What if I want to run a background check for non-employment purposes?

The Fair Credit Reporting Act (FCRA) lists specific categories of permissible purposes that allow consumer reporting agencies like Checkr to provide background check reports to customers. While many Checkr customers are requesting reports under an employment permissible purpose, there are additional non-employment purposes available under the FCRA:

• Insurance Underwriting: To evaluate and analyze risks involved in insuring consumers.
• License Eligibility or Government Benefits: To consider an applicant’s financial responsibility or status, as required by law, to determine a consumer’s eligibility for a license or other benefit granted by a governmental agency or entity (for example, certain state benefits).
• Extension of Credit: To extend credit as a result of an application from a consumer, or for the review or collection of a consumer’s account.
• Legitimate Business Need: In connection with a transaction initiated by the consumer OR to review whether the individual continues to meet the terms of an account the consumer holds with that business.

How are the documentation requirements different for non-employment purposes?

Generally speaking, the end-user (customer) requirements for non-employment purposes are less burdensome than for employment. For example, non-employment purpose reports do not require the same detailed adverse action notice process; a verbal notice to the candidate that they will not be moving forward is sufficient.

There remain requirements around the consumer’s informed consent and disclosures to the consumer. Ordering a report for non-employment purposes still requires a customer to obtain informed consent from the consumer(s) on whom they’re requesting a background check report. While a writing is not required under the FCRA, we often see customers collecting and recording the consumer’s consent to a background check report in the terms of service or other written form, as a best practice for audit purposes.  

In addition to informed consent, a non-employment permissible purpose may still require additional steps. Depending on the consumer’s location and the specific screening requested (such as Motor Vehicle screening), customers may still be required to provide some additional disclosures to comply with state, local, and/or agency laws. We recommend speaking with your attorneys to make sure you have the appropriate consent and disclosure(s) for the permissible purpose applicable to your business, the screening requested, and the location of the consumer.

No, Checkr will already have the candidate’s current location as part of the candidate flow, either because the candidate completed Checkr’s hosted flow or because you imported the ZIP code using the API. With that information, we can apply the proper compliance filters based on their home address.

When access to a full date of birth on criminal records is limited by courts, additional research is required and delays are expected. Checkr is diligently working to reduce the impact of PII redactions on customers through investments in our product, legislative solutions, and the expansion of our research team. Please find state-specific updates below:

Michigan

The state of Michigan originally planned to redact all dates of birth on July 1, 2021. This was postponed with an expected implementation date of April 1, 2022. Industry organizations like the PBSA and other allies are negotiating solutions with Michigan to make DOBs available for background checks. 

California

Many counties in California have limited public availability of DOBs on criminal records. Despite this, Checkr is still able to process the large majority of searches in just a few hours. For searches where there are potential matches to records, turnaround times have been impacted industry-wide. 

Checkr is committed to minimizing the impact of PII redactions on our customers through product enhancements, increased bandwidths, and legislative solutions.

This document outlines the processes Checkr uses to process records after they have been returned from court sources. Checkr performs post-processing according to the Fair Credit Reporting Act (FCRA) and comparable state laws in order to ensure reporting accuracy and compliance.

Checkr provides several types of post-processing, including:

• Identity-based post-processing
• Compliance-based post-processing
• Record deduplication

Identity-based post-processing

Identity-based post-processing ensures that only records bearing on the candidate are included in the background check report. For comprehensiveness purposes, Checkr furnishers initially employ overinclusive search methodologies with higher levels of tolerance for potential matches (such as name spelling variations, or partial identifier matches). After initially casting a wide net on the search, Checkr’s identity-based post-processing serves as a crucial step for background check accuracy. Checkr furnishers are instructed to return all available identifiers associated with a record. Based on the identifiers returned, Checkr determines whether the identifiers sufficiently match the candidate’s personally identifiable information (PII). Records determined to be not associated with the candidate are excluded from the final report.

The most common identifiers evaluated during identity-based post-processing are:

• Name (including aliases)
• Date of Birth
• Social Security Number
• Address
• Driver License

Based on the presence and calculated similarity of the above identifiers, as well as the demographic statistics of the relevant geographic location, Checkr computes probabilistic scoring that informs the inclusion criteria of a given record.

Additionally, records without PII sufficient to establish matching confidence scores are sent to Quality Assurance for additional review and research.

Compliance-based post-processing

To ensure background check reports are compiled in compliance with Consumer Reporting Agency (CRA) requirements, Checkr follows all federal and state-specific rules on reportability. These rules take into consideration factors such as the age of the record, the charge type (criminal vs. non-criminal), disposition (convictions vs. non-convictions), and other exemptions (listed below). Based on the following information, Checkr makes a determination regarding a record’s reportability in a specific jurisdiction.

