FCRA Compliance: The Complete Guide for Employers
Introduction – What is FCRA Compliance
The Fair Credit Reporting Act (FCRA) is a federal law passed in 1970 that controls the procurement of credit details and credit report access. In 1996 the FCRA expanded to also include background reports.
Employers are regulated by the FCRA to protect people. The FCRA is applicable anytime an employer gets a background check from a third-party entity.
Why is it Important for Employers to be FCRA Compliant?
Background Check compliance is a confusing and constantly changing subject. Not only do you need to ensure that you are compliant with FCRA (15 U.S.C. § 1681 et seq.), but you also have to comply with a myriad of state and local laws, ordinances and regulations as well.
ScoutLogic recommends you consult with experienced attorneys on these topics, and we would be happy to refer you to a number of great experts. That said, we also have a number of clients who have been asking about major “watch-outs” we see day in and day out at ScoutLogic.
Of course, ScoutLogic is not a law firm, and this should not be construed as legal advice. You should always reach out to your own counsel before you make any changes to your background screening compliance program.
This article is simply designed to give you a quick overview of significant “watch-outs” and practical steps you can take to improve your compliance.
Watch-Out #1: Managing Disputes
- Under the FCRA background screening companies (known as “consumer reporting agencies”} must follow reasonable procedures to assure maximum possible accuracy of the information in the reports we provide to employers.
- That said, given the number of data sources and humans involved in compiling a report, mistakes can happen.
- Which is why the FCRA allows consumers to dispute the accuracy and completeness of information in their report by contacting background screening companies like ScoutLogic directly. When a consumer disputes information in their report, a background screening company will conduct what’s called a “reinvestigation,” free of charge, to determine whether the disputed information is inaccurate and record the current status of the disputed information, or delete the item from the candidate’s file.
- Under the FCRA, a background check company has up to 30 days to conduct the reinvestigation.
✓Ask your background check provider for their dispute policy. Make sure that they have one, that the policy communicates a sense of urgency, and that it has strong customer service for the candidate.
✓ Encourage your background check provider to investigate as quickly as possible. Investigations shouldn’t take more than a few days (unless there are manual counties which require court runners). The faster the resolution, the less impacted your candidate will be.
✓ Ensure your background check company and, should your own team interact with the disputing candidate, treat the applicant with respect and over-communicate. We have seen many firms that treat disputing candidates with poor customer service. We recommend taking the opposite approach. Over-service the disputing candidate helps to reduce frustration from any mis-reported results.
Watch-Out #2: Using the Wrong State Consents & Disclosures
- Many employers believe that one set of consents and disclosures will suffice for authorization to run a background check.
- The reality is that many states – and even cities – have their own versions with specific verbiage and language options.
- Additionally, you may need to provide different consents and disclosures based on where your candidate will both work and live. Which isn’t always the same place.
✓ Review how you determine which consents and disclosures your candidate should receive. If you are using your background check provider’s platform, simply ask them for the logic they use to determine if the candidate receives the appropriate forms. If you are doing this on your own, you may want to see if your company has guidelines to ensure candidates are receiving the right consents and disclosures.
✓ Although background check providers will provide drafts or templates of the Disclosure and Authorization, it is important to have the document reviewed by counsel with FCRA experience. Legal responsibility under the FCRA to provide a “clear and conspicuous disclosure” that a background check report is being requested, along with ensuring you properly capture the candidate’s written authorization, falls on employers.
✓ Make sure you have a procedure to keep track of this information. It may be as simple as asking your current background check provider on a monthly or quarterly basis. Or you may want to subscribe to the NAPBS (National Association of Professional Background Screeners) weekly email, which always includes great updates on compliance-related topics.
Watch-Out #3: Stand Alone Authorization
- Under the Fair Credit Reporting Act, it should be clear that the authorization to perform the background check is separate from the job application.
- We have seen companies try to bundle all these documents together as part of an eSignature project.
