What if I want to run a background check for non-employment purposes?

The Fair Credit Reporting Act (FCRA) lists specific categories of permissible purposes that allow consumer reporting agencies like Checkr to provide background check reports to customers. While many Checkr customers are requesting reports under an employment permissible purpose, there are additional non-employment purposes available under the FCRA:

• Insurance Underwriting: To evaluate and analyze risks involved in insuring consumers.
• License Eligibility or Government Benefits: To consider an applicant’s financial responsibility or status, as required by law, to determine a consumer’s eligibility for a license or other benefit granted by a governmental agency or entity (for example, certain state benefits).
• Extension of Credit: To extend credit as a result of an application from a consumer, or for the review or collection of a consumer’s account.
• Legitimate Business Need: In connection with a transaction initiated by the consumer OR to review whether the individual continues to meet the terms of an account the consumer holds with that business.

How are the documentation requirements different for non-employment purposes?

Generally speaking, the end-user (customer) requirements for non-employment purposes are less burdensome than for employment. For example, non-employment purpose reports do not require the same detailed adverse action notice process; a verbal notice to the candidate that they will not be moving forward is sufficient.

There remain requirements around the consumer’s informed consent and disclosures to the consumer. Ordering a report for non-employment purposes still requires a customer to obtain informed consent from the consumer(s) on whom they’re requesting a background check report. While a writing is not required under the FCRA, we often see customers collecting and recording the consumer’s consent to a background check report in the terms of service or other written form, as a best practice for audit purposes.  

In addition to informed consent, a non-employment permissible purpose may still require additional steps. Depending on the consumer’s location and the specific screening requested (such as Motor Vehicle screening), customers may still be required to provide some additional disclosures to comply with state, local, and/or agency laws. We recommend speaking with your attorneys to make sure you have the appropriate consent and disclosure(s) for the permissible purpose applicable to your business, the screening requested, and the location of the consumer.

No, Checkr will already have the candidate’s current location as part of the candidate flow, either because the candidate completed Checkr’s hosted flow or because you imported the ZIP code using the API. With that information, we can apply the proper compliance filters based on their home address.

When access to a full date of birth on criminal records is limited by courts, additional research is required and delays are expected. Checkr is diligently working to reduce the impact of PII redactions on customers through investments in our product, legislative solutions, and the expansion of our research team. Please find state-specific updates below:

Michigan

The state of Michigan originally planned to redact all dates of birth on July 1, 2021. This was postponed with an expected implementation date of April 1, 2022. Industry organizations like the PBSA and other allies are negotiating solutions with Michigan to make DOBs available for background checks. 

California

Many counties in California have limited public availability of DOBs on criminal records. Despite this, Checkr is still able to process the large majority of searches in just a few hours. For searches where there are potential matches to records, turnaround times have been impacted industry-wide. 

Checkr is committed to minimizing the impact of PII redactions on our customers through product enhancements, increased bandwidths, and legislative solutions.

This document outlines the processes Checkr uses to process records after they have been returned from court sources. Checkr performs post-processing according to the Fair Credit Reporting Act (FCRA) and comparable state laws in order to ensure reporting accuracy and compliance.

Checkr provides several types of post-processing, including:

• Identity-based post-processing
• Compliance-based post-processing
• Record deduplication

Identity-based post-processing

Identity-based post-processing ensures that only records bearing on the candidate are included in the background check report. For comprehensiveness purposes, Checkr furnishers initially employ overinclusive search methodologies with higher levels of tolerance for potential matches (such as name spelling variations, or partial identifier matches). After initially casting a wide net on the search, Checkr’s identity-based post-processing serves as a crucial step for background check accuracy. Checkr furnishers are instructed to return all available identifiers associated with a record. Based on the identifiers returned, Checkr determines whether the identifiers sufficiently match the candidate’s personally identifiable information (PII). Records determined to be not associated with the candidate are excluded from the final report.

The most common identifiers evaluated during identity-based post-processing are:

• Name (including aliases)
• Date of Birth
• Social Security Number
• Address
• Driver License

Based on the presence and calculated similarity of the above identifiers, as well as the demographic statistics of the relevant geographic location, Checkr computes probabilistic scoring that informs the inclusion criteria of a given record.

Additionally, records without PII sufficient to establish matching confidence scores are sent to Quality Assurance for additional review and research.

Compliance-based post-processing

To ensure background check reports are compiled in compliance with Consumer Reporting Agency (CRA) requirements, Checkr follows all federal and state-specific rules on reportability. These rules take into consideration factors such as the age of the record, the charge type (criminal vs. non-criminal), disposition (convictions vs. non-convictions), and other exemptions (listed below). Based on the following information, Checkr makes a determination regarding a record’s reportability in a specific jurisdiction.

Age of record

As a CRA, Checkr complies with FCRA and comparable state-specific laws. These laws determine whether a given record can be reported based on the record’s age, as well as how the record’s age is calculated. For example, the age of a conviction is calculated based on the most recent case activity date available, whereas the age of non-conviction records is calculated using the filing date.

Charge type

Record reportability is also dependent on the nature of the offense. Specifically, non-criminal information (such as petty offenses and civil infractions) are only reportable for 7 years. As a result, non-criminal records older than 7 years are excluded from the background check report.

Disposition

Dispositions may be generally classified as convictions and non-convictions. The FCRA and state laws govern the reportability of these two disposition types.

Convictions: Under the FCRA, convictions can appear on a background report regardless of when they occurred. However, some states have limited the scope of conviction reporting to seven years, including California, Kansas, Maryland, Massachusetts, Montana, New Mexico, New York, New Hampshire, and Washington.

Non-conviction: A "non-conviction" includes arrests, dismissed cases, not-guilty verdicts, alternative adjudications (programs that result in dismissed charges if the defendant completes certain conditions), and “nolle prosequi” (formal abandonment of prosecution).

Under the FCRA, non-convictions are reportable for seven years from the filing date. For most states, non-convictions are therefore reported for 7 years. However, four states (California, Kentucky, New York, and New Mexico) prohibit the reporting of non-convictions. In these states, and absent some exemption, there will be no reporting of non-convictions.

Jurisdiction-specific rules

To determine which jurisdiction’s reporting rules to apply to the report, Checkr evaluates the following pieces of information:

• Report’s location
• Candidate’s work location (The state for the candidate's most recent location.)
• Candidate’s postal code
• Account’s default compliance state

Other exemptions

Federal and state-specific exemptions to the aforementioned reporting rules include salary exemption as well as Transportation Network Company (TNC) exemption where applicable. Such exemptions will extend the reporting period beyond the standard scope.

Record deduplication

To comply with the FCRA and to avoid misleading or duplicate reporting, Checkr performs record deduplication. Duplicate records that are excluded from the background check reports generally fall into two categories:

• Transferred cases: When a case is shown to be transferred to another court jurisdiction, Checkr reports only the information from the court to which the case was transferred. This ensures that the reported information is the most up-to-date case information for the specific record.
• Duplicate cases: When a case is determined to be a duplicate of another case, Checkr displays only one instance of the case on the report.

This article will help you understand:

• The Fair Credit Reporting Act (FCRA) 
• Your Responsibilities as an End-User 
• Checkr's Responsibilities as a CRA

The Fair Credit Reporting Act (FCRA)

The FCRA is a federal law that governs how companies order, use, and consider consumer reports, which include what’s commonly referred to as background checks or credit checks.   

