State laws on consumer reports and background information

For specific state hiring laws see: State Hiring Laws

Nearly half the states impose additional consumer reporting regulations that may be more stringent than FCRA requirements or may mandate unique processes. California for example requires a check box for the applicant to obtain a copy of the report. For more information see the California Investigative Consumer Reporting Agencies Act (ICRAA). http://www.privacy.ca.gov/icraa.htm In 2011 several states placed restrictions on credit reports. Other states have pending legislation attempting to restrict usage.

This is primarily because of all the recent foreclosures and the economy. Other states have laws that govern pre-screening are listed below:

• Arizona
• California
• Colorado
• Georgia
• Kansas
• Kentucky
• Minnesota
• Montana
• New Hampshire
• New Jersey
• New Mexico
• New York
• Louisiana
• Maine
• Maryland
• Massachusetts
• Oklahoma
• Rhode Island
• Texas
• Washington

AB 22 prohibits the use of credit reports for employment purposes except in very limited circumstances. The law does not apply to certain federally and state regulated financial institutions. All other employers and prospective employers are prohibited from obtaining or relying on consumer or credit reports in making employment decisions about employees or applicants for employment. The only exception is where the position at issue is one of the following:

– a position in the California Department of Justice;

– a managerial position, defined as one that qualifies for the executive exemption from overtime;

– a sworn peace officer or other law enforcement position;

– a position for which the information contained in the report is required by law to be disclosed or obtained;

– a position that involves regular access to specified personal information (bank or credit card account information, social security number, and date of birth) for any purpose other than the routine solicitation and processing of credit card applications in a retail establishment;

– a position in which the person is or would be a named signatory on the employer’s bank or credit card account, or authorized to transfer money or enter into financial contracts on the employer’s behalf;

– a position that involves access to confidential or proprietary information that qualifies as “trade secrets” under Civil Code Section 3426.1(d); or

– a position that involves regular access to cash totaling $10,000 or more of the employer, a customer, or client during the workday.

AB 22 also requires that an employer provide written notice to the applicant or employee when it seeks a consumer credit report under one of the exceptions above, specifying the permissible basis for requesting the report and also providing a box to check off to request a copy of the report. In that circumstance, a copy of the report must be provided free of charge at the same time as the employer receives a copy of the credit report. As is currently the law, if the employer makes an adverse employment decision based on information in the credit report, it must notify the applicant or employee of that fact and provide the contact information of the credit reporting agency.

In 2011 CONNECTICUT passed a law that applies to all employers with one or more employees as well as the state government and its political subdivisions. Under its provisions, employers may not require an employee or prospective employee to consent to a credit report, with several exceptions including managerial positions that involve setting the direction or control of a business, division, unit or an agency of a business; access to personal or financial information of customers, employees or the employer (other than information customarily provided in a retail transaction); if the position involves a fiduciary responsibility to the employer, and other specific exceptions.

In 2011 MARYLAND passed a law stating non-exempt employers may not use a job applicant’s or employee’s “credit report” or “credit history” to determine whether to deny employment to the applicant, to discharge the employee, or to determine the terms, conditions, or privileges of employment, including compensation. General exception allows employers to request or use 1) an employee’s credit report or history; or 2) the credit report or history of an applicant who has been offered employment – that is, the credit check must be post-offer – for any purpose not explicitly prohibited by the Act, or if the employer has a “bona fide purpose” for the information.

In 2011 ILLINOIS passed a law that prohibits many Illinois employers from basing hiring, promotion, and other employment decisions on an employee or job applicant’s credit history. There are limited exceptions to the law. For example, covered employers may still use credit history for employment decisions for managerial positions that involve setting the direction or control of the business and for positions that involve unsupervised access to more than $2,500; signatory power over business assets of $100 or more per transaction; or access to personal, financial, confidential, trade secret, or state/national security information.

In 2010 OREGON enacted SB 1045. Joining Washington and Hawaii, the Oregon law (originally effective July 1st 2010 but the governor of Oregon declared the law effective immediately) prohibits the use of credit history for employment purposes including hiring, discharge, promotion, and compensation. The law provides exceptions for financial institutions, public safety offices, and other employment if credit history is job-related and use is disclosed to applicant or employee. The law establishes any violation as an unlawful employment practice, enforceable through the Bureau of Labor and Industries and civil action.

In 2009 HAWAII enacted HB 31, a law that establishes an employer’s use of an individual’s credit history or credit report in hiring and termination decisions as an unlawful discriminatory practice unless the information directly relates to a bona fide occupational qualification under the Hawaii Fair Employment Practices Act.

