Wednesday, March 03, 2004
Needless Risk - Are you conducting background searches illegally?
By Barry J. Nadell, President InfoLink Screening Services, Inc.
Loss Prevention & Security Journal, June 2003
Faced with danger, it's preferable to do something rather than nothing. Most of us would prefer to manage our fate, instead of just hoping for the best. However, when action is taken there is always a risk of inadvertently making the situation worse.
It is a function of loss prevention and security personnel to protect their employer from preventable risks. However, in prevention activities there is often the associated risk of legal compliance. When prevention activities infringe upon laws to which they should be adhering, risk escalates instead of diminishing. It is a professional responsibility to ensure legal compliance always occurs.
The Dangers of Negligent Hiring
There has been a dramatic viewpoint change among those responsible for corporate security. Initially, awareness of the risks associated with the failure to do appropriate background screening was low. However, hiring or retaining dangerous employees is clearly negligent conduct. Spectacular court cases soon brought home to security professionals the legal doctrine of "negligent hiring" and its attendant risks for employers. According to the Workplace Violence Research Institute in Newport Beach, Calif., lawsuits claiming "negligent hiring" or "negligent retention" cost U.S. businesses an estimated $18 billion a year.
The courts have been particularly sensitive to cases where employees directly impact the health, safety and welfare of the public. For example, in Ward v. Trusted Health, No. 94-4297 (Suffolk Superior Court), Trusted Health Resources Inc. hired Jesse L. Rogers in 1991 as an aide in a home healthcare program run by the Visiting Nurses Association (VNA) of Boston. Trusted Health Resources never requested a criminal background check on Rogers, but such a check would have revealed six larceny-related convictions in Massachusetts. Likewise, his bogus claims of working at a state agency and attending nursing classes at Northeastern University would have been uncovered. Rogers was later convicted of stabbing to death John Ward, a quadriplegic under his care, and the victim's grandmother. The murders were apparently committed to cover up thefts from the household. Ward's parents brought suit against Trusted Health and the VNA, winning compensatory and punitive damages of $26.5 million and sending Trusted Health into bankruptcy.
Current Misconceptions
Over the last decade, awareness of the risks posed by negligent hiring and retention has grown and more companies have integrated background screening into their hiring process. As the number of companies conducting screening has grown, however, so has the number of companies that are doing so without full legal compliance. In fact, some startling misconceptions have surfaced that specifically violate the legalities of background screening, exposing companies to needless risk.
Some examples:
• A private investigator is not entitled to conduct background checks simply because he is a licensed P.I.
• An attorney is not entitled to conduct background checks simply because he is an attorney.
• A background check conducted on the basis of a legitimate business need is not justified simply because the person soliciting the report feels he has a legitimate business need for the report.
• The fact that background information is available and can be obtained does not mean that the information can be used legally and without liability.
Temptations of the Internet
In addition to the misconceptions listed, the advent of the Internet has brought new confusion and temptation. Many screening-related sites have sprung up. Some of these are tied to reputable, pre-existing background screening firms that know the law and take steps to ensure their clients' compliance with it. These firms should be quite familiar with the demands of legal compliance and pose no danger.
There are also sites that are primarily reference sites, providing links to sources of information located elsewhere on the Internet. However, those within the industry know that much of the important information typically sought in background screening, such as criminal records, does not exist in the form of a national database and therefore cannot be accessed via the Internet at all.
Most troubling are the Internet sites that seem to freely offer sensitive background information without qualification. To do so is not legal. As will later be fully explained, background searches are permitted by law only for specifically stated purposes. Even then, those seeking information under a permissible purpose must certify that purpose to the information vendor before the information can be released. Regarding these sites, there is every reason to be concerned whether one can actually obtain valuable background information and whether it is being obtained without legal compliance and, therefore, done "illegally."
Here are samples of language used by such Internet sites and in promotional e-mails:
• "Find out anything about anyone."
• "Perform a comprehensive national background search."