For the purposes of employment, the FCRA generally applies to consumer reports for both employees and independent contractors.

Enforcement of the FCRA is overseen by the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB). The law was enacted to promote the accuracy, fairness, and privacy of consumer information contained in the files of consumer reporting agencies like Checkr. To that end, it provides safeguards and rights for the consumer (the candidate or employee that is the subject of the background report.

The Consumer Reporting Agency (CRA, such as Checkr) providing the consumer report and the company that ordered the report (the End-User) must adhere to certain safeguards that ensure consumers’ rights are protected.

Your Responsibilities as an End-User

As an end-user under the FCRA, your responsibilities and duties may vary depending on the purpose for which you obtain a consumer report, including but not limited to insurance underwriting, tenant screening, or employment-- i.e., the listed “permissible purposes” for obtaining a consumer report allowed by the FCRA. End-users have specific duties and obligations under the FCRA when they obtain a background check report for employment purposes (such as hiring or promoting job applicants, employees, or independent contractors). These duties include:

1. Obtain a consumer report(s) for an FCRA permissible purpose(s) (Permissible Purpose);
2. Provide notice to the consumer in writing that you intend to obtain a consumer report for employment purposes (Written Disclosure);
3.  Obtain the consumer's written consent to run a report (Authorization); 
4. Provide the consumer with a “pre-adverse action notice,” a summary of their rights under the FCRA, and a copy of their report if you intend to make an adverse decision (such as declining them for employment or promotions) based on the information in the report (Pre-Adverse Action);
5. Waiting Period: Give the consumer a reasonable waiting period to provide additional context or to dispute any inaccurate information contained in the  consumer report before making a final adverse decision (Waiting Period);
6. Notify the consumer in writing when an adverse action is taken (Final Adverse Action Notice);
7. Identify the CRA that provided the report so that the consumer can dispute inaccurate information in their report with the CRA.

As your partner in background check screening, Checkr helps facilitate your compliance with the FCRA by:

• Disclosure and Authorizations. If you are utilizing Checkr’s hosted-flow process, Checkr will provide the candidate with the summary of rights and your relevant federal, state, and/or local disclosure notice(s), and collect authorization from the candidate directly. Checkr streamlines your compliance processes by presenting these forms to the candidate as part of the consumer’s background check process. See our disclosure and authorization article for more information.
• Adverse Actions. You can use Checkr’s dashboard to make the adverse action process more efficient for your team. Specifically, you can ask Checkr to send a pre-adverse action notice (as required by the FCRA for employment screening) on your behalf to the candidate. Checkr will keep track of the waiting period for you. If the adverse action process is not canceled (for example, if you decide to cancel adverse action and move forward with the candidate after they submit additional context or evidence of rehabilitation), Checkr will automatically send the required post-adverse notice following the statutory waiting period. See our adverse action article for more information.

As a reminder, while Checkr helps facilitate your compliance processes, it’s important to consult your legal counsel to ensure that your compliance needs under federal, state and/or local law are met.

Checkr's Responsibilities as a CRA

As a consumer reporting agency (CRA), Checkr’s responsibilities are different from an end-user’s under the FCRA, including:

• Credentialing end-users to run background checks;
• Maintaining strict procedures to ensure the maximum possible accuracy of the information in reports or sending a contemporaneous notice to consumers when we report potentially adverse information in reports requested for employment purposes;
• Providing consumers with all information in their files upon request (also known as a Full File Disclosure);
• Re-investigating information on the report after candidates dispute the information within 30 days; and
• Not reporting obsolete information, such as non-convictions older than seven years.

Note again that these are different from your responsibilities as an end-user. For example, while CRAs are restricted on what can or cannot be reported in a background check (such as inaccurate or obsolete information), end-users are responsible for how the information is reviewed and what actions they can take.

Following the above procedures ensures that candidates are aware of their rights under the FCRA and are given the opportunity to address concerns about their background check.

Many employers open themselves to risk by not properly disclosing that they will run a background check, or by failing to gain the candidate's authorization. This is true both for full-time employees and independent contractors. Avoid this risk by telling your candidates you intend to run a background check report on them and asking for permission.

Proper disclosure and authorization requires:

• A standalone disclosure (consisting only of the disclosure) informing the candidate that you will be running a background check. Non-standalone disclosures are an extremely common area of legal risk.
• State disclosures (if applicable). Some states, like California, require specific disclosures and formatting.
• An Authorization Form seeking consent from the candidate to run the background check.

If you use the Checkr-hosted application flow (set up by default), Checkr will help automate disclosure and authorization for you by providing sample disclosure notices and authorization language.

Here’s what the candidate will do in the Checkr-hosted flow:

1. Enter their personally identifiable information (PII) so that Checkr can run the background check.
   
   
   
   
2. Read and acknowledge A Summary of Your Rights Under the Fair Credit Reporting Act, which we include to help consumers understand their rights.
   
   
   
   
3. Read and acknowledge the Disclosure Regarding Background Investigation. This is what’s known as the sole disclosure and it must not have anything else added to it, including liability waivers, application effectiveness periods, disclaimers of accuracy, or any other extraneous information. The FCRA specifically requires that the disclosure be “clear and conspicuous” and consist “solely of the disclosure.”
   
   Your disclosure should look similar to the image below, otherwise you expose yourself to one of the most common areas of legal risk. If you add extraneous information to the disclosure, you may leave yourself vulnerable to a class action with a large class size, because every single candidate going through a background check will be exposed to your disclosure before proceeding.
   
   
   
   If the candidate or job location is in a state with its own disclosure requirements, based on the screening components and candidate’s ZIP code, Checkr will automatically provide the state-specific disclosure as a separate step.
   
   
   
   
4. Read and acknowledge the authorization for a background check. Included in this authorization is any state-specific language required by law. The candidate can choose to be emailed a copy of the report, then e-signs with their full name (which much match the name they entered earlier in the process).
   
   
   
   
5. Click Submit, and now the background check process begins. 

To recap, one of the more frequent areas of litigation around background checks involves the requirement to have a document that consists “solely” of the disclosure. You may be tempted to add to or modify your disclosures, but by doing so, you may be vulnerable to legal action from plaintiffs’ attorneys who file thousands of FCRA lawsuits each year.

Candidates must consent to being screened before a background check is requested. These consent forms will be handled differently depending on whether you use Checkr's Dashboard or API to request background reports.

Consent through the Checkr Dashboard

If you are using Checkr directly through the Dashboard and requesting reports via invitation links sent by Checkr, we will store completed consent forms on your behalf.

Once a candidate e-signs the “Acknowledgement and Authorization for Background Check” form, a PDF version of this document is generated and stored on Checkr’s servers.

Consent through the API

If you request consumer reports through the Checkr API, you are required to store and maintain the candidate's consent form. Collecting proof of authorization is a requirement of the end-user of background reports(the company hiring or engaging candidates).

If you are audited, you must must be able to furnish copies of the authorization for background check.

Copies must be stored for at least five (5) years. This means that your custom API flow must include a mechanism for storing the candidate's consent. We recommend the following:

• Make sure the user is identified by username and password
• Have the candidate type their name in signature box
• Upon submission of authorization, generate a PDF of the authorization form and store this PDF on your internal system
• On the PDF, store date/timestamp and store candidate IP Address

Hundreds of cities, counties, and even states have implemented Ban the Box rules that prohibit questions about criminal conviction history on job applications. Initially, the “box” referred to the box on a job application where candidates would indicate whether they had criminal histories, but these regulations have often expanded to govern when employers are allowed to ask about criminal histories.

