The Fair Credit Reporting Act (FCRA) governs credit checks and reporting, right? If a credit reporting agency reports incorrect information and fails to correct it after being notified – or wrongfully runs a credit check – it violates FCRA. But did you know the FCRA also governs employment background checks?
FCRA does not apply to an employer that conducts background checks for itself. FCRA only applies if an employer uses a outside company (also known as a third party) to conduct all or part of a background check. (A third party can include websites that aggregate information from public sources and sell it to employers.) If you do not use a third party in gathering information to make employment decisions, you can stop reading now. If you do use an outside company for investigating applicants and employees, you need to read further.
The background information covered by FCRA includes details relating to character, general reputation, personal characteristics and mode of living. FCRA applies regardless of the source of the information: social media, criminal background reports; workers’ compensation histories and medical reports; motor vehicle reports; reference checks; verifications of education, license or past employment; or credit history reports.
Many employers require drug screens but don’t obtain background checks. FCRA does not apply to drug/alcohol screens if the employer orders the screen and the facility sends the results directly to the Medical Reporting Officer of the employer. FCRA does apply when a third party, as part of its investigation efforts, obtains drug screen results from the screening facility and reports it to an employer). FCRA imposes greater protections for applicants and employees if the third party conducts personal interviews of references and past employers.
FCRA also restricts the information that may be reported to an employer. Reports may not contain information regarding:
- Bankruptcies more than 10 years old;
- Lawsuits and judgments more than seven years old;
- Paid tax liens more than seven years old;
- Accounts placed for collection or charged to profit and loss more than seven years old;
- Records of arrest, indictment or conviction more than seven years old;
- Any other adverse information more than seven years old.
FCRA Requirements
Many of FCRA’s requirements are procedural. As mentioned above, checks that involve personal interviews require greater efforts on the part of the employer. As a best practice, it is wise for the employer to follow the more stringent requirements in every case so it does not have to worry about the actions the background service took or did not take.
Obtaining Background Information
Before an employer orders a background report from an outside company, the employer must:
- Notify the applicant or employee that it may obtain background information on the individual for employment purposes. This initial notice and disclosure must be made in writing in a separate document containing no other content and must be clear and conspicuous. The notice must include:
a. A statement that the investigative consumer report may include information about the individual’s character, general reputation, personal characteristics or mode of living;
b. A statement advising the individual of his or her right to make a written request to the employer for a complete and accurate disclosure of the nature and scope of the investigation requested by the employer;
c. A statement that the employer is required to disclose the nature and scope of the investigation to the individual, in writing, within five days after the date the employer receives the individual’s request for disclosure or the date the employer requests the investigative consumer report, whichever is later; and
d. A copy of the “summary of consumer rights.”
- Obtain written consent or authorization from the applicant or employee. If the report will include medical information, the applicant or employee must specifically consent to the inclusion of the medical information in the report. The consent or authorization form should state that it is a continuing consent and will remain valid until the applicant or employee revokes the consent in writing. It is also a good practice to include general release language in the consent.
- Certify to the third party that it (1) has a “permissible purpose” for procuring a report; (2) has provided the required disclosures to the applicant or employee; (3) has obtained the requisite written authorization from the applicant or employee; (4) will not use the information contained in the report in violation of any federal or state equal opportunity law or regulation; and (5) will, if any “adverse action” is to be taken based on the report, provide the applicant or employee with a copy of the report and the FCRA Summary of Rights.
Acting on Information
Pre-action Notice
Before an employer may take adverse action against an applicant or employee that is based in whole or in part on a background report obtained through a third party, it must provide the individual with:
- A description of the intended action;
- A copy of the background report; and
- A copy of the FCRA summary of consumer rights.
Notice of Adverse Action
Although FCRA does not prescribe a specific waiting period, a Federal Trade Commission (FTC) opinion letter suggests an employer should wait at least five business days before undertaking the adverse action. Presumably, this allows the applicant or employee sufficient opportunity to explain or refute the information that is the basis for the adverse action.
After waiting a sufficient period of time, the employer may follow through on the pre-announced adverse action by sending final notification. The notification must include:
- An explanation of the adverse action.
- The name, address and telephone number of the reporting agency (including the toll-free number for the reporting agency if it operates on a nationwide basis) that provided the report.
- A statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide the individual the specific reasons why the adverse action was taken.
- A statement that the individual has the right to request a free copy of the report from the consumer reporting agency within 60 days after the individual receives this notice.
- A statement that the individual has the right to dispute with the consumer reporting agency the accuracy or completeness of any information in the report.
While FCRA does not require this notice to be in writing, employers are advised to provide written notice anyway.
Much FCRA litigation against employers involves the failure to provide pre-adverse action notice. Although FCRA requires a reasonable time for an applicant or employee to dispute background information, FCRA does not contain a specific requirement that an employer refrain from taking the adverse action if an applicant or employee successfully refutes the information. However, ignoring exculpatory information could give rise to pretext and other arguments in discrimination litigation.
Exceptions
Excluded from FCRA requirements are (1) misconduct investigation reports; and (2) investigation reports into “compliance with Federal, State, or local laws and regulations, the rules of a self-regulatory organization, or any preexisting written policies of the employer.” As a result, employers no longer have to notify the accused employee of the investigation, seek consent from the accused employee, provide the accused with a copy of the report, or wait a “reasonable” amount of time between giving the accused employee a copy of the report and taking adverse action. However, the accused employee is entitled to a summary of the “nature and substance” of the report. Employers should remember that internal investigation efforts are not subject to FCRA. FCRA applies only if a third-party entity conducts the investigation.
The Disposal Rule
FCRA requires disposal practices that are reasonable and appropriate to prevent the unauthorized access to – or use of – information in a background check. For example, reasonable measures for disposing of consumer report information could include establishing and complying with policies to:
- burn, pulverize, or shred papers containing consumer report information so that the information cannot be read or reconstructed;
- destroy or erase electronic files or media containing consumer report information so that the information cannot be read or reconstructed;
- hire a certified contractor to dispose of material.
Various federal agencies have document retention regulations, so you need to check how long background information must be retained before disposal. A good rule of thumb is four years. If agency proceedings or a lawsuit is commenced, information must be retained until the proceeding(s) is concluded.
Damages
A FCRA action must be brought within two years after the applicant or employer learns of the facts constituting a violation, or five years, whichever is earlier. A violation of FCRA can subject an employer to civil liability. Relief can include the actual damages, including emotional distress, punitive damages (in cases of willful violations), and attorney’s fees and costs. More importantly. class action procedures are available. The class is easy to identify: applicants who were denied employment, or employees who were subjected to adverse action (not based on misconduct) based on information in a covered background check, who did not give the required consent, and/or who did not receive the required notices.
The Bottom Line
- Review your application and hiring document procedures.
- Prepare and use the required consents, notices and disclosures. Remember that no form fits all employers. Notice for applicants may need to be different from those for employees.
- Restrict the number of background checks you obtain. Just as you make hiring conditional on drug screens and/or medical examinations, restrict the use of background checks in the same manner. Reduce or limit your applicant pool before obtaining background checks.
Remember that other federal and state laws and regulations may impact the use of information contained in a background check. Just because you comply with FCRA does not give you clear sailing for other employment laws.