FCRA and Employment Background Checks: The Obligations the Statute Places on Employers
Key Takeaways
- The statute reaches a background report only where it was assembled by a consumer reporting agency as defined at 15 U.S.C. 1681a(f). An employer that gathers the same information itself is generally outside the definition, and outside these obligations.
- Section 1681b(b)(2)(A)(i) requires the disclosure to appear “in a document that consists solely of the disclosure.” The Ninth Circuit held in Syed v. M-I, LLC that including a liability waiver in that document violates the requirement, and in Gilberg v. California Check Cashing Stores that extraneous state-law disclosures do too.
- Two notices bracket an adverse hiring decision. Section 1681b(b)(3)(A) requires a copy of the report and a written description of the consumer's rights before the action; section 1681m(a) requires a further set of disclosures after it.
- Section 1681c bars most adverse items older than seven years from a consumer report, with bankruptcies at ten — but records of criminal convictions carry no time limit under paragraph (a)(5).
- Damages turn on state of mind. Section 1681o gives actual damages for negligence; section 1681n adds statutory damages of $100 to $1,000, punitive damages and fees for willful violations, which Safeco Ins. Co. of America v. Burr held includes reckless disregard.
Who Is a Consumer Reporting Agency
Nearly every obligation described here is triggered by a report that came from a consumer reporting agency, so the definition at 15 U.S.C. 1681a(f) is the gate. It covers any person that, for monetary fees, dues or on a cooperative nonprofit basis, regularly engages in whole or in part in assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and that uses any means of interstate commerce to prepare or furnish them.
Three elements carry the weight: regularity, the purpose of furnishing reports to third parties, and compensation. A commercial background screening vendor satisfies all three. An employer that runs its own courthouse searches, calls references itself and never furnishes the results to anyone else generally does not, because it is not assembling information for the purpose of furnishing reports to third parties.
That boundary matters more than it might appear. Where no consumer reporting agency is involved, the disclosure, authorization, pre-adverse action and adverse action machinery in section 1681b(b) is not engaged at all — though other bodies of law, including state statutes restricting criminal history inquiries and the federal antidiscrimination statutes the EEOC enforces, continue to apply on their own terms.
What Counts as a Consumer Report
Section 1681a(d)(1) defines a consumer report as a communication of information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living, which is used or expected to be used or collected in whole or in part as a factor in establishing eligibility for credit or insurance for personal, family or household purposes, for employment purposes, or for another purpose authorized under section 1681b.
The phrase “character, general reputation, personal characteristics, or mode of living” is what pulls criminal history, driving records and reference checks into the definition alongside credit information. Section 1681a(h) defines employment purposes as a report used for evaluating a consumer for employment, promotion, reassignment or retention — language that reaches current employees, not only applicants.
Section 1681a(e) separates out the investigative consumer report: a consumer report, or a portion of one, in which information on character, general reputation, personal characteristics or mode of living is obtained through personal interviews with neighbors, friends, associates or others acquainted with the consumer. The definition expressly excludes specific factual information about a credit record obtained directly from a creditor or from a consumer reporting agency. Investigative reports carry additional disclosure duties beyond those described below.
Section 1681a(d)(2) then excludes several communications from the definition, including a report containing information solely as to transactions or experiences between the consumer and the person making the report. Information an employer already holds about its own employee, standing alone, is not a consumer report.
Disclosure and Authorization
Section 1681b(b)(2)(A) conditions procurement of a consumer report for employment purposes on two things having already happened. First, a clear and conspicuous disclosure made in writing to the consumer, at any time before the report is procured, in a document that consists solely of the disclosure, stating that a consumer report may be obtained for employment purposes. Second, written authorization from the consumer, which the statute permits to appear on the same document as the disclosure.
A separate obligation runs to the screening vendor. Section 1681b(b)(1)(A) permits a consumer reporting agency to furnish a report for employment purposes only if the user certifies that it has complied with the disclosure and authorization paragraph, that it will comply with the pre-adverse action paragraph if that becomes applicable, and that the information will not be used in violation of any applicable federal or state equal employment opportunity law. Section 1681b(b)(1)(B) requires the agency to provide a summary of the consumer's rights with the report.
Section 1681b(b)(2)(B) creates a narrow alternative route for applications made by mail, telephone or computer, allowing oral or electronic notice and consent. Its scope, at subparagraph (C), is confined to positions over which the Secretary of Transportation has power to establish qualifications and hours of service, or positions subject to safety regulation by a state transportation agency, and only where the sole interaction with the applicant has been remote. It is not a general electronic-consent provision.
The Standalone Disclosure Requirement
More reported employment-screening litigation concerns the format of the disclosure document than any other provision of the statute, and the Ninth Circuit has twice explained why.
