1. BACKGROUND CHECKS IN EMPLOYMENTBACKGROUND CHECKS IN EMPLOYMENT:
Legal Requirements, Pitfalls, and Practical Considerations
March 22, 2012
Copyright © 2010 by K&L Gates LLP. All rights reserved.

2. EXCLUSIVE RIGHTS TO MATERIALS
THE FOLLOWING MATERIALS HAVE BEEN PREPARED BY K&LTHE FOLLOWING MATERIALS HAVE BEEN PREPARED BY K&L
GATES TO BE USED EXCLUSIVELY BY PARTICIPANTS IN
CONNECTION WITH THE K&L GATES SEMINAR ON
BACKGROUND CHECKS.BACKGROUND CHECKS.
THESE MATERIALS ARE NOT TO BE REPRODUCED, COPIED,
TRANSMITTED OR USED IN ANY MANNER BY ANY OTHER
PERSON OR ENTITY WITHOUT THE EXPRESS WRITTEN
CONSENT OF K&L GATES.
2

3. Today’s Presenter
Linda L. Usoz
K&L GatesK&L Gates
Palo Alto Office
Phone: 650.798.6702
F 650 798 6701Fax: 650.798.6701
linda.usoz@klgates.com
3

4. Legal Framework
St t LState Laws:
 California Labor Code
 California Civil Code
 State Constitution
Federal Law:
 Fair Credit Reporting ActFair Credit Reporting Act
4

5. What is a Background Check?
 Information obtained from various sources concerning an Information obtained from various sources concerning an
employee or applicant’s:
 character
 general reputation
 personal characteristics, or
 mode of living mode of living
5

6. Background Checks May Include:
Criminal conviction records Criminal conviction records
 Civil litigation history
 Employment references
 Credit history
 Department of Motor Vehicle records,
 School records, andSchool records, and
 Professional and personal references
6

7. Why Obtain the Information?
 Background checks may be legally required based on Background checks may be legally required based on
particular positions or industries
 Government contracts/security clearance
 DOT-regulated (transportation of goods or persons)
 Certain employees in medical-related professions
 Law enforcement/public safety officers Law enforcement/public safety officers
 Public and private schools
 FDIC Insured institutions
 NASD Securities industry
 Entity is subject to PCI DSS (Payment Card Industry Data
Security Standard)
7
Security Standard)

8. Why Obtain the Information? (Cont.)
 Good business practice (even if not legally required) Good business practice (even if not legally required)
 Screens out employees who may be more likely to commit
theft or engage in violent acts
P t t i i titi i d t i di Protects companies in competitive industries regarding
employee access to sensitive business information
 Type of position (accounting, courier of sensitive
i f ti bj t t t d t linformation or objects, access to trade secrets, employee
will be driving on company business, etc.)
 Helps protect companies from negligent hiring claims
8

9. Restrictions on Obtaining Background Info
 While employers may have incentive to obtain as much While employers may have incentive to obtain as much
background information on applicants and/or employees as
possible, legal requirements impose various restrictions on
the employer’s ability to do so:
 Privacy Rights (Cal. Constitution, Art. I, Section 1)
 Arrests and certain misdemeanors (Labor Code § 432.7)
 Polygraph tests (L C § 432 2 and 29 U S C § 2002)Polygraph tests (L.C. § 432.2 and 29 U.S.C. § 2002)
 Fingerprinting (Labor Code § 1051)
 Obtaining/use of credit reports for employment (new Labor
Code § 1024 5)Code § 1024.5)
 Use of Credit Reporting Agencies and Investigative
Consumer Reporting Agencies (ICRAA; CCRAA; FCRA)
9

10. Privacy Rights – Cal. Const. Art. I, Sect. 1
 Applies to all private employers Requires “balancing” of employee Applies to all private employers – Requires balancing of employee
privacy rights and legitimate business interests
 Drug/Alcohol Tests
 Applicants: okay to test pre employment Applicants: okay to test pre-employment
 Employees: permitted only if “reasonable suspicion” of current use
 Random drug tests: generally not permitted, except where required
b l ( DOT R ’ ) f li it d f t iti itiby law (e.g. DOT Reg.’s) or for limited safety-sensitive positions
 Personality Tests
 Limits scope of some inquiries even if validated
 Personnel Records
 May not be disclosed without employee’s consent
 Permitted to answer legitimate inquiry as to whether or not
10
g q y
employer would rehire employee (Civil Code § 47)

