MEMORANDUM OPINION AND ORDER
In early 2001, Plaintiff Mike Del Amora was in the process of getting a divorce. His estranged wife’s brother, Jesus Roman, worked as a salesman for Defendant Metro Ford Sales and Service, Inc. In that position, Roman was authorized to obtain and review credit reports in connection with making car sales. Roman knew that he was only allowed to obtain the credit reports of customers who were interested in purchasing vehicles from Metro Ford and who gave Roman permission to check their credit histories.
On January 31 and March 27, 2001, Roman used his position at Metro Ford to obtain credit reports on Del Amora. Del Amora was not interested in buying" a car from Metro Ford and did not give Roman permission to check his credit. Roman was motivated solely by personal reasons related to his sister’s separation, and not by any desire to further Metro Ford’s business. The parties acknowledge that Roman obtained both credit reports without Metro Ford’s knowledge or consent. When Del Amora learned that Roman had obtained his credit report, he filed this lawsuit alleging that Metro Ford willfully violated the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. §§ 1681b(f) & 1681(q).
Metro Ford now seeks summary judgment on the grounds that it cannot be vicariously liable for Roman’s willful misconduct, relying on Judge James Moran’s decision in Kodrick v. Ferguson, 54 F.Supp.2d 788 (N.D.Ill.1999). Del Amora initially failed to respond to Metro Ford’s motion, thereby admitting all .the facts as set forth by the company in its summary judgment submission. Local Rule 56.1(b)(3)(B); Hudson v. West Harvey/Dixmoor Sch. Dist. No. 147, 168 F.Supp.2d 851,- 852 (N.D.Ill.2001). At our instruction that Del Amora address Metro Ford’s legal arguments in light of a conflicting Circuit-level decision, Jones v. Federated Fin. Reserve Corp., 144 F.3d 961 (6th Cir.1998), he filed a cross-motion for summary judgment seeking to hold Metro Ford liable for Roman’s actions pursuant to that case.
DISCUSSION
The FCRA- prohibits any person from using or obtaining a consumer report for other than permissible purposes. 15 U.S.C. § 1681b®. Any person who willfully or negligently fails to comply with any requirement of the Act with respect to any consumer is liable to that consumer for actual damages, attorneys’ fees and costs. 15 U.S.C: §§ 1681n-o. Willful violations may also result in punitive damages. 15 U.S.C. §' 1681n. In addition, any person who knowingly obtains a credit report under false pretenses shall be fined, imprisoned or both. 15 U.S.C. § 1681q.
In this case, the parties agree that Roman, a non-supervisory employee, obtained Del Amora’s credit reports for an improper purpose under false pretenses in violation of these sections. The only question is whether Metro Ford can be vicariously liable for Roman’s willful misconduct. Metro Ford argues that Del Amora should not be able to proceed on this theory because he failed to allege it in his complaint. The Court disagrees. The Federal Rules of Civil Procedure do not require a plaintiff to plead a legal theory. Kirksey v. R.J. Reynolds Tobacco Co., 168 F.3d 1039, 1041 (7th Cir.1999). The complaint plainly *950says that Metro Ford violated the FCRA. Fairly read, this allegation encompasses the possibility of a theory of vicarious liability: corporations necessarily act through their agents. Shager v. Upjohn Co., 913 F.2d 398, 404 (7th Cir.1990). Metro Ford is in no way unfairly prejudiced or surprised by Del Amora’s argument; indeed, it affirmatively raised the issue in its summary judgment motion. (Def.Memo, p. 4) (“... Metro Ford cannot be held liable for Jesus Roman’s independent actions in this case”). On these facts, it would be inappropriate to preclude Del Amora from raising the argument. See Barbian v. Panagis, 694 F.2d 476, 487 n. 9 (7th Cir.1982) (the court must construe a complaint liberally on a motion for summary judgment).
A. Vicarious Liability Under the FCRA
The FCRA does not specifically provide for vicarious liability.. Del Amora argues that we should follow the lead of Jones and fill in this statutory gap with common law agency principles. Metro Ford urges us instead to, follow Kodrick and leave such gap-filling to Congress. Although neither case is binding on this Court, we find it useful to review both here.
