FCRA Compliance: What You Really Need to Know

Do your company’s pre-employment background checks comply to the Fair Credit Reporting Act (FCRA)? Outsourcing to a reputable background screening provider can help ensure compliance with federal laws, but employers are ultimately responsible for meeting FCRA requirements such as sending pre-adverse action notices.

Learn how to avoid the most common FCRA background-check violations.

---

For employers, a chief benefit of outsourcing candidate background checks is letting professionals handle the bulk of responsibility for adherence to laws and regulations on collecting and reporting confidential information.

Professional organizations that perform FCRA-compliant background checks do most of the heavy lifting with respect to federal requirements, but employers still have some obligations under the set of regulations known as the FCRA, or the Fair Credit Reporting Act.

Employer failure to meet FCRA requirements can have costly consequences: Fair Credit Reporting Act violations are expensive to litigate and settle.

Beyond “Credit Reporting”

When Congress enacted FCRA in 1970, its intent was to protect the personal financial data compiled to create consumer credit reports. Congress has since expanded its scope significantly, and the types of companies governed by the FCRA, collectively known as consumer reporting agencies (CRAs), now include background-check services (such as GoodHire), as well as credit bureaus.

Among its provisions, the FCRA is intended to reassure consumers that:

• They have the right to be informed and provide consent when an employment background check occurs
• They have the right to review information compiled on them and dispute any inaccuracies it may contain
• They have the right to know when their personal data is used in employment decisions that affect them—like hiring, not hiring, not promoting, or termination 

Choosing a background check provider that is a certified FCRA-compliant CRA covers you as an employer with respect to proper collection, storage, and eventual discarding of job candidates’ personal data.

As an employer, you play a critical role in several steps of the background check process. Your responsibilities for FCRA compliance include:

FCRA-permitted purpose. The law only allows employers to conduct background checks on employees or potential hires for purposes of determining fitness for a position. Routine background checks on current employees can take place to check for recent findings since the initial report was completed (e.g., annual checks); or if an employee is being considered for promotion or is switching to a new position (e.g., one of greater financial responsibility).

Disclosure. For a background check to be legal, the employer must provide all candidates (including internal candidates) with a written disclosure of their plans to conduct the check. The disclosure document must be presented on its own—not handed over in an orientation packet or other collection of papers.

Consent. Before instructing a CRA to conduct a background check, an employer must obtain signed consent from the job candidate under review, acknowledging that the check is happening and that they give permission for it to occur.

The FCRA permits the candidate to authorize, or provide consent to, the background check within the disclosure document.

Sharing results with the candidate. Upon completion of a background check (by a certified FCRA-compliant CRA), and before making a final hiring decision, the employer must inform candidates of their rights under FCRA and offer them the opportunity to review and correct their reports. A process like GoodHire’s, which automatically provides a duplicate report to the candidate via a secure website, simplifies the process. By providing interactive tools that let candidates note questions or concerns, this approach also can reduce the amount of time required to re-check disputed information, if any.

Apply Equal Employment Opportunity Commission rules to findings review. The federal Equal Employment Opportunity Commission (EEOC) bans employers from excluding potential hires based purely on past arrests or criminal convictions, as long as state or federal regulations don’t forbid persons with criminal records from holding the job in question, and the offense isn’t relevant to performing the job.

Individuals with criminal records must be considered on a case-by-case basis, in light of job requirements and any mitigating circumstances, such as personal character, successful completion of rehabilitation or diversion programs, satisfactory job performance in a similar role, and other context. A background check CRA should provide reports that conform to those requirements. As appropriate, the CRA also should honor various states’ “ban the box” regulations, which forbid employers from asking about criminal records until after deciding whether a candidate’s qualifications merit an interview and/or serious hiring consideration.

Follow proper 2-step adverse-action procedures. If a background check leads to a decision against hiring, retaining, or promoting a candidate, the employer must issue the candidate a written notice, known as a pre-adverse action notification, and give the candidate a chance to refute or explain any findings before a hiring decision is final. GoodHire provides guidance through this process and helps generate appropriate pre-adverse action notifications to streamline this process, and provides a secure web portal the candidate can use to submit any explanations.

In instances when the background check leads to an adverse employment decision (the employer decides not to hire), employers must send a final adverse action notice to the candidate or employee.

