On May 10, 2016, the Federal Trade Commission (FTC) released a new publication related to background checks and the Fair Credit Reporting Act (FCRA) titled What Employment Background Screening Companies Need to Know About the Fair Credit Reporting Act.¹  As the name suggests, the publication surveys the obligations that consumer reporting agencies (background check companies or CRAs) have under the FCRA when compiling employment-purposed consumer reports (background reports).  The FTC’s publication is a useful resource for employers for learning about the legal requirements governing the preparation of background reports by CRAs, and indirectly highlights several compliance requirements applicable to employers.

The FTC first addresses the question, “When is an employment background screening company a ‘consumer reporting agency’?”  The answer, according to the FTC, is that a business may be a CRA “if it provides information about people to employers for use in hiring or other employment decisions,” and specifically provides information to employers “bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.”  Although somewhat self-evident, this description illustrates that when employers conduct their own background inquiries, they are not consumer reporting agencies and their inquiries are not subject to the FCRA.  On the other hand, the fact that the question was posed and answered by the FTC suggests that some companies may market such information without operating as a CRA.  Prudent employers will want to ensure they are comfortable using such vendors given that the FCRA regulates both the business marketing, and the employer using, true consumer reports.

The second question answered by the FTC is, “If your employment background screening company is a consumer reporting agency under the FCRA, what does the law require you to do?”  The FTC summarizes the FCRA’s core requirements for CRAs as follows:

• Accurate Reporting:  CRAs must establish and follow “reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.”  The FTC notes also that “certain practices may be indicators that a background screening company isn’t following reasonable procedures,” and provides the following example: “if a report lists criminal convictions for people other than the applicant or employee – for instance, a person with a middle name or date of birth different from the applicant’s – that raises FCRA compliance concerns.”  Other “indicators” according to the FTC are when a CRA provides “screening reports with multiple entries for the same offense or that list criminal records that have been expunged or otherwise sealed.”
• Employer Certifications:  CRAs must obtain from the user (i.e., the employer) the requisite certifications that the employer will comply with its obligations under the FCRA, including that the employer will use the background report for employment purposes only,  has provided applicants and employees with the necessary disclosures before ordering background reports, and has secured their authorization to order the reports.  This point serves as a reminder to employers to provide these certifications.  Some state “mini-FCRA” statutes also impose an obligation on the employer to provide such certifications, not just on the CRA to collect them.
• Consumer Rights:  CRAs must honor the rights that applicants and employees have under the FCRA, including giving them access to their “files” when they ask for them, conducting a reasonable investigation when they “dispute” the accuracy of information, and giving them written notice of the results of investigations.  Another FCRA violation, according to the FTC, is “creating unreasonable obstacles for consumers trying to exercise their rights under the FCRA.”  Employers should note that applicants and employees may choose to exercise these rights after receiving a pre-adverse action notice from the employer to inform the individual that the employer may take adverse action based, in whole or in part, on a background report provided by the CRA.

The FTC also explains the specific obligations that CRAs have when providing reports with negative public record information.  CRAs have two options: “(1) Notify the person who is the subject of the report when public record information is being reported; or (2) Maintain what the FCRA calls ‘strict procedures’ designed to ensure that reported public record data is complete and up to date.”  The first option, the notice, is not sent in lieu of the pre-adverse action notice; the employer must send that notice regardless of which option the CRA elects.

Although the FTC’s publication speaks to the obligations that CRAs—not employers—have under the FCRA, the timing of the publication reinforces how compliance with the FCRA’s employment provisions remains an enforcement priority for the FTC staff.  Notably, the recent FTC guidance lists an additional resource, the guidance issued by the FTC and the EEOC in January 2012, titled “Using Consumer Reports: What Employers Need To Know.”²

In addition, the FTC recently mailed out more than a dozen “access letters” to sharing economy companies seeking information about their policies and procedures for complying with the FCRA’s employment provisions.  As previously reported, nationwide FCRA class action filings against employers are also continuing to spike.³ Thus, employers should consider conducting a privileged review of (1) their background check disclosure and authorization forms to fortify compliance with the emerging line of cases raising concerns about including any text in such forms other than the minimum necessary FCRA disclosure (i.e., that the employer will request a background report); and (2) their procedures for ensuring that pre-adverse action notices are timely sent if a potential adverse action against a job applicant or employee may be based, even in part, on the contents of the background report.