Learn about employee background check laws, common employer mistakes, and penalties for non-compliance.

Here's what you need to know:
-
The Fair Credit Reporting Act (FCRA) imposes permission and disclosure requirements for background checks.
-
You must notify job applicants and employees that a background check will be conducted.
-
Written permission must be granted to allow a third party to conduct background screening.
-
If the report includes information that will lead to an adverse employment action such as the decision not to hire the job applicant, the prospective employer must provide the candidate with a "meaningful opportunity" to explain the information via a pre-adverse action notice.
Employee background screening is a common part of the hiring process. Most employers conduct background checks of prospective employees to verify job qualifications and to protect their companies from making a bad hiring decision. A 2018 report sponsored by the National Association of Background Screeners (NABS) found that 95% of the employers surveyed said they used one or more types of employment background screening.
Most of the companies that conduct background screening have discovered discrepancies. Eighty-five percent of the employers surveyed said they uncovered misrepresentations on a candidate’s resume or job application during the screening process. These results are up from 66% in 2013, according to a 2018 HireRight report.
You must handle these reports correctly to avoid legal liability.
Background check laws
An employment background check is a review that covers a person’s employment, educational, and credit records. Some reports go even further and include data on a person’s reputation. A number of laws – local, state, and federal – regulate the collection and the use of the information and the conduct of the organization performing the review.
The Fair Credit Reporting Act
The Fair Credit Reporting Act (FCRA) is federal legislation that imposes permission and disclosure requirements for background checks. Under the FCRA, an employer must take certain steps before it obtains the report. The company also must undertake specific actions if it decides to take adverse action against someone based on information obtained through the background check.
“This is an important law for employers,” Rod Fliegel, an attorney with the San Francisco office of Littler Mendelson P.C., said in an interview. Fliegel noted that in the past several years plaintiffs have filed a lot of class-action lawsuits over FCRA issues.
Remember EEOC requirements at the same time
Equal employment opportunity laws also matter.
According to the U.S. Equal Employment Opportunity Commission (EEOC), background checks cannot be used to discriminate against candidates on the basis of:
- Race
- Color
- National origin
- Sex
- Religion
- Disability
- Genetics
- Age
Case law example: Target™ agreed to pay $3.7 million in 2018 to settle a class-action lawsuit. The suit alleged that it had an “overly broad and outdated criminal background check policy” that discriminated against African-American and Latino applicants. The plaintiffs claimed that the background check policy Target had in operation at the time automatically disqualified a large number of otherwise qualified minority candidates.
Target said in a statement that it has removed the criminal history question from its employment applications. The company also said that when it asks about criminal history later in the hiring process, it provides an opportunity for applicants to explain criminal convictions.
States may have additional requirements
Some states have their own FCRA, so multi-state employers must be mindful of the obligations under federal and applicable state law, Fliegel said. This is particularly important when considering “hotbeds for claims activity such as California and New York.”
You also need to take local laws into consideration. Some states and many cities have passed “ban the box” laws that regulate when and if criminal records can be considered in hiring decisions. Generally, these laws prohibit employers from conducting background checks until after an offer of employment has been made. The City of Los Angeles has a “unique” ban-the-box law, Fliegel noted.
Employers will want to make sure that their procedures for requesting and using background checks are compliant with several sets of laws. However, one of the pieces of legislation that most often trips up employers is the FCRA.
What’s your biggest 2022 HR challenge that you’d like to resolve
Answer to see the results
An FCRA compliant background check process
The background check process under the FCRA should follow 4 basic steps.
Notify the job applicant or the employee
First, as the prospective employer, you must notify job applicants and employees that a background check will be conducted. You must also make them aware that the information might be used to make decisions about employment.
According to guidance jointly published by the Federal Trade Commission (FTC) and the U.S. Equal Employment Opportunity Commission (EEOC):
- “Tell the applicant or employee you might use the information for decisions about his or her employment.
- This notice must be in writing and in a stand-alone format.
- The notice can’t be in an employment application.
- You can include some minor additional information in the notice (like a brief description of the nature of consumer reports), but only if it doesn’t confuse or detract from the notice.”
While compliance with these rules might sound rather technical, some employers have paid hefty settlements to resolve allegations that they failed to follow the requirements.