11. Restrictions on Use of Criminal History -
Arrests
 California law prohibits an employer from asking in any
manner about an arrest or detention that did not result in a
conviction (Labor Code § 432.7)
 Exception: May ask about an arrest for which applicant or
employee is out on bail or on his or her own recognizance
pending trialpending trial
 Penalty: $200 or actual damages, whichever is greater,
plus costs and attorneys fees
I t ti l Vi l ti $500 t bl d hi h Intentional Violation: $500 or treble damages, whichever
is greater, plus costs and attorneys fees, and also
constitutes a misdemeanor, up to $500 fine
11

12. Restrictions on Use of Criminal History -
Convictions
 May freely ask about felony convictions
 Nolo contendere and guilty pleas to a felony count as a
conviction (regardless of sentence imposed)conviction (regardless of sentence imposed)
 May NOT ask about certain misdemeanors (marijuana
related, > two years old, per L.C. § 432.8) and convictions for
which the record has been sealed expunged eradicated orwhich the record has been sealed, expunged, eradicated or
dismissed pursuant to a pre-trial or post-trial diversion
program (L.C. § 432.7 and Cal. Code of Reg.’s. § 7287.4.)
 Penalties: Same as for arrests under L.C. § 432.7Penalties: Same as for arrests under L.C. § 432.7
 Any violation, again, is also a misdemeanor per L.C. § 433
12

13. Restrictions on Use of Criminal History (Cont.)
 No automatic disqualification for criminal convictions No automatic disqualification for criminal convictions
 Even when use of criminal records is permitted, an
employer may not automatically disqualify an applicant for
employment merely because of a criminal record, as this
has been held to have a disparate impact upon protected
racial and ethnic groups, and is unlawful
 Basis for disqualification must be job-related
 Practice Pointer: When asking applicants about criminal
records, be sure to inform them in writing that a criminalrecords, be sure to inform them in writing that a criminal
conviction will not necessarily or automatically disqualify them
from employment
13

14. Restrictions on Use of Polygraph Tests
California Labor Code § 432 2 provides:California Labor Code § 432.2, provides:
“(a) No employer shall demand or require any applicant for
employment or prospective employment or any employee to
submit to or take a polygraph, lie detector or similar test orsubmit to or take a polygraph, lie detector or similar test or
examination as a condition of employment or continued
employment.”
 Exception: Does not apply to the federal government orp pp y g
any agency, or the state government or any agency (or
any political subdivision thereof)
“(b) No employer shall request any person to take such a test,
or administer such a test without first advising the person inor administer such a test, without first advising the person in
writing at the time the test is to be administered of the rights
guaranteed by this section.”
14

15. Restrictions on Use of Polygraph Tests
(Cont.)
 The Federal Employee Polygraph Protection Act (29 U.S.C. §
2002, et seq.) goes even further and provides that it shall be
unlawful for any employer:
 “(1) directly or indirectly, to require, request, suggest, or
cause any employee or prospective employee to take or
submit to any lie detector test.” (Emphasis added.)
 Also unlawful to discharge or deny employment to any
person who refuses to take such a test
 Exemptions apply for all local, state and federal governmentp pp y , g
employers, certain employers who manufacture or distribute
drugs, certain security industry employers (armored car,
security, alarm) and limited exemption for ongoing
i ti ti i l i i l t th b i
15
investigations involving economic loss to the business

16. Requirements For Polygraphs When
Investigating Suspected Wrongdoingg g p g g
 Employee must be given notice in writing explaining incident
being investigated and basis for testing particular employees
 Notice must contain: Notice must contain:
 Detailed description of the loss or injury to the business
 Description of employee’s access to property which is
subject of investigationsubject of investigation
 Detailed description of employer’s reasonable suspicion of
the employee’s involvement in the incident or activity in
questionq
 Signature of the employer or its agent (other than
polygraph examiner)
16

17. Requirements For Polygraphs Under EPPA
 Employers who seek to conduct polygraph tests under exceptions to Employers who seek to conduct polygraph tests under exceptions to
the EPPA must provide written notice of:
 Date, time and place of examination
 Examinee’s right to consult legal counsel or employee Examinee s right to consult legal counsel or employee
representative before each phase of the test
 Nature and characteristics of polygraph instrument and
instrumentinstrument
 Extensive description of examinee’s rights (including lists of
prohibited questions and topics, rights to end examination, right
to file complaint with US DOLto file complaint with US DOL
 Examiner must be given written notice identifying the examinees
17

18. Recordkeeping Under EPPA
 Imposes recordkeeping obligations on both examiners andImposes recordkeeping obligations on both examiners and
employers
 Most records must be kept for 3 years
 Must maintain all notices provided to employees and Must maintain all notices provided to employees and
examiners
 Must maintain all opinions, reports, etc. furnished by examiner
to employerto employer
 Examiner must also maintain records of all opinions, reports,
graphs, charts, lists, written questions, and other records
relating to the tests and number of exams conducted eachrelating to the tests, and number of exams conducted each
day and length of each
18

