Fact Sheet 16b:
Small Business Owner Background Check Guide

Send to PrinterSend to Printer
Copyright © 2003-2016
Privacy Rights Clearinghouse
Posted August 2003
Revised May 2016

The PRC does not perform background checks.

  1. Introduction
  2. Background Check Primer: Know the Terminology
  3. Employment Background Checks and Federal Law, the FCRA
  4. What Can an Employer Find Out? What Is Off Limits?
  5. Should I Hire an Outside Screening Company?
  6. Background Checks: Not Just for Applicants
  7. The Employer’s Obligations under the FCRA
  8. Proper Disposal of Employment Reports
  9. Workplace Investigations
  10. Special Rules for California Employers
  11. Employer Checklist and Tips
  12. Resources

1. Introduction

Small business owners and large corporations alike know the value of good employees. But unlike large corporations, small business owners are often unable to absorb the risks and liability that may come from bad hiring decisions. On the one hand, employers are being sued by victims that allege the employer failed to exercise due diligence in hiring.  Conversely, employers also face lawsuits from job applicants complaining about the
accuracy of background reports or the failure to meet regulatory guidelines.

This guide is intended to acquaint small business owners with basic information about screening applicants and current employees.

2. Background Check Primer: Know the Terminology

Like most issues today, the subject of employment background checks has its own language. Many terms have different meanings, depending on where the words appear. And terms sometimes come into the language through common usage, but are not recognized as technical terms or terms you will find defined in the laws we discuss in this fact sheet.

When an employer performs what he or she calls a background check or an employment screening, this may or may not be subject to the two laws we discuss here:

  • Federal Fair Credit Reporting Act (FCRA), 15 USC §§1681 et seq.
  • California Investigative Consumer Reporting Agencies Act (ICRAA), Civil Code §1786 et seq.

Whether you are researching this topic for the first time or are a seasoned employer, it helps to know the language.

Consumer Report
This is the term used in the federal FCRA for any “written, oral, or other communication,” in other words, a report made about a person by a consumer reporting agency that bears on the person’s “credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.” This includes credit reports and investigative consumer reports (also sometimes called “interview” reports) made, among other things, for the employment purposes of hiring, promotion, reassignment, or retention.
Investigative Consumer Report
Under the federal FCRA this means a report about a consumer’s character, general reputation, personal characteristics, or mode of living in which information is obtained through interviews with neighbors, friends, or associates. Under California’s Investigative Consumer Reporting Agencies Act, or ICRAA, an investigative consumer report is a report in which the same types of information are obtained through any means. The term in California excludes credit reports.

3. Employment Background Checks and Federal Law, the FCRA

The federal Fair Credit Reporting Act (FCRA) sets the national standard for employers who want to find out more about an applicant or current employee. Sometimes mistaken for the credit reporting law, the FCRA covers much more than credit reports. It is enforced by the Federal Trade Commission (FTC), www.ftc.gov.

The FCRA covers “consumer reports.” In addition to credit worthiness information, it covers information about a person’s “character, general reputation, personal characteristics, and mode of living.” This is the type of information you as an employer usually want to know before making important decisions about an applicant or employee. Thus, whether a credit check is included or not, an employment background check is a type of “consumer report” that is covered by the FCRA.

Be aware: For an employment background check to qualify as a “consumer report” under the FCRA, it must be prepared by a third-party consumer reporting agency. For more on consumer reporting agencies and when an employment background check is subject to the FCRA, see sections 3, 4, and 7 of this guide.

Why is a law needed?

The purpose of the FCRA is to assure that reports used to make important decisions such as those related to a person’s employment are accurate. Privacy is also a factor in protecting a consumer’s rights. The law limits who has legitimate access to employment background checks. For the individual who is the subject of a background check as well as the employer, such safeguards are essential. For example, a report that erroneously shows a criminal conviction can wreck a career and at the same time rob a business of a valuable member of the workforce.

I only have a few employees. Does the FCRA apply to me?

Yes. The FCRA makes no distinctions between a small business owner and a large corporation. If the information you seek on an applicant or current employee meets the definition of a consumer report and the information is compiled by a consumer reporting agency, the FCRA applies no matter how many employees you have.

4. What Can an Employer Find Out? What Is Off Limits?

What is a background check?

“Background check” is a common term used to describe any one or a combination of reports collected about individuals for employment purposes. The technical term used by the FCRA for a collection of such data is a “consumer report,” defined as “…any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living….”. (15 USC §1681a(d)(1))

If you are a California employer, the technical term for a background check is an “investigative consumer report,” which includes information about a person’s “character, general reputation, personal characteristics,” but does not include information about creditworthiness. For more on California law, see section 10.

Is a background check required?

