FCRA Compliance: An In-Depth Guide for Employers

Do you use or plan to use background checks for employment purposes? If so, your business faces a legal requirement to achieve FCRA compliance. The FCRA, or the Fair Credit Reporting Act, is a federal law that protects the privacy and rights of the subjects of consumer reports. Background checks for employment purposes qualify as consumer reports, which means they are subject to the provisions of the law.

The “employment purposes” covered by the law include part-time or full-time employees and contractors, temporary workers, agents, or volunteers. You must follow the Fair Credit Reporting Act requirements whenever you’re using a background check to vet someone who will work for you. In this article, you’ll find a comprehensive guide to understanding this law and your compliance obligations.

What Is the Fair Credit Reporting Act?

The Fair Credit Reporting Act is a federal law intended to ensure the privacy, accuracy, and fairness of consumer reports. Initially created to regulate credit checks and mainly applied to credit bureaus, the FCRA today extends to companies that conduct background checks. Employers, landlords, lenders, and other entities regularly using such reports must follow the law’s regulations to avoid potentially costly violations.

History

Passed in 1970, the FCRA became the first significant law to ensure that consumer reporting agencies acted with fairness, impartiality, and respect for the consumer’s right to privacy. This law protects the subject of a check by limiting what a consumer reporting agency (CRA) can report. Effective nationwide, the law is the key landmark for consumer, employee, and job seeker rights. It was the first law in the United States to regulate how private businesses could access and use someone’s personal information. Though more laws regulating background checks have since come into force, the FCRA remains one of the most crucial laws on background checks.

At the FCRA’s inception, the credit reporting industry was amidst massive growth. The end of the 19th century saw the creation of the first significant CRA in American history, called the Retail Credit Co. Retail Credit grew considerably over the first half of the 20th century, acquiring smaller agencies and expanding its influence.

The growth of Retail Credit and the broader credit reporting industry inspired controversy and backlash. Credit reports could deny consumers key opportunities, from loans to housing. There was no mechanism for consumers to review their credit reports, dispute their accuracy, or explain a lapse to a creditor.

Not only did consumers have no rights to their own reports, but industry practices were unethical, too. Credit investigators charged with assembling consumer credit reports had to reach “quotas” for adverse information on their reports.

To achieve those quotas, some investigators used incomplete information to impact consumers negatively.

In other cases, investigators fabricated negative information. Sometimes, they relied on highlighting private information, such as race, national origin, sex, etc, claiming these details revealed credit-relevant information about a person’s “character.”

Such abuses ultimately led Congress to launch an inquiry into the credit reporting industry, which led, in turn, to the Fair Credit Reporting Act.

The law took effect on April 25, 1971. Amended and improved over the years, it remains the primary regulation for the reporting industry. It applies to entities ranging from the three major credit reporting bureaus (Equifax, Experian, and TransUnion) to screening companies such as backgroundchecks.com.

Purpose

The FCRA exists to protect the rights of consumers, job seekers, and employees. In the past, there was no way to defend oneself from unethical, inaccurate, or intrusive reports. Now, a far-reaching law protects these rights and lays out mechanisms for their protection.

Even though it mentions “credit reporting” in its title, the FCRA today applies to much more than credit reports. It now extends to any reports that concern “matters of character, general reputation, personal characteristics, mode of living” and similar information. In other words, the factors that could determine a person’s eligibility for housing, credit, insurance, or employment.

By those standards, screening companies qualify as a “consumer reporting agency,” and thus, employee background reports are also consumer reports subject to these regulatory measures.

Within the FCRA, there are rules about what consumer reporting agencies may share. For instance, bankruptcy cases can be no older than ten years, and all other adverse information—except criminal convictions—can be no older than seven years. Reports cannot share medical information unless they are for business conducted by insurance companies.

In addition to protecting the consumer once a check is underway, the FCRA requires an employer to disclose their intention to run the check and obtain the subject’s permission beforehand.

