Anyone running an employment background check through a third party, such as a background screening company such as ASE and/or automated verification systems is considered a user of consumer reports and therefore must follow the requirements of the FCRA.
Some of the obligations are basic, such as you must have a permissible purpose to procure the background check. While there is a list of permissible purposes, here we will just look at a couple of items under employment purposes. An employment purpose can be to hire someone which covers direct hire, contract hires, and volunteers; for promotion purposes; and when required for ongoing employment.
Required Forms
Before running a background check the employer must obtain FCRA compliant Authorization and Disclosure forms signed by the subject of the check, or in the case of anyone under the age of 18, signed by the parent(s) or guardian(s), and provide a copy of the Summary of Rights document to the subject.
To be FCRA compliant the Disclosure form must be a stand-a-lone document with no “extraneous information” added. This form is meant to be a short and straightforward form to disclose to the subject that a background check may be run and what items might be included in that check.
The authorization should include a statement acknowledging the receipt of the separate Disclosure form and the Summary of Rights. Other information to be included is a statement that the subject authorizes the employer, whose name must be on the form, and other entities to provide information on the subject. Typically, the name and address of the background screening company would also be listed.
Both the Authorization and Disclosure forms are legal documents, so an employer should have the forms reviewed by their legal counsel periodically to ensure they meet the requirements of the FCRA and any other applicable entities.
Credit Checks – Address Discrepancy
When running a credit check on a subject, employers “must develop and implement reasonable policies and procedures designed to enable the user to form a reasonable belief that the consumer report relates to the consumer whose report was requested, when the user receives a notice of address discrepancy in connection with a new or existing account.”
Following are examples of reasonable procedures:
- Comparing information in the consumer report with information the user:
- has obtained and used to verify the consumer’s identity as required by the Customer Identification Program rules (31 CFR 1020.220);
- maintains in its records; or
- obtains from a third party; or
- Verifying the information in the consumer report with the consumer.
There is also a requirement for the user (employer) to develop and implement reasonable policies and procedures for furnishing to the National Credit Reporting Agency (NCRA), such as Transunion, an address for the consumer that the user has reasonably confirmed is accurate when the user does the following:
- Forms a reasonable belief that the report relates to the consumer whose report was requested;
- Establishes a continuing relationship with the consumer (i.e., in connection with a new account); and
- Regularly, and in the ordinary course of business, furnishes information to the NCRA that provided the notice of address discrepancy.
A user’s policies and procedures for furnishing a consumer’s address to an NCRA must require the user to furnish the confirmed address as part of the information it regularly furnishes to the NCRA during the reporting period when it establishes a continuing relationship with the consumer.
There are other important requirements for employers, so it is imperative that employers review the information and contact their legal counsel as needed for clarification on the requirements or to assist in developing and updating policies and procedures regarding employment background checks.
Sources:
https://files.consumerfinance.gov/f/documents/102012_cfpb_fair-credit-reporting-act-fcra_procedures.pdf
https://www.ftc.gov/system/files/ftc_gov/pdf/fcra-may2023-508.pdf