Each Ban the Box law contains unique requirements, so be sure to check the laws in locations where you hire contractors or employees. For example, some laws govern whether you can ask about criminal history on a job application, and others go further to restrict you from asking about criminal history until a conditional offer is made.

Which states and municipalities ban the box?

As of April 2018, 31 states have implemented Ban the Box regulations.

The following have implemented laws for private employers:

• California
• Colorado
• Hawaii
• Illinois
• Massachusetts
• Minnesota
• New Jersey
• Oregon
• Rhode Island
• Vermont
• Washington

The following have implemented laws for public employers only:

• Arizona
• Connecticut
• Delaware
• Georgia  
• Indiana  
• Kentucky
• Louisiana
• Maryland
• Missouri
• Nebraska  
• Nevada
• New Mexico  
• New York
• Ohio
• Oklahoma
• Pennsylvania
• Tennessee
• Utah
• Virginia
• Wisconsin

In addition to states, over 100 cities and counties now require Ban the Box practices for private employers. They include:

• Austin, TX
• Baltimore, MD
• Buffalo, NY
• Chicago, IL
• Columbia, MO
• Washington, D.C.
• Kansas City, MO
• Los Angeles, CA
• Montgomery County, MD
• New York City, NY
• Philadelphia, PA
• Portland, OR
• Prince George’s County, MD
• Rochester, NY
• San Francisco, CA
• Seattle, WA
• Spokane, WA

Ban the Box legislation is just one example in a growing trend of state and municipal fair-hiring laws. While Ban the Box typically governs when an employer can inquire about criminal history, some cities have instituted “Fair Chance Ordinances” that govern how criminal history is considered and require a show-your-work rule when denying applicants due to criminal records. Based on the Equal Employment Opportunity Commission’s guidance, you should evaluate offenses on background reports individually, rather than blanket exclusions. For more information, see our article on individualized assessment.

Incorporating Ban the Box laws into your hiring process

Whether these laws apply to you depends on multiple factors, including:

• Your company size
• Where you’re located or where you hire employees
• Whether you’re a government agency or private employer
• What industry you’re in (health care, child care, law enforcement, education, banking, accounting, insurance, transportation & security, and others often fall under different regulations)

Consult with your counsel to determine which Ban the Box laws apply to you, and based on that guidance you may want to review the language on your job descriptions and applications, and/or ensure that your hiring or engagement managers are not asking about criminal history as part of the interview process.

For example, some employers choose to replace language such as “Candidates with felonies in the past 7 years need not apply” with language such as “This position is subject to a background check for any convictions directly related to its duties and responsibilities. Only job-related convictions will be considered and will not automatically disqualify the candidate,” providing a more accurate statement of how individualized assessment works.

This document describes Checkr’s process in collecting and determining aliases for candidates when conducting background check screenings, and includes the following information:

• Checkr's sources for aliases
• Checkr's alias types:
  • Request alias
  • Validation alias
• How Checkr uses aliases
• How Checkr evaluates 'partial' names

Alias sources

Aliases are different names or permutations of the same name associated with a candidate. When applicable, Checkr uses aliases to identify records under names that differ from the candidate’s provided name, thus increasing the comprehensiveness of the background check report.

Aliases are identified through names returned from various sources, including candidate creation, SSN Trace records, Motor Vehicle Records check, and document transcriptions. These returned names are stored as “name occurrences”, and evaluated to generate aliases.

• Candidate submission: The information submitted by the candidate to Checkr acts as a starting point for the candidate’s profile.
• SSN Trace: Checkr identifies additional names from SSN Trace data. These names are aggregated into the candidate’s record and stored.
• Motor Vehicle Records: MVR checks often return name variants. These names are aggregated into the candidate’s record and stored.
• Document transcription: Customer and Checkr support team document transcriptions may introduce additional names for the candidate.
• Name normalization: Checkr software identifies potential nicknames for a candidate. For example, if a candidate submits Bob as a first name, our software automatically recognizes that Bob is a nickname for Robert and stores Robert as a first name for that candidate.

Checkr uses name occurrences from all previous reports associated with an individual candidate when computing aliases

Alias types

Checkr leverages a variety of algorithms to evaluate returned name occurrences, and aggregates this raw data to generate aliases for a candidate. Two types of aliases are generated in this process:

• Request alias: Request aliases are used to initiate screenings for the candidate. Package configuration will determine whether and how many distinct aliases are used in requests.
• Validation alias: Validation aliases are used to confirm that the records returned by our vendors match the candidate. In order to ensure accuracy, alias matches are only one of several identifiers used to match.

Request alias name selection

The selection process of request aliases ensures that distinct name components are represented and therefore searched. When generating request aliases, Checkr evaluates all available first, middle, and last names for each candidate returned in the sources listed above.

First name evaluation

When two different first names are collected, Checkr will select both as request aliases. For example, given Patricia Stewart and Martha Stewart, Checkr will select both Patricia and Martha as distinct request aliases.

Last name evaluation

When two different last names are collected, Checkr selects both as request aliases. For example, given Martha Jones and Martha Stewart, Checkr will select both Jones and Stewart as distinct request aliases.

Middle name evaluation

When evaluating multiple middle names, Checkr selects the most representative name variation as the request alias, allowing our providers to return all data that is likely to be related to the candidate.

• Given Patrick and P, Checkr selects Patrick
• Given Patrick, Pete and Paul, Checkr selects P
• Given Patrick and Neal, Checkr selects neither

Validation alias name selection

While request aliases are selected to broaden search coverage and increase comprehensiveness, validation aliases are generated to ensure all components from various name occurrences are represented when validating records.

The following example is constructed to illustrate these differences.

For example: Checkr receives the following name occurrences for a candidate from various sources:

• JOHN J SMITH
• JOHN SMITH
• JOHN S SMITH
• JOHN SAM SMITH
• JOHN JONES SMITH

Because “JOHN SMITH” is the name that can represent all other name occurrences, Checkr will select the name “JOHN SMITH“ as a request alias.

And, to ensure all name components are represented in record validation, Checkr will use both “JOHN SAM SMITH” and “JOHN JONES SMITH” as validation aliases to ensure maximum possible accuracy.

Alias use

Checkr enables the use of aliases for the following screenings:

• National Criminal Database Check
• Sex Offender Registry Check
• Global Watchlist Records Check
• Federal Criminal Records Check
• Federal Civil Records Check
• County Criminal Records Check
• County Civil Records Check
• State Criminal Records Check
• Municipal Criminal Records Check

Partial name handling

In some cases, candidates may not have both first and last names. In these cases FNU is used in place of first name to designate First Name Unknown, and LNU is used in place of last name to designate Last Name Unknown. Because the same designations are also used in public records, Checkr accepts FNU and LNU as valid name input, as they will function as regular name values in searches, and provide a basis for matching records to be returned.

While it’s common for candidates to have no “first” name (or FNU) on the record, it is very rare for candidates to have no “last” name (or LNU). Candidates with a single name often submit it as their last, rather than their first for United States documents.

Checkr does not accept single letter last names as valid input, and customer API calls that POST single letter last names will be responded to with an error.

Checkr does accept single character first names as valid input.

