Every employer must take the time to review and understand the complicated requirements of the federal Fair Credit Reporting Act (FCRA), 15 U.S.C. §§1681-1681u, et seq. when obtaining consumer reports and/or making employment decisions based on those reports. The FCRA requirements place substantial burdens on employers using consumer reporting agencies to perform credit and background checks of new and current employees.
When Does the FCRA Apply to an Employer?
When an employer obtains background information on an individual from a third party to make employment-related decisions, it must comply with the FCRA if the background information is either a consumer report or an investigative consumer report and the third party is a consumer reporting agency.
A consumer report is defined as any communication that contains information about an individual’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living. Although the FCRA does not give specific examples, some examples may include criminal background reports; workers’ compensation history and medical reports; motor vehicle reports; reference checks; verification of education, license or past employment; credit history reports; and general background reports.
An investigative consumer report is defined as any communication containing information about an individual’s character, general reputation, personal characteristics, or mode of living that is obtained through personal interviews with neighbors, friends, or associates of the individual. If a consumer report contains this type of information, and the information is obtained through personal interviews with others, that portion of the consumer report is treated as an investigative consumer report.
A consumer reporting agency is defined as any person or entity who regularly engages in the practice of assembling or evaluating the information on individuals for the purpose of providing reports to third parties. According to this definition, the FCRA does not apply to an employer that conducts reference checks for itself. Thus, the FCRA is not implicated when the employer conducts, for its own use, reference checks with prior employers of an applicant or employee.
When May an Employer Obtain A Report Under the FCRA?
The FCRA authorizes a consumer reporting agency to furnish reports for a limited number of permissible purposes. The FCRA also prohibits a person from obtaining or using a report for any purpose not authorized by the FCRA. Relevant to an employer, a consumer reporting agency may furnish a report if it is:
- In response to a court order or federal grand jury subpoena;
- In accordance with the written instructions of the individual to whom it relates; or
- Provided to a person who intends to use the information for employment purposes.
Thus, an employer may order and use reports obtained from a consumer reporting agency to make employment-related decisions, such as hiring, promotion, reassignment, or employee retention.
What Information Must Be Excluded from a Report?
An employer also should be aware that the FCRA imposes certain restrictions on the content of a consumer report or investigative consumer report. The following information may not be included or requested in a report:
- Bankruptcies that are more than 10 years old.
- Lawsuits and judgments that are more than seven years old.
- Paid tax liens that are more than seven years old.
- Accounts placed for collection or charged to profit and loss that are more than seven years old.
- Records of arrest.
- Any other adverse information that is more than seven years old at the time the report is made.
What Are the FCRA’s Procedural Requirements?
An employer that orders and uses a consumer report or investigative consumer report from a consumer reporting agency for employment purposes must comply with various procedural requirements. These requirements consist primarily of notice and disclosure to the individual and certification of compliance with the FCRA to the consumer reporting agency.
The procedural requirements for obtaining and using a consumer report and investigative consumer report are very similar but not identical. Because the information provided in an investigative consumer report is obtained through personal interviews with associates of the individual, these reports are a greater intrusion into individual privacy. Thus, the FCRA imposes greater procedural requirements on employers that request and use an investigative consumer report. Following are the major procedural requirements an employer must comply with under the FCRA.
Notice and Disclosure:
Prior to obtaining a report from a consumer reporting agency, an employer must provide the following notice and disclosure to the applicant or employee:
Initial notice and disclosure for a consumer report.
Before an employer orders a consumer report, the employer must notify the applicant or employee that it may obtain a consumer report on the individual for employment purposes. This initial notice and disclosure requirement for a consumer report must be made in writing in a separate document containing no other content and must be clear and conspicuous.
Special notice and disclosure for an investigative consumer report.
An employer must specially notify an applicant or employee that it may obtain an investigative consumer report on the applicant or employee for employment purposes. The special notice and disclosure for the investigative consumer report must be:
- Made no later than three days after the employer requests the investigative consumer report.
- Made in writing.
- Mailed or delivered to the applicant or employee in clear and accurate language.
- The notice and disclosure must include the following:
- A statement that the investigative consumer report may include information about the individual’s character, general reputation, personal characteristics, or mode of living.
- A statement advising the individual of their right to make a written request to the employer for a complete and accurate disclosure of the nature and scope of the employer's investigation requested.