In Syed v. M-I, LLC, 853 F.3d 492 (9th Cir. 2017), the panel held that a prospective employer violates section 1681b(b)(2)(A) when it procures an applicant's consumer report after including a liability waiver in the same document as the statutorily mandated disclosure. The panel reversed a dismissal under Rule 12(b)(6), reading the statutory language that the disclosure document consist solely of the disclosure to mean what it says.
In Gilberg v. California Check Cashing Stores, LLC, No. 17-16263 (9th Cir. Jan. 29, 2019), the panel extended the point to material that was not a waiver at all. It held that including extraneous information relating to various state disclosure requirements violates the standalone document requirement, and separately held that the employer's form failed the clear and conspicuous requirement because, although the disclosure was conspicuous, it was not clear. Both holdings applied equally to California's Investigative Consumer Reporting Agencies Act.
The two decisions together describe a provision that is unforgiving about content and about drafting. A form can be legible, prominent and signed, and still be defective because of what else appears on it. Because these are Ninth Circuit decisions, they bind federal courts in that circuit; other circuits have addressed the same language with their own reasoning, and this guide does not survey those decisions.
Pre-Adverse and Adverse Action Notices
Section 1681a(k)(1)(B)(ii) defines adverse action, for employment purposes, as a denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee. Two separate notices attach to it.
The first comes before the decision. Section 1681b(b)(3)(A) provides that before taking any adverse action based in whole or in part on the report, the person intending to take it shall provide to the consumer a copy of the report and a written description of the consumer's rights under the subchapter, as prescribed by the Bureau. The FTC's guidance for employers describes the function of the advance notice plainly: giving the person the notice in advance provides an opportunity to review the report and explain any negative information.
The second comes after. Section 1681m(a) requires a person taking adverse action based in whole or in part on a consumer report to provide notice of the adverse action; the name, address and telephone number of the consumer reporting agency that furnished the report, including its toll-free number if it maintains files nationwide; a statement that the agency did not make the decision and cannot provide the specific reasons for it; and notice of the consumer's right to obtain a free copy of the report from that agency within the 60-day period under section 1681j and to dispute its accuracy or completeness under section 1681i.
The statute sets no numeric waiting period between the two notices. Section 1681b(b)(3)(A) states only that the pre-adverse notice precede the action. The one place a fixed interval appears is section 1681b(b)(3)(B)(i), the narrow transportation-position route, which requires notification within 3 business days of taking the action and substitutes for both notices.
Accuracy and Dispute Obligations
The duties in this part of the statute fall mainly on the agency rather than the employer, but they determine what a disputed record does after an applicant challenges it.
Section 1681e(b) requires that whenever a consumer reporting agency prepares a consumer report it follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual the report relates to. It is a procedural standard rather than a guarantee of accuracy, and it is the provision most often litigated when a report attributes another person's record to an applicant.
Section 1681i(a)(1)(A) requires an agency, on notice of a dispute from the consumer directly or through a reseller, to conduct a reasonable reinvestigation free of charge and either record the current status of the disputed information or delete it, before the end of the 30-day period beginning when it receives the notice. Paragraph (a)(1)(B) permits a 15-day extension where the consumer supplies relevant information during the original 30 days, and paragraph (a)(1)(C) withdraws that extension where the information is found inaccurate or incomplete, or cannot be verified, within the first 30 days. Paragraph (a)(2)(A) requires the agency to notify the furnisher of the dispute within 5 business days.
Section 1681c limits what may appear in the report at all. Paragraph (a)(1) bars bankruptcy cases antedating the report by more than 10 years; paragraph (a)(2) bars civil suits, civil judgments and records of arrest older than seven years or until the governing statute of limitations expires, whichever is longer; paragraphs (a)(3) and (a)(4) apply seven years to paid tax liens and to accounts placed for collection or charged to profit and loss. Paragraph (a)(5) is a catch-all for any other adverse item older than seven years — and it carves out records of convictions of crimes, which the section does not time-bar.
Permissible Purposes
Section 1681b(a) states the closed list of circumstances in which a consumer reporting agency may furnish a consumer report at all. Employment is one entry on it, at 1681b(a)(3)(B), and it sits alongside credit transactions, insurance underwriting, eligibility for a government license or benefit where the agency is required by law to consider financial responsibility, review of an existing account, and a residual category at 1681b(a)(3)(F) for a legitimate business need in connection with a consumer-initiated business transaction.
The list structure has a consequence that recurs in litigation: pulling a report for a purpose not on the list is not merely a procedural defect. Section 1681n(a)(1)(B) sets a distinct and higher measure of damages for a natural person who obtains a consumer report under false pretenses or knowingly without a permissible purpose — actual damages or $1,000, whichever is greater — and section 1681n(b) makes such a person liable to the consumer reporting agency as well.
