top of page

Sedona Conference Primer on Data Privacy - Part 3

Here's the conclusion of my outline of the Sedona Conference's Data Privacy Primer, which I last blogged about on January 22, 2017.

B. Fair Credit Reporting Act

1. Overview

a. Enacted in 1970 to regulate consumer reporting industry such as Equifax, TransUnion, Experian, and others.

2. Duties of Consumer Reporting Agencies

(1) Accuracy

(2) Disclosure [all information in the file]

(3) Investigation [must conduct investigation when consumer questions accuracy]

(4) Free Consumer Reports [at least once a year];

(5) Permissible Uses

i. court order or subpoena

ii. to person who the report pertains

iii. use report in connection with extension of credit, employment, insurance underwriting, licensing or conferring of government benefits, legitimate business need.

iv. capacity to pay child support.

v. agency administering child support plan

vi. to FDIC or NCUA

c. Individual can opt out of sharing of information with affiliate.

3. Furnishers of Information to CRAs

Individuals can dispute accuracy of information furnished to the CRA and the furnisher must notify the CRA.

4. Users of Consumer Reports

The FCRA provides that a person may not procure a consumer report for employment purposes unless the employer or potential employer discloses in writing to the consumer that a report is to be obtained and the consumer authorizes in writing that a report can be obtained.

5. Limitations on Information Contained in Credit Reports

No CRA can make a consumer report containing any of the following information:

1. Bankrupcty cases more than 10 years old.

2. Civil suits older than 7 years, or those for which the statute of limitations has expired.

3. Tax liens older than 7 years.

4. Accounts placed for collection older than 7 years.

5. Any other adverse information other than a conviction record which is more than 7 years old.

6. Contact information for any medical information furnisher.

These restrictions are not applicable in credit transactions for more than $150,000; insurance agreements with a face amount of $150,000; and jobs with a salary of more than $75,000.

6. Private Rights of Action and Damages

Consumers have a private remedy against “negligent or willful misconduct by a furnisher” of consumer credit information, this right only arises once the furnisher has received a notice from the CRA disputing the accuracy or completeness of the information provided. The FCRA’s statute of limitations extends to two years after the date when plaintiff discovers the violation or five years af-ter the date of the violation, whichever occurs earlier.

7. Rulemaking and Enforcement

FCRA is enforced by the FTC and the CFPB.

C. Right to Financial Privacy Act of 1978

Individual had no individual right of privacy in his or her financial records (United States v. Miller) according to court decisions, so Congress enacted Right to Financial Privacy Act of 1978.

1. Overview of RFPA

Only applies to federal agencies. Covers card issuers. Companies of more than five individuals are not covered.

2. Obligations of RFPA

(a) Limitations on Federal Government Requests

Must state specific basis for request. Can't transfer to other federal agency except for law enforcement purposes and intelligence.

(b) Financial Institution's Obligations

Upon receipt of government request, financial institution must obtain individual consent, and can't make this consent on condition on which it will do business with the individual.

3. Civil Penalties for Non-Compliance

Liability can equal $100 regardless of the number of records; actual damages; punitive damages; and costs of the action. Financial institutions have immunity for disclosures made for reports such as the Suspicious Activity Report (SAR) with Financial Crimes Enforcement Network.


A. Legal Framework

1. Regulatory Protections

Electronic Communications Privacy Act prohibits interception of communications while in transit or stored on computers. Business can monitor employee communications on a business provided device.

2. U.S. Constitution

A pivotal determination in cases involving governmental invasion of privacy is whether the government employee has a reasonable expectation of privacy in relation to the conduct of the governmental employer.

3. State Issues

Connecticut and Delaware require employers to give notice before monitoring employee communications.

B. Use of Computer Equipment and Email

City of Ontario v. Quon (U.S. 2010)- government search of employee texts was reasonable since measures were reasonably related to methods, and was justified at its inception. Many court decisions have found that employers can monitor communications on company provided devices. In addition to ownership of the device, courts consider the existence and scope of a company’s computer usage policy, steps taken by the employee to maintain the privacy of personal emails, the use of the company-owned computer system, and the content of the communication at issue.

C. Bring Your Own Device Policies

Rajaee v. Design Tech (S.D. Tex 2014) employee who used his own phone for business could not bring claim under ECPA after data (including personal data) was wiped on his private device by his employer.

D. Social Media Privacy

Costly and protracted risks associated with social media.

1. Passwords and Other Login Information

19 states have passed laws that prevent employers from requiring employees to hand over login information for social media sites.

2. Content Monitoring

Ehling v. Monmouth (D.N.J. 2013) Stored Communications Act was not violated when employer uses private data on Facebook as grounds for suspension that it only had access to through employee's Facebook friend. NLRB concluded that Costco was in violation of the National Labor Rela-tions Act (NLRA) by maintaining and enforcing a rule prohibiting employees from electronically damaging the company or any employee’s reputation.


A. Family Educational Rights and Privacy Act

Educational records cannot be transferred without student or parental consent. Rights transfer at 18. However institutions can disclose directory information.

Consent not required when all PII has been removed that student cannot be identified.

Children's Online Privacy Protection Act (COPPA) - 1998 - governs online collection of data about children. - FTC says under COPPA service providers can accept educational institution has obtained consent when collecting information.

Institutions must provide access to records to students within 45 days of the receipt of a request. No private right of action for a violation; must file a compliant with the Family Policy Compliance Office.

B. Protection of Pupil Rights Amendment

Prevents schools and third parties from learning certain information about students. The PPRA requires institutions that receive Department of Education funding to develop policies on parents' right to inspect surveys; right to inspect instructional material; opt out of non-emergency physical exams; opt out of collection of information for marketing purposes.

PPRA does not provide a private right of action. Must file compliant with Family Policy Compliance Office within Department of Education.

C. State Laws

In 2015, 14 states enacted legislation addressing the privacy rights of students.

bottom of page