Neither the FCRA nor the California ICRAA requires employers to conduct background checks. These laws merely set the standards that apply if and when a background check is conducted. The focus of both the FCRA and the ICRAA is not to help employers dig into an applicant’s past, but rather to assure the information obtained is accurate and up to date. Without these standards, erroneous information may follow an individual for a lifetime.

For certain jobs, specific laws make a background check mandatory rather than discretionary. Often the laws that require a background check are limited to a check of criminal records. Examples of jobs that require a criminal background check are those in the trucking industry, law enforcement and many jobs that involve contact with children, the elderly, and disabled persons. Such industry-specific background checks are beyond the scope of this fact sheet.

Immigration laws also call for employers to verify a person’s eligibility for employment. This requires a form called an Employment Authorization Document (EAD), sometimes referred to as an I-9 check. For more on this process and an employer’s obligations, visit the web site for the US Citizenship and Immigration Services Website at http://www.uscis.gov/portal/site/uscis.

What can I learn from a background check?

Depending on the focus of your business, here are just some of the things background checks can include:

*Credit history
Past employment
Professional licenses
Criminal recordsEducationWorkers’ comp
Driving records
Medical history

As a minimum, most employers want to check with a former employer. This type of background check is typically called a reference check. And employers usually want to be assured that the person about to be hired has no criminal record. For some jobs an employer may want to know if the person has shown responsibility in financial dealings. Some employers also consider personal interviews with the applicant’s business associates, friends, or neighbors of value in assessing character and reputation. Such inquiries seem routine enough, but some things are worth bearing in mind.

*Note that some states have passed laws that limit access to credit reports for employment purposes. Those states are: Washington, Oregon, Hawaii, Illinois, Maryland, Vermont, Connecticut and California. Generally, laws in these states allow access to credit history only for certain types of jobs such as those that involve handling money. 

Criminal records held by the court system are public records, and unless some restriction has been imposed by a court, the records are available to anyone. Even so, the FCRA says that records of arrest cannot be included on an employment background check after seven years. The FCRA allows a criminal conviction to be reported indefinitely.

Note: See sections 7 and 10 for more information on the California law. It states records of arrest cannot be reported at all unless a conviction resulted or the matter is pending judgment. California law also has a more restrictive rule about reporting criminal convictions.

A consumer reporting agency that includes public record information that is likely to have an adverse effect on a consumer's ability to obtain employment must either:

  • Notify the subject that negative information will be included on a report and include the name and address of the person who is getting the report, or
  • Insure that public record information is up-to-date as of the date it is reported.

Is there a national data base for criminal records I can access?

The FBI maintains a national data base of criminal records called the National Crime Information Center (NCIC). Employers whose workers are required to have a criminal background check may be able to access this national data base, either directly or through criminal record data bases maintained by the state attorney general.

However, the data base is not available to all employers. Access to the NCIC is typically allowed for employment screening related to jobs that involve work with children, the elderly, or the disabled.

If the job does not require or allow access to the NCIC where criminal information is compiled in one place, any company you hire to screen employees will search as many court systems as you are willing to pay for. Many background check companies (consumer reporting agencies) consult the data bases of information brokers that report on criminal records from multiple jurisdictions. Such third-party companies, if reputable, comply with the FCRA.

Note that official criminal records data bases maintained by the FBI and state law enforcement agencies are fingerprint-based checks. Commercial screening companies do not typically have access to official data bases and thus do not base background information on fingerprints. Rather, when matching the subject of a background check to criminal history, commercial screeners rely on certain items of personal information or data points such as name, middle initial, date of birth current and former addresses. For privacy reasons, many courts have removed the Social Security number from records maintained by local courts.

How can I check to see if an applicant has a criminal record?

If you want to conduct your own investigation rather than hire an outside company, you can request court records from every jurisdiction where the applicant may have lived. In some jurisdictions, court records are available directly from the court’s web site. Access to court records via the Internet varies greatly from jurisdiction to jurisdiction. If not available over the Internet, court files are available at the courthouse. Access may be restricted if a case has been sealed by the court or the record has been expunged.

Can I use an Internet research service to find out about criminal convictions?

In recent years, there has been an explosion of Internet data brokers that offer to “find out anything about anybody,” no questions asked. Typically, these services offer public records searches, including criminal records, for most jurisdictions. A word of caution: Many Internet sites advertise low rates for public records searches, but the advertised rates may be deceiving. The more jurisdictions you want to search, the more you are likely to pay.

There is a question as to whether such Internet search firms are “consumer reporting agencies” and thus subject to the FCRA. The Federal Trade Commission’s staff issued an opinion letter in 1998 that said a company that collects public records and sells those records to third parties, including companies for employment purposes, is a consumer reporting agency. www.ftc.gov/os/statutes/fcra/leblanc.htm.

