Understanding and Navigating the FCRA

The FCRA is a federal act regulating the accuracy, fairness, and privacy of sensitive and personal information disclosed in consumer reports. There are sometimes hefty and always serious civil and statutory penalties for non-compliance with the procedural requirements. We’ll cover those requirements here, but first, let’s explore what falls under the category of “consumer reports.”

What qualifies as a consumer report?

Officially, a consumer report is defined as “any written, oral, or other communication of any information by a consumer reporting agency (CRA) bearing on a consumer’s

• credit worthiness
• credit standing
• character
• general reputation
• personal characteristics
• or mode of living

which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility” for lending, housing, insurance, or employment purposes.

As you can imagine, the need for a governing body to regulate the use and dissemination of such sensitive information is necessary for our individual security and privacy. The FCRA provides that oversight, but it’s likewise important to the vast majority of employers, hiring managers, lenders, and landlords to have access to the above information so that they can make prudent decisions for their organizations. Handling consumer reports appropriately is the key to protecting everyone involved.

How do employee background checks fit in?

One of the reasons it can be unclear just what the Fair Credit Reporting Act governs is the name. It’s easy to assume that the FCRA covers credit reporting exclusively, but the regulations extend to:

• Criminal and civil records
• Civil lawsuits
• Reference checks
• DMV records
• Medical records
• And, of course, employee background checks, which can include all of the above.

Focusing on employee background checks, the FCRA makes it possible for job applicants to sue anyone who mishandles their consumer reports or otherwise fails to comply with procedural requirements. For a small company, such litigation can be disastrous, and for large companies that process hundreds if not thousands of applicants’ information, FCRA non-compliance can result in a crippling class-action lawsuit.

In other words, no organization should consider itself immune to FCRA oversight.

Procedural Requirements of the FCRA

These days applicants are generally aware of their rights under the FCRA, but part of the procedural requirements for requesting and using consumer reports is to appropriately educate the individual, disclose the reasons for the background check, and to acquire written authorization from the individual prior to ordering the report from a CRA such as Victig.

Failing to receive written authorization from your applicants and employees before running a background check is a surefire way to land in hot water, but one of the most common ways an organization fumbles with compliance and exposes itself to litigation is while taking adverse action.

Adverse action is the decision not to extend an offer of employment or promotion, or to terminate employment-based “in whole or in part” on information that is discovered on the applicants’ background check report. In other words, if an individual’s background check turns up something disqualifying, tread carefully before revoking a job offer or terminating an employee. Here’s what you need to keep in mind:

Steps for Acquiring Authorization and Taking Adverse Action

The breakdown of the FCRA’s procedural requirements are:

• Disclosure and pre-authorization
• Pre-adverse action letter, copy of report and rights
• Waiting period
• Adverse action letter

Disclosure & Pre-Authorization

• Whether the individual in question is an existing employee or a job candidate, the employer must provide them with written disclosure that is “clear and conspicuous.” This means that it cannot be attached to a job application, liability waivers, or other extraneous materials.
• The document must stand alone and clearly announce that a consumer report will be obtained and that their background information may be used to make employment decisions.
• Minor additional information may be included, but only if it is brief and does not detract from the notice, such as a description of consumer reports. Candidate’s written pre-authorization signature may be written on the disclosure or elsewhere, but it must be obtained.
• If you want to run background checks periodically through the individual’s employment (prior to promotions, for example), this must be made clear and conspicuous as well.

Pre-Adverse Action Letter, etc.

• If you’ve discovered disqualifying information in the background report, you must provide the candidate with a pre-adverse action letter that includes:
• A copy of the consumer report
• A document that clearly outlines their rights under the FCRA. (See here for a Summary of Rights.)
• The purpose of the pre-notice is to give the candidate the chance to discuss or dispute the report before the action is made final.

Waiting Period

• There is not an explicit time period for the waiting period outlined in the FCRA, but precedence has been set by the Federal Trade Commission (FTC) and relevant court hearings to wait five days before sending the adverse action letter.

Adverse Action Letter

• After the suggested five-day waiting period, it’s okay to send the final notice of adverse action, which must include:
• Name and contact information of the CRA that was used to generate the report.
• A statement explaining that the CRA did not make the adverse action decision and cannot provide additional information on the decision.
• A reiteration of their rights to request a free copy of their report within 60 days.