- Regardless, for maximum protection, keep them completely separate, regardless of whether you are using physical documents or electronic ones.
✓ Review your candidate onboarding and documentation process to ensure that you are not doing this today. Due to the high amount of litigation related to employers’ compliance with the FCRA, we recommend that the background check documents (i.e., the Disclosure and Authorization) not be embedded in the job application. It should be a separate, stand-alone document that prominently stands out to the candidate.
✓ If possible, your background check provider should have functionality that allows these documents to be sent to a candidate for electronic signature (assuming the candidate authorizes the use of their electronic signature and receipt of electronic communications). We think this is a great approach both to keeping everything separate and to keeping an electronic record of all communication.
✓ Document storage is critical. Make sure you are saving all of those documents if you are collecting them physically and maintaining the security of the documents since they contain sensitive personal information. We have many clients who just stuff them in a drawer (or worse), and they are difficult to locate should there ever be a need to produce them. The FCRA also requires that background check reports, or any information associated with those reports, be properly disposed of. For physical or paper documents, this means shredding or pulverizing those documents.
Watch-Out #4: Adverse Action
- Under the FCRA, employers must follow the adverse action process if there is adverse information in the report which the employer may use against the candidate to not offer them a job or promotion. It is a two-step process. The first step is the “pre-adverse action” process and it requires that any employer who may take “adverse action” against a candidate due to information in the background check report provide that candidate with a copy of their report and a copy of the federal disclosure called “A Summary of Your Rights Under the Fair Credit Reporting Act.”
- Many employers skip the pre-adverse process, which opens you up for litigation.
- Many employers also do not wait long enough to issue the adverse action notice (assuming one will be issued), denying candidates’ adequate time to dispute information in the report which may be inaccurate or incomplete.
✓ Ensure that you have a consistent standard for denying employment based on background check findings that also give individual consideration to each candidate. In fact, some states and local jurisdictions require what is called an “individualized assessment” be conducted affording the candidate the opportunity to explain any adverse criminal information or history in the report.
✓ Review your pre-adverse and adverse action notices, and process, with outside counsel. Please note, some jurisdictions have nuances in the language they require.
Review your policy for how long you wait between the pre-adverse action step and issuance of the adverse action notice. The general rule of thumb is five (5) business days, but we recommend at least seven (7) business days to be safe. Additionally, several local jurisdictions require a longer or different period such as Philadelphia, New York City, San Francisco, and Los Angeles.
✓ When providing the pre-adverse action notice because you may take adverse action based on information contained in the background check report, reach out to the candidate to ensure they have received the notice along with the copy of the report and the federal “A Summary of Your Rights Under the Fair Credit Reporting Act” disclosure. While this step is not required, we believe this is a good business practice to minimize candidate frustration over any potentially inaccurate reporting.
Watch-Out #5: Insurance Coverage
- Even if you have the best-in-class compliance program, you may get sued anyway.
- Companies that are perceived as having large brands and/or deep pockets are always litigation targets.
- In addition to having a great compliance program, you want to make sure your professional liability policy covers you for claims under the FCRA and that they aren’t specifically excluded.
✓ Request a copy of your policy from your insurance broker and read the exclusions.
✓ In the exclusions section, you want to ensure that anything related to the FCRA, Consumer Privacy, or TCPA is not excluded. These are the statutes under which companies are typically sued.
✓ If you are not sure whether you are covered speak with your insurance broker or an insurance broker with experience writing policies for employers and background check companies that cover FCRA-related claims. If you don’t know of any, please reach out to us and we can introduce you to a resource who can help.
Employers can never be too prepared when it comes to following federal regulations. If you’re unsure of whether you’re FCRA compliant, it’s time to find out.
We offer free evaluations of your current operation and spot ways you can improve the quality of your operation, reduce risk, and save money. Click here to book your free assessment today.
Download this free guide to go into the searching process prepared. This guide includes actionable steps to:
- Gather your requirements
- Determine vendors
- Check references
- Determine success metrics