In Jones, the plaintiffs ex-husband pressured his friend Janice Caylor, an employee of the defendant, to procure the plaintiffs credit report for personal reasons related to his divorce. Caylor was authorized to request credit reports from clerks who operated the company’s credit report request system, as long as she,supplied a customer name, address and social security number. There was no evidence suggesting that any other employee knew of Caylor’s improper request on behalf of the plaintiff. 144 F.3d at 962-63.
On appeal from verdicts in favor of the defendant, the Sixth Circuit considered only whether a principal may be vicariously liable for an agent’s tortious conduct under the FCRA based upon an apparent authority theory. Id. at 965. After concluding that such a theory is compatible with the Act’s purposes of protecting consumers from improper use of credit reports and deterring violations, the court found that the company could be liable for Caylor’s actions if it “created an appearance of authority that caused the credit reporting agency reasonably and prudently to believe that Caylor had made a proper request for a permissible purpose, and there was reliance on Caylor’s apparent authority.” Id. at 966. The court viewed this theory as a basis for finding either a willful or negligent violation on the part of the company.
In Kodrick, defendant Cheryl Ferguson worked for co-defendant Accubanc Mortgage as a senior loan officer. In that position, Ferguson was authorized to obtain and review confidential credit histories of Accubanc’s customers. On two occasions, Ferguson used her authority to obtain the plaintiffs credit report, ostensibly to process a real estate loan. However, the plaintiff had not applied for a loan, nor did she have any business relationship with Accubanc. Rather, Ferguson wanted information on the plaintiff because the plaintiff was married to Ferguson’s ex-husband. Ferguson acted without supervisory approval and did not have a high rank sufficient to deem her Accubanc’s alter ego. 54 F.Supp.2d at 789.
The court rejected the theory of vicarious liability for subscribers with rogue employees on the grounds that the FCRA is silent on the issue and places the duty to prevent impermissible uses of credit reports not on subscribers, but on consumer reporting agencies and individuals who knowingly violate the law. Id. at 794. However, the court ultimately confined its *951holding to the particular scenario at issue in the case:
We hold. only that a subscriber is not liable under § 1681n or § 1681o for its employee’s unauthorized willful violations of the Fair Credit Reporting Act, where the employee of the subscriber obtained the report under false pretenses and for personal use without the express or implied approval of her supervisors.
Id. at 797-98. The court expressly left open the possibility of direct corporate liability where supervisors know their facilities are being used to obtain reports for improper purposes, or where a company recklessly gives access to its credit bureau facilities to employees who do not need such access to perform their jobs. Id. See, e.g., Yohay v. City of Alexandria Employees Credit Union, Inc., 827 F.2d 967, 973-74 (4th Cir.1987) (credit union was liable for employee’s violation of the FCRA where anyone using the credit union’s computers had access to credit reports, and the credit union posted no guidelines for obtaining them).
We agree with the Jones court that imposing vicarious liability under the FCRA is consistent with Congress’s intent to protect consumers from improper use of credit reports and to deter statutory violations. See 15 U.S.C. § 1681(a)(4) (“[tjhere is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer’s right to privacy”); Pappas v. City of Calumet City, 9 F.Supp.2d 943, 949 (N.D.Ill.1998) (FCRA is intended “to protect individual privacy interests”). Though the FCRA originally imposed civil liability on “[ajny consumer reporting agency or user of information” that fails to comply with any requirement of the Act, in 1996, Congress amended the Act’s civil liability provisions to cover “[ajny person” who willfully or negligently fails to do so. The term “person” is defined broadly to include corporations which, as we have noted, necessarily act through their agents. 15 U.S.C. § 1681a(b); Shager, 913 F.2d at 404. It follows that a subscriber corporation can be liable for its agent’s misconduct under the Act.