- A statement that the employer is required to disclose the nature and scope of the investigation to the individual, in writing, within five days after the date the employer receives the individual’s request for disclosure or the date the employer requests the investigative consumer report, whichever is later.
- A copy of the “summary of consumer rights.” The FCRA also requires that the consumer reporting agency provide the employer with a copy of the summary of consumer rights at the time the report is furnished to the employer.
Written Consent From Applicant or Employee
An employer must obtain written consent from the applicant or employee authorizing the employer to order a consumer report or investigative consumer report.
General consent
Before an employer requests a consumer report or an investigative consumer report, the applicant or employee must authorize the employer to obtain the consumer report or investigative consumer report by written consent.
Medical consent
If the report will include medical information, the applicant or employee must specifically consent to the inclusion of the medical information in the report. This consent must be in writing and must specifically authorize the employer to obtain medical information.
It is unclear under the FCRA whether a new consent or authorization must be obtained each time an employer wants to order a report on the applicant or employee. In 1998, the Federal Trade Commission (FTC) issued a nonbinding opinion letter that provided that employers need not “go through the disclosure/authorization process each time a report is requested.” Instead, the employer may “obtain a general or ‘blanket’ authorization from the consumer to obtain consumer reports at any time during the consumer’s tenure of employment.”
Nonetheless, it is recommended that if an employer uses a general consent or authorization form, the employer should make clear that it is a “continuing” consent or authorization. The consent or authorization form should state that it is a continuing consent and will remain valid until the applicant or employee revokes the consent in writing.
Certification of Compliance
Before a consumer reporting agency may provide any information to an employer, the employer must provide initial certification of use and legal compliance. Special certification is required for an investigative consumer report.
Initial Certification of Use and Legal Compliance.
An employer must identify itself and certify the use of the report and legal compliance with the FCRA. The certification will require the employer to state the purpose, which must be permissible under the FCRA, for which the employer intends to use the report and to state that the employer:
- Will not use the report for any other purpose.
- Provided the required initial notice and disclosure to the applicant or employee.
- Will provide a copy of the summary of consumer rights to the applicant or employee before taking any adverse action.
- Will not violate any federal or state equal employment opportunity laws in connection with its use of the report. If an employer requests a report from a consumer reporting agency for a purpose that is not permitted by the FCRA, but represents to the consumer reporting agency that the report will be used for a permissible purpose, the employer will be civilly liable to both the consumer reporting agency and the individual, and also may be subject to criminal penalties, for obtaining the information under false pretenses.
Special Certification for an Investigative Consumer Report.
Before an employer obtains an investigative consumer report, it must make a special certification to the consumer reporting agency, in addition to the above certification of use and legal compliance. This special certification must state that the employer:
- Has provided the required investigative consumer report special notice and disclosure to the applicant or employee.
- Will disclose the nature and scope of the investigation to the applicant or employee upon written request no later than five days after the date the employer receives the request or the date the employer first ordered the investigative consumer report, whichever is later. While it is not clear whether the FCRA permits a general and continuing certification, it is clear that the FCRA imposes greater procedural requirements on the use of investigative consumer reports. Thus, it is recommended that the employer complete a certification each time it orders an investigative consumer report.
What Should the Employer Expect From the Consumer Reporting Agency?
An employer should expect the following when the consumer reporting agency provides the requested consumer report or investigative consumer report to the employer:
- Summary of consumer rights. The consumer reporting agency must provide a written summary of the consumer’s rights at the time the consumer reporting agency gives the report to the employer.
- Notice of user responsibilities. The consumer reporting agency must provide the employer with a notice of the employer’s responsibilities as a user of a consumer report or investigative consumer report under the FCRA.
What Procedural Requirements Must an Employer Follow Before Taking Adverse Action?
In addition to the notice, disclosure and certification an employer must make before obtaining a consumer report or investigative consumer report from a consumer reporting agency, an employer must comply with various procedural requirements when it actually uses the information provided in the report. Primarily, an employer must adhere to certain procedures when it takes “adverse action” based on a consumer report or investigative consumer report.
The FCRA defines “adverse action” as a denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee. This definition is extremely broad and could include decisions regarding promotion, demotion, suspension, reassignment, termination or retention of an employee, among other actions.