• "Conduct a background check on someone, all you need is their name and one of the following: present/previous address, date of birth or social security number."
• "If you've met on the Internet, consider getting a background check before you get too involved."
• However, upon closer review, various disclaimers are also found:
• "Some searches, such as credit checks and driving record searches, require written authorization from the subject of the search in order to comply with federal law."
• "The person you are looking for will not be notified that you are searching for them, therefore, we ask that you act responsibly and in accordance with the law once you receive your search results."
• "Specifically to comply with privacy laws, we do not have access, utilize, reveal or provide any confidential information, such as an individual's financial status, employment background, credit history, or medical records contained in consumer reports, the dissemination of which is strictly prohibited by the Fair Credit Reporting Act. 15 USCS 1681a."
• "This data must only be used to locate or further identify the subject and should not be used in whole or in part to determine a consumer's eligibility for credit, employment or insurance or any other purpose for which a consumer report would be obtained, except in connection with collection of a debt. This data is to be used for lead information only."
A Matter of Definition
When we compare what is promoted as available on the Internet and the disclosures that limit the availability and use of such data, there is an apparent contradiction. As seen from the disclaimers, much of the information is not immediately available or, if it is available, the provider may attempt to surreptitiously place responsibility for legal use of the information on the user and away from itself. Resolving this contradiction requires knowledge of the definitions established by law, as well as the permissible purposes for obtaining background information.
First, it must be observed that some sites may be operating beyond the boundaries required by law and there may come a time when the validity of their operations will be tested in court.
Second, "background check" is a familiar term, but not one that is defined by the applicable laws. The law most directly governing this activity is the Fair Credit Reporting Act [FCRA] of 1970, which was amended in 1997. Don't let the name mislead you--the FCRA covers far more than just consumer credit reports. Besides the FCRA, there are various state laws that do not contradict the federal law, but typically affirm or expand upon it.
It should be noted that where employers perform reference and background checks without using services offered by third parties for a fee, the FCRA generally does not apply. A quick look at the basic FCRA definitions provides considerable insight:
Consumer: An individual.
Investigative consumer report: "The term 'investigative consumer report' means a consumer report or portion thereof in which information on a consumer's character, general reputation, personal characteristics or mode of living is obtained through personal interviews with neighbors, friends or associates of the consumer reported on or with others with whom he is acquainted or who may have knowledge concerning any such items of information."
Common examples of investigative consumer reports are employment verifications and interviews with former employers and co-workers, where these are performed by a consumer reporting agency.
Consumer report: "The term 'consumer report' means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living that is used or expected to be used for the purpose of establishing the consumer's eligibility for [credit or insurance, employment, etc]."
A consumer report would therefore include any oral or written information from a consumer reporting agency, such as a criminal background check, credit histories, ID verification, department of motor vehicle records check, and investigative consumer report information derived from personal interviews.
Consumer reporting agency: "Any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties."
Thus, a consumer reporting agency is basically any organization that supplies and charges for information on consumers. This specifically includes private investigators and companies who refer to themselves as "record search firms."
Under the FCRA, every consumer reporting agency must take appropriate measures to prevent inappropriate disclosures of information. Prospective users of information must identify themselves, certify the purposes for obtaining the information, and certify the information will not be used for any unauthorized purpose.
Consequences on Noncompliance
Compliance with the requirements of the FCRA is enforced by the Federal Trade Commission (FTC). Failure to comply with the FCRA can result in state or federal enforcement actions, as well as private lawsuits. In addition, any person who knowingly and willfully obtains a consumer report under false pretenses may face criminal prosecution.
Regarding employers specifically, failure to comply with the requirements of the FCRA can result in civil liability in the form of actual damages sustained by the applicant or employee, punitive damages (in the case of willful noncompliance with the FCRA), and imposition of costs and attorneys' fees. Additionally, it is a felony to procure a consumer report (i.e., a background check) under false pretenses. If convicted, the person who knowingly and willfully obtained the information is subject to a fine, imprisonment for up to two years, or both.