In March 2012, the FTC filed a lawsuit against Internet data broker, Spokeo, charging that the company operated as a consumer reporting agency. For more on this case, go to: www.ftc.gov/opa/2012/06/spokeo.shtm 

In our opinion, if you are conducting a background check for employment purposes, you should avoid dealing with any Internet search service that does not show compliance with the FCRA. For more on this, see section 6 on how to choose a company to screen your potential and current employees.

Is a criminal record alone enough to reject an applicant?

Not necessarily. The U.S. Equal Employment Opportunity Commission (EEOC) has said that use of criminal history may sometimes violate Title VII of the Civil Rights Act of 1964. This can happen, the EEOC says, when employers treat criminal history differently for different applicants or employees.

On April 25, 2012, the EEOC issued extensive guidelines for employers in considering the criminal history of a job applicant or employee. The EEOC cites the most important considerations as:  (1) the nature and gravity of the offense (2) the time that has lapsed since the offense and (3) the nature of the job. To aid in compliance with Title VII, the EEOC guidelines provide employers with examples of best business practices.

The EEOC’s guidelines, Consideration of Arrest and Conviction Records in Employment Decisions Under Title VII of the Civil Rights Act of 1964,  can be found at: www.eeoc.gov/laws/guidance/arrest_conviction.cfm

As an employer, can I get civil court records?

Public records, other than criminal records, may also be a part of an employment background check. This could include such information as bankruptcy, civil judgments, or tax liens. The FCRA imposes limits on the time such “negative” information can be reported by a consumer reporting agency. But the FCRA time limit does not apply if you visit the courthouse yourself.

When included in a report prepared by a consumer reporting agency, civil judgments and tax liens should not be reported after seven years, and bankruptcy should not be reported after 10 years. When noting a consumer’s bankruptcy, the report should also include the type of bankruptcy filed (the applicable chapter of Title 11 of the bankruptcy code). If the bankruptcy was withdrawn before judgment, that information should also be reported.

May I consider data that goes beyond the FCRA time limits?

The time limits do not apply to positions with an annual salary of $75,000 or more. For jobs that fall under this threshold, the rule is that consumer reporting agencies cannot report information beyond the time limit. The FCRA does not say an employer cannot consider older information if the consumer reporting agency makes a mistake and reports information beyond the time limit.

The distinction between what can be reported and what an employee can consider is explained by the FTC in the 1999 staff opinion letter to Sum, www.ftc.gov/os/statutes/fcra/sum.htm.

For more on time limits and reporting negative information and public record information, see these FTC staff opinion letters:

In short, the time limits in the FCRA restrict what can be reported by a consumer reporting agency or background screening company. The screening company may make a mistake and report negative information that should not be reported because of FCRA times limits. The FCRA letters listed above say that mistakes like this are the problem of the consumer reporting agency, not the employer. It is not the employer’s obligation to see that the screening company reports only timely information.

See section 7 of this guide for information on an employer’s obligations.

Is a reference check considered a consumer report?

Reference checks may be as simple as a brief telephone call to an applicant’s former employer to verify facts such as date of employment, salary, and job title. Reference checks limited to such factual information are generally not considered part of a consumer report — even when the call is made by a third party consumer reporting agency.

However, if the conversation goes beyond a simple check of facts and this information is included in a background check report, this may constitute what the FCRA calls an “investigative consumer report.” It requires additional disclosures to the applicant or employee.

For more on reference checks and when an inquiry becomes an investigative consumer report, see these FTC staff opinion letters:

I need a “team player.” May I ask the former boss if an applicant fits the bill?

Questions like this are designed to elicit an opinion rather than facts. Under the FCRA, investigative consumer reports are a kind of consumer report in which information about a consumer’s “character, general reputation, personal characteristics, or mode of living” is obtained through personal interviews with people who have reason to know about these matters. The term does not include information obtained from a creditor. (Note: The term “investigative consumer report” has a different meaning in California, explained in section 10.)

If interviews with neighbors, friends, relatives, associates or others are requested as part of an employment background check, the FCRA requires additional steps to be taken by both the employer and the one who prepares the report of interviews.

The employer’s obligations are to give the individual:

  • Written notice that a report will include interviews. You have three days after you request the report to inform the individual.
  • A statement of the individual’s right to request more details, that is, a statement of the “nature and scope” of the requested report.
  • If the employee or applicant requests additional information, you, the employer, must give a written disclosure within five days of receiving the request. The written disclosure tells the individual how to obtain a copy of his or her file.

The employer must also certify to the reporting agency that this notice has been given to the individual.

A consumer reporting agency’s obligations for reports based on interviews are to:

  • Verify public record information during the 30-day period before the report is issued.
  • Confirm the accuracy of information obtained through interviews, unless the person interviewed is the best source.
  • Avoid any inquiry that would violate federal or state equal employment laws.

Is an Internet “Google” search a consumer report?

