​

TWO CASINOS, the Las Vegas-based Imperial Palace and the Biloxi-based Imperial Palace of Mississippi, asked job applicants to sign a release form authorizing the companies to obtain the applicants’ credit reports, then reviewed each credit report and used it to rate the applicant as either “poor,” “fair,” or “good.” Based on this rating, the applicants were recommended as either favorable or unfavorable hires.

That may sound like a reasonable preemployment screening process, but it has landed both companies in hot water with the Federal Trade Commission (FTC). The commission alleges that, in many cases, the defendants’ decision not to hire a particular applicant was based wholly or partly on information contained in those credit reports. While this practice is not illegal, the way the companies went about it, alleged the FTC, violated the Fair Credit Reporting Act (FCRA).

The FCRA requires that before taking adverse action—such as a demotion or a refusal to hire—against a current employee or job applicant based on information in the subject’s credit report, the employer must give that person a copy of the report and a written description of his or her FCRA rights. The FTC brought charges in federal court alleging that the defendants failed to provide applicants with the required notices. (USA v. Imperial Palace Casino, FTC File No. 0323050, CVSO40963, United States District Court, Nevada, 2004)

The companies entered into a consent decree. (A consent decree does not constitute an admission of lawbreaking.) The consent decree bars the defendants from taking adverse action against current employees or job applicants based on information in their credit reports without providing the FCRA-required notices. The decree also requires the defendants to pay a civil penalty of $325,000 and assist the FTC in monitoring compliance.

As this case shows, background screening, and other employment investigations, while essential, must be conducted with care and in line with federal and state statutes, or the results can cause a company almost as many legal woes as hiring the wrong person. It’s critical to have an understanding of the basic requirements, including the legitimate purposes for which records may be obtained, disclosure rules, and issues surrounding when copies of records must be provided.

Legitimate Purposes

The FCRA says that an employer can obtain a consumer report, which includes both credit reports and criminal or investigative background reports, for “employment purposes.” That means the report will be used to evaluate an individual for employment, promotion, reassignment, or retention.

The courts have ruled that employers are also entitled to obtain consumer reports relating to employees for purposes of deciding whether to discharge them. If, however, an employee has already been discharged or has resigned, there is no longer an employment purpose, and the employer no longer has the right to obtain the report.

Courts have held that when credit or background reports are obtained by employers under false pretenses—for reasons other than determining eligibility for employment or continued employment—the subject employees may recover actual and punitive damages and attorney’s fees and costs from the users of such information.

For example, in one case, an employer rescinded an employment offer made to a job applicant. After the applicant objected to the denial of employment, the prospective employer obtained a credit report on the individual, claiming it was for employment purposes. The court held that the report was obtained under false pretenses, thereby violating both the civil and criminal provisions of the FCRA. The employer settled the case out of court for an undisclosed amount.

Disclosure

Federal law requires that the subject of the record search be notified of the employer’s intent and asked for authorization. This disclosure notice must be a discrete document separate from the employment application; it should consist solely of the disclosure. The disclosure notice must be clear and conspicuous and must state what type of reports may be obtained and for what purpose.

Companies also need to be aware of state laws. The California statute, for example, goes further. California law requires that the notice inform the employee that the report may include information about the applicant’s character, general reputation, personal characteristics, and mode of living. It must identify the investigative consumer reporting agency that will conduct the investigation by name, address, and telephone number, and provide a summary of the applicant’s rights as outlined in the California statute.

The form must also contain a box that the applicant may check off to waive his or her right to receive a copy of the investigative report. (Other states, including Minnesota and Oklahoma, also require a check-off box.)

If the report will contain medical information, federal law requires that the applicant specifically consent to the inclusion of that information in writing. Also, in all cases, the employer must certify to the agency from which it requests a report that it is in legal compliance with the state and federal requirements.

Blanket Authorization

Under the federal statute, an employer can require staff as a condition of employment to sign a blanket authorization for the company to gather consumer-report information in the future to, for example, conduct a background check in anticipation of a promotion. No prior employee consent is needed for an employer to conduct an investigation of an employee suspected of wrongdoing or misconduct.

The right of employers to ask for blanket authorization has been upheld by the courts. In the case clarifying that right (Kelchner v. Sycamore Manor Health Center, U.S. District Court for the Middle District of Pennsylvania, No. 04-2552, 2004), Lisa Kelchner had been employed at Sycamore Manor for 19 years when she was asked to sign a document authorizing her employer to obtain reports on her.