Understanding the “Seven-Year Rule”

Employers may experience confusion over how far back a criminal background check goes because of the law’s time limits on reporting. The confusion grows when combined with state laws that may also impact reporting limits. However, the reality is that the FCRA’s “seven-year rule” never applies to criminal convictions. Convictions could appear on a candidate’s background check report forever in states that do not limit criminal history reporting. While some states have extended such limitations to conviction, many have not.

While states often have their own laws concerning consumer reporting, no state can pass a law that pre-empts the FCRA. As a federal law, all background check companies and employers in the United States must obey this law. However, states may pass laws that go further and are stricter.

FCRA Compliance Requirements for Employers Running Background Checks

Any employer using information obtained through a reporting agency for employment purposes must follow the letter of the law. These requirements apply whether you’re hiring for a full-time position or a part-time job. They also apply whether you’re vetting contractors or temporary employees. Even screening volunteers requires you to obey this law. All these individuals have rights regarding personal information in consumer reports that you must respect as an employer.

To learn more about how FCRA compliance works in the context of the pre-employment background screenings that backgroundchecks.com provides, continue reading below.

Before using our services

Before conducting a background check for employment purposes, educate yourself on the requirements of the law. Start by reading the Consumer Financial Protection Bureau’s “Notice to Users of Consumer Reports.”

Before the check

The first steps of the background screening process are straightforward for both the employer and the applicant.

First, the employer must provide the applicant with a disclosure form. This paperwork informs the candidate that you intend to check their background for employment purposes. This disclosure must be separate from any other documents. You cannot, for example, include the disclosure language as an integrated part of an employment application or a release of liability.

Second, the applicant must sign an authorization that permits the employer to run a background check. Similar to the disclosure form, the consent authorization form must be a standalone page separate from other application documents.

The FCRA permits the combination of the disclosure and authorization forms, though they can also appear separately. If you do choose to combine the two documents, note that the combined form cannot contain anything other than disclosure and authorization.

Check whether each sentence in your form can begin with either “We hereby disclose to you that...” or “You hereby authorize us to...”. If not, there is likely extraneous information that might make it non-compliant. Always consult with legal counsel when preparing these documents to ensure that they follow the letter of the law.

To better understand why the proper presentation of disclosure and consent documents matters, read this article about a court ruling from 2017. A court found that FCRA disclosures containing waivers were “willful” violations of the FCRA simply because they incorporated additional liability waiver terms. Even seemingly simple mistakes could mean lawsuits, court cases, and fines.

Realize that these rules of proper disclosure and authorization don’t just apply to criminal history checks. In any situation where backgroundchecks.com obtains information for you based on an interview (for example, during reference checks), you must provide additional disclosures.

You must inform the subject that you’ll obtain an investigative consumer report about them, including information about character, general reputation, personal characteristics, or way of living.

You must also inform the subject that they have a right to request a description of the nature and scope of the investigation. If the subject requests that description, you must provide it within five days.

Before the decision

If a background check returns no red flags, the employer may choose to move forward with hiring the applicant. In these situations, the employer has no more obligations to fulfill under the FCRA.

However, if you decide to rescind a job offer or disqualify a candidate based on your findings, additional FCRA requirements apply. Such decisions qualify as an “adverse action.” Employers considering adverse action must take further steps to maintain compliance.

Specifically, the FCRA requires you to send the candidate a “pre-adverse-action notice” before you officially finalize your decision. The pre-adverse action notice must include a copy of the background report and the Consumer Financial Protection Bureau’s summary of rights.

You must send this pre-adverse notice a “reasonable time” before deciding based on the report. The Federal Trade Commission states that five business days is a reasonable time for the notice to arrive via first-class mail. If that five-day period elapses without a response from the subject, you may move forward with a decision based on the background check report. You may also communicate adverse action notices via email. However, use the method your applicant prefers.

If the subject initiates a dispute over the background report, you must pause your decision-making process. You may not move forward with adverse action until the background check company has resolved the candidate’s dispute.

At the decision

If the subject does not respond to the pre-adverse action notice, you can move forward with the hiring process. Similarly, if the background check company pursues the subject’s dispute but rules that the information included in the report is accurate, you may also proceed. You must now issue a “Final Notice of Adverse Action.”

