Loss Prevention and the FCRA

(Back to ESR Publications Page)

Working with the Fair Credit Reporting Act
How the FCRA regulates pre-employment screening and investigation of current employees by Loss Prevention or Internal Security Departments

By Lester S. Rosen

Employers have become acutely aware that hiring a job applicant with a criminal background or falsified credentials can be like a nightmare that never ends. One bad hiring decision can bring about enormous legal and financial consequences. To avoid bad hiring decisions, employers have increasingly turned to pre-employment background screening as a risk management tool. No such program, however, can be conducted without understanding the Fair Credit Reporting Act (FCRA), the federal laws that governs pre-employment screening. That law was substantially amended in 1997 and further clarified in November 1998. There are also state laws that can affect pre-employment screening practices.

The FCRA governs background reports prepared by third parties, such as professional screening companies, credit bureaus or licensed private investigators. The FCRA does not control background investigation conducted by an employer through their own security or human resources departments. However, the FCRA has a significant impact even for firms that conduct investigations in-house through their own security departments. In fact, for maximum legal protection, many corporate security departments now conduct all in-house pre-employment background checks as though covered by the FCRA.

Under the FCRA, a background report is known as a consumer report if prepared by someone an employer hires to obtain information about a job applicant. A consumer report is nearly any type of background screening report about a job applicant, including criminal and civil court records, driving records, past employment, education, professional licenses, worker compensation, Social Security number traces or header provided by a credit agency or credit reports. A consumer report is not restricted to just traditional credit reports. A credit report is simply one type of consumer report.

Another special type of consumer report is called an investigative consumer report, which is based upon interviews with anyone other then the applicant/employee, and about their character, general reputation, personal characteristics or mode of living. For example, if a background agency goes beyond just verifying dates of employment and asks about job performance, that becomes an investigative consumer report.

To comply with the FCRA, an employer must follow four basic steps in obtaining and using a Consumer Report. (These are also available through the Federal Trade Commission web site at www.ftc.gov/os/statutes/fcrajump.htm ):

First, an employer must certify to the outside agency gathering the information that it will comply with the FCRA, and it will not misuse any information in the report in violation of federal or state equal employment opportunity laws or regulations.

Second, before obtaining a consumer report from a reporting agency, the employer must obtain written consent and provide the applicant with a clear and conspicuous written disclosure that a background report may be requested. This disclosure must be provided in a standalone document to prevent it from being buried in an employment application. A 1998 amendment to the FCRA clarified that the disclosure and consent may be in the same document. However, the Federal Trade Commission (FTC), which enforces the FCRA, cautions that the form should not contain excessive information that may distract a consumer. When an investigative consumer report is requested, there are some additional disclosures and procedures required.

Third, if an employer receives a consumer report, and intends to take an adverse action based upon the report in any way, then the applicant has certain rights. An adverse action means a denial of employment or any other decision that adversely affects current or prospective employees. Before taking the adverse action, the employer must provide applicant with a copy of the report and statement of their rights prepared by the FTC. This gives an applicant the opportunity to see the report being used against them prior to being denied an employment opportunity. If the applicant believes the background report is inaccurate or incomplete, the applicant then has the opportunity to contact the employer and the consumer reporting agency to dispute or explain what is in the report. Without this right, applicants could be denied employment without ever knowing they were the victims of inaccurate or incomplete information.

Fourth, if the employer intends to make the decision final, the employer must take one more step. The employer must send the applicant a Notice of Adverse Action informing the applicant the employer has made a final decision, containing certain information set forth in the FCRA.

Some employers question whether the pre-adverse action notification procedure is worth the time and trouble of performing background reports. As a practical matter, the procedure takes very little time or resources. It is simply a matter of providing the applicant with a copy of the report, a summary of their rights, and a cover letter. The protection afforded by pre-employment screening certainly outweighs the slight administrative burden of complying with the FCRA. Without pre-employment screening, it is a near statistical certainty that an employer will hire a criminal, which will create problems far more serious then having to send out an occasional adverse action notice.

In addition, by the time an applicant is the subject of a consumer report, an employer has spent time, money and effort in recruiting and hiring. Therefore, it is in the employer's best interest to give an applicant an opportunity to explain any information before denying a job offer. If there was an error in the public records, giving the applicant the opportunity to explain or correct it could be to the employer's advantage. Even if there were other reasons for not hiring an applicant, these rights still apply. In a situation where the employer feels they would have made an adverse decision anyway, regardless of the background report, an employer should still follow this procedure for maximum legal protection.