19. Restrictions on Fingerprinting
Cal Labor Code §1051 prohibits an employer from providingCal. Labor Code §1051 prohibits an employer from providing
fingerprints to law enforcement agencies for the purpose of
obtaining criminal record information about the applicant or
employeeemployee
Special exception applies for banks and savings associations to
learn about certain crimes involving theft, fraud, dishonesty,
etc (See for example Cal Financial Code §6525)etc. (See, for example, Cal. Financial Code §6525)
Also, security clearance requirements mandated by federal law
would preempt §1051, as would other federal statutory and
regulatory requirements for certain professionals such asregulatory requirements for certain professionals, such as
registered representative of broker dealers
19

20. New California Law Restricting Use of Credit
Reports in Employment
 New California Labor Code section 1024.5 became effective
January 1, 2012
 Prohibits employers from using a consumer credit report forProhibits employers from using a consumer credit report for
employment purposes unless the position of the person
whose report is sought falls into one of 8 specified categories
 New law does not apply to a person or business subject topp y p j
the Gramm-Leach-Biley Act found in 15 USC §§ 6801-6809
(concerning non-public, personal information sharing by and
among financial institutions) and state and federal regulations
implementing such if the person or business is subject toimplementing such if the person or business is subject to
compliance oversight by a state or federal regulatory agency
with respect to such laws
20

21. New California Law Restricting Use of Credit
Reports in Employment (cont.)
The eight categories are:
 A managerial position (defined narrowly as one subject to the
executive exemption under Wage Order No 4)executive exemption under Wage Order No. 4)
 A position in the State Dept. of Justice
 A sworn peace officer or other law enforcement position
 A position for which the information contained in the report is
required by law to be disclosed or obtained
21

22. New California Law Restricting Use of Credit
Reports in Employment (cont.)
 A position involving regular access, for any purpose other than
the routine solicitation and processing of credit card
applications at a retail establishment, to all of the following
types of information:
 Bank or credit card account information
 Social Security NumberSocial Security Number
 Date of Birth
 A position in which the person is or would one of the following:
 Named signatory on employer’s bank or credit card account
 Authorized to transfer money on behalf of employer
 Authorized to enter into financial contracts on behalf of the
22
 Authorized to enter into financial contracts on behalf of the
employer

23. New California Law Restricting Use of Credit
Reports in Employment (cont.)
 A position that involves access to confidential or proprietary
information, including a formula, pattern, compilation,
program device method technique process or trade secretprogram, device, method, technique, process or trade secret
that derives independent economic value, actual or potential,
from not being generally known to and not being readily
ascertainable by proper means by other persons who mayascertainable by proper means by other persons who may
obtain economic value from the disclosure or use of the
information and is subject of an effort that is reasonable under
the circumstances to maintain secrecy of the information
 A position that involves regular access to cash totaling
$10,000 or more of the employer, a customer or client during
the workday
23

24. EEOC’s Stand on Credit Reports in
Employmentp y
 Increasing spotlight on practice of using credit reports in
making employment decisions
I O t b 2010 EEOC h ld bli h i th i d In October 2010, EEOC held public hearings on the issue and
heightened concerns over the practice as it tended to unfairly
disqualify protected groups (women, minorities, persons with
disabilities and others unfairly disadvantaged at a time of highdisabilities and others unfairly disadvantaged at a time of high
unemployment and tighter credit)
 Various constituent groups have called on the EEOC to issue
specific guidance on use of credit (and background checks) inspecific guidance on use of credit (and background checks) in
employment
24

25. Use of Consumer Reports
 California Investigative Consumer Reporting Agencies Act California Investigative Consumer Reporting Agencies Act
(ICRAA); Cal. Civil Code §§ 1786 - 1786.60
 Covers “character, general reputation, personal
h t i ti d f li i ”characteristics, or mode of living”
 California Consumer Credit Reporting Agencies Act
(CCRAA); Cal. Civil Code §§ 1785.1 - 1785.36
 Covers “credit worthiness, credit standing, or credit
capacity”
 Federal Fair Credit Reporting Act (FCRA)Federal Fair Credit Reporting Act (FCRA)
 Covers both credit and background
 California employers must comply with ALL three!
25