In addition to these rules, many states (notably California) have additional requirements concerning using a background check company’s services. Always consult local laws and regulations and speak to legal counsel to verify your compliance with local provisions.

Now, let’s look at each element of compliance in greater detail.

Proper Disclosure & Consent

An employer must disclose to the candidate, in writing, that they intend to obtain a report for employment purposes. They must present this disclosure form as either a standalone document or paired with only an authorization and consent form.

Employers may not bundle the disclosure and consent agreements with any other employment or application-related materials. Each candidate must know precisely what they agree to when they sign a consent form for a check.

Remember that you must also have a signed authorization form to move forward with obtaining a report. If the candidate refuses to sign the consent form, the employer has the right to disqualify that candidate from employment consideration. You may not proceed with the screening without consent.

Pre-Adverse Action

“Adverse action” refers to an employment decision that negatively affects a job candidate, such as disqualifying an applicant for a job because of a red flag on the criminal report.

Per the FCRA, employers must provide a candidate with notice if they are considering making an adverse decision about the candidate based on background findings. Employers must provide this notice to the applicant before they finalize their decision.

In addition to a pre-adverse notice, the employer must provide the candidate with a copy of the report that led to the decision and a copy of the summary of consumer rights from the Consumer Financial Protection Bureau. The employer must then wait a reasonable period before making the adverse decision official and moving on with the hiring process.

How long is a reasonable wait time? According to the Federal Trade Commission, employers should provide their candidates at least five business days.

The waiting period provides time for the candidate to dispute the report with the reporting agency. A candidate may wish to challenge the report’s accuracy. In some cases, they may want to provide context for their background check so that the employer has a fuller picture of the facts. Allowing this period to elapse is fundamental to compliance.

Adverse Action

Any adverse hiring decision activates a checklist of FCRA requirements that the employer must follow strictly.

If an employer chooses to act against a candidate because of something they learned in a check, they must finalize the decision by taking the following steps:

• Notify the candidate of the adverse decision
• Provide the candidate with information about the company that prepared the background reports, including the company name, address, and phone number
• Include a disclaimer to the candidate that the investigation company prepared the report but did not make the adverse decision
• Inform the candidate that they have the right to request another free copy of their report from the check company at any point within the next 62 days, and
• Tell the candidate that they can dispute any information on the report with the screening company should they believe that there is any outdated or inaccurate information.

Employers should also check their state laws, which may stipulate additional requirements for this adverse decision step. Consulting with an attorney with expertise and experience navigating the nuances of employment law can be helpful here.

Sample FCRA Forms

At backgroundchecks.com, we strive to make compliance easy for our customers. We know that screening laws are often confusing. We also know that with a law like the FCRA, the stakes for compliance are high. Violations can lead to costly lawsuits and other problems for employers.

By providing access to a dedicated compliance area in our web-based background check ordering system, we strive to provide greater clarity on compliance issues for our partners. Here, you can view sample FCRA-compliant forms, notices, and other documents to help you navigate the process of designing a compliant screening process for your organization.

Forms available through this portal include:

• Sample disclosure forms
• Sample authorization forms
• Consumer summary of rights
• Sample pre-adverse action notices
• Sample adverse action notices
• An overview of FCRA employer obligations
• An overview of how the Driver’s Privacy Protection Act of 1994 impacts the use of motor vehicle reports in consumer investigations

Equal Employment Opportunity Commission (EEOC)

The FCRA is not the only guide for legal compliance during background investigations. Another factor to consider when devising a compliant background screening policy for your business is the Equal Employment Opportunity Commission (EEOC).

The EEOC provides federal guidance on using background checks to protect the rights of minorities, women, people with disabilities, and other groups. The organization’s mission is “to stop and remedy unlawful employment discrimination in the workplace by enforcing federal laws that prohibit employment discrimination.”