Hiring a third-party investigator provides more protection for a company than if it performs its own investigations. The FCRA provides limited legal immunity to employers who hire third-party investigators. This legal immunity applies to suits alleging defamation, invasion of privacy or negligence in connection with the investigation. There is no comparable immunity for employers who conduct their own investigations.
Needless to say, the legal risks are accentuated for a user when information is thought to have been obtained legally and when it hasn't.
How To Comply
Those who obtain consumer background information should consult their background screening agency and/or legal counsel for their specific compliance requirements. That said, the general requirements, briefly stated, are as follows:
1. Make required disclosures and obtain written consent to obtain background information.
2. Certify permissible purpose to the credit-reporting agency involved.
3. Make sure the data obtained is FCRA compliant.
4. Give notice before taking "adverse action," namely, by providing the consumer a copy of the negative report along with a statement of rights developed by the FTC and waiting a reasonable period of time for the consumer to contest the information (usually 3-5 days). Then, take adverse action in writing.
Permissible Purposes for Obtaining Background Information
The list of permissible purposes specified by Congress in the FCRA is important, because these purposes have been held by the courts to be exclusive. In other words, access to reports for a non-specified purpose, even though it may have a legitimate business purpose or seem like a good idea, is not permitted. The wording of the FCRA states, "A consumer reporting agency may furnish a consumer report under the following circumstances and no other."
Section 604 of the FCRA contains a list of the permissible purposes under law. These are:
• As permitted by order of a court or a federal grand jury subpoena. [Section 604(a)(1)]
• For any purpose if the consumer gives permission in writing. [Section 604(a)(2)]
• For the extension of credit as a result of an application from a consumer or the review or collection of a consumer's account. [Section 604(a)(3)(A)]
• For employment purposes, including hiring and promotion decisions, where the consumer has given written permission. [Sections 604(a)(3)(B) and 604(b)] (Note: Employment purposes may include hiring, termination, reassignment or promotion of an applicant or employee.)
• For the underwriting of insurance as a result of an application from a consumer. [Section 604(a)(3)(C)]
• When there is a legitimate business need in connection with a business transaction that is initiated by the consumer. [Section 604(a)(3)(F)(i)]
• To review a consumer's account to determine whether the consumer continues to meet the terms of the account. [Section 604(a)(3)(F)(ii)]
• To determine a consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status. [Section 604(a)(3)(D)]
• For use by a potential investor or servicer--or current insurer--in a valuation of, or an assessment of, the credit or repayment risks associated with an existing credit obligation. [Section 604(a)(3)(E)]
• For use by state and local officials in connection with the determination of child support payments or modifications and enforcement thereof. [Sections 604(a)(4) and 604(a)(5)]
In addition, creditors and insurers may obtain certain consumer report information for the purpose of making unsolicited offers of credit or insurance.
The following states have implemented their own laws concerning permissible purposes, many of which conform to federal law: Arizona, California, Colorado, Georgia, Kansas, Maine, Maryland, Massachusetts, Minnesota, Montana, Nevada, New Hampshire, New Jersey, New York, Texas, Virginia and Washington. Several other states have additional laws that relate to the FCRA.
In summary, the basic principle governing access to consumer reports is that actions authorized or initiated by the consumer are generally permitted, while unauthorized uses or disclosures are prohibited. Specific exceptions to the general rule have been made to accommodate public interests (alimony, licensing, court orders, etc.).
It is recommended those obtaining background information be thoroughly familiar with FCRA provisions and the permissible purposes for obtaining consumer reports, as well as how these regulations apply to their own specific circumstances. To fail in providing such policies is to incur needless legal risks. *
Barry Nadell is president of InfoLink Screening Services Inc. in Chatsworth, Calif., a nationwide provider of background screening and drug testing programs. The company provides the latest online technology to request, review and archive reports via its secure website at www.InfoLinkScreening.com or (800) 990-HIRE (4473).