What you learn about an applicant from an Internet search engine like Google may include information about the person’s “character, general reputation, personal characteristics, mode of living,” or even credit worthiness. However, to be a “consumer report,” the information must be assembled by a “consumer reporting agency” that “regularly” prepares reports for a fee to employers. A search of a person’s name through an Internet search engine does not appear to meet this definition.

But, the risk of relying on such a source to screen employees is equal to that of checking any Internet site: You have no assurance that the information you retrieve is about the person you want to check. And even if it is, you have no assurance it is accurate.

Does the FCRA cover screening for illegal drugs?

Generally, no. Screening of applicants or current employees for use of drugs falls under state and federal employment and labor laws. The U.S. Department of Labor’s workplace drug testing page: www.dol.gov/elaws/asp/drugfree/drugs/screen92.asp

However, according to an FTC staff opinion letter, in some situations, drug testing may be subject to the FCRA. www.ftc.gov/os/statutes/fcra/islinger.shtm

You should also visit the web site for your state employment agency for more information.

Does the FCRA cover use of medical information for employment checks?

The FCRA puts limits on medical information furnished by a consumer reporting agency for employment purposes. First, the subject must “affirmatively consent.” Second, medical information can only be furnished by a consumer reporting agency if it is relevant to the job. (FCRA §604(g))

What other laws might cover background checks?

In addition to labor or employment laws, screening of job applications or current employees may overlap other laws, such as:

Is there any free advice for a small business owner?

National or local branches of the federal Small Business Administration (SBA) may assist small business owners in meeting the legal requirements in industries that require a background check. www.sba.gov

The nonprofit Service Corps of Retired Executives (SCORE), www.score.org, works with the SBA. Its members counsel small business owners on all operations. One SCORE publication gives advice on how to select a good employee. www.score.org/eguide-small-business-hiring

The U.S. Department of Labor web site provides a section for answering employers’ questions. www.dol.gov/dol/audience/aud-employers.htm

The FTC has published a guide for employers who use credit reports as part of an employment background check. http://business.ftc.gov/documents/bus08-using-consumer-reports-what-employers-need-know

Employers who want to use credit reports for employment purposes should be aware that some states have restricted the use of credit checks for employment purposes. Washington, Oregon, Hawaii, Maryland, Vermont, Connecticut, California and Illinois have passed such laws.

For more on credit reports as part of employment checks, see Part 7 of PRC Fact Sheet 16, www.privacyrights.org/fs/fs16-bck.htm#7

Another source of information should be the company you hire to conduct employment screening. A reputable company will provide information about your responsibilities under the FCRA, for example, 15 USC §1681e(d)(1). A good screening company will want to make sure you understand the employee’s rights under the FCRA as well as your own responsibilities.

5. Should I Hire an Outside Screening Company?

What must I do to have an outside company conduct a background check?

The FCRA requires that consumer reporting agencies have the following assurances from the “user” of a consumer report, in other words, you the employer. Before the process begins, you must:

  • Verify to the reporting agency that you have a legitimate need for requesting an investigation of an existing employee or job applicant.
  • Certify that you have obtained permission from the employee or applicant.
  • State the reason that you are requesting the report.
  • Certify that the information will only be used for employment purposes.

Why should I hire an employment screening company? Can’t I just do the report myself?

There are many reasons to hire a reputable company. When it does its job correctly, a good background screening company will guide you through the process. This includes not just the legal process of compliance with the FCRA, but the administrative process that involves an applicant’s permission and notices required in the event you decide to take an adverse action based on the report.

In addition, when you deal with a reputable company, you have some assurance that the company has met its obligations as well. In particular, a consumer reporting agency that includes public records in an employment background check report must verify the accuracy of the information before the report is given to you, the employer.

Another reason to hire a reputable company is that you receive some assurance of completeness. An incomplete search can be devastating to both you and an employee or applicant. A potential or current employee wrongly charged with a crime should not be penalized by having that negative notation on a background check. For example, if the applicant were a victim of criminal identity theft, the report is likely to include criminal records that are not his. For more information on criminal identity theft, see PRC Fact Sheet 17g, www.privacyrights.org/fs/fs17g-CrimIdTheft.htm.

As an employer, you deserve some assurance that the screening process actually reveals information that could be detrimental to your organization. For example, instances of workplace violence are often in the news these days. A prudent business person should question whether an inexpensive Internet background check is worth the risk of later learning about an employee’s unreported history of violence or firearms violations.

A small business owner who establishes a relationship with a reputable screening company has much to gain. In establishing such a relationship, you want to know if the company:

  • Follows the FCRA and applicable state and laws.
  • Gives you guidance about your responsibilities as a user of consumer reports.
  • Provides forms to obtain permission and gives the required notice to the applicant or employee.
  • Provides forms and guidance if you are faced with an “adverse action” decision.
  • Meets its obligations to provide the individual access to reports and to his or her file.
  • Follows required procedures for investigating inaccurate information.

