Doing background checks on potential employees, and regularly for certain positions with significant access to personally identifiable information (PII) or managemen capabilities, has been a growing trend in recent years. Such checks are viewed as ways to help prevent putting untrustworthy and significant at-risk individuals into positions where they could perform malicious and/or criminal activities.
The Fair Credit Reporting Act (FCRA) establishes background check requirements for employment that all U.S. businesses must follow. The FCRA defines a background check as a consumer report. Before a company can get a consumer report they must notify the individual and obtain written authorization; allowing potential employees the opportunity to withdraw the application if there will be information that he or she does not want disclosed.
Credit reports are used by many organizations to check on potential and current employees who are in positions with access to financial assets, such as bank tellers, systems programmers responsible for financial applications, accounts payable managers, and so on.
Washington state governor Christine Gregoire signed S.B. 5827 into law on April 18.
As an effect of this new law, employers in Washington state may no longer access the credit reports of employees or job applicants unless such information is substantially related to the individual’s current or potential job responsibilities.
While this new law is fairly short, it is significant. The requirements of S.B. 5827 as taken from the bill:
5 (1) A consumer reporting agency may furnish a consumer report only
6 under the following circumstances:
7 (a) In response to the order of a court having jurisdiction to
8 issue the order;
9 (b) In accordance with the written instructions of the consumer to
10 whom it relates; or
11 (c) To a person that the agency has reason to believe:
12 (i) Intends to use the information in connection with a credit
13 transaction involving the consumer on whom the information is to be
14 furnished and involving the extension of credit to, or review or
15 collection of an account of, the consumer;
16 (ii) Intends to use the information for employment purposes;
17 (iii) Intends to use the information in connection with the
18 underwriting of insurance involving the consumer;
p. 1 ESSB 5827.PL
1 (iv) Intends to use the information in connection with a
2 determination of the consumer’s eligibility for a license or other
3 benefit granted by a governmental instrumentality required by law to
4 consider an applicant’s financial responsibility or status; or
5 (v) Otherwise has a legitimate business need for the information in
6 connection with a business transaction involving the consumer.
7 (2)(a) Subject to (c) of this subsection, a person may not procure
8 a consumer report, or cause a consumer report to be procured, for
9 employment purposes with respect to any consumer who is not an employee
10 at the time the report is procured or caused to be procured unless:
11 (i) A clear and conspicuous disclosure has been made in writing to
12 the consumer before the report is procured or caused to be procured
13 that a consumer report may be obtained for purposes of considering the
14 consumer for employment. The disclosure may be contained in a written
15 statement contained in employment application materials; or
16 (ii) The consumer authorizes the procurement of the report.
17 (b) A person may not procure a consumer report, or cause a consumer
18 report to be procured, for employment purposes with respect to any
19 employee unless the employee has received, at any time after the person
20 became an employee, written notice that consumer reports may be used
21 for employment purposes. A written statement that consumer reports may
22 be used for employment purposes that is contained in employee
23 guidelines or manuals available to employees or included in written
24 materials provided to employees constitutes written notice for purposes
25 of this subsection. This subsection does not apply with respect to a
26 consumer report of an employee who the employer has reasonable cause to
27 believe has engaged in specific activity that constitutes a violation
28 of law.
29 (c) As applied to (a) and (b) of this subsection, a person may not
30 procure a consumer report for employment purposes where any information
31 contained in the report bears on the consumer’s credit worthiness,
32 credit standing, or credit capacity, unless the information is either:
33 (i) Substantially job related and the employer’s reasons for the
34 use of such information are disclosed to the consumer in writing; or
35 (ii) Required by law.
36 (d) In using a consumer report for employment purposes, before
37 taking any adverse action based in whole or part on the report, a
38 person shall provide to the consumer to whom the report relates: (i)
ESSB 5827.PL p. 2
1 The name, address, and telephone number of the consumer reporting
2 agency providing the report; (ii) a description of the consumer’s
3 rights under this chapter pertaining to consumer reports obtained for
4 employment purposes; and (iii) a reasonable opportunity to respond to
5 any information in the report that is disputed by the consumer. This
6 subsection applies to job applicants and current employees.
It is worth noting that the new law does not apply to an employer review of the credit report of an employee “who the employer has reasonable cause to believe has engaged in specific activity that constitutes a violation of law.”
Four other states (Hawaii, Pennsylvania, New York and Wisconsin) have similar restrictions on employers using credit reports.
While it is obvious the new law applies to employers based in Washington and employees and job applicants who are residents of Washington, it could also apply to a Washington employer with out-of-state job applicants or employees, an out-of-state employer with employees and applicants that live in Washington, and possibly even a business that interviews job applicants who would need to relocate to Washington to perform the job.
Talk with your legal counsel about the impacts of this law on your business. Consider doing the following, which are good to do on a periodic basis anyway:
* Identify and clearly document categories of employees and specific employees for whom credit information is related to their job responsibilities to justify why credit checks are necessary.
* Review your employment forms to ensure that they are not worded in such a way that an employee or job applicant is giving permission for a credit report review that is now prohibited by this and similar laws.
* Check with your background check vendors to ensure that they do not mistakenly provide credit report information when they shouldn’t be when conducting a background check.
Tags: awareness and training, employee privacy, FCRA, government, Information Security, IT compliance, policies and procedures, privacy, risk management, state employment law