26. Use of Consumer Investigative Reports (State
Law)
 Governed by CA Investigative Consumer Reporting Agencies
Act (“ICRAA”), but specifically excludes “credit reports” from
its coverage
 Is in addition to any other applicable laws (i.e., FCRA)
 Defines “investigative consumer report” and “investigative
consumer reporting agency” broadly (similar to “consumerp g g y y (
report” or “consumer reporting agency” under Fair Credit
Reporting Act)
 Must be used for proper employment purposes (evaluating forp p p y p p ( g
employment, promotion, reassignment, or retention)
26

27. ICRAA Requirements Apply:
 When using an investigative Consumer Reporting Agency When using an investigative Consumer Reporting Agency
(CRA)
 To investigate job applicants OR
 To investigate employees being considered for promotion,
reassignment or routine checks (but not for suspicion of
wrongdoing or misconduct)g g )
 Applies to information obtained through any means, whether
in written or oral form, and whether gathered through review
of public records or through interviewsg
 Also, required whenever employer obtains “public records”
even without use of CRA
27

28. Conditions for Procuring Report Under CA
Law
 Must provide “clear and conspicuous” separate written disclosure to
applicant or employee stating that:
 An investigative consumer report may be obtained
 Report will be used for permissible employment purposes (nature
and scope of the investigation requested)
 Report may include information on character, general reputation,p y , g p ,
personal characteristics, and mode of living
 The name, address, website address (this is new as of January 1,
2012) and telephone number of the CRA (and as of January 1,) p ( y ,
2012, the CRA must post its privacy practices on their website, or if
none exists, mail the privacy practices notice upon request)
 A summary of Civil Code section 1786.22 (describing the files
28
y ( g
maintained by the CRA and how the employee or applicant can
inspect the files with the CRA)

29. Conditions for Procuring Report Under CA
Law (Cont.)
 Disclosure must be provided before report is procured
 Must obtain applicant/employee’s prior written
consent/authorization on a separate documentp
 Must provide written document containing a box to check by
the employee or applicant to indicate if he/she wishes to
receive a copy of the report. (This can be on either the
disclosure form described above or on a separate consent
form)
 NOTE: The foregoing conditions need not be met if theg g
employer is seeking the report because it suspects the
employee of wrongdoing or misconduct
29

30. Other ICRAA Requirements
 If box is checked employer must provide the report to the If box is checked, employer must provide the report to the
applicant or employee within three business days after the
employer receives the report, or contract with the CRA to
send a copy directly to the applicant or employee within thesend a copy directly to the applicant or employee within the
time period
 Employer must also certify to the CRA that it has made the
required disclosures and it will comply with its obligations torequired disclosures and it will comply with its obligations to
provide a copy of the report if requested and inform the
applicant/employee if adverse action has been taken based
on the reportp
30

31. Information Contained in the Report Under
ICRAA
B k t i t 10 ld Bankruptcies, up to 10 years old
 Convictions, from date of disposition, release or parole, up to
7 years old (unless full pardon granted)
 But note the restrictions imposed by Labor Code section
432.7
 Civil suits, judgments, unlawful detainer actions, paid tax
liens, accounts placed for collection, and other adverse
information, provided all less than 7 years old
 Arrests, indictments, or misdemeanor complaints may be
d di f j dreported pending pronouncement of judgment
 Exceptions to time frames above apply if governmental
regulatory agency mandates that the employer review older
i f ti
31
information

32. Taking Adverse Action Based on Report
 Under ICRAA must advise the applicant/employee if Under ICRAA, must advise the applicant/employee if
employment is denied under circumstances in which a report
has been obtained and provide the name and address of the
CRA that made the reportCRA that made the report
 NOTE: If an adverse employment action is taken, the
employer must provide copy of the report to the
applicant/employee pursuant to the FCRA before taking anyapplicant/employee pursuant to the FCRA before taking any
adverse action, regardless of whether the box is checked
under Cal. ICRAA. The employer must also provide a
description in writing of the rights of the consumer under thep g g
FCRA. (Usually provided by the CRA along with copy of the
report)
32

33. Employer Searches Public Records On Its Own
 Under ICRAA, even if employer conducts own in-houseUnder ICRAA, even if employer conducts own in house
investigation without using CRA, employer still has to provide
applicant or employee with info regarding certain “public
records” accessed, obtained, or used in connection with
employment purposes, whether received in written or oral
form
 “Records documenting an arrest, indictment, conviction,g
civil judicial action, tax lien, or outstanding judgment”
 Employer shall provide “waiver” box on application or other
form
 if checked, then do not need to provide copy of public
records to applicant/employee
If not checked then must provide copy of public records
33
 If not checked, then must provide copy of public records
within 7 days after receipt of information