By Barry J. Nadell, President InfoLink Screening Services, Inc.
Loss Prevention & Security Journal, June 2003
Faced with danger, it's preferable to do something rather than nothing. Most of us would prefer to manage our fate, instead of just hoping for the best. However, when action is taken there is always a risk of inadvertently making the situation worse.
It is a function of loss prevention and security personnel to protect their employer from preventable risks. However, in prevention activities there is often the associated risk of legal compliance. When prevention activities infringe upon laws to which they should be adhering, risk escalates instead of diminishing. It is a professional responsibility to ensure legal compliance always occurs.
The Dangers of Negligent Hiring
There has been a dramatic viewpoint change among those responsible for corporate security. Initially, awareness of the risks associated with the failure to do appropriate background screening was low. However, hiring or retaining dangerous employees is clearly negligent conduct. Spectacular court cases soon brought home to security professionals the legal doctrine of "negligent hiring" and its attendant risks for employers. According to the Workplace Violence Research Institute in Newport Beach, Calif., lawsuits claiming "negligent hiring" or "negligent retention" cost U.S. businesses an estimated $18 billion a year.
The courts have been particularly sensitive to cases where employees directly impact the health, safety and welfare of the public. For example, in Ward v. Trusted Health, No. 94-4297 (Suffolk Superior Court), Trusted Health Resources Inc. hired Jesse L. Rogers in 1991 as an aide in a home healthcare program run by the Visiting Nurses Association (VNA) of Boston. Trusted Health Resources never requested a criminal background check on Rogers, but such a check would have revealed six larceny-related convictions in Massachusetts. Likewise, his bogus claims of working at a state agency and attending nursing classes at Northeastern University would have been uncovered. Rogers was later convicted of stabbing to death John Ward, a quadriplegic under his care, and the victim's grandmother. The murders were apparently committed to cover up thefts from the household. Ward's parents brought suit against Trusted Health and the VNA, winning compensatory and punitive damages of $26.5 million and sending Trusted Health into bankruptcy.
Current Misconceptions
Over the last decade, awareness of the risks posed by negligent hiring and retention has grown and more companies have integrated background screening into their hiring process. As the number of companies conducting screening has grown, however, so has the number of companies that are doing so without full legal compliance. In fact, some startling misconceptions have surfaced that specifically violate the legalities of background screening, exposing companies to needless risk.
Some examples:
• A private investigator is not entitled to conduct background checks simply because he is a licensed P.I.
• An attorney is not entitled to conduct background checks simply because he is an attorney.
• A background check conducted on the basis of a legitimate business need is not justified simply because the person soliciting the report feels he has a legitimate business need for the report.
• The fact that background information is available and can be obtained does not mean that the information can be used legally and without liability.
Temptations of the Internet
In addition to the misconceptions listed, the advent of the Internet has brought new confusion and temptation. Many screening-related sites have sprung up. Some of these are tied to reputable, pre-existing background screening firms that know the law and take steps to ensure their clients' compliance with it. These firms should be quite familiar with the demands of legal compliance and pose no danger.
There are also sites that are primarily reference sites, providing links to sources of information located elsewhere on the Internet. However, those within the industry know that much of the important information typically sought in background screening, such as criminal records, does not exist in the form of a national database and therefore cannot be accessed via the Internet at all.
Most troubling are the Internet sites that seem to freely offer sensitive background information without qualification. To do so is not legal. As will later be fully explained, background searches are permitted by law only for specifically stated purposes. Even then, those seeking information under a permissible purpose must certify that purpose to the information vendor before the information can be released. Regarding these sites, there is every reason to be concerned whether one can actually obtain valuable background information and whether it is being obtained without legal compliance and, therefore, done "illegally."
Here are samples of language used by such Internet sites and in promotional e-mails:
• "Find out anything about anyone."
• "Perform a comprehensive national background search."