Age of record

As a CRA, Checkr complies with FCRA and comparable state-specific laws. These laws determine whether a given record can be reported based on the record’s age, as well as how the record’s age is calculated. For example, the age of a conviction is calculated based on the most recent case activity date available, whereas the age of non-conviction records is calculated using the filing date.

Charge type

Record reportability is also dependent on the nature of the offense. Specifically, non-criminal information (such as petty offenses and civil infractions) are only reportable for 7 years. As a result, non-criminal records older than 7 years are excluded from the background check report.

Disposition

Dispositions may be generally classified as convictions and non-convictions. The FCRA and state laws govern the reportability of these two disposition types.

Convictions: Under the FCRA, convictions can appear on a background report regardless of when they occurred. However, some states have limited the scope of conviction reporting to seven years, including California, Kansas, Maryland, Massachusetts, Montana, New Mexico, New York, New Hampshire, and Washington.

Non-conviction: A "non-conviction" includes arrests, dismissed cases, not-guilty verdicts, alternative adjudications (programs that result in dismissed charges if the defendant completes certain conditions), and “nolle prosequi” (formal abandonment of prosecution).

Under the FCRA, non-convictions are reportable for seven years from the filing date. For most states, non-convictions are therefore reported for 7 years. However, four states (California, Kentucky, New York, and New Mexico) prohibit the reporting of non-convictions. In these states, and absent some exemption, there will be no reporting of non-convictions.

Jurisdiction-specific rules

To determine which jurisdiction’s reporting rules to apply to the report, Checkr evaluates the following pieces of information:

• Report’s location
• Candidate’s work location (The state for the candidate's most recent location.)
• Candidate’s postal code
• Account’s default compliance state

Other exemptions

Federal and state-specific exemptions to the aforementioned reporting rules include salary exemption as well as Transportation Network Company (TNC) exemption where applicable. Such exemptions will extend the reporting period beyond the standard scope.

Record deduplication

To comply with the FCRA and to avoid misleading or duplicate reporting, Checkr performs record deduplication. Duplicate records that are excluded from the background check reports generally fall into two categories:

• Transferred cases: When a case is shown to be transferred to another court jurisdiction, Checkr reports only the information from the court to which the case was transferred. This ensures that the reported information is the most up-to-date case information for the specific record.
• Duplicate cases: When a case is determined to be a duplicate of another case, Checkr displays only one instance of the case on the report.

The Fair Credit Reporting Act (FCRA)

The FCRA is a federal law that governs how companies order, use, and consider consumer reports, which include what’s commonly referred to as background checks or credit checks.   

For the purposes of employment, the FCRA generally applies to consumer reports for both employees and independent contractors.

Enforcement of the FCRA is overseen by the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB). The law was enacted to promote the accuracy, fairness, and privacy of consumer information contained in the files of consumer reporting agencies like Checkr. To that end, it provides safeguards and rights for the consumer (the candidate or employee that is the subject of the background report.

The consumer reporting agency (CRA, such as Checkr) providing the consumer report and the company that ordered the report (the End-User) must adhere to certain safeguards that ensure consumers’ rights are protected.

Your responsibilities as an end-user

As an end-user under the FCRA, your responsibilities and duties may vary depending on the purpose for which you obtain a consumer report, including but not limited to insurance underwriting, tenant screening, or employment-- i.e., the listed “permissible purposes” for obtaining a consumer report allowed by the FCRA. End-users have specific duties and obligations under the FCRA when they obtain a background check report for employment purposes (such as hiring or promoting job applicants, employees, or independent contractors). These duties include:

1. Obtain a consumer report(s) for an FCRA permissible purpose(s) (Permissible Purpose);
2. Provide notice to the consumer in writing that you intend to obtain a consumer report for employment purposes (Written Disclosure);
3.  Obtain the consumer's written consent to run a report (Authorization); 
4. Provide the consumer with a “pre-adverse action notice,” a summary of their rights under the FCRA, and a copy of their report if you intend to make an adverse decision (such as declining them for employment or promotions) based on the information in the report (Pre-Adverse Action);
5. Waiting Period: Give the consumer a reasonable waiting period to provide additional context or to dispute any inaccurate information contained in the  consumer report before making a final adverse decision (Waiting Period);
6. Notify the consumer in writing when an adverse action is taken (Final Adverse Action Notice);
7. Identify the CRA that provided the report so that the consumer can dispute inaccurate information in their report with the CRA.

