The Fair Credit Reporting Act (“FCRA”) imposes a number of restrictions and duties on employers who wish to access and use consumer reports (also known as employment background checks) to make employment decisions.

Before you can obtain a consumer report, you must inform the applicant or employee that you might use information in their consumer report as the basis for decisions related to their employment. This notice must be in writing and in stand-alone format, meaning you cannot bury it in other employment-related forms or inside an employee handbook.

You must also obtain written authorization from the applicant or employee, which can be at the bottom of the same form you use to provide notice. If you want the employee to authorize you to access consumer reports throughout the course of his or her employment, you must explicitly say so in the authorization section.

Finally, prior to obtaining a consumer report, you must certify to the company from which you are requesting the report that you have complied with all FCRA requirements that are applicable to you and that you will not discriminate against the applicant or employee or otherwise misuse the information in the report.

If you see something in the consumer report that you don’t like, make sure you do the following before you take an adverse action against the applicant or employee as a result:

  1. Make sure you aren’t using the information to discriminate on the basis of a protected class — such as race, national origin, color, sex (including sexual orientation and gender identity), age, religion, disability, veteran status, and genetic information.
  2. Give the applicant or employee a written notice of the planned adverse action as well as a copy of the report you relied on to make your decision.
  3. Allow the employee or applicant the opportunity to review the report and dispute its accuracy.

After taking an adverse action based on a consumer report, you must provide the applicant or employee with a notice of that fact. While you are permitted to give oral notice, it is a best practice to give written or electronic notice. This notice must include the following information:

  1. The name, address, and phone number of the consumer reporting company that provided you with the report;
  2. A statement that the company that provided you with the report did not make the decision to take the adverse action and cannot provide any specific reasons to the applicant or employee as to why you made the adverse decision;
  3. A notice of the applicant’s or employee’s right to dispute the accuracy or completeness of any information the consumer reporting company furnished, and to get an additional free report from the company if so requested within 60 days.

You must then securely destroy the consumer report by shredding a hard copy or disposing of electronic information so that it cannot be read by other parties.

If you want to go a step further by requesting an “investigative report,” for an applicant or employee, you will have additional requirements that include additional written notices and authorizations, including a statement that the individual has a right to request additional disclosures and a summary of the scope and substance of the investigative report.

If you are found liable for a willful violation of the FCRA, you may be liable for the following damages:

  1. Either the actual damages sustained by the applicant or employee or statutory damages of not less than $100 and not more than $1,000; and
  2. Punitive damages in an amount “as the court may allow;” and
  3. Attorneys’ fees and costs.

A class action could substantially increase your liability even if an individual plaintiff’s damages might be fairly low.

If your violation was negligent, however, you are only liable for any actual damages suffered by the plaintiff and the plaintiff’s attorneys’ fees and costs.