Employers should understand the Fair Credit Reporting Act (FCRA) requirements for background checks because these laws apply to employers—not just to businesses checking consumer creditworthiness.
Claims of negligent hiring are on the rise, as are incidents of workplace violence and theft, making employers feel they need to know as much as possible about every employee. The need to investigate and confirm application data is more important than ever.
However, in an effort to appropriately balance an employer's "need to know" with an employee's privacy and equal employment opportunity rights, laws like FCRA seek to regulate the type and amount of information that employers may obtain. Employers need to stay in compliance with the law while still finding out what they need to know to make good hiring decisions.
Understanding FCRA requirements for background checks: 4 steps
Summarizing the employer FCRA requirements for background checks can be put into 4 steps:
- Employer certification to CRA
- Disclosure to and authorization from the applicant
- Pre-adverse action protocol
- Adverse action protocol
Employer certification to the CRA.
When an employer requests a consumer reporting agency (CRA) to conduct a background check, they must certify that they have notified the individual (employee or applicant) clearly and conspicuously that a consumer report is being requested. This means that they should have signed an authorization form from the potential employee that serves as written authorization from that individual allowing the employer to obtain a copy of the consumer report.
The statement to the employee or applicant should say that the employer will only use information for permissible purposes (which includes making employment decisions). It should also say that the employer will comply with the conditions for adverse action if necessary, and that information from the consumer report will not be used in violation of any applicable federal or state equal protection laws or regulations.
The employer should provide a copy of the written authorization that has these statements and all pertinent information for the background check to be run by the CRA. In fact, the CRA should be giving the employer the federally-mandated form to use—only hire CRAs who do this.
Disclosure to and authorization from the applicant
When you get the written authorization described above, the other side of the coin is that you're also disclosing the nature of the background check to the applicant.
"You have to disclose to the applicant that . . . ’we're going to be running a background report on you. Here's what we're going to get, and here's why we're going to get it.’" Sara Hutchins Jodka explained in a recent BLR webinar. This disclosure needs to be in a stand-alone document, not added to the employment application. A copy of the form is given to the CRA. "It has to notify the applicant clearly and conspicuously and in writing that a consumer report is being requested for employment purposes and the information contained in the report may be used in employment-related decisions."
Individual states may have additional requirements on authorization and disclosure—be sure to understand your state laws as well.
Pre-adverse action protocol
If you have gotten back a report that has information that means you may take an adverse employment action (firing a current employee or not hiring an applicant, for example) that triggers the next step. Before taking an adverse action based in whole or in part on information in a consumer report, the employer must provide to the applicant or employee a copy of the report received. They must also provide a copy of the document "Summary of Your Rights Under the Fair Credit Reporting Act," which can be downloaded online.
These items must be provided a reasonable time period before taking adverse action to give the individual time to respond. The amount of time that is reasonable varies by industry but is not clearly defined in the statute. It is better to err on the side of giving the individual more time—such as one or two weeks—even though this is not clearly defined.
Though not required, it is also advisable to send these notices with the ability to track delivery, such as via certified mail or FedEx, so that you have evidence of meeting your requirements under the law.
Adverse action protocol
If you do make the final determination to take adverse action, then another letter is required: the employer must provide an "Adverse Action Letter." The Adverse Action Letter includes:
- The name, address, and telephone number of the CRA that provided the report.
- A statement that the CRA did not make the adverse decision and is not able to provide the applicant with any specific reasons why the adverse action was taken.
- A statement that applicant has the right to obtain a free copy of the consumer report from the CRA by making a request within 60 days.
- A statement that the applicant can dispute the accuracy or completeness of any information in the report directly with the CRA.
"FCRA is not that difficult—these aren't that hard to do ... The problem is documenting it, training HR, making the copies, sending the certified mail—that's what gets tedious, especially if you're a large employer and you have so many applicants that you're dealing with." Jodka noted.
For more information on FCRA requirements for background checks, order the webinar recording of "Conducting Legally Sound Background Checks: New FCRA Requirements and EEOC Guidance Explained." To register for a future webinar, visit http://store.blr.com/events/webinars.
Attorney Sara Hutchins Jodka of Porter Wright has significant experience representing employers in all facets of employment-related litigation. Ms. Jodka has drafted company handbooks, workplace policies, and more.