• "Conduct a background check on someone, all you need is their name and one of the following: present/previous address, date of birth or social security number."
• "If you've met on the Internet, consider getting a background check before you get too involved."
• However, upon closer review, various disclaimers are also found:
• "Some searches, such as credit checks and driving record searches, require written authorization from the subject of the search in order to comply with federal law."
• "The person you are looking for will not be notified that you are searching for them, therefore, we ask that you act responsibly and in accordance with the law once you receive your search results."
• "Specifically to comply with privacy laws, we do not have access, utilize, reveal or provide any confidential information, such as an individual's financial status, employment background, credit history, or medical records contained in consumer reports, the dissemination of which is strictly prohibited by the Fair Credit Reporting Act. 15 USCS 1681a."
• "This data must only be used to locate or further identify the subject and should not be used in whole or in part to determine a consumer's eligibility for credit, employment or insurance or any other purpose for which a consumer report would be obtained, except in connection with collection of a debt. This data is to be used for lead information only."
A Matter of Definition
When we compare what is promoted as available on the Internet and the disclosures that limit the availability and use of such data, there is an apparent contradiction. As seen from the disclaimers, much of the information is not immediately available or, if it is available, the provider may attempt to surreptitiously place responsibility for legal use of the information on the user and away from itself. Resolving this contradiction requires knowledge of the definitions established by law, as well as the permissible purposes for obtaining background information.
First, it must be observed that some sites may be operating beyond the boundaries required by law and there may come a time when the validity of their operations will be tested in court.
Second, "background check" is a familiar term, but not one that is defined by the applicable laws. The law most directly governing this activity is the Fair Credit Reporting Act [FCRA] of 1970, which was amended in 1997. Don't let the name mislead you--the FCRA covers far more than just consumer credit reports. Besides the FCRA, there are various state laws that do not contradict the federal law, but typically affirm or expand upon it.
It should be noted that where employers perform reference and background checks without using services offered by third parties for a fee, the FCRA generally does not apply. A quick look at the basic FCRA definitions provides considerable insight:
Consumer: An individual.
Investigative consumer report: "The term 'investigative consumer report' means a consumer report or portion thereof in which information on a consumer's character, general reputation, personal characteristics or mode of living is obtained through personal interviews with neighbors, friends or associates of the consumer reported on or with others with whom he is acquainted or who may have knowledge concerning any such items of information."
Common examples of investigative consumer reports are employment verifications and interviews with former employers and co-workers, where these are performed by a consumer reporting agency.
Consumer report: "The term 'consumer report' means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living that is used or expected to be used for the purpose of establishing the consumer's eligibility for [credit or insurance, employment, etc]."
A consumer report would therefore include any oral or written information from a consumer reporting agency, such as a criminal background check, credit histories, ID verification, department of motor vehicle records check, and investigative consumer report information derived from personal interviews.
Consumer reporting agency: "Any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties."
Thus, a consumer reporting agency is basically any organization that supplies and charges for information on consumers. This specifically includes private investigators and companies who refer to themselves as "record search firms."
Under the FCRA, every consumer reporting agency must take appropriate measures to prevent inappropriate disclosures of information. Prospective users of information must identify themselves, certify the purposes for obtaining the information, and certify the information will not be used for any unauthorized purpose.
Consequences on Noncompliance
Compliance with the requirements of the FCRA is enforced by the Federal Trade Commission (FTC). Failure to comply with the FCRA can result in state or federal enforcement actions, as well as private lawsuits. In addition, any person who knowingly and willfully obtains a consumer report under false pretenses may face criminal prosecution.
Regarding employers specifically, failure to comply with the requirements of the FCRA can result in civil liability in the form of actual damages sustained by the applicant or employee, punitive damages (in the case of willful noncompliance with the FCRA), and imposition of costs and attorneys' fees. Additionally, it is a felony to procure a consumer report (i.e., a background check) under false pretenses. If convicted, the person who knowingly and willfully obtained the information is subject to a fine, imprisonment for up to two years, or both.