State comprehensive privacy statutes generally step aside where the FCRA governs. California's Civil Code section 1798.145 exempts activity involving information collected, maintained, used, communicated, disclosed or sold as authorized by the FCRA, and provides that the exemption does not extend to section 1798.150, the breach cause of action.
Damages and Litigation Patterns
The remedial provisions divide on state of mind. Section 1681o(a) makes a person negligent in failing to comply liable for actual damages and, on a successful action, costs and reasonable attorney's fees. Section 1681n(a) makes a person who willfully fails to comply liable for actual damages or statutory damages of not less than $100 and not more than $1,000, plus such punitive damages as the court may allow, plus costs and fees.
The practical difference is that the willful track does not require proof of loss. That makes the meaning of willfulness decisive, and the Supreme Court settled it in Safeco Ins. Co. of America v. Burr, 551 U.S. 47 (2007). The Court held that section 1681n(a) reaches not only knowing violations but reckless ones, reading “willfully” in its standard civil sense. It defined recklessness by an objective standard — action entailing an unjustifiably high risk of harm that is either known or so obvious that it should be known — and found that Safeco, which had read the adverse action provision not to apply to initial insurance applications, was not reckless in doing so because its reading, though mistaken, was not objectively unreasonable.
The second constraint on this litigation is who may bring it in federal court. In TransUnion LLC v. Ramirez, 594 U.S. ___ (2021), a class of 8,185 individuals whose credit files carried misleading alerts matching their names against a Treasury Department list sued under section 1681e(b). The parties stipulated that the reports of only 1,853 class members had been provided to third parties during the class period. The Court held that only plaintiffs concretely harmed by a statutory violation have Article III standing: the 1,853 whose misleading reports were disseminated suffered a harm bearing a close relationship to defamation, while the mere existence of inaccurate information in the internal files of the remaining 6,332, absent dissemination, was not a concrete injury.
The two decisions cut in opposite directions for a class action built on a defective disclosure form. Safeco makes statutory damages available without proof of loss where the violation was reckless; TransUnion requires each class member to have suffered concrete harm to remain in federal court. This guide describes the FCRA-specific holdings of both and does not work through the wider standing doctrine they belong to.
Background
For the underlying law rather than this development: HR & Employment privacy law.
Frequently Asked Questions
Does the FCRA apply when an employer runs its own background search without a vendor?
Can the FCRA disclosure be included in the job application?
How long must an employer wait after sending the pre-adverse action notice?
Do criminal convictions age off a consumer report after seven years?
What damages does the FCRA make available for a violation that caused no financial loss?
Sources
Everything above is reported from these documents. Follow them to verify.
- 15 U.S.C. § 1681a — Definitions; rules of construction statute
- 15 U.S.C. § 1681b — Permissible purposes of consumer reports, including subsection (b) on employment purposes statute
- 15 U.S.C. § 1681c — Requirements relating to information contained in consumer reports statute
- 15 U.S.C. § 1681e — Compliance procedures, including the accuracy standard at subsection (b) statute
- 15 U.S.C. § 1681i — Procedure in case of disputed accuracy statute
- 15 U.S.C. § 1681m — Requirements on users of consumer reports statute
- 15 U.S.C. § 1681n — Civil liability for willful noncompliance statute
- 15 U.S.C. § 1681o — Civil liability for negligent noncompliance statute
- Syed v. M-I, LLC, No. 14-17186 — amended opinion, U.S. Court of Appeals for the Ninth Circuit (March 20, 2017) court opinion
- Gilberg v. California Check Cashing Stores, LLC, No. 17-16263 — opinion, U.S. Court of Appeals for the Ninth Circuit (January 29, 2019) court opinion
- Safeco Ins. Co. of America v. Burr, 551 U.S. 47 (2007) — opinion of the Court (June 4, 2007) court opinion
- TransUnion LLC v. Ramirez, 594 U.S. ___ (2021), No. 20-297 — slip opinion (June 25, 2021) court opinion
- FTC and EEOC — Background Checks: What Employers Need to Know agency guidance
- Cal. Civ. Code § 1798.145 — CCPA exemptions, including the FCRA exemption statute
Reporting, not legal advice. This article reports on developments in privacy law using publicly available primary sources, which are linked throughout and listed at the end. It is not legal advice, it is not written or reviewed by an attorney, and it does not assess how any law applies to your situation. Privacy law changes frequently and differs by jurisdiction. Reading this does not create an attorney-client relationship. To find out where you or your business stands, consult a licensed attorney. How we report.