6. Background Checks: Not Just for Applicants

Does the FCRA apply only to people I am considering for a new job?

No. The same law applies to all checks made for employment purposes. It covers a report used “for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee.” (15 USC §1681a(h)) The same is true whether you are a California business owner or located in another state in which only the FCRA applies.

Can I run a check on an independent contractor’s employees?

Yes. The Federal Trade Commission has issued an opinion stating that the term “employment purposes” includes independent contractors. Even if your work is done by people who use their own equipment or work for someone else on your property, you can request a background check. But, you have to follow the same rules as you would with one of your regular employees. (Isaac-Allison Letter, www.ftc.gov/os/statutes/fcra/allison.htm)

7. The Employer’s Obligations under the FCRA

What are my obligations in performing a background check?

First, if you hire an outside company, you must get permission from the applicant or employee. This has to be on a separate form and cannot be included with other documents such as an employment application. If you want to include medical information in the report, you must give specific notice.

After that, your obligations may differ depending on whether you are doing business in California or in another state. Some of the most important distinctions between the FCRA and California state law involve the notice you are required to give when you ask for the employee’s permission to conduct the background check. This and other important distinctions can best be explained by a professional screener who understands the laws of your state. The FTC’s guidance for users of consumer reports is the minimum required. www.ftc.gov/bcp/conline/pubs/buspubs/credempl.htm

An employer also has an obligation to notify the subject of a background check before taking an adverse action based on information included in a report. An example would be if you decide not to hire a person based on information included in the report. And the same rules apply whether the negative information included in the background report was the only reason you decided not to make the job offer or was just one of the factors that made you decide against hiring that person.

The FTC gives examples of an employer’s obligations when making an “adverse” decision in its publication, Using Consumer Reports: What Employers Need to Know, www.ftc.gov/bcp/edu/pubs/business/credit/bus08.shtm

Do I have to get permission every time I do a background check?

California law says the subject of a report has to be notified at any time a background check is requested. The only exception is an investigation into suspected wrongdoing. The FCRA, on the other hand, does not specify that notice is required every time a check is conducted. Under federal law, once an applicant or employee gives permission for a background check, that is all that is required.

Does a report have to be written to fall under the FCRA?

No. Information about an employee relayed verbally to you or an agency you hire need not be in writing to trigger your obligations. You need not reduce the report to writing but may pass the information along verbally to the person that is the subject of the report. But, following good business practices, you should always keep a written record even when information is relayed verbally.

Do I have to give the employee a copy of the report?

An employee’s right to a copy of his or her file is a good example of how state and federal laws can differ. Both federal and California law allow an applicant access to the “file,” that is the information contained in the screening company’s records. An “adverse” employment decision means the employee gets a copy of the report free. Otherwise, there may be a charge.

The FCRA allows employees and applicants to get one free employment report each year directly from the screening company. For more on this, see PRC Fact Sheet 6b, The Other Consumer Reports: What You Should Know about “Specialty” Reports, www.privacyrights.org/fs/fs6b-SpecReports.htm.

The right to get this free report does not create a new obligation for employers. However, as we note below, a loophole in the FCRA means the employee may never know the name of the screening company. In situations not covered by amendments to the FCRA, there may be a charge to obtain a copy.

In California, the employee or applicant marks a box to request a copy of the file. This is done at the earliest stage, when permission for the background check is granted by the individual. At this time, the employer also provides information about how the individual can obtain the file, including the name, address, and telephone number of the screening company.

Under the FCRA, the employee is entitled to notice of the right to get a copy of the report and to obtain contact information for the background check company only when the employer has to give a pre-adverse employment decision. The process that allows the subject of a report to gain access to her own information points out one of many flaws in the FCRA, as follows:

The FCRA gives consumers an absolute right to access the file, but the subject is not entitled to know the name and contact information for the company that compiled the file unless the employer makes a decision that is adverse to the employee’s interest. When the file in question is a credit file, this should not present a problem since there are only three national consumer reporting agencies that keep credit files.

However, there are literally thousands of companies that perform employment background checks that are (or should be) classified as consumer reporting agencies under the FCRA. Unless an adverse action is taken, the employee or applicant who wants to review his or her file for accuracy can only rely on the goodwill of the employer to voluntarily supply the name, address, and telephone number of the consumer reporting agency involved.

Although technically not required, an employer has nothing to gain by withholding contact information from one who wants – and indeed is entitled by law – to see information contained in the “file.”

What if the employee or applicant says information in the report is inaccurate?

