What is the FCRA?
Enacted back in 1970, the Federal Fair Credit Reporting Act (FCRA) was designed to promote fairness and accuracy and ensure data confidentiality for consumers when their consumer reports are obtained through third-party Consumer Reporting Agencies (CRAs). The Federal Trade Commission (FTC) and Consumer Financial Protection Bureau (CFPB) enforce the FCRA.
Despite misconceptions, consumer reports do not just pertain to credit reports generated by Equifax, Experian or TransUnion. Under the FCRA, consumer reports include any information from a CRA which bears upon a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living. This means employment background checks, too.
According to a recent survey conducted by the Professional Background Screening Association (PBSA), 93% of organizations with a U.S. location conduct some type of background screening. This percentage is expectedly high because background checks are vitally important to businesses that want to hire the best people but also ensure safety for their employees and assets.
Performing these valuable screenings comes with obligations, not the least of which is adhering to the requirements of the FCRA. In the event of non-compliance with the FCRA, costly litigation can follow. In a 2021 Webrecon report, the FCRA was found to be the only consumer statute showing consistent yearly increases in consumer complaints. These cases can come with hefty monetary damages, ranging from hundreds to millions of dollars that employers want to avoid at all costs (pun intended). By using this guide as a resource, you can significantly reduce your legal exposure.
Understand your FCRA duties and put proper processes in place
Being aware of the FCRA requirements can help employers put proper measures in place to minimize litigation risk. Here are best practices employers should keep top of mind:
- Ensure a “permissible purpose” of employment only
If you have an agreement in place with your screening provider to screen for “employment purposes”, you should not be performing checks for any other reason. Conducting checks for any other purpose would be a violation of the FCRA. - Provide proper disclosure and obtain written authorization
Employers must provide a “clear and conspicuous” disclosure to consumers and obtain written authorization prior to performing a background check. There have been many class-action lawsuits centered around non-compliant disclosures. A few years ago, the FTC provided guidance on how to keep required disclosures simple, because using overly complicated language may in fact violate FCRA requirements. Note: If your candidates are logging into a secure portal to enter data for their background check, it’s likely that this requirement is captured there. Ask your screening provider to be sure! - Follow the two-step adverse action process
Adverse action is any action that is unfavorable to the consumer based in whole, or in part, on something found in the background check. When this happens, a two-step notification process is required. Step one requires that a notice be sent to the consumer which includes a copy of the consumer report and a copy of “A Summary of Your Rights Under the Fair Credit Reporting Act”. This step gives the candidate an opportunity to review the report and dispute any information that may be incorrect. After a sufficient amount of time of at least 5-10 business days, and if there is no dispute, a final adverse action notice can be sent.
This notice tells the consumer of your final decision and must include:- The name, address, and phone number of the consumer reporting company that supplied the report
- A statement that the company that supplied the report did not make the decision to take the unfavorable action and can't give specific reasons for it
- A notice of the person's right to dispute the accuracy or completeness of any information the consumer reporting company furnished, and that they may get an additional free report from the company if requested within 60 days
- Certify compliance to your CRA
Prior to obtaining a consumer report, an employer must provide certification to the consumer reporting agency that the employer 1) has complied with disclosure and authorization requirements, 2) will comply with adverse action, and 3) will not use reports in violation of any applicable Federal or State equal employment opportunity law or regulation. Ensure that you are providing this certification with each background check request. - Securely maintain and properly dispose of reports
Employers are responsible for secure maintenance and destruction of consumer reports. Be sure to store data securely and dispose of the data securely once you are done with it. Confidentiality and protection of consumer data are of high importance generally, but especially as it pertains to the FCRA. More specific FTC guidance on this topic can be found here. - Include the “Summary of Rights” when sending report copies to consumers
Any time a consumer requests a copy of their report it should be provided to them securely
along with a copy of “A Summary of Your Rights Under the Fair Credit Reporting Act”. - Consult with your legal counsel
Certn prides itself on being an educational resource to our clients as a screening provider, but Certn does not provide legal advice. Most consumer reporting agencies (CRAs) do not. We recommend that you speak with your legal counsel to ensure you have all proper controls in place to stay compliant with the FCRA in addition to any state/local laws that may impact the implementation of a successful screening program at your organization.
Other Important Considerations
In addition to the FCRA, we want to remind you of a few other Federal, State, and Local
legal frameworks that often play a role in conducting compliant background checks for
employment purposes.
- Equal Employment Opportunity Commission (EEOC) Guidance of 2012
In 2012, the EEOC released guidance for employers on how to perform criminal background checks in a non-discriminatory fashion. It isn’t a law, but rather resource employers should look to when creating hiring policies and making employment decisions to ensure fairness and to avoid Title VII discrimination claims. It touches on the idea of not using bright-line hiring policies which adversely impact minority groups. The guidance also urges employers to conduct individualized assessments on every consumer by considering and documenting the nature of each criminal offense, how much time has passed since the offense and its relation to the job before making any decisions. It is a good idea to read and understand this guidance. Certn also has samples of individualized assessments for our clients. - State/Local Ban the Box and Fair Chance Laws
All over the nation, 37 states and over 150 cities have implemented some sort of criminal justice reform law. These laws often termed “Ban the Box” or “Fair Chance” laws aim at making it easier for ex-offenders to find their way back into the workplace. The most basic type of these laws and ordinances may simply “ban the box” where an applicant must indicate if they
have a prior criminal history. The more modernized versions of these laws incorporate conditional offer requirements prior to running background checks, individualized assessment requirements, criminal record usage limitations, adverse action requirements beyond the FCRA, and the list goes on. You will want to consult with your counsel about where your business operates to ensure that you adhere to all appropriate requirements. A helpful guide can also be found on the National Employment Law Project (NELP) website. - Credit reports in hiring decisions
Performing credit checks as part of a background check is a hot-button topic these days. Not only have many states and localities put detailed limitations on their use in employment decisions but a few states have also added consent form specificities (e.g. CA, MD, WA, OR, CT, VT, CO) and layered on notice and adverse action requirements. To boot, some states/localities have banned the use of credit checks completely (with narrow exceptions). Credit checks should only be requested in limited instances. If you want to perform credit checks, but are unsure if you should, reach out to your legal counsel or screening provider to help you decide! Certn has many resources to help you determine if credit checks are right for you. - Consider carefully the types of checks you are performing for each role
When you are creating hiring policies and determining what types of checks to perform for certain roles, it is recommended that you only perform checks that are relevant to the role you
are hiring for. For example, it does not make sense to perform a motor vehicle check for a laborer who won’t be required to drive as part of their job or to perform a credit check on someone who will be an entry-level office employee. It is equally important that whatever checks are deemed appropriate for a certain role, the same checks are performed for everyone in that role. Discrimination claims often arise from treating people in the same role differently. Avoid these issues by working with your counsel to clearly define screening procedures prior to starting the hiring process. Following well-defined procedures decreases the risk of unintentional bias.
Looking for a quick reference guide? Here is a summary of what you as an employer should consider as best practices for compliance: USA Employers FCRA Best Practices Guide