The document stated that the company could gather consumer reports that could involve “personal interviews with sources such as neighbors, friends or associates.” The form stated that reports would be used for employment purposes only, but Kelchner refused to sign the document. She was discharged.

Kelchner sued Sycamore Manor for wrongful termination, arguing that blanket authorization forms were not permitted under the FCRA. The court found in favor of Sycamore Manor, ruling that blanket authorizations are allowed under the FCRA.

The court noted that the employer sought only authorization to procure a report if the need for one arose, and that the reports that were requested clearly qualified as valid because they were for employment purposes. The report authorizations were tailored to each employee. Only those who drove vehicles for the company, for example, were subject to a check of driving records.

Notification of Results

There are provisions in federal and state laws regarding when and how employers must share the results of the records search. In California, for example, an employer that conducts its own in-house investigation of an applicant using public records, defined as “records documenting an arrest, indictment, conviction, civil judgment action, tax lien, or outstanding judgment,” must give the applicant prior written notice that public records may be obtained, and the notice must include a box that the applicant may check off to waive his or her right to receive a copy of the records.

Under California law, assuming that the applicant has not waived the right to receive the records, the employer must provide the applicant with a copy of the records from the search within seven days of receipt of the information.

If the employer denies employment based on the public record information, the employer must provide a copy of the public records to the applicant regardless of whether the applicant waived his or her rights under the law. California employers must keep in mind that, unlike in federal law, the information must be provided to the applicant even if the information was received verbally.

Employers often seek references from applicants. A reference verified by an employer is not covered by the FCRA or California law; a reference verified by a consumer reporting agency is covered.

Similarly, in a misconduct investigation, although advance notice by the employer that a report will be obtained is not required, if an employer takes adverse action based in whole or in part on a consumer report, the employer must give the employee a summary of the nature and scope of the investigation when it is complete. If the decision to take adverse action is based on information contained in public records or in a consumer report, those records must be disclosed to the employee.

The report information need not be disclosed to the employee, however, if the decision to take the adverse action was not based in any way on specific information contained in consumer records protected under the FCRA and obtained during the investigation. Information contained in a report generated by attorneys or a private investigative agency on behalf of an employer is generally not considered a consumer report and need not be disclosed.

New Disposal Rule

The FTC last year put in place the Federal Disposal Rule, calling for the proper disposal of information in consumer reports and records to protect against “unauthorized access to or use of the information.” The rule, which went into effect in June 2005, applies to consumer reports or information derived from them, used or expected to be used in establishing eligibility for credit, employment, or insurance, among other purposes.

Credit reports and credit scores are consumer reports, as are reports that businesses or individuals receive with information relating to employment background, check writing history, insurance claims, residential or tenant history, or medical history.

The rule requires disposal practices that are “reasonable and appropriate.” Paper documents should be burned, pulverized, or shredded so that the information cannot be read or reconstructed, and electronic files or media should be destroyed or erased for the same reason.

The rules recommend conducting due diligence when hiring a document-destruction contractor to dispose of material identified as consumer-report information consistent with the rule. This due diligence could include:

■ Reviewing an independent audit of a disposal company’s operations.

■ Obtaining information about the disposal company from several references.

■ Requiring that the disposal company be certified by a recognized trade association.

■ Reviewing and evaluating the disposal company’s information security policies and procedures.

The FTC recommends that financial institutions that are subject to both the disposal rule and Gramm-Leach-Bliley safeguards should incorporate practices dealing with the proper disposal of consumer information into the information-security program required under the financial law.

Failure to comply carries significant penalties. For example, if an employee’s identity is stolen, that employee can recover actual damages from its employer for all damages incurred from identity theft. An employer also may be liable for statutory damages of up to $1,000 per employee. Additionally, the federal government can fine an employer up to $2,500 for each violation, and states can issue fines up to $1,000 for each violation.

Any information obtained through credit checks or background reports should be considered highly confidential and should be maintained in a file separate and apart from the employee’s personnel file. Such information should not be shared with potential creditors or used for any purpose other than a job-related purpose.

Managers know that hiring the right person is never easy. They should also not take for granted the complexities of checking into an applicant’s background without violating the law.

Laura P. Worsinger is senior counsel at Buchalter Nemer in Los Angeles. Her practice involves all aspects of employment counseling, litigation, and practice before federal and state agencies.