More case law examples
Delta Air Lines™ agreed to pay $2.3 million to settle a class-action lawsuit alleging it failed to provide approximately 44,000 applicants with a stand-alone background check disclosure. This claim placed them squarely in violation of the FCRA and California law.
Snack food manufacturer Frito-Lay Inc™. agreed to pay $2.4 million to resolve claims that it violated the FCRA by using improper disclosure forms for obtaining consumer reports for pre-employment background checks.
The FCRA prohibits employers from obtaining a consumer report without, among other things, providing a “clear and conspicuous disclosure” in a document that consists solely of the disclosure.
The plaintiffs said Frito-Lay violated the FCRA by including the disclosure in a document that also included extraneous information not allowed by law.
“Minor additional information” can be provided alongside the notice, but the additional information can’t take away from the main message, according to the EEOC.
Similarly, the 9th Circuit in 2020 allowed a lawsuit alleging that a grocer included too much information in a background check disclosure to move forward. The appeals court also sent one of the claims in the legal action back to the trial court to determine whether some of the language in the disclosure satisfied the FCRA’s “clear and conspicuous” language requirement.
Employers also need to notify the applicant or employee if they require an “investigative report,” the EEOC has noted. Such a report provides more details on a person’s life, such as their:
- Character
- Reputation
- Lifestyle
Obtain written permission
Second, once your company has provided a proper disclosure, written permission must be granted to allow a third party to conduct background screening.
Many lawsuits allege that employers failed to obtain consent for background checks. However, if the employer is conducting inquiries on its own such as calling a worker’s former employer, then the employer does not have to obtain permission.
Provide a copy of the report if used to deny employment
Third, if the report includes information that will lead to an adverse employment action such as the decision not to hire the job applicant, the employer has to “pause the hiring decision.” As a result of the adverse decision, the prospective employer must provide the candidate with a “meaningful opportunity” to explain the information via a pre-adverse action notice, Fliegel said.
Once again, local laws can come into play. Fliegel noted that Philadelphia requires employers to give applicants 10 business days in which to respond.
Employers often forget to provide a pre-adverse action notice. The FCRA requires a pre-adverse action notice, as well as an adverse action notice. A pre-adverse notice should include a copy of the consumer report used in making the decision and a notice of rights under the FCRA.
If your company decides not to hire the applicant as a result of the background check, you must provide the applicant with an adverse action notice. The notice needs to include the following information:
- Name, address, and phone number of the company that supplied the credit report
- A statement that the company that supplied the information didn’t make the decision to take the adverse action and can’t provide any specific reasons for it
- Notice of the applicant’s right to dispute the accuracy or completeness of any information in the credit report and to get an additional free credit report from the company that supplied the credit or other background information if requested within 60 days.
Recordkeeping
Lastly, employers need to keep personnel or employment records for one year after the records were produced or after the personnel action was carried out — whichever comes later, according to the EEOC. Document destruction must be done securely.
You can burn or shred paper documents. Electronic documents must be purged so that the previously recorded information can’t be read or reconstructed.
Employer mistakes
As previously discussed, common employer mistakes include:
- Extraneous language in the form that notifies employees of the background check
- Making adverse employment decisions before providing applicants with copies of the report and their rights
Fliegel said common employer mistakes also include:
- Lack of sufficient knowledge of local requirements
- Not auditing the process to make sure it works as intended
- Not updating pamphlets and other documents used in the process
- Assuming the background check vendor is taking care of compliance obligations. Do not assume that you can use all of the returned reported information in hiring decisions. It can land your company in hot water.
- Insufficient training of the people who are evaluating criminal records
Penalties for non-compliance
When your company does not comply with the FCRA, the organization can be sued for money damages in an individual legal action or a class-action lawsuit.
Under the FCRA, employers can be held liable for failure to:
- Obtain an applicant’s permission before pulling a credit report or other background report
- Provide the employee with timely and adequate disclosures
- Provide pre-adverse action notices to employees
Common law issues can also come into play
If your company doesn’t handle background checks correctly, there can be legal liability for common law claims such as negligent hiring and tortious interference with present and future employment.
Background checks can be fraught with liability for employers. However, when handled correctly, they are an important tool in making strong and positive hiring decisions.