Question

The National Criminal Database Search casts a wide net to search for potential records. Although this search is extensive, the records returned are often incomplete, lacking identifying information and/or the final disposition of the case (for example, whether the case was dismissed). 

When a potential record is identified in the National Criminal Database Search, what happens next? 

Answer

The report is automatically upgraded using County Level Verification to ensure that public record information is complete and up to date. This means that Checkr then runs a search in the county indicated by the National Criminal Database, with the goal of obtaining:

• Additional identifiers to determine whether or not the record belongs to the individual in question; and 
• Up-to-date case information (such as disposition or status)

In addition, Checkr also sends a “Contemporaneous Notice” or “613 Notice” to the candidate. The County Level Verification and the notice help Checkr comply with Section 613 of the Fair Credit Reporting Act.

When a County Criminal Check was not ordered as part of the background check package but there is a hit on a National Criminal Database Check, please expect a County-Level Verification fee and possible county-level passthrough fees to appear on your invoice. 

Also see What are the additional fees on our invoice?

As more states pass fair hiring laws encouraging you to assess the individual circumstances of each candidate’s background check, Checkr helps you keep your hiring process fair and compliant through individualized assessment tools.

What is individualized assessment, and why is it important?

Individualized Assessment refers to how you review criminal records on a pre-employment background check. Rather than focus simply on the name of an identified criminal offense, individualized assessment means that you take into account the specific circumstances of the candidate and the crime(s) to make a fairer and more job related determination. All of this happens before you initiate Adverse Action against a candidate.

Unlike the Adverse Action process, which is required under the Fair Credit Reporting Act (FCRA), your Individualized Assessment responsibilities stem from federal, state, and municipal fair hiring laws. 

In 2012, the Equal Employment Opportunity Commission (EEOC), under title VII of the Civil Rights Act of 1964, issued guidelines advising employers to consider the specifics of each candidate who may be denied employment based on a background check.

Here’s how the EEOC defines Individualized Assessment:

Individualized assessment generally means that an employer informs the individual that he may be excluded because of past criminal conduct; provides an opportunity to the individual to demonstrate that the exclusion does not properly apply to him; and considers whether the individual's additional information shows that the policy as applied is not job related and consistent with business necessity.

The EEOC specifically mentions three criteria to consider when reviewing criminal records, known as the "nature/time/nature" test:

• The nature and gravity of the offense
• The time that has passed since the offense, conduct, and/or completion of sentence
• The nature of the job held or sought

In other words: “How severe was the offense? How much time has passed since the offense? How relevant is the offense to the job?”

The EEOC encourages you to consider other factors, such as:

• The facts or circumstances surrounding the offense or conduct.
• The number of offenses for which the individual was convicted.
• The candidate's age at the time of conviction, or release from prison.
• Evidence that the individual performed the same type of work, post-conviction, with the same or a different employer, with no known incidents of criminal conduct.
• The length and consistency of employment history before and after the offense or conduct.
• Rehabilitation efforts, such as education or training.
• Employment or character references and any other information regarding fitness for the particular position.
• Whether the individual is bonded under a federal, state, or local bonding program.

Also note the disposition of the records as you review them, because even dismissed records can still be reported in most states.

No individualized assessment is needed when there is a “demonstrably tight nexus” between the job duties and responsibilities and the offense or conduct. This occurs in specific and limited situations, for example:

• A recently convicted sexual predator applying to work supervising children at a day care.
• A candidate with recent convictions for identity theft applying to work in a position handling sensitive personal financial information like Social Security and credit card numbers.

Create an individualized assessment process

The best practice is to create and document a fair individualized assessment process that goes hand-in-hand with your adverse action process. You should then distribute and train your adjudicators and hiring managers on these processes. In general, these processes may govern:

• Which offenses wouldn’t adversely affect an employment decision because they are minor, irrelevant, etc. (our Positive Adjudication Matrix helps you filter these automatically).
• Which factors to examine on a criminal record during an individualized assessment.
• When, if at all, to ask about criminal history (to comply with “Ban the Box” laws).
• How to reach out to candidates to gain additional information or context on a criminal record.
• How to account for severity, age, relevance, and disposition during adjudication.
• How to document individualized assessments for candidates with whom you will initiate an Adverse Action process.

For example, you may create a worksheet similar to the following:

"Show your work” laws and ordinances

Taking the EEOC guidance a step further, some municipalities (for example, the cities of New York and Los Angeles) specifically require that employers not only conduct individualized assessments, but also “show their work” to candidates. These jurisdictions require that you send a written analysis to the candidate explaining why the criminal record disqualifies them from employment in a given position.

For example, in July of 2017, the City of Los Angeles began enforcement of the Fair Chance Initiative for Hiring Ordinance. In keeping with a general trend towards increased transparency in the hiring process, the Ordinance requires employers to provide their written individualized assessment with the pre-adverse action notice (i.e. “show your work”). New York City implemented a similar requirement in August 2017.

Individualized assessment in the Checkr platform

To assist you in conducting compliant individualized assessments, Checkr provides two useful features.

First, Checkr’s Positive Adjudication Matrix allows you to automatically filter out minor or irrelevant offenses that wouldn’t disqualify a candidate, so that those reports will clear without you needing to conduct individualized assessment. Not only will this result in fairer and more consistent hiring practices, but it will also free up your employees’ time from having to review these reports.

Checkr also allows you to add your written individualized assessment directly into the adverse action notice.

Specifically, if you’re hiring candidates in locations with “show your work” laws or ordinances, such as the cities of Los Angeles and New York, or the state of Illinois, Checkr will prompt you to use our Individualized Assessment tool during the adverse action process.

We use the following logic to determine whether to activate the Individualized Assessment Tool:

• If your candidate's Work or Home ZIP code is in New York City or Los Angeles, we will activate the assessment form for that candidate.
• If your candidate is in California, Illinois, or New York Geo, we will activate the assessment form for that candidate.
• By request, we can activate the assessment form for all candidates. Please contact Checkr Customer Support.

Provide your rationale in the Initial Assessment field.

For candidates in the cities of New York or Los Angeles, use the Upload document section to download the New York or Los Angeles Individualized Assessment forms, fill in the details, and then upload directly into the form. Whatever you enter or upload will also be sent to the candidate with the Pre-Adverse Action notice.

When you preview the Pre-Adverse Notice, you’ll see the individualized assessment show up as well. In the screenshot below, the text inside the red box (“Company’s Initial Assessment”) comes directly from the text you entered on the previous screen within the “Initial Assessment” field.

The candidate has 7 days by default to provide an explanation or to dispute the accuracy of the report by visiting the Candidate Portal. Based on the information that the candidate provides, conduct a reassessment or consider the additional information in the Reassessment field.

If, based on this reassessment, you decide that you would like to hire the candidate, you can cancel the Pre-Adverse Action notice at this point.

If your company engages contractors (using a 1099 tax form) instead of full-time employees (using a W-2 form), you may wonder whether you have the same obligations under the Fair Credit Reporting Act, Equal Employment Opportunity Commission guidelines, and state "Ban the Box" laws as you would for full-time W-2 employees.

Fair Credit Reporting Act (FCRA): According to commonly accepted interpretations of the Fair Credit Reporting Act (FCRA), purchasing and reviewing background checks as part of the screening process for independent contractors or volunteers falls under "Employment Purposes," making reports for contractors/volunteers subject to the same FCRA guidelines as for employees.

