the agency can run a motor vehicle report (MVR). Some agencies have the practice of faxing the employer a copy of the MVR, especially in situations where the employee's driving record does not meet the underwriting guidelines of the Business Auto Policy. In other instances, the agency might call the employer to discuss problems with the MVR. Some agencies even engage in the practice of routinely providing MVRs to their commercial customers. Before an agency engages in the practice of sharing MVRs with others it's important to consider the impact of:
The federal Fair Credit Reporting Act
The MVR vendor contract
The agency E&O policy
Fair Credit Reporting Act
The federal Fair Credit Reporting Act (FCRA), which applies to all "consumer reports," including MVRs, CLUE reports, credit scores, and many other types of information on individuals, has very strict guidelines on what is legal regarding the use of such reports.
Under the FCRA, an employer is well within their rights to require that a current or prospective employee provide or make available a wide variety of personal information such as an MVR, credit report, criminal background report, etc. At the same time, the employee is granted significant safeguards regarding the access and use of such information for employment.
When any consumer report will be used for employment purposes, the employee or prospective employee must first give written permission for such information to be obtained by the employer. When the employer requests this information from a "consumer reporting agency" (CRA) such as Equifax, Experian, TransUnion, ChoicePoint, etc., there are certain federally-mandated documents and procedures which must accompany the transaction between the CRA and the employer. For a detailed report on this, see the Federal Trade Commission (FTC) report, "Using Consumer Reports - What Employers Need To Know," available on the FTC website - www.ftc.gov. Suffice it to say, the paperwork required between the employer, employee, and CRA is voluminous.
An insurance agency that pulls an MVR only in conjunction with "the underwriting of insurance," as prescribed in the FCRA, Section 604, does not need written permission to obtain the MVR. Therefore, when the commercial insured/employer sends a request to the agency to pull the MVR on a new employee in conjunction with adding the employee as a driver under the Business Auto Policy, the agency can do so without the written permission of the new employee.
In addition, to inform a commercial insured that a new driver does or does not qualify as a driver for underwriting purposes seems to be a part of "the underwriting of insurance."
However, most experts believe that if the agency shares the specific contents of an MVR with the employer, via fax or phone, the agency is no longer "underwriting insurance," but is now acting as a "consumer reporting agency," and must follow all the steps and procedures required under the FCRA.
Therefore, if the agency chooses to furnish MVRs to commercial insureds on their current or prospective employees, they may legally do so, if they follow all the requirements of a "consumer reporting agency" under the FCRA. Again, the paperwork between the agency and commercial insured is extensive and federally mandated procedures must be followed exactly as prescribed. While not intended to be a complete analysis of the massive amount of paperwork required, below is a summary of what is required under the FCRA if an agency furnishes MVRs to commercial customers.
The agency must make certain that the MVR vendor contract allows the agency to share MVRs with others.
The agency provides the employer with the FTC document "Prescribed Notice of User Responsibilities." This must be provided only once per employer.
The agency obtains a document signed by the employer stating they understand the FCRA and will comply with it. Debate exists over whether this document is required only once or with each MVR request. The safest approach is to require the employer to provide this to the agency with each request. The employer must sign this document.
With each MVR request the employer provides the agency with a document signed by the employee or prospective employee authorizing the employer to obtain the MVR. This document must contain only such permission and the permission cannot be part of another document such as an application for employment.
The agency obtains the MVR and provides it to the employer, along with the three-page FTC document "Appendix A - Prescribed Summary of Consumer Rights."
The employer has further responsibilities. If the MVR contains adverse information which may affect the decision to hire or promote, the employer must provide further notices. A "Pre-Adverse Action" letter is required initially when the employer provides the employee with a copy of the MVR and "Appendix A - Prescribed Summary of Consumer Rights." After a period of time (three to five days) the employer must then provide the employee with the "Adverse Action" letter. Should the employer fail to take these steps it's possible that the agency could be named in any suit the employee may elect to bring against the employer. This would be due to the fact that the agency was the source of the MVR and was serving as a "Consumer Reporting Agency" when they supplied the MVR to the employer.
MVR Vendor/Provider Contract
While the practice of an insurance agency furnishing MVRs to commercial insureds on their current or new employees can be legal under the FCRA if all of the paperwork procedures are followed, virtually all sources from whom the agency obtains the MVRs expressly prohibit the practice. Following are excerpts from the contracts of two MVR providers that many insurance agencies use.
MVR Company A: "The Consumer Reports provided by Company A are for the sole and internal use of the Insurance Agency, and may not be resold, sub-licensed, delivered or displayed in any way or used by any third party. Insurance Agency certifies that it shall order, receive, disseminate and otherwise use the Consumer Reports in compliance with all applicable federal, state and local statutes, rules, codes and regulations. Insurance Agency agrees to indemnify and hold harmless Company A from any and all damages, costs, judgments and expenses."
MVR Company B: "All reports, whether oral or written, will be kept strictly confidential; except as provided by law, no information from reports will be revealed to any person except the subject of the report. No information will be requested for the use of any other person, agency or organization except with the written permission of Company B. Reports may not be resold or transferred to any other person. The unlawful ordering or use of consumer reports can subject you to criminal and civil penalties in accordance with both federal and state laws."
In the past, one of the largest MVR Companies in the nation sent this memo to all insurance agency customers:
"It has recently come to our attention that some insurance agencies may be furnishing MVRs obtained for commercial underwriting purposes to the commercial insurance buying customer.
Please be aware that the consumer reports you obtain from us may not be used beyond the purpose for which they were ordered and cannot be sold or given to parties outside the ordering insurance company or insurance agency.
Allowing an employer to receive an MVR that was provided to you for commercial underwriting purposes would be a violation of law as well as a violation of your agreement with us."
Thus, most MVR providers do not permit the practice of an insurance agency furnishing MVRs to commercial insureds on their current or prospective employees.
The Agency E&O Policy
Most E&O policies provide coverage for "insurance professional services." While each situation is unique and no determination of coverage can be made without all the specific facts of a particular situation being known, most insurance professionals agree that providing MVRs to clients as part of an employee screening program falls outside the coverage area of the E&O policy. That means when/if the agency gets sued or fined because proper procedures weren't followed to the letter of the law, there may be no coverage under the E&O policy.>
Several agencies have reported that they routinely obtain MVRs for their commercial customers as a "value added service." In fact, one agency stated, "We have one person whose full time job is to pull MVRs for commercial customers. We are not prepared to stop this practice." Another agency reported, "We run 800 MVRs a month for our customers and there is no way we will stop doing it." Agencies who engage in the practice of providing MVRs to parties other than the insurance company assume a greater risk of civil suit and federal, and they must realize that there may be no insurance coverage, including defense costs, for such suits and fines.
Summary
The practice of sharing MVRs with third parties may be permitted under the FCRA when all of the proper procedures are followed.
Most MVR vendor contracts expressly prohibit sharing MVRs with third parties.
The agency E&O policy may not provide coverage for an agency that is sued or fined over the MVR sharing issue.
The best course of action for an agency is to tell commercial insureds that they must obtain the employee's MVR on their own; that keeps the agency completely out of the loop.
Legal experts recommend that agencies include guidelines about this issue in their employee handbook, or agency operations manual.
This article contains copyrighted material from Edwards & Associates in Atlanta, Georgia as well as the Independent Insurance Agents of Louisiana and is used with permission.
6/4/04 David Thompson