Earlier this week, the Federal Trade Commission (FTC) announced a settlement with background screening giant, HireRight. The scenario is pretty much every compliance officer or in-house counsel’s worst nightmare. The company has signed a consent decree that requires it to pay $2.6 million in penalties. Along with the payment, HireRight has to submit to monitoring by the FTC, is enjoined from some allegedly bad practices, and agrees to regular reporting and ongoing investigation by the agency for at least five years.
The FTC charges that the company violated the Fair Credit Reporting Act by failing to use reasonable procedures to assure the maximum possible accuracy of criminal background check information it provided, failing to give consumers copies of their reports, failing to re-investigate consumer disputes, and failing to sufficiently notify consumers when public record information is used in a background check. In plain English, the FTC is saying that consumers were denied protections that are required under the law.
While the consent judgment does not admit any wrongdoing, the company has agreed to cease certain practices, and they are paying a hefty fine, to boot. For more of the legal nitty gritty, our friends in the privacy practice group at Arnall Golden Gregory LLP have done a great job of laying out the statutory violations here.
Up until now, the FTC’s investigation and enforcement of the FCRA, specifically the accuracy of consumer reports, has not shown much muscle. It’s been focused more on credit reports than criminal backgrounds. The recent scrutiny by the FTC is, in my opinion, due to a convergence of a few things. First, with the ongoing job crisis, there is increasing attention on potential barriers to employment, including a criminal past or a bad credit report. When background companies get it wrong and someone is unjustly denied a job, those applicants are crying foul. As well they should.
In addition, watchdog organizations are sounding the alarm. Groups like the National Employment Law Project (NELP) are reaching out to regulators and providing a platform for ex-offenders and potential victims of discrimination to protest inaccuracies in reports and potential FCRA violations. I can’t argue with that. And the CFPB is now in the mix, asking questions as well.
Finally, technology and price pressures have converged to make the quick and easy instant database search an attractive but dangerous product. Don’t confuse a cheap and cheerful web search with a real background check. Databases and public records are invaluable tools if used properly. But they can be inaccurate and damaging if not vetted and verified.
Full disclosure—I am employed by a background screening company. Moreover, I am on the board of directors for the National Association of Professional Background Screeners. With that said, I firmly believe that if you are running or managing a business, doing a criminal background check is a must. It’s a sound and best practice. In some instances, it might be negligent not to do so, and it may actually be required by law. But how do you know if your background company is following the law? I have a few recommendations, based on the FTC’s allegations and the resulting judgment and order.
1. Look for NAPBS accreditation: This standard, established a couple of years ago by the National Association of Professional Background Screeners, identifies that a background screening firm is committed to best practices, subjects itself to on-site audits, and has submitted to ongoing monitoring and approval of policies and procedures by an accrediting board.
2. Ask your provider about accuracy: The FCRA requires “reasonable procedures” to ensure “maximum possible accuracy.” Ask your background company about this requirement. They should know what you’re talking about. If they don’t, start looking for a replacement.
3. Does your background firm use databases? Databases are great. They are highly effective when used properly. So if they use them, how do they confirm that the information is up-to-date? A database is NEVER completely up-to-date. Even the FBI and state police databases are full of holes and gaps. By definition, a database is stored information that does not keep up with the real-time activity of a court. Unless a provider is confirming with an on-site or real-time court level check, the information may not be accurate.
4. What about expungements? Again, if the information is not verified at the county court level, you run the risk of making a decision based on an expunged or sealed records.
5. Does your provider publish duplicate offenses? If a case is reported in multiple places, the right thing to do is only report it once. Courts and regulators agree–reporting duplicates can make an applicant look worse that they really are.
6. Does your provider send required notifications to consumers when public record information cannot be verified? This is one area where the FTC came down hard. In this case the FTC alleged that they had a “complex, multistep process for notifying consumers that public record information was being reported.” This process delayed notification, and could have been avoided altogether if the information had been verified at the source before being reported.
7. How does your provider deal with consumer inquiries? Ask for a copy of their dispute resolution policy. Take it to your attorney to review. The law says disputes must be responded to within 5 days, resolved within 30 days, and the background screening company must provide a copy of the report upon request. If it seems like they are making your job applicants jump through hoops when they have a question about the report, be on notice. The law exists to help consumers and job seekers, and the background screening companies are a critical part of that process.
At the end of the day, employers can help themselves and their applicants by asking these questions. And if the answers don’t sound right, it might be time to make some changes.
Continue Reading