34. Employer Searches of Public Records (Cont.)
 If information is obtained as a result of suspicion of If information is obtained as a result of suspicion of
wrongdoing or misconduct, employer may withhold the public
records information until the investigation is completed (and
does not need to provide if the employee had waived his/herdoes not need to provide if the employee had waived his/her
rights under the “opt out” waiver box)
 If adverse action is taken, a copy of the public records
obtained or used must be provided even if the applicant orobtained or used must be provided, even if the applicant or
employee checked the “waiver” box, and this applies even for
investigations of misconduct
 DO NOT have to provide employee with work referencesDO NOT have to provide employee with work references
obtained directly by employer without the use of CRA
34

35. ICRAA Exception for Investigations Regarding
Misconduct or Wrongdoing
 Under ICRAA employer does NOT have to first notify employee or Under ICRAA, employer does NOT have to first notify employee or
obtain consent if a third party CRA has been hired to investigate
suspicion of misconduct or wrongdoing by the employee (such as
harassment, theft, etc.)harassment, theft, etc.)
 Effective March 31, 2004, the FCRA was also amended to exclude
from the FCRA disclosure and employee authorization
requirements any communications made to an employer inq y p y
connection with an investigation of--
 “(i) suspected misconduct relating to employment; or
 (ii) compliance with Federal State or local laws and(ii) compliance with Federal, State, or local laws and
regulations, the rules of a self-regulatory organization, or any
preexisting written policies of the employer;”
 This exception does not apply to “credit” related inquiries
35
This exception does not apply to credit related inquiries
 If “adverse action” is taken, then certain info must be provided

36. Remedies for Violation of ICRAA
 Actual damages or $10 000 whichever is greater Actual damages, or $10,000, whichever is greater
 Costs and reasonable attorneys fees
 Punitive damages, if court finds violation was grossly
li t illf lnegligent or willful
 No liability if violation resulted in more favorable investigative
consumer report
 Statute of limitations is 2 years
 No “double liability”: if applicant or employee has brought suit
against employer for violation of Fair Credit Reporting Actg y g
(“FCRA”), employer is not subject to suit under ICRAA for
same acts constituting violation under FCRA
36

37. CA Law Governing Use of Credit Reports in
Employment
 Credit reports (“credit worthiness, credit standing, or credit
capacity”) are not considered “investigative consumer reports”
under CA law, and are excluded from ICRAA
 Credit reports obtained for employment purposes in CA are
governed by the Consumer Credit Reporting Agencies Act
(CCRAA) and now also by Labor Code section 1024.5
 Employer must first provide a written notice that a report will
be used and the source of the report (CRA), and have a box
to check for the person to receive a copy of the credit report
37

38. Contents of Report Under CCRAA
 Generally contains “credit scores” and other similar “public Generally, contains credit scores and other similar public
record” information as provided under ICRAA (bankruptcies,
civil suits and judgments, convictions, accounts placed in
collection etc ) as long as no more than 7 years old (exceptcollection, etc.) as long as no more than 7 years old (except
bankruptcies, which may be 10 years old)
 Cannot contain information about the age, marital status,
race color or creed of the applicant or employeerace, color, or creed of the applicant or employee
 Cannot contain any medical information about the person
38

39. Adverse Action Under CCRA
 If adverse action is taken employer must: If adverse action is taken, employer must:
 Provide written notice
 Provide name, address, telephone number of agency
l i th t (800 # if ti l CRA)supplying the report (800 # if national CRA)
 State the adverse decision was based in whole or in part
on information contained in the report
 Provide a notice telling the applicant or employee that
he/she has the right to obtain a copy of the report within 60
days after learning of the adverse action AND telling the
li t h / h h i ht t di t th f thapplicant he/she has a right to dispute the accuracy of the
information
39

40. Remedies Under CCRA
 Negligent violation: actual damages including court costs Negligent violation: actual damages, including court costs,
lost wages, attorneys fees, pain and suffering
 Willful violation: same as negligent violation, and punitive
damages of $100 $5 000 for each violation in the court’sdamages of $100-$5,000 for each violation in the court s
discretion, except punitive damages for class actions is in
court’s discretion
 Obtaining information under false pretenses or knowingly Obtaining information under false pretenses or knowingly
without permissible purpose: same as negligent violation but
a minimum of $2,500
 Injunctive relief Injunctive relief
 Statute of limitations: 2 years, but not more than 7 years after
liability could have arisen (or 2 years after plaintiff discovers
willful misrepresentation by defendant affecting liability of
40
willful misrepresentation by defendant affecting liability of
defendant

