Background Checks: Compliance, Accuracy, and the FCRA Trap

Background checks feel like a routine vendor process. They're not. They're a regulated consumer reporting activity governed by the Fair Credit Reporting Act (FCRA), state ban-the-box laws, EEOC disparate impact guidance, and a patchwork of city ordinances. Mistakes are common, expensive, and almost always procedural.

The largest FCRA class actions in recent years involved Fortune 500 employers — Whole Foods, Disney, Frito-Lay, Vivint, Calvin Klein. None of them were sued for what their background checks found. They were sued for how the checks were procedurally handled.

1. Standalone disclosure

Before running a background check, employers must provide a "clear and conspicuous" written disclosure that a consumer report will be obtained. This disclosure must be in a document that consists solely of the disclosure — not buried in an application or employment agreement.

2. Written authorization

The candidate must provide written authorization. This can be on the same form as the disclosure but must be a separate, clear authorization.

3. Pre-adverse action notice

If the report contains information that may lead to an adverse decision (not hiring, terminating, demoting), the employer must provide:

• A copy of the consumer report
• A summary of consumer rights under FCRA
• Reasonable time to respond and dispute (typically 5–10 business days)

4. Adverse action notice

If, after the pre-adverse waiting period, the decision is final, the employer must send a separate adverse action notice with:

• The name and contact info of the screening company
• A statement that the screening company didn't make the decision and can't explain it
• The candidate's right to dispute and get a free copy of the report

5. Disposal requirements

Consumer reports must be securely disposed of after the retention period — shredding, secure deletion, vendor disposal protocols.

37 US states and over 150 cities have passed ban-the-box laws restricting when employers can ask about criminal history. The exact rules vary, but typical requirements:

• No criminal history questions on the initial application
• Criminal background checks deferred until after a conditional offer is extended
• Individualized assessment if disqualifying information is found, considering the nature of the offense, time elapsed, and relevance to the role
• Written notice to candidates explaining why an adverse decision was based on criminal history

California, New York, Illinois, Massachusetts, and Washington have the strictest requirements. Federal contractors are also subject to additional rules under the Fair Chance to Compete for Jobs Act.

FTC commissioned studies have found that roughly 1 in 4 background check reports contain errors, and 5–10% contain errors serious enough to affect employment decisions. Common sources:

• Mistaken identity — common names match to wrong individuals, especially in counties with poor identifier data
• Stale records — expunged or sealed records that should not be reported
• Misclassified offenses — arrests reported as convictions, dismissed cases reported as pending
• Outdated employment data — old roles misremembered or wrongly verified

The legal liability for inaccurate reports primarily sits with the screening company under FCRA. But employer reputational liability and litigation exposure are still meaningful. Best practice: build in candidate dispute mechanisms and human review of any adverse-leaning report.