An open question is how long an employer must wait before denying employment based upon information contained in a consumer report. The FCRA is silent on this point. However, many authorities advise that an employer should wait a reasonable period of time before making the final decision. This period should be the time needed for an applicant to meaningfully review the report and make known to the employer or the reporting agency any inaccurate or incomplete information. This does not mean an employer is required to hold the job open for a long period of time. Most employers find as a practical matter that this provision of law does not impose any undue hardships or burdens. Even though in rare situations an employer may have questions on how to proceed, the clear advantages of a pre-employment screening program far outweigh any complications that can theoretically arise from compliance issues.

One common question is how far back a consumer reporting agency can go in reporting criminal convictions. The 1998 amendments to the FCRA removed the limitation on reporting criminal records more then seven years old. However, the laws did not affect limitations imposed by state law. It can be argued that some states, such as California, still retain a seven-year limitation on reporting certain criminal convictions. Because there is no workable national rule, many agencies still limit their search to seven years.

Conducting Investigations In-House Vs. Hiring an Outside Agency

Even though the FCRA applies to reports prepared by third parties, it is considered a best practice for corporate security departments conducting their own pre-employment screening programs in-house to operate as though governed by the FCRA. First, if an employer does not operate under the FCRA, the investigation is governed by the privacy rules in effect in that jurisdiction. Although each state is different, the general rule is that employee investigations are governed by a reasonableness standard that balances the employee's expectation of privacy against the employer's legitimate business needs. An employer must show not only reasonable grounds for the investigation, but also that measures adopted are reasonably related to the objectives of the search and not excessively intrusive.

Rather then risk liability for excessive investigations that invade an applicant’s privacy, an employer can simply choose to follow the FCRA. Since Congress has set forth certain rules and procedures to protect consumers, an employer minimizes any liability when its internal security department follows the federal rules.

The second problem is that even when an internal security department conducts an investigation, it can still fall under the rules of the FCRA. For example, if corporate security retains the services of a records search firm or a private investigator to obtain criminal records on its behalf, it is preparing a "consumer report," and all FCRA rules apply, including the need for written consent and disclosure. An opinion letter issued by the legal staff of the FTC interpreting the FCRA states in clear terms that even when that company hires an investigator or public records firm just to obtain court records for an internal investigation, written consent and disclosure is necessary. Although such staff letters are not legally binding, they carry great weight in the interpretation of the FCRA. Thus, unless a corporate security department intends to perform everything in-house, including sending its own employees to any courthouse in the country where it wants to obtain criminal records, the employer should arguably operate under the rules of the FCRA.

An employer that accesses an online database to obtain information about an applicant also may trigger the FCRA requirements concerning disclosure, authorization and adverse action letters. Unless the employer is obtaining information through a database that any citizen could easily obtain, it is arguable that FCRA rules apply. In addition, many online databases require that the user not utilize any information directly for any FCRA-covered purpose, such as employment. These databases require a user to agree as a condition of use that the information can only be used as the basis to conduct further independent investigation. Many information providers require compliance with the policies of the Individual Reference Services Group (IRSG), a voluntary industry group that has set principles regarding the use and access of non-public information. (See www.IRSG.org)

As a result, the action least likely to trigger the FCRA is for an internal security department to only obtain records that any member of the general public can obtain, and only do it themselves through their own internal employees. However, even in that situation, a company can face liability. Assume, for example, corporate security locates a criminal record resulting in a person not being hired. Public records, however, can contain errors. Sometimes the records actually may be about someone else. Or it may not be legal to utilize a particular criminal record for employment purposes, given the many complicated rules in the various states about what records can and cannot be used. If the firm were operating under the FCRA, the applicant would have the right to first review the report before any decision is made final, and to clear up a mistake. But if corporate security does not follow the FCRA, and the applicant is erroneously denied employment, there is the chance of a lawsuit being filed.

In addition, just because the FCRA applies on its face to the activities of "third party" consumer reporting agencies, that does not mean that someday a job applicant denied employment will not sue a company for not following the FCRA. A lawsuit could be brought on the basis the internal security department is the functional equivalents of a third party. Even though it is an internal department receiving company paychecks, an applicant could well argue that internal security is in effect an independent entity within the company, and consumer protections guaranteed by the FCRA should apply to internal investigations as well. An argument can be made that it is a violation of equal protection for applicants who are investigated by internal security have less rights just because an investigator is paid by a company paycheck, as opposed to a check being issued for services rendered.