41. Inaccuracies of Credit Reports
According to 1998 study conducted by US Public Interest
Research Group (PIRG):
 70% of credit reports contain some kind of error
 29% of credit reports contained serious errors that could result in
denial of credit or employment
 20% of credit reports were missing creditworthiness information
th t ld h i t d i bt i i ditthat would have assisted consumer in obtaining credit
41

42. Federal Law: Fair Credit Reporting Act (“FCRA”)
 Unlike CA the FCRA includes credit as well as other Unlike CA, the FCRA includes credit as well as other
investigative consumer reports in one Act
 Has separate requirements for “investigative consumer
reports” which are the product of a third party who is hired toreports which are the product of a third party who is hired to
conduct interviews concerning the person’s character, general
reputation, and mode of living
42

43. FCRA Requirements
 Similar to ICRAA: Similar to ICRAA:
 Requires separate written disclosure to applicants or
employees (i.e., not part of standard form application)
 Requires separate written consent (may be combined with
notice)
 Requires the employer to certify to the consumer reportingRequires the employer to certify to the consumer reporting
agency (“CRA”) that it will comply with FCRA
43

44. Other Purposes for Obtaining Reports
 Extend credit
 Business transaction initiated by consumer
 Application for insurance
 Government security clearances
 At consumer requestq
 For government officials (eligibility for license or similar
benefit, in connection with child support payments,
government sponsored individually billed travel cards, ing p y ,
connection with failed financial institution by FDIC or NCUA)
44

45. Use of Consumer Report Under FCRA by
Employer
If adverse action is contemplated, the employer must provide a
written pre-adverse action notice containing:
 Statement that adverse action is contemplatedStatement that adverse action is contemplated
 Name, address, and telephone number of CRA providing
the report (800 number if national CRA)
 Statement that CRA is not responsible for any adverse Statement that CRA is not responsible for any adverse
action
 Statement of the applicant or employee’s right to obtain a
copy of the report within 60 dayscopy of the report within 60 days
 Statement summarizing the employee or applicant’s right
to dispute the information contained in the report
45

46. New Revised FCRA Summary of Rights
 August 27, 2010 FTC issued proposed revised Summary
of Rights, Furnisher Notice, and User Notice, located in
Federal Register, Volume 75, No. 52655
 Public comment period supposedly closed on September
21, 2010
 FTC turned over their proposed rule to the Consumerp p
Financial Protection Bureau (CFPB), and, to date, no
further action has been taken on the proposed rule
46

47. Highlights of Changes to Summary of Rights
 On July 1, 2009, FTC issued the Furnisher Direct Dispute
Rule, which became effective on July 1, 2010
P i t i f thi R l l h d i ht t Prior to issuance of this Rule, consumers only had a right to
dispute accuracy of information contained in a report with the
CRA who issued the report
Si J l 1 2010 h th dditi l i ht t Since July 1, 2010, consumers have the additional right to
dispute the accuracy of information with the furnisher of the
information
47

48. Highlights of Changes to Summary of Rights
(cont.)
 Contains reference directing consumers to FTC’s
website for further information concerning their rights
t di t i f tito dispute information
 Changes format, reorders information
 Deletes unnecessary information, such as list of
federal agencies responsible for enforcing FCRA
(information is not required by FCRA, already
provided by CRAs, and is contained on FTC’s
ebsite)website)
48

49. Furnisher Obligations Under New Rule
 Notice must reflect right of consumer to dispute accuracy of
information directly with furnisher
 Notice format and verbiage changed for clarity ease of Notice format and verbiage changed for clarity, ease of
understanding
 Furnisher obligated to develop policies and procedures to
ensure accuracy and integrity of information furnished toy g y
CRAs
49

50. User Obligations Under New Rules
 Notice must reflect new duties imposed by rules
finalized under the FACT Act, including Risk-Based
Pricing Rule (applicable to users extending credit to
consumers under less favorable terms than it offers to
others)
 Under the Address Discrepancy Rule (effective
January 1, 2008), if CRA notifies user of consumer
address discrepancy, user must verify the report
relates to the correct consumer and must implement
i t d f ifi tiappropriate procedures for verification process
50

51. User Obligations Under New Rules (cont.)
 Must provide CRA with information as to when an
account delinquency began
 Must state whether an account closed at the request of
the consumer or the creditor
 If notified by CRA that negative information provided is
result of identity theft, must have procedures to respond
and to not supply the information again
 If notified by consumer that information supplied is result
of identity theft, cannot supply that information again
unless/until consumer notifies furnisher that the
information is correct
51

