Chances are your organization performs background checks on applicants before you hire them. It’s a good way to make sure you are hiring competent, honest and reliable people. You also might arrange for a new investigation when a promotion is in the works or an employee is about to take on additional, more responsible duties.

Many employers conduct background checks when investigating reports of employee misconduct, such as alleged sexual harassment or suspected theft.

Employers that use third parties (referred to in the law as credit reporting agencies, or CRAs) to perform background checks and investigations need to be aware of the requirements of the federal Fair Credit Reporting Act (FCRA).

How the FCRA works

The Federal Trade Commission (FTC) enforces the FCRA. The FTC conducts employer audits to find out whether an employer is using a CRA to conduct background checks and, if so, whether the employer provided required notices to those being investigated. Employers need to retain records that show compliance.

The statute also permits individuals who believe their FCRA rights have been violated to sue their employers and others directly in federal court.

Violations of FCRA can be costly. Individuals harmed by FCRA violations may claim actual damages as well as attorneys’ fees. A willful violation also can lead to punitive damages. In addition, the FTC can seek civil penalties for noncompliance.

Adverse action

Once you receive background check information from a CRA, you will have to decide how to use it. If, for example, the applicant is seeking a job handling money, and a credit report shows financial problems, the employer may want to decline to offer the applicant the position.

If that’s the case, the FCRA imposes two requirements.

First, the FCRA requires the employer to hold off making an adverse employment decision. The employer must first send the applicant a notice about the report. The notice must allow the applicant to correct any information that might be inaccurate. This is known as the “pre-adverse action disclosure.”

Second, assuming the applicant does not respond or otherwise challenge the report, the employer must inform the applicant that the adverse action was made and that it was based on the report. This is known as the “adverse action notice.”

Investigations and ‘the Vail letter’

Employee investigations, such as investigation of sexual harassment complaints, create different FCRA issues.

Several years ago, the FTC took the position that an employer that hired a third party, such as a law firm, to conduct an investigation had to comply with the FCRA if the results of the investigation might lead to an adverse action. The FTC set forth this position in a staff opinion letter known as “the Vail letter.”

The Vail letter created practical problems for employers. Employers have a statutory obligation to investigate problems such as sexual harassment. However, under the FCRA, an alleged harasser might be able to prevent an investigation by withholding consent to conduct an investigation. Also, an employer might not want to permit the alleged harasser to see the investigation report.

In 2003, Congress amended the FCRA in response to these concerns. There is now a specific but limited exclusion for certain communications made during an employee investigation. That exclusion applies to employment misconduct investigations, investigations into federal or state law or regulation compliance, and several other types of investigations.

Note, though, that the communication cannot be connected to an investigation of someone’s credit worthiness, credit standing or credit capacity. Plus, the communication can be shared only with limited people, such as the employer and its agents, government personnel or applicable self-regulatory organizations. If these conditions are met, the investigation would not be subject to the FCRA, so the notice and disclosure obligations would not apply.

In general, the Fair Credit Reporting Act (FCRA) applies only when an employer uses a third party to provide information about applicants or employees. Thus, an employer that uses its own staff to check an applicant’s employment references or conduct investigations does not have to follow the FCRA. But if the employer hires an outside service to obtain information about applicants or employees, then the FCRA applies.

The FCRA requires that an employer let an employee know it will be conducting an investigation before the investigation takes place and before using it as a basis for an adverse employment action.

There are two basic requirements.

First, the employer must disclose to the applicant—in writing—that it is seeking information. The employer must then obtain the individual’s written consent to investigate. This document must contain specific notices, depending on the type of information being collected. Typically, the credit reporting agency (CRA) collecting and providing the information for the employer will provide those forms. If it does not do so, you may want to consider another CRA.

Second, the employer must provide certification to the CRA that it will use the information in compliance with the FCRA and other laws before it can get access to any information. Again, the CRA should provide the appropriate certification form.