FCRA for Employers: Background Checks Done Lawfully

When a consumer report, information from a consumer reporting agency bearing on character, reputation, characteristics, or mode of living, is used for employment purposes: hiring, promotion, retention, or reassignment. The trigger is the third party: criminal-records vendors, employment/education verifiers, driving-record services, and credit-report providers are CRAs; the background-check industry is an FCRA industry. What escapes: purely internal investigations by your own staff using your own records; direct reference calls made by the employer itself; and public-record searches the employer runs directly (though state law may still regulate them). The 2003 FACTA amendment carved out third-party investigations of suspected misconduct or compliance violations from the consent flow, no advance disclosure or authorization needed, but after taking adverse action based on such an investigation, the employer must give the employee a summary of the nature and substance of the report. Misclassifying a vendor-run check as an 'investigation' to skip consent is a litigated mistake.

1681b(b)(2) requires, before procuring the report, a clear and conspicuous written disclosure that a consumer report may be obtained for employment purposes, in a document that consists solely of the disclosure, plus the applicant's written authorization (which may share the document). 'Solely' is enforced literally: courts have condemned forms bundling liability releases (Syed v. M-I, Ninth Circuit, finding willfulness), state-law notices, at-will acknowledgments, blanket future-check language beyond what the statute permits, and dense legalese defeating clarity. Electronic disclosure and e-signature are fine. The class-action math explains the litigation volume: willful violations carry $100 to $1,000 statutory damages per applicant with no proof of injury, so a defective form used across 50,000 applicants is a facial eight-figure exposure, and settlements (Uber, Delta, Frito-Lay, dozens more) price it accordingly. The fix costs nothing: one page, disclosure and signature, nothing else.

Step one, pre-adverse action: before taking adverse action based in whole or in part on the report, provide the applicant a copy of the report and the CFPB's 'Summary of Your Rights Under the FCRA.' Then wait a reasonable time for the applicant to dispute or explain, five business days is the litigated benchmark, longer where state law (or your own policy) requires individualized assessment. Step two, adverse action: after the window, the final notice with the CRA's name and contact information, a statement that the CRA did not make the decision and cannot explain it, and the rights to a free file copy within 60 days and to dispute. The purpose is error correction: background reports misattribute records to common names, mix files, and report expunged matters, and the pre-adverse pause exists so the applicant can fix the record before the decision hardens. Automating the sequence but not the pause, rejection letters firing the same day as pre-adverse notices, is a recurring class allegation.

Before a CRA furnishes an employment-purpose report, the employer certifies (usually in the vendor contract): a permissible purpose; that disclosure and authorization were made; that pre-adverse and adverse action duties will be honored; and that the information will not be used in violation of equal employment opportunity laws. That last certification imports the EEOC dimension: Title VII disparate-impact analysis of criminal-record screens (the Green factors, nature of the offense, time elapsed, job relatedness, per EEOC's 2012 guidance) is certified into every FCRA transaction. Downstream: reports must be used for the certified purpose only, stored securely, and disposed of under the Disposal Rule (16 CFR Part 682, reasonable measures against unauthorized access in disposal). Investigative consumer reports (interview-based character reports) trigger additional notices. And keep the authorization evidence: in litigation, the signed form and the notice timeline are the whole defense.

The binding constraints, increasingly. Ban-the-box/fair-chance laws (37+ states and localities in some form): no criminal-history inquiry until after a conditional offer (California Fair Chance Act, NYC FCA), mandated individualized assessment weighing the conviction against the job, written preliminary-decision notices with response windows longer than FCRA's, and specific reassessment forms (NYC's Article 23-A analysis). Credit-check restrictions: eleven-plus states (California, Illinois, Washington, Colorado, New York City among them) bar employment credit checks except for exempted roles (finance, law enforcement, fiduciary positions). Salary-history bans intersect the same workflows. Seven-year reporting limits: some states cap conviction reporting beyond FCRA's rules for lower-salary roles. Clean-slate laws automatically seal records, using sealed records is independently actionable. The operational answer is a jurisdiction matrix in the ATS: the check's timing, scope, and adverse-action paperwork keyed to the work location, because the strictest applicable law, rarely FCRA itself, drives each element.