EEOC guidelines and state/local laws: Each state and local law (such as "Ban the Box" laws that are becoming more common) takes a slightly different position on how it applies to independent contractors. That said, the spirit of the EEOC guidelines and the guidance they provide on non-discrimination is intended to cover all types of employment relationships.

Co-employment Risk: Co-employment risk arises when individuals hired as contractors (often through staffing agencies) are effectively treated like full-time employees, and must then be subject to the same employer obligations as full-time employees. Just because you engage 1099 contractors instead of full-time employees, it is not a guarantee that you are exempt from co-employment risk. The IRS lists 20 factors that are used to determine whether an independent contractor relationship is valid. Having even some of those factors, not all, may lead to the determination that your 1099 contractors are actually in an employment relationship with you.

Evergreen consent is a candidate's permission for you to run background checks for the duration of their employment.

When you run a background check, you’re required by law to gain the candidate’s consent. This means you need to disclose the nature of the check, and gain the candidate’s authorization to proceed. 

Checkr obtains evergreen consent from all candidates applying through our Checkr-Hosted Apply Flow. If you order background checks manually, or by some other means that does not take advantage of our Apply Flow, you will be required to obtain evergreen consent from your candidates directly.

For example, if you create a manual invitation for a candidate, and then wish to re-run their background check using Checkr’s subscriptions feature, you are required to obtain their “evergreen consent”.

Please consult with your legal counsel on whether and how to use evergreen consent. Consider the following points:

Do you place evergreen consent language in the disclosure form or the authorization form?

• Many companies place the evergreen consent notice in the authorization form, so as not to violate the “sole disclosure” requirement in the Fair Credit Reporting Act (FCRA).
• Upon request, Checkr can provide you with template authorization forms that include evergreen consent language, but you are ultimately responsible for the language you use.

How are you complying with state laws?

• Some state laws, notably California’s Investigative Consumer Reporting Agencies Act (ICRAA), are ambiguous on the topic of evergreen consent. Although the Federal Trade Commission has interpreted the FCRA to allow for consent throughout the course of employment, ICRAA’s language is more ambiguous.
• You may consider asking for disclosure each time you re-run a check for candidates living or working in California.

Question

I worked with my legal team to ensure we have “evergreen consent”. If a candidate withdraws consent, does this apply to us?

Answer

Regardless of whether or not Evergreen Consent is used, if a candidate withdraws consent, it is considered withdrawn by Checkr and the client must collect new consent from the candidate if they wish to run a new report on them.

See Disclosure and consent: Gaining permission to run background checks for more information

Checkr's Information Security Management System (ISMS) is ISO/IEC 27001:2013 certified by ANAB-accredited A-LIGN, SOC 2 type II compliant, and uses modern encryption methods to both transfer and store all user information. 

Encryption: Data is always transferred using Secure Sockets Layer (SSL) and AES-256 encryption. Sensitive information like Social Security Numbers are truncated and stored encrypted in our protected databases.  

Security: Checkr has established an ISMS (Information Security Management System) based on the ISO 27001:2013 Information Security Standard because it is one of the most recognized frameworks worldwide.

Risk Management: Checkr has established a risk management program to demonstrate our commitment to information security. We leverage ISO 27005 Risk Management framework to prioritize risks identified.

Download our latest ISO 27001 certificate from Checkr's Trust & Security page.

Question

What if the candidate changes their mind and wants to have a report run on them after withdrawing consent? Should I send a new invitation?

Answer

Yes, a new invitation should be sent to the candidate to collect consent. 

See Disclosure and consent: Gaining permission to run background checks for more information

Checkr retains reports in accordance with applicable laws and agreements between Checkr and its customers and affiliates. For example, for FCRA purposes Checkr generally retains reports for at least 5 years. If a candidate asks you to, you can use both the Checkr Dashboard and the Checkr API to request that Checkr delete their data.

Delete candidate data using the Checkr Dashboard

To delete candidate data using the Checkr Dashboard, use the steps below:

1. Open the candidate's report.
2. In the candidate information, select Delete candidate data.
3. Confirm that you received and verified the candidate’s request to delete their data.
4. To confirm the request, select Delete candidate data.

After deletion, the candidate loses access to the Candidate Portal, and Checkr deletes the candidate’s data, such as the candidate’s report, from your account.

Checkr can't recover deleted data for your account.

Compliance considerations

Don’t delete a candidate’s data unless the candidate asks you to. Candidates can also contact Checkr directly to request removal of their personal data.

Checkr designed this feature in accordance with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Checkr offers this feature to maintain Fair Credit Reporting Act (FCRA) obligations and align with the CCPA and CPRA. It helps provide transparency and gives candidates more control over their data.

For more information about the CCPA and your candidates' reports, refer to What CCPA Compliance Means in the Context of Background Checks.

This information doesn't constitute and isn't intended as legal advice. Consult your legal counsel about your compliance obligations and best practices.

This article will help you:

• Familiarize yourself with various state-by-state reporting requirements that affect background checks
• Determine why you may not see all possible criminal records reported
• Determine why you may or may not see dismissed records reported

In addition to federal laws that pertain to background checks, companies that use background checks should be aware that some individual states may also have their own laws that affect a background check and what can be reported by consumer reporting agencies (“CRAs”) like Checkr.

Similar to how the FCRA restricts CRAs from reporting non-convictions over seven years old, some states have passed their own legislation that further restricts CRAs from reporting both conviction and non-conviction information. For this reason, you may not see information reported in an employment background check, even if it is available on an unvetted source (like a mugshot database).

Checkr automates reporting in line with each state’s requirements using our Compliance Engine to help you avoid seeing information that is not reportable.

Which states restrict reporting on convictions?

Under the FCRA, convictions can appear on a background report regardless of when they occurred. However, some states have limited the scope of conviction reporting to seven years (unless an exemption applies), including California, Kansas, Maryland, Massachusetts, Montana, New Hampshire, New Mexico, New York, and Washington.

Which states restrict reporting on non-convictions?

Under the FCRA, non-convictions are reportable for seven years from the filing date and can appear on a background report for seven years.

However, some states prohibit non-convictions from being reported. These states are California, Kentucky, New Mexico, and New York.

A "non-conviction" could include dismissed cases, not-guilty verdicts, alternative adjudications (programs that result in dismissed charges if the defendant completes certain conditions), and nolle prosequi (formal abandonment of prosecution).

While the states listed above don't allow dismissed records to be reported, Checkr can report dismissed records in the states that permit it. It's important to consider the totality of the reported record, charge(s), disposition (guilty, dismissed, pending) and sentencing, and give an individualized assessment.

Note: By default, the setting to show dismissed records is turned off. This means that customers will not see dismissed records unless they request to. Contact Customer Support to request a change to this setting. 

Why don’t I see all possible criminal records?

You may notice that not all criminal records are reportable on a background check. In fact, a record may not be reportable due to state laws.

Some states limit the scope of reporting criminal conviction records to the last 7 years. That said, how the scope is defined can vary depending on data availability. For example, the 7 years can start from

• the date of the disposition of the record
• the date the candidate is released from incarceration
• the date the candidate is paroled

Public court records often do not include release information. When these later dates are unknown, the scope is measured by the earlier available date.

For more information on the scope of a check, see our article on lookback periods. 