B. Common Law Theories of Agency
Where, as here, an employee cannot be considered án employer’s “alter ego,” we look to the common law of agency to determine the circumstances in which the employer may be liable under the FCRA for its employee’s willful misconduct. See Shager, 913 F.2d at 404 (common law rule regarding vicarious liability for intentional torts “usually is carried over to statutory torts, because statutes creating torts rarely bother to set forth all the ancillary doctrines ... that are necessary to compose a complete regime of tort liability”). To promote uniformity in the application of agency principles to the FCRA, we rely on the general common law of agency as opposed to the law of any particular state. See Kodrick, 54 F.Supp.2d at 794 (legislative history of the 1996 amendments to the FCRA “indicates that Congress did not intend that we establish differing rules for subscribers based on the agency law in each forum”). We note, however, that federal courts have adopted the Restatement of Agency in establishing federal common law, and that Illinois law parallels the Restatement. See Opp v. Wheaton Van Lines, Inc., 231 F.3d 1060, 1064 (7th Cir.2000) (“Illinois law of agency, as well as the federal common law of agency, accord with the Restatement”).
Under general agency rules, an employer may be vicariously liable for the acts of its employees under one of two theories. Under the respondeat superior doctrine, *952an employer is strictly liable for its employee’s acts committed within the scope of employment. Restatement. (Second) of Agency §§ 219(1). Intentional torts generally do not fall within the scope of this doctrine “unless the employee or agent is acting in furtherance (however misguidedly) of his principal’s business.” Rice v. Nova Biomedical Corp., 38 F.3d 909, 913 (7th Cir.1995); Restatement (Second) Agency § 235 (employee’s act is not within scope of employment “if it is done with no intention to perform it as a part of or incident to a service on account of which he is employed”); § 228. But see West v. Waymire, 114 F.3d 646, 649 (7th Cir.1997) (for public policy reasons, respondeat superior doctrine should apply where police officer extracted sexual favors from troubled teenaged girls).
An employer may also be subject to vicarious liability if an employee had apparent authority to act on behalf of the employer or was aided in accomplishing the wrongful act by the existence of the agency relation. Restatement (Second) Agency § 219(2). The apparent authority doctrine addresses the situation where an employee purports to exercise a power which he or she does not have; the “aided in the agency relation” doctrine applies where an employee threatens to misuse actual power. Burlington Indus., Inc. v. Ellerth, 524 U.S. 742, 759-60, 118 S.Ct. 2257, 141 L.Ed.2d 633 (1998). Most workplace tortfeasors are aided in accomplishing their tortious objective by the existence of the agency relation. Id. at 760, 118 S.Ct. 2257. The commentary to the Restatement suggests that this theory contemplates holding an employer liable only if the tort was “accomplished by an instrumentality, or through conduct associated with the agency status.” Restatement (Second) Agency § 219 cmt. e; Costos v. Coconut Island Corp., 137 F.3d 46, 49 (1st Cir.1998) (inn was vicariously liable for manager’s rape of customer where agency relation allowed manager to obtain victim’s room key). See also Ellerth, 524 U.S. at 760, 118 S.Ct. 2257 (in Title VII context, “aided in the agency relation standard requires the existence of something more than the employment relation itself’).
If an employer cannot be vicariously liable under one of these theories, liability may attach only where the employer expressly or implicitly authorized the conduct; the employer was negligent or reckless in allowing the conduct to occur; or the conduct violated a non-delegable duty of the employer. Restatement (Second) of Agency § 219(2).
C. Application to Metro Ford
1. Respondeat Superior Liability
Del Amora argues that Metro Ford is hable under a respondeat superior analysis because Roman was authorized to pull credit reports as part of his regular job duties. PI. Mem., pp. 4-6. This argument is without merit, given that Roman’s intentional actions were in no way designed to further Metro Ford’s business, and Metro Ford did not even know about Roman’s intentional misconduct until this lawsuit was filed. See Restatement (Second) of Agency §§ 235, 228; Rice, 38 F.3d at 913; Dillard-Heard v. Payne, No. 97 C 107, 1998 WL 67618 (N.D.Ill. Feb. 9, 1998) (“conduct that accrues to the sole benefit of the employee is generally regarded to fall beyond the scope of employment”). Roman committed a willful violation for purely personal reasons, which takes his conduct outside the scope of his employment at Metro Ford. Rice, 38 F.3d at 913 (“[ijntentional torts do not fall within the scope of the doctrine of respondeat superi- or unless the employee or agent is acting in furtherance ... of his principal’s business”). Metro Ford cannot be subjected *953to respondeat superior liability on these facts.