52. User Obligations Under New Rules (cont.)
 Users who verify the address and regularly furnish
information to CRAs have additional obligations
 Financial institutions which extend credit and regularlya c a st tut o s c e te d c ed t a d egu a y
supply information to CRA must notify consumer in writing
whenever supplying negative information to CRA
 Under Medical Information Rules (effective April 1, 2006), if( p , ),
furnisher’s primary business is medical services, products
or devices, must notify CRA that furnisher is medical
information furnisher and consumer must give informed
consent (disclosure of scope, purpose) unless for
insurance transaction
52

53. Adverse Action Under FCRA
 Once a decision is made to take adverse action, the employer
must send an adverse action notice containing most of the
same information as the pre-adverse action notice (copy of
th t d t b f i h d if it l d f i h d tthe report need not be furnished if it was already furnished to
the employee in connection with the pre-adverse action
notice)
C ti FCRA i l t id bl Caution: FCRA requires employers to provide reasonable
opportunity for employees or applicants to remedy or correct
information in a report after providing the pre-adverse action
notice Period of time may vary depending on circumstancesnotice. Period of time may vary depending on circumstances,
but period of 5 business days has been held in many
instances to be “reasonable.”
53

54. Investigations Pursuant to Suspicion of
Wrongdoing or Misconduct Under FCRA
Communication is not a “consumer report” under FCRA if:
 Report obtained as part of investigation by employer or its
agent based on suspicion of wrongdoing or misconduct byagent based on suspicion of wrongdoing or misconduct by
the employee
 Investigation not for purpose of determining the
employee’s creditworthiness or capacityemployee s creditworthiness or capacity
 After taking adverse action against the employee based in
whole or in part on the information so obtained, the
employer provides the employee with a summary of theemployer provides the employee with a summary of the
nature and substance of the communication, but need not
disclose the source of the information
54

55. Proper Disposal of a Report
Law imposes requirement to implement disposal practices that
are reasonable and appropriate to prevent the unauthorized
access to – or use of – information in a consumer report
 Burn, pulverize, or shred papers containing such reports
 PERMANENTLY delete from electronic files and back up
storage any media containing consumer reportg y g p
information
 Contract with secure document disposal company (after
conducting due diligence) and store information in lockedg g )
facility with limited access until it can be disposed of
55

56. Remedies Under FCRA
F Willf l N liFor Willful Noncompliance
 Any actual damages sustained, or damages of not less
than $100 and not more than $1,000
 Punitive damages allowed by the court
 Costs and reasonable attorneys fees
For Negligent Noncomplianceg g p
 Any actual damages sustained
 Costs and reasonable attorneys fees
56

57. Best Practices to Minimize Liabilities in
Obtaining and Using Consumer Reports
 Engage services of reputable, known CRA
 Ensure CRA and employer mutually certify compliance with
applicable law; ensure CRA selected is familiar with and
complies with state laws, not just FCRA
 Review current forms and ensure the Company has, and
regularly uses, a separate disclosure/consent form that
contains all required disclosures under ICRAA, CCRA, and
FCRA; if they have not been reviewed in the last 2-3 years by
legal counsel, it’s time to have them reviewed, as changes to
the law or regulations have occurred as recently as 2011the law or regulations have occurred as recently as 2011
 Ensure you have a Pre-Adverse Action notice form, and an
Adverse Action Notice form
57

58. Best Practices to Minimize Liabilities in Obtaining
and Using Consumer Reports (Cont.)
 Ensure employees who will be responsible for dealing with
background checks and related issues are properly trained
and update that training at least annually
 Ensure that all decisions to take adverse action are reviewed
by the proper personnel and/or legal counsel before taking
the action
58

59. Company’s Use of Internet Sources
S i l t ki it (F b k M S t )Social networking sites (Facebook.com, MySpace.com, etc.),
blogging pages are sometimes sources of information to which
employers might not otherwise have access – These are neither
“public records” nor CRAspublic records nor CRAs
 BUT be wary that you cannot prove who posted or
authorized the information (spoofing occurs, and posting
can occur without the knowledge or consent of the personcan occur without the knowledge or consent of the person
who owns the page)
 Information on these sites, however, can provide useful
information if work related on which the employer caninformation, if work-related, on which the employer can
question or confront the employee
59

60. Beware of New Mobile Apps
In February 2012, the FTC warned markets of 6 mobile apps that
the apps may violate FCRA:
 Everify Inc (Police Records app) Everify, Inc. (Police Records app)
 InfoPay, Inc. (Criminal Pages app)
 Intelligator, Inc. (Background Checks, Criminal Records
S h I ti t d L t A P l S h dSearch, Investigate and Locate Anyone, People Search and
Investigator
People using mobile apps for purposes covered either by FCRA or
t t CCRA ICCRAstate CCRA or ICCRA
60

