As we continue to provide Agency Risk Management solutions for independent agents, we are tasked with providing guidance on a variety of operational practices and agency workflows. This particular area of focus has been requiring our attention more often, and for agencies of all sizes.
There are many aspects to the issues surrounding obtaining, sharing and storing MVRs for an insured. You are always encouraged to reach out to Virtual Agency Solutions staff for specific recommendations on your unique situation, but this article should provide you enough information to assess whether you have a significant agency risk that should be addressed immediately.
Obtaining MVRs – Best Practices and Legal Concerns
The use of Motor Vehicle Records (MVRs) is outlined in the federal Fair Credit Reporting Act (FCRA), which is regulated by the Federal Trade Commission (FTC). An MVR is an example of a “consumer report” and must be handled in accordance to federal guidelines. Do I have your attention now? Good. An insurance agency may request an MVR for “the underwriting of insurance”, as outlined in the FCRA, Section 604, as follows:
604. Permissible purposes of consumer reports [15 U.S.C. § 1681b]
(a) In general. Subject to subsection (c), any consumer reporting agency may furnish a consumer report under the following circumstances and no other:
(3) To a person which it has reason to believe
(C) intends to use the information in connection with the underwriting of insurance involving the consumer;
In the circumstance where an agency is only underwriting drivers for commercial risk, the FCRA does not require the consumer’s written permission to access an MVR. If you are receiving requests from a commercial insured/employer to pull the MVR for a new employee for the purpose of adding the employee as a driver under the Business Auto Policy, you can feel comfortable doing so without written permission from the new employee. In addition, to inform a commercial insured that a new driver does or does not qualify as a driver for underwriting purposes would be considered part of "the underwriting of insurance."
The legal risk, however, is if the agency is providing specific details of an MVR with the employee. Those additional details could qualify the agent as a “consumer reporting agency” (CRA) and no longer simply providing information for the “underwriting of insurance”. There are more detailed steps and procedures for a CRA to follow which are outlined at www.ftc.gov.
Sharing MVRs – Best Practices and Legal Concerns
So, what information should be shared from an MVR with an insured/employer? The agency should only be providing written documentation to the insured as to whether coverage can be obtained for the new employee. The agency should NOT be providing the insured with a copy of the MVR.
The sharing of MVR information will indicate whether or not the agency is acting as a CRA. This is important to understand, but there is still another significant risk regarding the sharing of MVR information that could exist. The risk is not with the FCRA, but rather, with the MVR Company being used by the insurance agency. Independent Insurance Agents and Brokers of America (IIABA) research shows examples of language used by two MVR providers utilized heavily by insurance agencies:
MVR Company A:
"The Consumer Reports provided by Company A are for the sole and internal use of the Insurance Agency, and may not be resold, sub-licensed, delivered or displayed in any way or used by any third party. Insurance Agency certifies that it shall order, receive, disseminate and otherwise use the Consumer Reports in compliance with all applicable federal, state and local statutes, rules, codes and regulations. Insurance Agency agrees to indemnify and hold harmless Company A from any and all damages, costs, judgments and expenses."
MVR Company B:
"All reports, whether oral or written, will be kept strictly confidential; except as provided by law, no information from reports will be revealed to any person except the subject of the report. No information will be requested for the use of any other person, agency or organization except with the written permission of Company B. Reports may not be resold or transferred to any other person. The unlawful ordering or use of consumer reports can subject you to criminal and civil penalties in accordance with both federal and state laws."
As indicated in these two excerpts, even if it is legal to for an agency to supply MVRs to commercial insureds, there is a high likelihood that is it not permitted by the MVR provider being utilized by the agency.
Storing MVRs – Best Practices and Legal Concerns
My number one rule of thumb when I am reviewing the information in a customer file of an agency management system is to keep only the information you need and only for the length of time you need it. Using this guidance, an agency should consider whether they are saving the MVR reports or if they are being destroyed once the underwriting information has been provided to the insured. The agency should maintain only the documentation sent to the insured regarding the underwriting action taken on the new employee but should not keep the entire MVR in the insureds file. According to the FTC, insurers must comply with the Disposal Rule outlined on the FTC website. This rule indicates that consumer information, such as that found in an MVR, should be properly and securely disposed of “once your business is finished with” it.
Many agencies are not aware of the above-mentioned information and will ask what steps they should take to make sure they are in compliance with FTC guidelines. I recognize that I may be telling you to eliminate a service that you believe provides value to your commercial insureds, but if you are facing $4,000 fines, per incident, or even up to two years imprisonment, your value to your insureds will likely decrease anyway.
There are a variety of employee screening services available to your insureds for background checks, and you should refer your commercial insureds to these screening services if they are looking for additional information outside of the standard insurance underwriting functions you can provide.
All agencies should also verify that they are educating their employees on what is considered an ‘underwriting’ function and what could be considered an ‘employee screening’ activity. This education should cover guidelines outlined by the FCRA and also be clearly outlined in an employee handbook or procedure manual. In addition to how to share the information found on an MVR, the procedure should also clearly explain how to properly dispose of the MVR once the information has been shared with the insured.
As always, you are welcome and encouraged to reach out to Virtual Agency Solutions staff with any questions pertaining to agency operations, including specific MVR-related workflows. You can also find great information on the national IIABA website, www.iiaba.net, as well as the FTC website, www.ftc.gov.