The EEOC argues that background checks for employment can lead, intentionally or not, to discrimination in hiring. If the EEOC deems there to be an issue of discrimination with an employer’s hiring policies, the commission may file a lawsuit against that employer. As such, you should always consider EEOC guidance when devising policies and protocols for vetting candidates.

EEOC guidance on background checks encourages reviewing each candidate on a case-by-case basis. For instance, the EEOC cautions against disqualifying every candidate with a criminal record. Instead, employers should consider each criminal conviction independently and determine the relevance to the vacancy.

The employer has reasonable grounds to disqualify an applicant for a job with direct relevance to the position (such as a candidate for a banking job who has a history of embezzlement). Other criminal history, though – such as past drug charges – may not be as relevant to the role and, therefore, may not factor into the decision. Individual assessments give employers a chance to add nuance to background reports.

Similarly, the EEOC encourages employers to consider details such as the severity of the crime, how much time has elapsed since the conviction, whether the subject is a one-time or repeat offender, and other variables when considering criminal records.

Read our Learning Center page about the EEOC to learn more about this guidance and why it matters.

Common FCRA Violations

FCRA claims have become more common in recent years. Employers that fail to comply with every nuance of the law can find themselves in the defendant’s chair for costly lawsuits. Major employers such as Amazon.com, Uber, Avis, PostMates, and JPMorgan have all faced lawsuits over alleged violations of the FCRA. In 2019, a judge certified a class of five million job applicants in an FCRA class-action suit against Walmart. Clearly, even the biggest companies in the US are not immune to the risks of an FCRA violation. Smaller businesses should not assume they are immune, either.

Understanding just how costly even a minor FCRA violation can be should encourage all employers to approach compliance seriously. Learning from the mistakes of other employers could help your business design a compliant policy.

Because knowledge of past FCRA violations can be helpful in multiple ways, backgroundchecks.com regularly covers major FCRA lawsuits on our blog. Some of the most common violations in pre-employment investigations relate to the following compliance missteps:

• Failing to provide disclosure and consent documents separate from other application materials
• Conducting checks without notifying candidates or obtaining written permission
• Not providing candidates with a reasonable amount of time to dispute their report before finalizing an adverse decision
• Failing to inform candidates in writing about adverse action based on findings from a background screening
• Not furnishing the candidate with a copy of the report, a summary of their rights, and other materials, documents, or information required by law.

This list is not a comprehensive accounting of the various reasons employers went to court for violating the FCRA. Still, it does give an idea of where violations often occur. As such, this list is a valuable starting checklist for employers trying to “lawsuit-proof” their FCRA compliance.

Summary of Rights & Copy of Report

As part of FCRA compliance, any employer wishing to disqualify a candidate from job consideration based on background check findings must furnish the subject with a summary of their rights under the FCRA and a copy of the background check report.

You can find a summary of consumer rights under the FCRA on the Consumer Financial Protection Bureau website. Employers must provide a copy of this document to all candidates during the pre-adverse process.

As for the background check, once an employer receives the report from a CRA, they can copy and distribute it to the job candidate for review.

At backgroundcheck.com, we can assist in compliance-related matters such as these. Employers may provide us with email addresses for their candidates during the ordering process. If our reports lead you to make adverse decisions, we can send copies of the reports directly to the candidates in question.

Further Reading

As part of the backgroundchecks.com blog, we regularly explore topics related to the FCRA and FCRA compliance. Here are some of our latest FCRA-related blogs for further reading and learning:

• FCRA Compliance Update: A New Summary of Rights Has Been Released
• Avoiding Legal Exposure From Faulty FCRA Disclosures
• FTC Imposes Largest Fine for a Background Check Provider After FCRA Violations
• California Supreme Court Ruling Reinforces the Importance of Consent in Background Checks
• The Gilberg Decision: What a Recent Court Case Reminds Us about the FCRA
• Employers Continue to be Sued in Class Action Lawsuits Alleging FCRA Violations
• Are Criminal Background Checks Subject to the FCRA?
• CFPB Updates Summary of Rights Under FCRA
• Employers Settle FCRA Documentation Class Actions for $5.9 Million