Part 2: Background Checks and the Fair Credit Reporting Act

This resource has multiple chapters. Use the navigation on the side or below to browse each chapter.

As we discussed in Part One of this series, “Check Background or Risk a Smackdown for Your Organization,” background checks can be an important part of a comprehensive pre-employment screening process. But there are several considerations an organization must take into account. Local “ban the box” or fair chance hiring laws may restrain when or how you can conduct certain background checks. Even if your locale doesn’t have a “ban the box” law (yet), you still don’t have carte blanche to run background checks. The federal Fair Credit Reporting Act, which is a misnomer because it applies to more than just credit reporting, also applies to certain criminal background checks.

Complying with the Fair Credit Reporting Act: When Does the Law Apply?

There are several ways to do a criminal background check. The most common way is to have a third-party service provider conduct the check for you. There are several advantages to doing this, particularly if you have a trusted provider. (For more information on how to find a provider that works for your organization, see Part One of this series.)

If you have a background check done by an outside company that is in the business of compiling background information, you must follow specific rules under the Fair Credit Reporting Act (FCRA). Technically, the FCRA applies when using a report compiled by a “credit reporting agency” to make employment decisions. Because of its reference to credit reporting, the reach of the FCRA may seem limited. But, while it does cover credit checks in the traditional sense, it also covers most third-party service providers who compile criminal background check information. So, if you are contracting out your background checks, it is likely the FCRA applies.

In contrast, if you aren’t using a third-party service, but are just obtaining criminal records from (for instance) the local police department, the FCRA is not implicated (although some other law might be, so it is important to check the laws specific to your jurisdiction). It is also always a good idea to get permission from the applicant to go looking for their personal information. But these days, many background checks are done through credit reporting agencies, and thus, will be governed by the FCRA.

So, what do you need to do to stay on the right side of the law?

While individualized review of your company’s process is recommended, some general principles are instructive. The federal Fair Trade Commission (FTC), which enforces the FCRA, has compiled a helpful resource on what employers need to know. This resource is very informative and can serve as a starting point for compliance in your screening process. Generally, FCRA requirements fall into three distinct phases: (1) before running the background check, (2) before taking “adverse action” (for example, revoking a conditional job offer), and (3) after taking the adverse action.

Complying with the Fair Credit Reporting Act: Before You Run the Background Check

Before you run a background check—or before you tell your service provider to run it—there are several things your company must do. Remember, the FCRA will come into play if a consumer reporting agency is compiling the background check.

First, you must provide the prospective employee with an appropriate notice. This notice should be conspicuous enough so that the person knows that you are planning to run a background check that will be used in the hiring process. It should be a stand-alone notice, not just part of the employment application. It also should not have a lot of extra language—keep it simple.

Second, you need to have permission to run the check. This should be done in writing, and can be in the same document as the notice.

Third, when you go to run the check with the third party service, you must certify to them that you’ve complied with the FCRA.

Finally, although this is not a rule of compliance with the FCRA, it is important to make sure no other local rules apply. Some jurisdictions may have specific rules regarding running background checks and what can or cannot be considered in hiring. It is always important to check city or state rules.

Complying with the Fair Credit Reporting Act: Before You Take Adverse Action

The FCRA also provides employees with rights in the event that the background check comes back unfavorable to the employee and the employer decides to take some sort of adverse action. An adverse action is exactly what its name implies. It might include deciding not to offer the job, rescinding a conditional job offer, firing or demoting an already hired employee, or passing over an employee for a promotion. Before you can take an adverse action in response to the information you received in the report, you need to let the employee know a few things.

Under the FCRA, before you take the adverse action, you must give an employee or prospective employee an initial notice of what you intend to do, along with a copy of the report that informed the decision-making process. You must also give them a summary of their rights under the FCRA. You can provide them with this summary.

The purpose of the notice is to allow the employee or applicant to cross-check with the credit reporting organization and ensure his or her information is being accurately reported. This makes good sense; businesses should make sure they are relying on accurate information, just as much as applicants desire to have their information conveyed correctly.

Complying with the Fair Credit Reporting Act: After You Take Adverse Action

Finally, if you decide to actually take the adverse action in response to a credit report (including a criminal background check compiled by a third party service), you must provide the employee or applicant with a second notice after you’ve taken the action. This is called an “adverse action notice.” The adverse action notice must contain the following information:

• Information about the company that compiled the report, including the company’s name, address, and phone number;

• A disclaimer that the company that compiled the report was not the one that made the decision to take the adverse action and cannot provide a specific reason for the adverse action; and

• A notice to the employee or applicant that they have the right to dispute the accuracy or completeness of the information in the report. The notice also must tell the employee or applicant that they have the right to request a free additional report from the reporting company if they request it within 60 days.

Regardless of whether a business takes an adverse action in response to a report, the FCRA also requires that information obtained be securely disposed of once you are done using it.

Getting this wrong can subject the organization to penalties, and depending on the violation, these can be substantial. The statutory amount of a single violation is not itself very large, but if several of these pile up, the repercussions can be severe. In recent history, FCRA violations have been a basis for class-action lawsuits against organizations. Spend a little time to develop a comprehensive and holistic, but compliant, employee screening program—it can go a long way toward minimizing risk and ensuring the right people are on-board. In the next and final post of this series, we will take a look at what can happen if an organization mishandles the background check process through a recent case out of California.