The individual has the right to dispute inaccurate and incomplete information. If you give a pre-adverse action notice, the FCRA requires you to also give the employee or applicant a copy of the report. At that time you must also give the employee the name, address, and telephone number of the company that conducted the background check. You must also give the individual information about how to dispute information in the report. The process may vary slightly depending on whether you are in California or whether the rules of the FCRA apply.

What are my obligations if a report comes back with negative information?

The FCRA requires you to make specific statements to the employee if you decide not to hire an applicant or if you take some adverse action against a current employee. In California, you have even more of an obligation to advise the employee of his or her rights.

Following is an example of what you must do under the FCRA if you decide not to hire or promote someone based on information in the background report.

  • First, give the person a pre-adverse action disclosure along with a copy of the report and a summary of rights. For reports prepared by an outside screening company in California, the FCRA procedure applies. Under the FCRA, an employer who conducts a background check in-house, would not have to give the pre-adverse action notice. However, an adverse action notice is required for in-house screenings in California.

  • If you are in California and you conduct the background check without the assistance of an outside company, you will also need to include the summary of rights. You may get a summary of rights from the FTC’s web site.

  • Once you take an adverse action based on a background report, the FCRA requires you to give a second notice to the individual that (1) identifies the source of the report (the employment screening company or the private investigator), (2) explains that the adverse employment decision was not made by the source of the report, and (3) includes notice of the right to dispute the accuracy or completeness of the report.

Are the procedures the same if the report shows a criminal conviction?

Yes. The FCRA as well as the California ICRA Act were established to ensure that only accurate and up-to-date information is reported. In addition, amendments to the California law recognize that the growing crime of identity theft means that false information could prevent an applicant from being hired.

Both the FCRA and California law include specific sections about public record information that shows an arrest, indictment, or conviction.

  • The FCRA says that this type of public record information has to be current as of the date of the background report.
  • In California, an agency that conducts a background check has to verify the accuracy of public record information about crimes in the 30-day period before the report is provided to the employer.

I have two equally qualified applicants for a job. Because one has a poor credit record, I want to select the other for the job. What are my obligations?

As noted earlier, some states restrict the use of credit reports for employment. If a credit report or other form of background check information is even one of the factors used to make an employment decision, the above procedures must be followed. The FTC’s guide for employers gives several examples of how bad credit might factor into your decision as well as what you should do under different circumstances. http://business.ftc.gov/documents/bus08-using-consumer-reports-what-employers-need-know

Following are examples of employment situations that, according to the FTC, require a pre- adverse action notice.

  • You advertise vacancies for cashiers and receive 100 applications. You want just a credit report on each applicant because you plan to eliminate those with poor credit histories.
  • A job applicant gives you permission to get a consumer report. Although the credit history is poor and that's a negative factor, the applicant's lack of relevant experience carries more weight in your decision not to hire.
  • The applicants for a sensitive financial position have authorized you to obtain credit reports. You reject one applicant whose credit report shows a debt load that may be too high for the proposed salary, even though the report shows a good repayment history. You turn down another whose credit report shows only one credit account because you want someone who has shown more financial responsibility.

I suspect one of my employees is stealing from the company. Do I have to get permission to do a background check?

No. In California the law specifies “suspicion of wrongdoing” as an exception to an employer’s obligation to get prior consent. The FCRA also includes a similar exception under the amendments in the Fair and Accurate Credit Transactions Act of 2003 (FACTA). See section 9 for more information about FACTA.

Can I face legal action for not complying with the law?

Yes. Action may be taken against you, both by the individual involved and the FTC or the state attorney general. If a person whose background information you have obtained sues you, you can be liable for actual damages, punitive damages, court costs, and attorneys’ fees. If the violation is found to be “willful,” the penalty is more.

The FTC can also sue employers for up to $2,500 per violation of the FCRA. In California the penalty for violating the ICRAA is the greater of actual damages or $10,000. The court may also award costs and attorney’s fees. If the violation is determined to be grossly negligent or willful, the court may also assess punitive damages. The California penalties apply to both the employer (the user of the report) and the screening company that prepared the report.

In recent years, there have been multi-million dollar class action settlements against companies for faliure to follow the FCRA.

8. Proper Disposal of Employment Reports

Proper disposal is required for information contained in or derived from a consumer report. As we discuss above, an employment background report is just one kind of consumer report covered by the FCRA. 

Congress directed the FTC and the federal banking agencies to issue regulations about proper disposal of information included in or derived from consumer reports. The FTC’s final regulations were issued on November 14, 2004, www.ftc.gov/opa/2004/11/factadisposal.htm. The disposal requirements are effective June 1, 2005. To read the PRC’s comments on the FTC’s proposal, see www.privacyrights.org/ar/FTC-DocDisposal.htm.

What does “proper disposal” mean?

The FTC defines “proper disposal” as (1) discarding or abandonment of consumer information and (2) the sale, donation, or transfer of any medium, including computer equipment, upon which consumer information is stored.