Finalize the hire. Once all background checks are conducted; any disputed facts have been rechecked and corrected as needed; and candidates have been notified of proposed adverse actions and given a chance to respond, the employer can make a final hiring decision and notify all candidates of the final decision.

---

---

Fair Credit Reporting Act Violations

The number of lawsuits filed over alleged FCRA violations has increased steadily each year since 2010. This figure recently increased nearly 10% from 2016 to 2017, to 4,346 from 3,954.¹ The volume was increasing at a similar rate (9.6%) for the first half of 2018, when the number of cases was 2,323, up from 2,119 for the same period in 2017.²

Many FCRA violation cases are class-action lawsuits, brought on behalf of sizable groups of job candidates. Widespread employer use of standardized documents and background check procedures helps make this a sound legal strategy (and a potentially lucrative one for law firms).

In organizations that make dozens (or hundreds) of hires each month, if one or more steps in the background-check process violates FCRA, it creates hundreds (or thousands) of potential plaintiffs.

Attorney Lanette Suarez noted in Law.com’s Daily Business Review, “FCRA litigation includes damages of $100 to $1,000 dollars for each individual violation and, in a class action setting, those dollar amounts can add up to multi-million dollar settlements. For example, recent class action settlements include a major transportation company that settled for $7.5 million, a major bank that settled for $12 million and a grocery chain that settled for $6.8 million.”³

Avoid these five common FRCA background-check violations:

1. Improper background check disclosure. If you intend to run an employment background check on an applicant, you must tell them beforehand. The disclosure statement cannot be mixed in among a stack of documents or a mass of fine print (in the case of an online application form).
2. Failure to get express written consent. Job applicants must give express consent for a background check, via a signature or digital equivalent. FCRA allows disclosure and consent for background checks to be combined in one document, but it cannot include any other notices or approvals, such as liability waivers or nondisclosure agreements.
3. Failure to share screening results. Sharing the background check report with the candidate is optional until a pre-adverse action notice must be sent. In the event the employer believes the report contents may lead to an adverse employment decision, then the employer must not only share the pre-adverse action notice, but must also include a copy of the report and the Summary of Rights document along with the notice. This gives applicants a chance to review the results of their background checks—and gives them time to correct or clarify any findings before a hiring decision is finalized. At minimum, candidates must be given the name and contact information of the background screening company, with instructions on how to obtain their screening results. GoodHire automatically provides results to all screening subjects via a secure website that also gives them a chance to enter comments and explanations alongside each finding.
4. Failure to inform candidates of FCRA rights. When notifying applicants that they can review background-check results, employers must also inform them of their rights under FCRA by providing a copy of the FCRA Summary of Rights document.
5. Improper follow-through on adverse-action procedures. Once a final hiring decision is made, any candidate who was not hired based on a background check must be informed of the decision. GoodHire provides helpful tools for generating such notifications and delivering them as needed to candidates it screens.

Recent FCRA-violation Lawsuits

A few of the highest-profile FCRA violation cases include:

Petco. In August 2018, after a two-year trial in a case that affects more than 37,000 job applicants, the pet-supply retailer agreed to pay $1.2 million to settle a class-action suit over FCRA-noncompliant background check disclosure in its online job application form.⁴

DISH Network. In 2016, the satellite-TV provider paid a $1.75 million class-action settlement over FCRA violations involving disclosure of its background check procedures and its procedures for sharing completed reports with applicants.⁵

Starbucks. The coffee giant faces a class-action suit in Georgia from a man who claims his job application was declined based on a criminal conviction wrongly attributed to him, and that Starbucks failed to give him a copy of the background check in time to correct the error.⁶

While coverage of FCRA violation cases typically focuses on their financial fallout, it’s important to remember that these actions also have reputational costs. No matter what their eventual outcomes may be, high profile suits and settlements bring unfavorable publicity. And the perception that an employer may be careless about job-candidate rights can discourage promising applicants from pursuing opportunities with them.

Wise Choices Can Avoid Noncompliance

Conducting an FCRA-compliant background check is not overly complicated, but care must be taken to choose a FCRA-compliant CRA, and to ensure all necessary documents and procedures are in place from the start, and that there are no deviations. As an employer, you need to work closely with HR and legal counsel to vet all policies and procedures. Choosing GoodHire as your CRA partner will also bring plenty of guidance, support, and peace of mind.

---