As your partner in background check screening, Checkr helps facilitate your compliance with the FCRA by:

• Disclosure and Authorizations. If you are utilizing Checkr’s hosted-flow process, Checkr will provide the candidate with the summary of rights and your relevant federal, state, and/or local disclosure notice(s), and collect authorization from the candidate directly. Checkr streamlines your compliance processes by presenting these forms to the candidate as part of the consumer’s background check process. See our disclosure and authorization article for more information.
• Adverse Actions. You can use Checkr’s dashboard to make the adverse action process more efficient for your team. Specifically, you can ask Checkr to send a pre-adverse action notice (as required by the FCRA for employment screening) on your behalf to the candidate. Checkr will keep track of the waiting period for you. If the adverse action process is not canceled (for example, if you decide to cancel adverse action and move forward with the candidate after they submit additional context or evidence of rehabilitation), Checkr will automatically send the required post-adverse notice following the statutory waiting period. See our adverse action article for more information.

As a reminder, while Checkr helps facilitate your compliance processes, it’s important to consult your legal counsel to ensure that your compliance needs under federal, state and/or local law are met.

Checkr's responsibilities as a CRA

As a consumer reporting agency (CRA), Checkr’s responsibilities are different from an end-user’s under the FCRA, including:

• Credentialing end-users to run background checks;
• Maintaining strict procedures to ensure the maximum possible accuracy of the information in reports or sending a contemporaneous notice to consumers when we report potentially adverse information in reports requested for employment purposes;
• Providing consumers with all information in their files upon request (also known as a Full File Disclosure);
• Re-investigating information on the report after candidates dispute the information within 30 days; and
• Not reporting obsolete information, such as non-convictions older than seven years.

Note again that these are different from your responsibilities as an end-user. For example, while CRAs are restricted on what can or cannot be reported in a background check (such as inaccurate or obsolete information), end-users are responsible for how the information is reviewed and what actions they can take.

Following the above procedures ensures that candidates are aware of their rights under the FCRA and are given the opportunity to address concerns about their background check.

Hundreds of cities, counties, and even states have implemented Ban the Box rules that prohibit questions about criminal conviction history on job applications. Initially, the “box” referred to the box on a job application where candidates would indicate whether they had criminal histories, but these regulations have often expanded to govern when employers are allowed to ask about criminal histories.

Each Ban the Box law contains unique requirements, so be sure to check the laws in locations where you hire contractors or employees. For example, some laws govern whether you can ask about criminal history on a job application, and others go further to restrict you from asking about criminal history until a conditional offer is made.

Which states and municipalities ban the box?

As of April 2018, 31 states have implemented Ban the Box regulations.

The following have implemented laws for private employers:

• California
• Colorado
• Hawaii
• Illinois
• Massachusetts
• Minnesota
• New Jersey
• Oregon
• Rhode Island
• Vermont
• Washington

The following have implemented laws for public employers only:

• Arizona
• Connecticut
• Delaware
• Georgia  
• Indiana  
• Kentucky
• Louisiana
• Maryland
• Missouri
• Nebraska  
• Nevada
• New Mexico  
• New York
• Ohio
• Oklahoma
• Pennsylvania
• Tennessee
• Utah
• Virginia
• Wisconsin

In addition to states, over 100 cities and counties now require Ban the Box practices for private employers. They include:

• Austin, TX
• Baltimore, MD
• Buffalo, NY
• Chicago, IL
• Columbia, MO
• Washington, D.C.
• Kansas City, MO
• Los Angeles, CA
• Montgomery County, MD
• New York City, NY
• Philadelphia, PA
• Portland, OR
• Prince George’s County, MD
• Rochester, NY
• San Francisco, CA
• Seattle, WA
• Spokane, WA

Ban the Box legislation is just one example in a growing trend of state and municipal fair-hiring laws. While Ban the Box typically governs when an employer can inquire about criminal history, some cities have instituted “Fair Chance Ordinances” that govern how criminal history is considered and require a show-your-work rule when denying applicants due to criminal records. Based on the Equal Employment Opportunity Commission’s guidance, you should evaluate offenses on background reports individually, rather than blanket exclusions. For more information, see our article on individualized assessment.

Incorporating Ban the Box laws into your hiring process

Whether these laws apply to you depends on multiple factors, including:

• Your company size
• Where you’re located or where you hire employees
• Whether you’re a government agency or private employer
• What industry you’re in (health care, child care, law enforcement, education, banking, accounting, insurance, transportation & security, and others often fall under different regulations)

Consult with your counsel to determine which Ban the Box laws apply to you, and based on that guidance you may want to review the language on your job descriptions and applications, and/or ensure that your hiring or engagement managers are not asking about criminal history as part of the interview process.

For example, some employers choose to replace language such as “Candidates with felonies in the past 7 years need not apply” with language such as “This position is subject to a background check for any convictions directly related to its duties and responsibilities. Only job-related convictions will be considered and will not automatically disqualify the candidate,” providing a more accurate statement of how individualized assessment works.

If any information contained on a candidate’s background check precludes them from working with your company, it is your obligation to carry out the adverse action process. Although responsibility and liability for the adverse action process ultimately lies with you as the end user, Checkr helps make it easier to maintain a compliant adverse action process.

