On August 11, 2009, the FTC filed proposed consent decrees in United States v. Quality Terminal Servs., LLC D. Colo., No. 09-cv-01853 and United States v. Rail Terminal Servs., LLC. W.D.Wash., No. 09-CV0111, that will require the companies to pay a combined $77,000 in penalties for violating the Fair Credit Reporting Act (FCRA) and the Federal Trade Commission (FTC) Act, by using employee background checks without providing applicants and current employees with the required "pre-adverse action" and "adverse action" notices. The consent decrees underscore the importance of following the proper procedures when taking action against applicants and employees based on background checks.
Preliminarily, the subject rules apply only when employers use a third-party "consumer reporting agency" to conduct background checks. A "consumer reporting agency" is any business that for fees, dues or on a cooperative, nonprofit basis, regularly engages in assembling information on consumers for the purpose of furnishing consumer reports to third parties. Therefore, the subject rules generally do not apply when the employer conducts its own background checks by, for example, calling references.
Under the FCRA, employers must do certain things when using a consumer reporting agency to conduct background checks on applicants and current employees and when acting on those background checks. These obligations are summarized below.
First, before conducting a background check, employers must follow the "notice and authorization" provisions of the FCRA by providing the applicant or employee with a disclosure form stating that a background check may be obtained for employment purposes and by having the applicant or employee sign a written authorization permitting the employer to conduct the background check.
Second, if the background check reveals a problem that may warrant the employer taking some adverse action, such as dismissal or denial of employment, the employer cannot take such action until it provides the applicant or employee with the required "pre-adverse action disclosure," which includes a copy of the report and a written statement of his/her rights under the FCRA, as prescribed by the FTC, found at 16 C.F.R. Pt. 698, App. F, in the document titled "A Summary of Your Rights Under the Fair Credit Reporting Act."
Once the employer provides the employee or applicant with this information, the employer must allow the employee a sufficient amount of time to dispute and correct the information contained in the report(s) before taking any adverse action. While the statute is silent on the time required, the FTC has stated that a five-day period is generally reasonable unless circumstances exist warranting a longer or shorter period.
Third, if the employer decides to take any adverse action against the applicant or employee based on the background check, the employer must provide the employee with an "adverse action notice," informing the applicant or employee of the following:
- The adverse action the employer is taking;
- The name, address and telephone number of the consumer reporting agency (including a toll-free telephone number established by the agency if the agency compiles and maintains files on consumers on a national basis) that provided the report to the employer;
- That the consumer reporting agency did not make the adverse action decision and is unable to provide to the consumer the specific reasons why the adverse action was taken;
- That the applicant or employee can obtain a free copy of the background check report; and
- That the applicant or employee can dispute the accuracy or completeness of any information in the report.
The foregoing consent decrees and the corresponding employer penalties illustrate the risks employers face if they fail to provide the appropriate notices to applicants and employees regarding background checks before such a check is conducted, when adverse action is being considered and when adverse action is taken. Notably, these duties fall squarely on employers and, as a result, employers should be wary of relying on third-party providers to satisfy these all of these obligations.