The primary downside to a private employer having an internal security department act as though the FCRA applied is that some states have their own laws that parallel the FCRA, but restrict criminal records to a seven-year period. If a firm did an investigation completely in-house, then any such limitation would arguably not apply. However, an employer instates that have such a seven year limitation must balance that against the significant legal protection they gain by complying with the FCRA for in-house investigations. In addition, it is expected that over the next few years, states may lift those restrictions, just as Congress lifted the seven-year limit on convictions from the FCRA in 1998.

Investigating Current employees

An evolving area of the FCRA is how to handle investigations of current employees. The FCRA rules apply not only to pre-employment screening, but also to screening of current employees for purpose promotion, reassignment or retention as an employee. Consequently, consumer reports by a third party of current employees are covered by the FCRA.

An FTC staff letter has made it clear there is no exception under the FCRA for obtaining a consumer report on a current employee suspected of criminal activity. The FTC staff also has indicated an independent sexual harassment investigation is covered by the FCRA. Although there is proposed legislation in Congress (HR 3408 introduced in November 1999) to amend the FCRA to exempt investigations of workplace misconduct, employers currently face a difficult situation.

Under the current law, if a company hires an outside screening company or investigator to do a background check on a current employee suspected of wrongdoing or misconduct, including theft or violence, the company may be required to provide the target of an investigation with a disclosure and consent form under the FCRA.

Such a notification presents a number of practical difficulties. First, it certainly makes it difficult to conduct an undercover investigation. Secondly, the outside investigator may not be able to obtain or consider certain adverse information that is too old under FCRA standards. In addition, since under the FCRA a consumer may obtain a copy of the consumer report, including an investigative consumer report, and sources may well be revealed, an investigator may be hampered in obtaining witness statements.

Under the current FCRA, one option is to conduct the investigation entirely in-house. For example, corporate security could use its own employees to pull criminal records, or conduct internal investigations and interviews. However, corporate security should be careful to avoid procedures that can invoke FCRA procedures, such as using an outside court research firm or private investigator, or accessing information from databases not available to the public.

An FTC staff letter has suggested that one avenue is to obtain a general or "blanket" authorization from the consumer at the time of hiring, allowing an employer to obtain a consumer report at any time during employment. Such a release would probably allow a firm to perform a criminal record search in the future without further authorization. Another FTC staff letter has indicated an employer could combine the additional disclosures required for an investigative consumer report in the initial disclosure to an applicant. The idea is that the original release and disclosure could authorize future undercover investigations of an employee. The FTC staff also has suggested an employer could obtain a release from all current employees in order to avoid alerting the target of the investigation, which may not be a practical suggestion.

There are complications, however, with the use of a blanket release for future investigations. A blanket release may not cover the situation where an employer decides to seek the assistance of an outside agency to conduct interviews as part of an investigation. Assuming the outside agency regularly performs such tasks, then the interviews could well be considered an investigative consumer report under the FCRA, which mandates certain additional disclosures.

The difficulty is that unless the initial disclosure was broad enough to advise an applicant as to the "nature and scope" of such a future investigation, the disclosure may not be adequate to cover that investigation. In addition, a subject of an investigative consumer report can request the user of a report disclose the "nature and scope of the investigation" within five days. Unless a consumer has specific knowledge that an investigation has been recently requested, the consumer cannot ask for further disclosure, and there is no way to give meaning to that right. As a result, using a blanket disclosure and release may not cover situations where an employer wants to use an outside agency for an undercover investigation involving interviews about an employee.

In order to allow undercover investigations and interviews by outside agencies, some authorities have suggested a firm can sign an agency agreement with an outside investigator, so they are agents of the company, and therefore would not be covered by the FCRA. It also has been suggested that if a company retains an outside investigator, the investigation is not about an individual, but is an investigation of a potential criminal or workplace problem, and therefore not covered by the FCRA. However, neither approach has been tested and the employee who is the target of such an investigation could raise legal challenges if they are terminated. In addition, an employer that violates the rules of the FCRA could potentially face substantial legal and financial exposure. Until the FCRA is clarified, employers should seek legal advice before retaining outside agencies to conduct an undercover investigation of a current employees.

Regardless of the situation, the FCRA provides protection to both job applicants and employers. Employers who understand and follow the FCRA can be ensured they are respecting the legal rights of all employees, and gain a great deal of legal protection.

Lester S. Rosen is an attorney and president of Employment Screening Resources (ESR), a national pre-employment screening agency in Novato, CA. For more information on the FCRA or ESR, visit www.ESRcheck.com.