Other Considerations

Below is a non-exhaustive list of other state-specific and industry-specific considerations to be aware of.

• California:
• Marijuana Misdemeanors: Non-Felony (Misdemeanor) convictions for marijuana possession can only be reported for 2 years from the disposition date. Furthermore, end users (employers) are also prohibited from seeking or considering this information when making employment decisions.
• Transportation Network Company(TNC): Regulatory exception under California Public Utilities Code 5445.2 allows CRAs like Checkr to report convictions beyond 7 years when preparing reports for TNCs. Under this regulatory reporting exception, TNCs can see convictions for CA candidates regardless of when they occurred.
• Maryland: Transportation Networks (TNCs) are required to search the "entire adult history" of candidates for TNC roles.
• Kentucky: Pending criminal cases are never reportable.
• Salary exceptions: Some states provide salary exceptions, allowing convictions to remain reportable for more than 7 years for candidates who expect to make more than a certain amount of money a year, such as $20,000 ($25,000 in New York).

What other location-specific laws should be considered?

This article deals with common state-based reporting requirements for CRAs like Checkr, which helps explain why certain records may not appear on the background check report.

Keep in mind, however, that states and municipalities also have specific laws regarding how end users and employers use and consider criminal records during an employment pre-screening process.  The laws include individualized assessment of offenses, “Ban the Box,” salary bans, permissible purposes for employment credit checks, disclosure and authorization, and waiting periods for adverse action notices.

Checkr uses in-product compliance features to assist with many of these, but you should consult with your legal counsel on the specifics of the localities where you hire candidates.

This article will help you:

• Compare name-based background checks with biometric/fingerprinting approaches
• Understand the limitations of each type of check

The term “background check” can refer to either name-based checks (which are used by the majority of background check companies) and biometric or fingerprint checks (which are used primarily by law enforcement).

Fingerprinting or biometricchecks such as "Live Scan" are required by law for certain industries, and it is also used in law enforcement, but the approach has drawbacks that many employers aren’t aware of.

Name-based checks

The majority of pre-employment background checks are conducted using a name-based approach.

When background check companies conduct a name-based checks, they use a candidate’s personally identifiable information (PII) to search for criminal history and other information. PII includes not just the candidate’s name, but also information like:

• Date of Birth (DOB)
• Social Security Number (SSN)
• Driver’s License Number

The candidate’s PII allows the background check company to look broadly for information using national and local sources. If the check turns up records that match the candidate’s PII, that information will be used as a “pointer” to specific county, state or federal jurisdictions. The background check company then conducts a search, at the source, in these jurisdictions.

As a result of this process, name-based searches can return information from national and local databases, as well as federal and county courts, in a matter of days.

Fingerprinting and biometric checks

Certain law enforcement groups, such as the Federal Bureau of Investigations (FBI), use fingerprinting or other biometric data as a way to find suspects’ criminal histories. FBI database screenings are only available to employers who have legal authority. In other words, access is authorized by statute, and not all parties can be granted access.

The FBI fingerprinting database, like many other criminal record databases, collects criminal record information from state and local law enforcement sources. Checks return an FBI Identification Record, which contains information tied to arrests, federal employment, naturalization, or military service -- in other words, times when an individual would have been fingerprinted.

However, because the information in the database is meant for law enforcement and not for employers, it is often missing information such as the final disposition of a record.

In other words, it may reveal an arrest record, but not show that the arrest later led to a dismissal. This type of information is missing in roughly 50% of cases, according to the U.S. Attorney General’s report (https://www.gao.gov/assets/670/668505.pdf page 19).

According to the National Association of Professional Background Screeners (NAPBS), fingerprint-based background checks are a useful tool when conducting background screening, but they don’t provide a comprehensive history and should not be solely relied upon for obtaining complete and up-to-date information.

Comparing name-based and fingerprinting approaches

While both name-based and fingerprint-based approaches both have pros and cons, it is widely accepted among background check experts that name-based checks are the preferred method for conducting background checks for employment-related or tenant screening purposes. The primary exception is for industries or locations that require fingerprint searches by law -- and even then, they should be used to supplement, not replace, name-based searches.

Consider the following when comparing fingerprinting to name-based checks.

Comprehensiveness

Although there is a commonly held belief that fingerprinting is the most comprehensive way to identify criminal records, the FBI database (like any individual source) does not always contain complete information. A fingerprint check only reflects information received by the FBI from states and municipalities. When you use the FBI database, you’ll find information collected when a suspect was arrested and fingerprinted, which doesn’t apply to 100% of the information in a background check.

In 2015, the Government Accountability Office (GAO) found significant gaps in the FBI database as many state and local jurisdictions fail to report arrest records or dispositions to the FBI.

Among the GAO’s recommendations:

• To improve disposition reporting that would help states update and complete criminal history records, the Director of the FBI should task the FBI Advisory Policy Board to establish a plan with timeframes and milestones for achieving its Disposition Task Force's stated goals.
• To better equip states to meet the regulatory requirement to notify individuals of their rights to challenge and update information in their criminal history records, and to ensure that audit findings are resolved, the Director of the FBI, in coordination with the Compact Council, should determine why states do not comply with the requirement to notify candidates and use this information to revise its state educational programs accordingly.   

According to a report from the U.S. Attorney General, “The FBI’s system is not a complete national database of all criminal history records in the United States” and that it was not intended to be used for pre-employment background checks. Furthermore, “Users may not want to rely exclusively on an FBI and state repository checks and may also want to check other record sources, such as commercial databases and local courthouses, to obtain more complete and up-to-date information.”

Accuracy

Consumer Reporting Agencies (CRAs) like Checkr are required by federal law to conduct checks with “maximum possible accuracy.” This means that we must ensure that the records returned are as complete and up-to-date as possible.

According to research by the Consumer Data Industry Association (CDIA), FBI database information can take as long as 24 days to report, and court disposition information can take over a month. This means that information in the FBI database may not be as up-to-date as information from a CRA.

Additionally, when you evaluate criminal records, the Equal Employment Opportunity Commission advises you to avoid disparate impact, where a seemingly neutral policy actually has an outsized effect on minority populations. Remember that many FBI arrest records don’t include final dispositions; in some jurisdictions with active police presence, relying on incomplete arrest data can potentially lead you to consider records that were dismissed, or that aren’t relevant to the job position. Making decisions based on incomplete information can unnecessarily disqualify candidates and create legal risk for your business.

Unlike pre-employment background checks, FBI records are not affected by consumer protection laws like the Fair Credit Reporting Act (FCRA). They often lack personally identifiable information (PII), such as full name and date of birth. If this PII is missing, it becomes difficult to ensure maximum possible accuracy of records, increasing the risk of litigation.

Turnaround time

For pre-employment background screenings, turnaround time is essential. As you support your candidates’ placement and onboarding schedules, you generally don’t want to wait any longer than possible for sources to return information.

Another overlooked difference between name-based and fingerprint background checks is access to fingerprinting facilities. Because name-based background checks do not require the physical submission of biometric data, they introduce much less friction into the onboarding process. Individuals living in small towns and rural areas may find it difficult and time consuming to access a fingerprinting facility.

The average name-based background check takes three to five days to complete, while FBI fingerprinting results typically take longer -- in some cases, even weeks.

In summary, while fingerprinting may be used as a component of background checks in certain regulated industries, they should neither be used as the only source of information, nor regarded as a comprehensive source of records. Name-based checks return more comprehensive data than fingerprints, are completed faster, and ensure maximum possible accuracy of records.