Disclosure of Report
Before an employer may take adverse action against an applicant or employee that is based in whole or in part on a consumer report or investigative consumer report, it must provide the individual with a copy of the report and a copy of the individual’s summary of consumer rights.
Notice of Adverse Action
When an employer takes an adverse action against an applicant or employee that is based in whole or in part on a consumer report or investigative consumer report, it must provide the individual with notice of the adverse action. This notice may be verbal, written or electronic and must provide:
- An explanation of the adverse action.
- The name, address, and telephone number of the consumer reporting agency (including the toll-free number for the consumer reporting agency if it operates on a nationwide basis) that provided the report.
- A statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide the individual the specific reasons why the adverse action was taken.
- A statement that the individual has the right to request a free copy of the report from the consumer reporting agency within 60 days after the individual receives this notice.
- A statement that the individual has the right to dispute with the consumer reporting agency the accuracy or completeness of any information in the report.
While the FCRA does not require this notice to be in writing, employers are advised to provide written notice anyway.
The report provided to the applicant or employee cannot be redacted in any way to conceal or remove information. For this reason, employers should instruct any third-party agency that conducts background checks to prepare separate reports on each individual. The only report that should be given to an applicant or employee is the report that pertains solely to that person.
The FCRA does not specify how long an employer must wait after making the pre-adverse action disclosure before actually taking adverse action and mailing the post-adverse action disclosure. However, the purpose of the provision is to permit the individual an opportunity to correct any error in the report before adverse action is taken based on the information in the report. Additionally, at least one FTC opinion letter states that a waiting period of five business days was reasonable under the circumstances addressed in that letter. Based on this letter and the purposes of the FCRA, employers should generally wait at least five business days after sending the pre-adverse action disclosure before making an adverse decision and mailing the post-adverse action disclosure form.
Federal regulations also require employers to take appropriate measures to dispose of sensitive information derived from consumer reports.
Are There Exceptions to The FCRA’s Procedural Requirements?
As originally enacted, the FCRA did not contain an exception for investigations of employee misconduct. As a result, the FTC promulgated an interpretation that employers must comply with the FTC’s disclosure and authorization requirements prior to engaging in an investigation of employee misconduct. In response, Congress amended the FCRA in 2003 to address this issue; as a result, the FCRA now contains an exception for “communications … made to an employer in connection with an investigation of (1) suspected misconduct relating to employment; or (2) compliance with Federal, State, or local laws and regulations, the rules of a self-regulatory organization, or any pre-existing written policies of the employer.”
In 2004, Congress amended the FCRA with the Fair and Accurate Credit Transactions Act (FACTA), which further addressed the issue of employee investigations. Specifically, FACTA excludes certain communications relating to investigations of employee misconduct from the definition of a consumer report. Consequently, FACTA amended the FCRA so that the FCRA exempts certain investigations of suspected wrongdoing from its typical notice and disclosure requirements. FACTA still requires that subsequent disclosure to the investigated party may need to be made when the investigation was conducted by a consumer reporting agency. If an adverse action is taken as a result of the investigation of employee misconduct, the employer must make disclosures to the employee. An employer must disclose a summary of the nature and substance of communications related to the investigation of employee misconduct, but it need not disclose its sources of information.
What Are the Penalties For Violating the FCRA?
Employers that are “negligent in failing to comply” with the FCRA’s requirements are liable to a consumer for actual damages, costs of a suit and attorneys’ fees. In addition, if it is determined that an employer is in “willful noncompliance” of the FCRA, the employer may face punitive damages. Furthermore, criminal penalties also may be imposed if a person obtains a credit report under false pretenses. Finally, employers also must be concerned about class-action lawsuits by applicants or employees based on violations of the FCRA.
Due to the inherent risks and potential liability involved in navigating through the confusing regulations of the FCRA, employers are strongly advised to consult with experienced labor counsel before obtaining any consumer reports or taking any adverse actions based on any consumer reports. Employers should therefore analyze their policies to ensure that they are in full compliance with requirements of the FCRA.
Finally, the laws of individual states sometimes impose additional requirements on employers that obtain and use background reports for employment applicants. Because some states impose these additional requirements, employers also should review the law of each state in which they intend to use any consumer reports.
Greg S. Labate is a partner and co-chair of Sheppard Mullin’s Labor and Employment Practice Group, and is based in Orange County, Calif