To the small business owner, this means that information you receive about a job applicant or employee that fits the definition of consumer information cannot be merely thrown in the trash. Rather, it must be shredded or otherwise destroyed so that information cannot be reconstructed. Proper disposal also means that if your company donates old computers to a school or a thrift shop and that computer was used to store consumer information, the computer must be erased so that information cannot practically be read or reconstructed.

What must I do to comply?

The FTC does not set up a point-by-point program that would be applicable to anyone that uses consumer reports. Rather, the FTC says you must “take reasonable measures to protect against unauthorized access to or use of the information.”

The FTC gives some examples of what it considers to be “reasonable measures.” These examples include adopting policies and procedures to ensure proper destruction of all consumer information, whether the data is kept in paper, electronic, or other form.

Since I have only a few employees, does this apply to me?

Yes. The FTC specifically states “…any employer, regardless of industry or size, that obtains a consumer report (whether a full credit report or a pre-employment check of public records) would be subject to the proposed Rule.”

What do I need to know about proper disposal?

Small business owners are well advised to read the FTC’s final regulations to assess current disposal practices, and adopt new procedures as needed.  http://www.business.ftc.gov/documents/alt152-disposing-consumer-report-information-rule-tells-how.

The web site of the National Association of Information Destruction provides useful information. www.naidonline.org.

Small business owners that are “financial institutions” under the Gramm-Leach-Bliley Act may also be subject to proper disposal requirements under the FTC’s Safeguarding Rule. www.ftc.gov/privacy/privacyinitiatives/safeguards.html

9. Workplace Investigations

What is an “employee misconduct investigation”?

This is an investigation conducted by a third-party that you, the employer, may hire if you suspect an employee of:

  • Misconduct relating to his or her employment.
  • A violation of federal, state, or local laws or regulations.
  • A violation of any preexisting written policies of the organization.
  • Noncompliance with the rules of a self-regulatory organization, that, for example, oversees the securities and commodity futures industry.

If I suspect an employee of misconduct, what steps do I take?

You do not have to give the employee notice and get permission to conduct a misconduct investigation. And you do not have to give a notice of rights as you would to others who are subject to a standard employment background check.

If, at the end of the investigation, you decide to take some action against the employee, you must give the employee an “adverse action” notice, but only after the action has been taken. An employee who is the subject of a “misconduct investigation” is entitled to receive only a “summary” of the investigation report, but not the detailed report that may include sources.

Who will see the investigation report?

The report may be communicated to:

  • The employer or its agent.
  • Any federal or state officer, agency or department or any officer, agency, or department of a unit of general local government.
  • Any self-regulatory organization with regulatory authority over the activities of the employer or the employee.
  • As is otherwise required by law, or
  • In accordance with an existing FCRA section that allows a consumer reporting agency to disclose personal identifying information to a government agency.

Can the employee dispute the findings?

Not under the FCRA dispute procedure. That is because the new section on workplace misconduct investigations was established by removing this type of investigation from the definition of “consumer report.” Thus, the usual protections that apply to a “consumer report” conducted for employment purposes do not apply to workplace misconduct investigations. If you find yourself in the position of conducting such an investigation of one of your employees, you will probably want to seek legal counsel.

The workplace misconduct provisions of the FCRA can be found at Section 603(y). www.ftc.gov/os/statutes/fcradoc.pdf

10. Special Rules for California Employers

Employers nationwide must comply with the minimum rules of the FCRA. California law goes beyond the national standard. Throughout this guide we have compared various requirements of the FCRA with the stronger California law. We have summarized these differences in the chart below. The requirements of California law are also discussed at length in PRC Fact Sheet 16a, “Employment Background Checks in California: A New Focus on Accuracy.” www.privacyrights.org/fs/fs16a-califbck.htm

Following are the most important things for a California employer to keep in mind when performing an employment background check:

  • Get permission at any time a background check is requested except for suspected wrongdoing.
  • Give a notice of rights at the time a check is requested, including the right to get a copy of any report made, and provide contact information for the screening agency.
  • If you conduct the background check yourself without the assistance of a third-party screening company, offer to provide copies of public records you obtain.