61. Gray Areas
 What if there is information contained in a criminal history that What if there is information contained in a criminal history that
is not technically a conviction but leads you to believe the
person might be a “bad seed”, and you no longer wish to hire
the person?the person?
 What if an indictment is unsealed shortly after you’ve hired an
employee who passed the background check with flying
colors?colors?
 When in the hiring process should you conduct the
background check?
61

62. Special Industry Rules and Considerations
S i l l d ti l f t i i d t i ithSpecial rules and exceptions apply for certain industries with
respect to conducting background checks, including:
 Financial institutions
 NASD Securities Industry
 Payment Card Industry, Data Security Standard
 Hospitals and health facilitiesp
62

63. Financial Institutions
 Federal Deposit Insurance Act prohibits an insured from Federal Deposit Insurance Act prohibits an insured from
employing individuals who have been convicted of any
criminal offense involving dishonesty, breach of trust, or
money launderingmoney laundering
 Insured has duty to make a reasonable inquiry as to the
applicant’s history, including criminal convictions
 For FDIC banks 12 U S C §1829 mandates inquiries about For FDIC banks, 12 U.S.C. §1829 mandates inquiries about
pretrial diversion or similar programs in connection with a
prosecution for any offense involving dishonesty, breach of
trust or money laundering – exception to Labor Code § 432.7trust or money laundering exception to Labor Code § 432.7
63

64. Financial Institutions (Cont.)
 Special exception also applies to banks and savings Special exception also applies to banks and savings
associations under Cal. Financial Code §6525 and other
provisions (condition of granting certain licenses, for example)
with respect to use of fingerprints to check criminal recordswith respect to use of fingerprints to check criminal records
with authorities, which would otherwise be prohibited by Labor
Code § 1051
 Covered financial institutions may provide fingerprints toCovered financial institutions may provide fingerprints to
authorities to learn about crimes involving robbery, burglary,
theft, embezzlement, fraud, forgery, bookmaking, receipt of
stolen property, counterfeiting, or crimes involving checks,p p y, g, g ,
credit cards or use of computers
64

65. NASD Securities Industry
 NASD Conduct Rule 3010(e) requires members to investigate NASD Conduct Rule 3010(e) requires members to investigate
“the good character, business repute, qualifications, and
experience of any person”; includes reviewing U-5
 NASD Conduct Rule 3070 requires member to report NASD Conduct Rule 3070 requires member to report
association with person who is subject to a “statutory
disqualification”
65

66. Note on PCI DSS
 Acronym for Payment Card Industry Data Security Standard Acronym for Payment Card Industry Data Security Standard
 Started in 2005 by consortium of major players in payment
card industry
C t d t d d i i d h t t Created common standard requiring covered merchants to
comply with 12-step standard
 Affects covered entities employing employees who have
t t d i f ti f taccess to payment card information of customers
66

67. PCI DSS Requirement Applicable to Employment
 “12 7 Screen potential employees to minimize the risk of 12.7 Screen potential employees to minimize the risk of
attacks from internal sources. For those employees such as
store cashiers who only have access to one card number at a
time when facilitating a transaction this requirement is atime when facilitating a transaction, this requirement is a
recommendation only.”
 12.7 “Inquire of Human Resource department management
and verify that background checks are conducted (within theand verify that background checks are conducted (within the
constraints of local laws) on potential employees who will
have access to cardholder data or the cardholder data
environment. (Examples of background checks include pre-( p g p
employment, criminal, credit history, and reference checks).”
67

68. Hospitals and Health Facilities
An exception to Labor Code § 432 7 regarding not asking aboutAn exception to Labor Code § 432.7 regarding not asking about
arrests is provided for health facilities:
 With regard to an applicant for a position with regular
t ti t t di l t d tiaccess to patients, to disclose an arrest under any section
specified in Penal Code § 290 (Registration of Sex
Offenders)
With d t li t f iti ith t With regard to an applicant for a position with access to
drugs and medications, to disclose an arrest under any
section specified in Health & Safety Code § 11590
(Registration of Controlled Substance Offenders)(Registration of Controlled Substance Offenders)
68

69. Independent Schools
 Education Code section 44237 mandates all non credentialed Education Code section 44237 mandates all non-credentialed
personnel who will be engaged by the school and have
interaction with minor students submit to a DOJ fingerprint
background check before being permitted to workbackground check before being permitted to work
 “Employment” is defined broadly to include those whose
services the school intends to engage
 Outsourcing positions will not alleviate the obligation to
conduct the DOJ checks
 Education Code section 33190 requires annual reporting tog
the state, including reporting on Education Code section
44237 compliance
69

70. Questions?
70