A hot topic in employment law news is a growing movement toward “banning the box” (i.e. implementing laws that bar employers from asking about a criminal history on the initial job application). But whether you properly ask the question on a job application, or inquire about the criminal history later in the hiring process or look into it for current employees, you must be careful to comply with the Fair Credit Reporting Act when you conduct a criminal background check.

The Fair Credit Reporting Act (the “FCRA”) is a federal law governing the reporting, collection and access to consumer information compiled into “consumer reports.” Although people typically think of consumer reports as credit reports that provide information on a consumer’s credit worthiness, the FCRA applies to a much broader spectrum of consumer information. Specifically, the law applies to “consumer reports” that are “any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for . . . [a variety of reasons including] employment purposes.” 15 U.S.C. § 1681a(d).

If you obtain a criminal background check through a company that is in the business of compiling that kind of information, then you must comply with the FCRA before obtaining the report, before taking any adverse action based on the report, and after taking adverse action based upon the report.

1) Before Obtaining the Background Check (15 U.S.C. §1681b(b)(2))

Before ordering the background check, you must disclose to the individual that you intend to pull a consumer report that might be used for decisions about his or her employment. The notice must be in writing and in a stand-alone format. (Keep in mind that it is not sufficient to include this disclosure on a job application.)

You must also obtain the individual’s consent, in writing, to your pulling the report. Typically this is done by having the individual sign the disclosure described above.

2) Before Taking Adverse Action (15 U.S.C. §1681b(b)(3))

If you receive the background check back, and you plan to not hire the individual based upon the report or not offer a promotion, etc. to a current employee, then you must provide the individual with a copy of the report you obtained and a summary of his or her rights under the FCRA, which you should have received from the company that sold you the report.

3) After Taking Adverse Action (15 U.S.C. §1681m)

After you take the adverse employment action, you must inform the person about the following information:

• that he or she was rejected because of information on the report;
• the name, address and phone number of the company that sold you the report;
• that the company selling the report did not make the hiring (or other employment-related) decision and cannot give specific reasons for it; and
• that the individual has the right to dispute the accuracy of the report and get an additional free report from the company within 60 days.

The law does not require that this communication be in writing, but it is advisable to do so in order to have a record of your compliance with the act.

It is important to comply with these requirements or it may be determined that you did not have a permissible purpose to obtain a copy of the report and/or that you violated the act as a user of the consumer report. This can result in liability for actual damages, attorney’s fees and costs, and even punitive damages. 15 U.S.C. §§ 1681n & o.