See also, Appendix C to Part 601 of the FTC regulations entitled Notice to Users of Consumer Reports: Obligations of Users Under the FCRA. http://www.ftc.gov/os/2004/11/041119factaapph.pdf

11. Employer Checklist and Tips

Summary of employer obligations:

If you hire an outside company to do a background check on a job applicant or current employee, the FCRA requires that you:

  • Get written permission from the individual for the background check.
  • Get permission on a separate document.
  • Get special permission if medical information is requested.
  • Give notice of the individual’s right to ask about the nature and scope of the report if the report will include interviews with others.
  • Give notice and a copy of the report before an adverse employment decision is made.
  • Give notice of rights and procedures to dispute inaccurate or incomplete information

If you are a California employer, and whether you conduct the background check yourself or hire an outside company, you must also:

  • Give notice to the individual of the right to ask for a copy of any background report.
  • Give notice of the right to know the nature and scope of a background check.
  • Give contact information for the screening company.
Employer’s ObligationsFCRACalifornia ICRA Act
Employee’s permissionMust be obtained on a separate document before a report is requested. Permission is not necessary for subsequent reports. Special permission is required for medical information.Must be obtained on a separate document at any time a report is requested. Special permission is required for medical information.
If employee is suspected of wrongdoingSame procedures for consent required.Consent is not required.
Notice of rights, for example to dispute information, to review filesMust be given before an adverse action is taken against the applicant or current employee.Must be given at the time a background check is requested and permission is obtained from the employee.
Copy of reportMust be offered at the time of a notice of intended adverse action.Must be offered at the time permission is obtained to get the background check report.
PenaltiesActual damages up to $1,000. Punitive damages, costs, and attorney fees (willful). Actual damages, costs, and attorney fees for negligent noncompliance.Actual damages, but no less than $10,000. Punitive damages for grossly negligent or willful conduct; attorney fees, and costs. Note: 2003 legislation, AB 1399, signed by the Governor on July 31, 2003, reduced penalties.

Tips for employers:

1. Educate yourself. A small business owner usually wears many hats. The best you can do for yourself and your company is to acquire at least a working knowledge of the many laws involved in being an employer. Government agency web sites are a good place to start. See resources at the end of this guide as well as the links provided throughout the guide for suggestions.

2. Seek free advice from organizations such as SCORE and the Small Business Administration. Follow the links on their web sites for other information. Use the contacts sections of these web sites to ask questions. Information about these organizations is provided below in section 12.

3. Join local business groups and share information with other small business owners.

4. If you decide to hire a background checking company, make sure the company you hire follows the FCRA and applicable state laws.

5. Be wary of Internet web sites that promise to find out anything about anybody, no questions asked. If you consider using an Internet information broker service, learn the total costs involved in checking public records. Bargain prices first quoted could turn out to be more expensive than the services of a reputable background checking company. Remember, if you are checking public records, the more jurisdictions you check, the greater the cost. Also, keep in mind that while an Internet data broker may claim not to be subject to the FCRA, the FTC may take a different view. See: The FTC's complaint filed against data broker Spokeo, www.ftc.gov/opa/2012/06/spokeo.shtm


Federal and State Law

Fair Credit Reporting Act, 15 USC §§1681 et seq. http://www.law.cornell.edu/uscode/text/15/1681
Federal Trade Commission Regulations. 16 CFR 601 et seq., www.ftc.gov/os/statutes/2-fedreg.htm
California Investigative Consumer Reporting Agencies Act, Civil Code §1786 et seq., www.leginfo.ca.gov/, as amended by Assembly Bill No. 1399, approved by the Governor July 31, 2003.

Federal Trade Commission Publications

Using Consumer Reports: What Employers Need to Know, www.ftc.gov/bcp/edu/pubs/business/credit/bus08.shtm
Employment Background Checks,
Background Checks: What Employers Need to Know, http://business.ftc.gov/documents/0487-background-checks-what-employers-need-know
Background Checks – Tips For Job Applicants and Employees
What Employment Background Screening Companies Need to Know About the FCRA

Counseling for Small Business Owners

Small Business Administration (SBA Answer Desk)
6302 Fairview Road, Suite 300
Charlotte, NC 28210
(800) U-ASK-SBA (800-827-5722)
Answer Desk TTY: (704) 344-6640
Send e-mails to: answerdesk@sba.gov
Web: http://www.sba.gov/content/contact-us

SBA Regional and District Office Contacts:  http://www.sba.gov/about-sba/sba_locations

Service Corps of Retire Executives (SCORE)
Phone: (800) 634-0245
Web: www.score.org

Information on Professional Background Search Companies

National Association of Professional Background Screeners
P.O. Box 3159
Durham, NC 27715
Telephone: (919) 433-0123 or (888) 686-2727
Fax: (919) 383-0035
Web: http://www.napbs.com/

Other Resources of Interest to Small Business Employers

Other Privacy Rights Clearinghouse Publications of Interest to Employers

Note: No endorsements are implied in this guide regarding references to the services and products of other organizations, companies, and trade associations.

The Privacy Rights Clearinghouse developed this guide with funding from the Rose Foundation Consumer Privacy Rights Fund

Content type: 
Copyright © Privacy Rights Clearinghouse. This copyrighted document may be copied and distributed for nonprofit, educational purposes only. For distribution, see our copyright and reprint guidelines. The text of this document may not be altered without express authorization of the Privacy Rights Clearinghouse.