Hiring a third-party investigator provides more protection for a company than if it performs its own investigations. The FCRA provides limited legal immunity to employers who hire third-party investigators. This legal immunity applies to suits alleging defamation, invasion of privacy or negligence in connection with the investigation. There is no comparable immunity for employers who conduct their own investigations.
Needless to say, the legal risks are accentuated for a user when information is thought to have been obtained legally and when it hasn't.
How To Comply
Those who obtain consumer background information should consult their background screening agency and/or legal counsel for their specific compliance requirements. That said, the general requirements, briefly stated, are as follows:
1. Make required disclosures and obtain written consent to obtain background information.
2. Certify permissible purpose to the credit-reporting agency involved.
3. Make sure the data obtained is FCRA compliant.
4. Give notice before taking "adverse action," namely, by providing the consumer a copy of the negative report along with a statement of rights developed by the FTC and waiting a reasonable period of time for the consumer to contest the information (usually 3-5 days). Then, take adverse action in writing.
Permissible Purposes for Obtaining Background Information
The list of permissible purposes specified by Congress in the FCRA is important, because these purposes have been held by the courts to be exclusive. In other words, access to reports for a non-specified purpose, even though it may have a legitimate business purpose or seem like a good idea, is not permitted. The wording of the FCRA states, "A consumer reporting agency may furnish a consumer report under the following circumstances and no other."
Section 604 of the FCRA contains a list of the permissible purposes under law. These are:
• As permitted by order of a court or a federal grand jury subpoena. [Section 604(a)(1)]
• For any purpose if the consumer gives permission in writing. [Section 604(a)(2)]
• For the extension of credit as a result of an application from a consumer or the review or collection of a consumer's account. [Section 604(a)(3)(A)]
• For employment purposes, including hiring and promotion decisions, where the consumer has given written permission. [Sections 604(a)(3)(B) and 604(b)] (Note: Employment purposes may include hiring, termination, reassignment or promotion of an applicant or employee.)
• For the underwriting of insurance as a result of an application from a consumer. [Section 604(a)(3)(C)]
• When there is a legitimate business need in connection with a business transaction that is initiated by the consumer. [Section 604(a)(3)(F)(i)]
• To review a consumer's account to determine whether the consumer continues to meet the terms of the account. [Section 604(a)(3)(F)(ii)]
• To determine a consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status. [Section 604(a)(3)(D)]
• For use by a potential investor or servicer--or current insurer--in a valuation of, or an assessment of, the credit or repayment risks associated with an existing credit obligation. [Section 604(a)(3)(E)]
• For use by state and local officials in connection with the determination of child support payments or modifications and enforcement thereof. [Sections 604(a)(4) and 604(a)(5)]
In addition, creditors and insurers may obtain certain consumer report information for the purpose of making unsolicited offers of credit or insurance.
The following states have implemented their own laws concerning permissible purposes, many of which conform to federal law: Arizona, California, Colorado, Georgia, Kansas, Maine, Maryland, Massachusetts, Minnesota, Montana, Nevada, New Hampshire, New Jersey, New York, Texas, Virginia and Washington. Several other states have additional laws that relate to the FCRA.
In summary, the basic principle governing access to consumer reports is that actions authorized or initiated by the consumer are generally permitted, while unauthorized uses or disclosures are prohibited. Specific exceptions to the general rule have been made to accommodate public interests (alimony, licensing, court orders, etc.).
It is recommended those obtaining background information be thoroughly familiar with FCRA provisions and the permissible purposes for obtaining consumer reports, as well as how these regulations apply to their own specific circumstances. To fail in providing such policies is to incur needless legal risks. *
Barry Nadell is president of InfoLink Screening Services Inc. in Chatsworth, Calif., a nationwide provider of background screening and drug testing programs. The company provides the latest online technology to request, review and archive reports via its secure website at www.InfoLinkScreening.com or (800) 990-HIRE (4473).