Why do we need to credential new customers?

One of our obligations under the FCRA is to verify that you have a permissible purpose to run background checks. We must also make sure that you represent a legitimate business entity.

We need to credential you to ensure compliance with the FCRA, applicable state and/or local laws, and other contractual or regulatory obligations. This helps to ensure that consumers’ privacy is protected.

How does credentialing work?

You’ll receive a form that collects a few key pieces of information about your business such as the business type and a trade or business name (your “DBA”).

Once this information is submitted, along with your signed Master Service Agreement (MSA), we review it to verify the legitimacy of your business entity and your permissible purpose.

If any further information is required or clarity needed, a member from our team will reach out to you via email.

How long does credentialing take?

Credentialing takes approximately one to two business days. To optimize your credentialing turnaround time, please make sure you provide the key pieces of information listed above to our team as soon as possible.

This article will help you:

• Decide whether to request a pre-employment credit report based on location
• See which locations have requirements around permissible reasons for pre-employment credit requests

In recent years, it has become less common to request credit checks as a standard pre-employment process. A candidage's credit history has little bearing on most job positions, especially those that don't directly involve financial transactions. Barring candidates for non-financial job positions based on credit history can result in an unnecessarily small candidate pool, as well as potential violations of disparate impact under Title VII of the Civil Rights Act of 1964.

Many states and municipalities have created requirements for when a credit check can be performed for pre-employment purposes.

To help you decide when to run credit checks, we've compiled a list of location-specific permissible reasons for requesting pre-employment credit reports. This is not an exhaustive list, but it does provide several examples of permissible reasons.

Scroll to the bottom of this article to see it as a downloadable PDF.

California

Colorado

Connecticut

District of Columbia

Hawaii

Illinois

Maryland

Nevada

New York, NY

Oregon

Philadelphia, PA

Rhode Island

Vermont

Washington

This article will help you:

• Differentiate between SSN Traces (a common step in background checks) and ID verification
• Decide which level of identity verification is necessary for your business

High-volume, online onboarding differs from traditional hiring

Companies who hire independent contractors at scale, like on-demand, marketplace, or online staffing businesses, must embrace high-volume hiring processes. These processes differ from traditional face-to-face hiring processes, where a candidate walks in for an interview, brings a resume, and often submits personal or professional references.

In a traditional hiring model, identity verification is built into the process--someone on the employer side sees the candidate and has the opportunity to catch false information during the interview and reference checks. Furthermore, with full-time employees, you can verify their identities when they submit their information for an I-9 (employment eligibility verification) form.

For businesses that hire independent contractors at scale, most of these steps don’t occur. While some businesses have in-person onboarding centers, many don’t, meaning that they will never actually see the candidate in person. Absent traditional verification procedures, these businesses rely on other mechanisms to ensure an individual's submitted information is valid.

What personal information is checked during a background check?

In most cases, the Consumer Reporting Agency (CRA) performing the background check also never sees the candidate in person. Employers generally pass on their candidates information to the CRA as a last step after most of the hiring process is completed. The CRA receives personally identifiable information (PII) like the candidate’s name, date of birth, and Social Security Number (SSN), to find previous addresses, aliases, DMV records, and possible criminal records.

Because the candidate has provided a SSN, the CRA can run a trace to identify known names and addresses associated with that SSN. The SSN Trace also identifies which state the SSN was issued in, and approximately which year. The CRA can also detect whether the candidate is using a SSN that is known to be false based on the structure of the number itself.  

Is a Social Security Number trace the same as ID Verification?

A SSN trace is not the same thing as ID verification. The SSN trace is designed to check whether submitted information (like the candidate’s name and age) matches commercially available  database information associated with the particular SSN. The SSN Trace is not designed to determine whether the person entering that information is who they claim to be.

To alleviate this issue, some companies use additional Identity Verification (IDV) or Knowledge-Based Authentication (KBA) services as part of their onboarding process.

IDV or “identity proofing” is used for purposes ranging from opening a bank account, to age verification, to onboarding for high-volume hiring companies. KBA provides an additional level of verification by asking candidates to answer certain questions that hopefully only they would know the answers to. These questions are often based on their credit history, such as what street they lived on or which bank they have a line of credit with. However, because these questions are often based on credit history, KBAs won’t work for every type of candidate, such as younger or first-time workers who lack a sufficient credit history.

That said, no matter what technology you use, you’re still relying on technology to prove that a person is who they say they are, and technology can be susceptible both to fraud and to imperfect information -- for example, in the case that a person changed their name, got married, or simply made a typo when entering information, you may still end up in a situation where the information entered does not precisely match other available records.

Although Checkr is not an ID Verification service, we flag areas where we find data discrepancies and reach out to the candidate for more accurate information.

While background screening is a common practice in most countries, navigating each jurisdiction’s unique regulations can be challenging for companies with a global presence. This resource is intended to provide companies with a general overview of common regulatory principles as well as illustrative examples of specific legislation governing data privacy and background check processing.

Data Privacy Legislation

Background checks inherently involve the collection and processing of sensitive personal information. And while there are many laws affecting the proper usage of the information collected (such as industry specific employment and anti-discrimination laws that vary by country), data privacy laws tend to impart the most stringent requirements on on all parties involved in the collection and processing of that personal information.

The primary example is the General Data Protection Regulation (GDPR), which is the overarching law governing companies processing personal data on individuals residing in the European Union (EU). Today, the GDPR offers the most comprehensive list of data rights granted to the individual, as well as broader data protection principles. Many companies choose to align their global data collection practices with GDPR as they scale their international hiring in the EU and beyond.

GDPR Party Classifications

The General Data Protection Regulation (GDPR) is the primary data privacy law in the European Union (EU). It came into effect on May 25th, 2018, replacing the EU’s Data Protection Directive. This legislation introduced new data privacy and security principles and regulations on companies handling personal data collected  on individuals residing or located in the EU.

GDPR covers three classifications of persons and organizations: (1) data subjects, (2) data controllers, and (3) data processors. The law primarily protects the rights and freedoms of data subjects while placing regulations on organizations controlling and processing their personal data. Below is a description of each party classification and how the relationship between Checkr and the company requesting the background check fits into them.

General Data Protection Principles

Article 5 of the GDPR outlines a set of principles related to processing of personal data (which includes background check information). These principles are outlined broadly below. As the responsible party, Data Controllers may incorporate these principles beyond their EU regional compliance to scale their global privacy program.

Lawfulness, Fairness and Transparency

Prior to requesting international background checks from your Data Processor, you as the Data Controller must (1) establish a lawful basis for processing, and (2) ensure that the data processing is being conducted in a fair and transparent manner. When considering the lawful basis for processing outlined in Article 6, companies often rely on the consent of the data subject (see Article 6(1)(a)). Some Member States do not accept consent as a legitimate basis (see Country Specific Analysis section for examples), leading many companies to instead rely on the balance of interests assessment, which indicates that you, as the data controller, have a legitimate interest for processing that is not overridden by the interests or rights of the data subject (see Article 6(1)(f)). It is your responsibility to specify which lawful basis (or bases) your company relies upon.

Under GDPR, lawfulness must also be met with fair and transparent processes, including respecting the rights allotted to data subjects and providing clear, plain, and intelligible information to them regarding the purpose and means of processing, such as through an updated Privacy Policy and notices to candidates prior to the background check request (see Article 5(1)(1)).