2. Aided in the Agency Relation Liability
Neither party addresses the “aided in the agency relation” standard; instead, both debate whether Roman had apparent authority as set forth in Jones. However, the apparent agency theory does not encompass the situation presented here, which involves an employee’s misuse of actual authority, as opposed to the exercise of authority the employee did not rightly have. See Ellerth, 524 U.S. at 759-60, 118 S.Ct. 2257. The aided in the agency relation doctrine requires a showing that the violation was “accomplished by an instrumentality, or through conduct associated with the agency status.” Restatement (Second) Agency § 219 emt. e. In this case, it is undisputed that Roman was able to obtain Del Amora’s credit report solely by virtue of his position with Metro Ford and his resultant access to Metro Ford’s consumer reporting facilities. Metro Ford is in the best position to prevent future FCRA violations through employee training and screening programs, and it is therefore liable for Roman’s actions. See, e.g., Jones, 144 F.3d at 965-66 (apparent authority theory “is in keeping with the FCRA’s underlying deterrent purpose because employers are in a better position to protect consumers by use of internal safeguards”).
3. Direct Liability
Having determined that Metro Ford is subject to vicarious liability under the aided in the agency relation standard, we next consider whether there is any basis for holding the company directly liable under the Act. To hold Metro Ford directly liable for Roman’s willful violation of the FCRA, Del Amora must demonstrate that (1) Metro Ford implicitly, or expressly authorized his misconduct; (2) Metro Ford was negligent or reckless in allowing the misconduct to occur; or (3) the misconduct involved a non-delegable duty belonging to Metro Ford. -Del Amora cannot establish any of these requirements. Del Amora admits that Roman did not have any express or implied authorization from Metro Ford to obtain the credit reports. Nor do we find support for the argument that Roman violated a non-dele-gable duty belonging to Metro Ford. It is clear that “all persons,” including Roman, have a duty to refrain from using or obtaining credit reports for improper purposes. 15 U.S.C. § 1681b(f).
Del Amora does not assert a negligence claim in his complaint, but he now suggests that questions of fact exist as to whether Metro Ford was negligent or reckless in allowing Roman to violate the statute. The Seventh Circuit has made it clear that “it is too late in the day to be adding new claims” in response to a summary judgment motion. Auston v. Schubnell, 116 F.3d 251, 255 (7th Cir.1997). Nevertheless, to the extent that this new theory does not change the outcome of the case and there is no prejudice to Metro Ford, we will allow Del Amora effectively to amend the pleadings pursuant to Fed. R.Civ.P. 15(a), and will consider the argument on its merits. See Bethany Pharmacol Co. v. QVC, Inc., 241 F.3d 854, 860-61 (7th Cir.2001) (“leave to amend a complaint should be freely granted when justice so requires”).
Del Amora asserts that “Defendant has not put forth any evidence that it had any policies in place to ensure compliance with the Fair Credit Reporting Act.” PL Mem., p. 6. It is worth repeating here that Del Amora never responded to Metro Ford’s Local Rule 56.1 statement of facts or supplied his own statement of material facts. He has offered no evidence regarding the alleged deficiency of Metro Ford’s policies. *954Having failed to comply with the applicable Local Rules, Del Amora cannot now avoid summary judgment with bald speculation that Metro Ford’s policies may have been deficient. Patterson v. Chicago Ass’n for Retarded Citizens, 150 F.3d 719, 724 (7th Cir.1998) (“a plaintiffs speculation is not a sufficient defense to a summary judgment motion”). Without any evidence that Metro Ford’s policies were in fact inadequate to ensure compliance with the FCRA, Del Amora cannot proceed on a negligence claim.
In sum, because Del Amora has produced no evidence sufficient to permit a finding of Metro Ford’s direct liability for Roman’s willful violation of the FCRA, the Court grants summary judgment for Metro Ford on the claim of direct liability.
Conclusion
For the reasons stated above, Metro Ford’s motion for summary judgment [docket item 3-1] is granted on the claim of direct liability but is otherwise denied. Del Amora’s cross-motion for summary judgment is granted on the claim of vicarious liability. The case is set for a status hearing on July 3, 2002 at 9:30 a.m.