In 2007 WASHINGTON state adopted bill 5827, which states that a person may not procure a consumer report for employment purposes where any information contained in the report bears on the consumer’s credit worthiness, credit standing, or credit capacity, unless the information is either: (i) Substantially job related and the employer’s reasons for the use of such information are disclosed to the consumer in writing; or (ii) Required by law. This law reduces the risk of successful disparate impact claims based upon denial of employment because of poor credit history.

Under federal fair employment law, employers should consider the job-relatedness of credit information in making employment decisions. Rejecting applicants based upon poor credit history may disproportionately exclude certain minority groups from consideration. The EEOC contends an organization should not use such information if it causes a “disparate impact,” unless justified by job-relatedness and business necessity.
Cite: State law

DPPA

Drivers Privacy Protection Act
Employers conducting motor vehicle record checks must comply with the Drivers Privacy Protection Act (DPPA), which was originally enacted in 1994 to protect the privacy of personal information compiled by State Departments of Motor Vehicles. The DPPA prohibits the release of personal information contained in a motor vehicle record to a third party without an individual’s express consent. Some states may further restrict the release of this information.

The American with Disabilities Act (ADA)

The Equal Employment Opportunity Commission (EEOC) defines a disability as a person who:

• has a physical or mental impairment that substantially limits one or more major life activities
• has a record of such an impairment
• or is regarded as having such an impairment

Under ADA, employers are restricted in using medical or disability data in the hiring process. Simply put, you cannot ask during the interview or background check about a person’s disabilities. The ADA covers businesses with 15 or more employees, including state and local governments.

Recent Trends in Pre-Screening

Instant Criminal Searches:

Several law suits have been filed regarding the “instant” criminal searches being sold on the internet. Most violate the FCRA and are designed as a non-FCRA inquiry only (i.e. Check your Mate). Some of the suits are from applicants who have had their records expunged at the court but the record still shows up on the instant search. This is because a company buys records in bulk from the courthouse and doesn’t update the data to reflect the record. Other suits center on common name “false positives”. A false positive is a positive criminal record which was found matching the name of the applicant but it is not the applicant. For example, if your applicant’s name is Mary Smith many records may return with the common name. It is the employer’s job to determine if it is the applicant or just a common name hit. If you plan on using this search use caution for the reasons stated above.

2012 Update: Most recently, the FTC issued this warning to companies providing mobile unfiltered access to the data.

A copy of the letter is on the next page:

Dear XXX:

This letter concerns your company’s mobile application(s) that may be in violation of the Fair Credit Reporting Act (“FCRA”),1 a federal law enforced by the Federal Trade Commission (“FTC”).

Under the FCRA, a company is a consumer reporting agency (“CRA”) if it assembles or evaluates information on consumers for the purpose of furnishing “consumer reports” to third parties. Consumer reports include information that relates to an individual’s character, reputation or personal characteristics and are used or expected to be used for employment, housing, credit, or other similar purposes. For example, when companies provide information to employers regarding current or prospective employees’ criminal histories, they are providing “consumer reports” because the data involves the individuals’ character, general reputation, or personal characteristics. Such companies, therefore, are acting as CRAs in this capacity and must comply with the FCRA.

CRAs must comply with several different FCRA provisions, including taking reasonable steps to ensure the maximum possible accuracy of the information provided in consumer reports. A CRA must also provide those who use its consumer reports with information about their obligations under the FCRA.4 In the case of reports provided for employment purposes, for example, the CRA must provide employers with information regarding their obligation to provide employees or applicants with notice of any adverse action taken on the basis of these reports, and to notify them of their rights to copies of the reports and to a free reinvestigation of information the consumer believes to be in error. A model notice is available in 16 Code of Federal Regulations § 698, Appendix H, which can be found here.

At least one of your company’s mobile applications involves background screening reports that include criminal histories. Employers are likely to use such criminal histories when screening job applicants. If you have reason to believe that your reports are being used for employment or other FCRA purposes, you and your customers who are using the reports for such purposes must comply with the FCRA. This is true even if you have a disclaimer on your website indicating that your reports should not be used for employment or other FCRA purposes.

We would evaluate many factors to determine if you had a reason to believe that a product is used for employment or other FCRA purposes, such as advertising placement and customer lists. At this time, we have not made a determination as to whether your company is violating the FCRA. However, we encourage you to review your mobile applications and your policies and procedures for compliance with the FCRA. You may find the full text of the FCRA and more information about the FCRA here.

The Commission reserves the right to take action against you based on past or future law violations; your practices also may be subject to laws enforced by other federal, state, or local law enforcement agencies. A violation of the FCRA may result in legal action by the FTC, in which it is entitled to seek injunctive relief and/or monetary penalties of up to $3,500 per violation.

If you have any questions, please call Anthony Rodriguez at (202) 326-2757.