Prior to requesting background checks with Checkr, customers must ensure they have a legal basis on which to process personal data. The GDPR provides a list of approved conditions on which processing may be deemed as lawful. They are:

• Data subject has provided consent
• Processing is necessary for contract fulfillment
• Processing is necessary for a legal obligation
• Processing is necessary to protect the interests of the data subject
• Processing is for the public interest
• Processing is necessary to support the legitimate interests of the data controller and those interests do not outweigh those of the data subject

In addition to supporting and complying with the GDPR’s fairness and transparency principles for EU residents, Checkr follows those principles for all candidates, regardless of location. We provide insight into our data practices for both candidates and businesses in our Privacy Policy as well as background check notifications to candidates directly. Checkr also hosts aCandidate Portal, where individuals can access their background check results, make requests for data access, request rectification (also known as dispute), or provide additional context around their records. For more information, read Checkr’s Fairness commitment.

Purpose limitation

This principle relates to your specific purpose for requesting processing of the data. The GDPR states that personal data shall be, “collected for specified, explicit and legitimate purposes” and indicates that use of the data should be limited to that specific purpose (see Article 5(1)(b)). Determining this purpose is the control you are exercising as the Data Controller.

When requesting background checks with Checkr, our customers certify that they have a specific and lawful purpose for the request, and that use of the data will be limited to fulfilling that request. This purpose determination is the primary control that our customers exercise as the Data Controllers.

As your Data Processor, Checkr also ensures that the data collected on your behalf is not used for any of our own purposes (such as marketing resources) outside of fulfilling our contractual obligation with customers.

Data minimisation

The personal data that’s collected and processed must be limited to what’s adequate, relevant and necessary for the purpose you specified in your agreements with Checkr and the data subject (see Article 5(1)(c)). When determining which international screenings to request from Checkr, it is important to consider the nature, scope, and context of your purpose to ensure you are only requesting what is relevant and necessary to fulfilling that purpose. This relevancy and necessity criterion is prevalent in nearly every country’s data privacy law.

Country-Specific Analysis

While the general principles described above are applicable in most jurisdictions, individual countries often introduce additional requirements in the collection, processing and proper use of personal data. These country specific regulations may introduce additional risks for Data Controllers as the users of such information .

Listed below are a few examples of legal parameters particular to individual countries. This list is non-exhaustive and is meant to highlight the need for companies to conduct their own country-specific analysis prior to requesting screenings from Checkr.

The Netherlands and Spain

Even within the EU, the GDPR does not provide for a uniform law to comply with as Member States are permitted to implement specifications, restrictions or additions that meet the needs of their respective countries. For example, in the Netherlands and Spain, consent is not considered to be ‘freely given’ in the employment context due to the imbalance of power between the candidate and the potential employer. Thus consent is not a reliable basis for processing and companies must ensure they are covered by an alternative basis when requesting screenings in these countries. (See Lawfulness, Fairness and Transparency section above.)

Israel and Ireland

In the international landscape, the most common background checks include education and employment verifications. Criminal screenings are less common and multiple countries restrict the permissibility of conducting such checks to limited circumstances. In Israel, access to criminal records from the national registry is strictly prohibited for private employers except in limited circumstances, such as where there are specific legal restrictions on hiring applicants with criminal convictions (e.g., positions at schools, daycares and hospitals). Similarly, Irish law specifies the specific situations under which criminal checks are permissible, including when the roles involve working with children or vulnerable persons, working for the State in sensitive areas, or working as security staff. As the Data Controller and ultimate user of this information, Companies must ensure they meet such local requirements and only request information permitted by law.

Brazil and Mexico

In both Brazil and Mexico, background screening has been strongly prevalent and contested in consumer litigation. A number of court filings have resulted from candidates being rejected based on background check information that was not directly related to the position they applied for. Court rulings have often been in favor of the candidate, deeming the background check process to have violated their right to privacy and/or right to work. Again, to mitigate risk of litigation, it is important to ensure you are only requesting information that is directly relevant to the position at hand and are able to demonstrate that relationship.

This article will help you:

• Determine why you may not see certain crimes reported for candidates in certain states
• Create exceptions (if necessary) for candidates earning above a certain salary threshold

Under the Fair Credit Reporting Act (FCRA), criminal convictions are reportable on a background report, with no time restriction - reported convictions can go back to even 30 years.

However, nine states have laws restricting the reportability of criminal convictions to seven years maximum.

Of those nine states, five decided to allow an exception to their normal rule of reporting criminal convictions (which is normally seven years max).

This exception, called the salary exception, is only triggered when the employer states that the candidate has the potential to make a certain salary. When that exception is triggered, then the employer can see any criminal convictions beyond the seven years.

What are the state salary exception thresholds?

In each of the following states, convictions cannot be reported beyond seven years unless the candidate's potential salary is at least $20,000 (or $25,000 in New York).

Can my company use the salary exception?

Checkr’s platform allows employers to control whether they want to use the state salary exception. By default this feature is not turned on. Please contact Checkr Customer Support for more information on whether your company can get the salary exception feature enabled.

As a Consumer Reporting Agency, Checkr must maintain processes to ensure maximum possible accuracy when reporting criminal records. Record matching is the process and standard we follow to avoid over-reporting or under-reporting of criminal records. In other words, we maintain processes to avoid (1) reporting an offense for a person other than the candidate, and (2) not reporting a reportable offense for the candidate.

A few factors affect record matching for most consumer reporting agencies:

• Social Security numbers are usually not available on public access to match records, so other information must be used -- generally, this is Personally Identifiable Information (PII).
• Many name combinations are common (i.e. John Smith or Jose Garcia), so there's a likelihood that different individuals may have the same identifying information.
• Variants of common names (suffixes, hyphens, nicknames, aliases, misspellings, etc.) may add complexity when trying to determine whether a candidate and criminal record match each other.

In general, for a criminal record to be reported, there must be at least two pieces of matching PII. For common names, and other cases, that threshold may be higher. Checkr does additional manual and automated work to QA (quality assure) accuracy of reports and maximize the probability of correct record matching.

That said, candidates always have the right to dispute the accuracy of their report if any potential discrepancies arise. 

Also see How do I know that candidates are who they say they are?

A background check report for employment purposes may include public record information that is likely to have an adverse effect on a candidate’s ability to obtain employment.  Where there is public record information that is likely to have an adverse effect on the candidate’s employment, the consumer reporting agency (CRA) has two options under the Fair Credit Reporting Act (FCRA).  The CRA, i.e. Checkr, must either: 

1. Notify the consumer at the time the public record information is reported, that such public record information is being reported by the CRA (with the name and address of who the information is being reported to, i.e. the end-user a.k.a. employer).  This is what is often called a “613 notice.”

or

2. Maintain strict procedures to ensure that public record information is complete and up-to-date.

When a CRA sends the 613 notice, or Option 1 above, it satisfies this section of the FCRA.

This page lists legislation related to expungements and criminal justice reform.

As states expand the number and type of records eligible for expungement, employers should revisit their review procedures and evaluation criteria to ensure eligible records are not being considered. Taking adverse action on charges that are otherwise eligible for expungement may create inconsistency in your adjudication practices because not all individuals will know about or be able to afford expungement services. 

This page lists legislation related to employment and background checks.