This article is intended to give product guidance and does not constitute legal advice. Please consult your legal counsel for questions or employment practices around adverse action and adjudication.

What is adverse action, and why is it important?

In the context of background checks, adverse action is any action you take based on the information in a background check report that negatively affects someone’s employment. This could mean denying them employment, but can also include denying a promotion or transfer, offering employment in a lesser position, or other negative outcomes.

Because adverse action adversely affects consumers (by nature), it is a common area of litigation and compliance risk for you. In fact, the Fair Credit Reporting Act (FCRA) requires that you follow certain procedures if you decline to hire, engage, or promote a candidate on the basis of information contained in a background report.

The adverse action workflow is critical because it allows the candidate to raise any concerns about their report, and the FCRA requires that employers/end users (which includes companies that use independent contractors) to follow this stringent process.

Some employers are tempted not to communicate with candidates whom they decline. However, if you don’t follow a defined and consistent adverse action process, you’re opening yourself up to legal risk.

What’s an adverse action process?

To stay compliant and avoid the legal action that can come from not properly handling adverse actions, you must follow a process that complies with the Fair Credit Reporting Act (FCRA).  

Remember that just because a report came back with the Consider status, that is not a reason to disqualify a candidate. Build a consistent adjudication process to take into account the nature of the crime (such as petty theft vs. assault and battery), when the crime occurred (6 months vs. 6 years ago), and whether the crime is relevant to the job duties that the candidate would be performing.

A compliant adverse action process for employment decisions will include the following:

• Pre-adverse action notice: Informs the candidate that you are considering not moving forward with the employment process based on information in the background report.
• Waiting period: The FCRA requires a reasonable amount of time (usually 7 calendar days, but some jurisdictions require more) before taking final action, so the candidate has an opportunity to dispute any incorrect or outdated information in the report.
• Adverse action notice (or “post-adverse action notice”): After you wait the required amount of time, including time required for the resolution of any dispute, you must provide a final notice of your decision if you have decided not to move forward with the candidate.

For non-employment purposes, you're not required under the FCRA to execute this whole process. You must only provide the adverse action notice.

Checkr helps you stay compliant throughout the adverse action process. 

Set an adverse action email address

The adverse action email is the email used to send pre- and post-adverse action notices on your behalf to candidates. It's also the address that will receive undeliverable notices if an adverse action notice isn't deliverable to a candidate (for instance, if they have a mistyped email address on file).

As part of your account setup, you are required to select an adverse action email address. As an admin user, go to Account Settings to set this up.

On the Account Settings page, your admin will also need to provide a Support email or Support phone for candidates to contact you with questions related to adverse actions.

Many Checkr clients choose to use a shared inbox for their adverse action email, so multiple people on your side can check the inbox and handle undeliverable adverse actions.

Important: Make sure that the email address you select is an email address at your company, not a Checkr email address.

Pre-adverse action notice

A pre-adverse action notice notifies the candidate that information contained on their background report might negatively affect a decision about their employment. It is intended to give the candidate an opportunity to respond to the information contained in the report, so by law it must contain a copy of the report. The notice must contain a standard document called “A Summary of Your Rights Under the FCRA,” and some states requires additional notices.

To begin the adverse action process from a background check report, log into Checkr as an admin or adjudicator, go to an individual candidate’s report, and click Pre-adverse action. This button will appear for reports with a consider status.

On the next screen, select the charge(s) that you believe disqualify the candidate from employment. You must select at least one, but you should select all the charges that are potentially disqualifying.

Before sending the email, Checkr will show you a preview of the email that will be sent to the candidate.

Checkr will include the necessary notices for the candidate as attachments, including a copy of the background report and "A Summary of Your Rights Under the Fair Credit Reporting Act."

All actions will be tracked in an audit log so that you can review them later. You can also download a PDF copy of the notices sent to the candidate.

When you preview the email, you’ll see the adverse action email address that will be used to send the email at the top of the preview screen.

Waiting period

During the waiting period, the candidate can reach out to Checkr directly to dispute the accuracy of their background check report. Candidates can also contact you to provide evidence of rehabilitation or additional information to consider. If the candidate does not dispute the report with Checkr during this time, then the post-adverse action notice will be sent automatically.

By default, Checkr’s waiting period is set to 7 calendar days, and Checkr's system will modify this waiting period as necessary under applicable law. For example, the city of Philadelphia requires a 10-day waiting period. Additionally, Checkr clients can increase the number of days from 7 should they wish (although 7 days is the minimum). If the candidate does not respond within that period of time, Checkr will automatically send a post-adverse notification to the candidate on your behalf (also known as an adverse action notification).

The FCRA does not define a set number of days for the waiting period, but does mandate a “reasonable waiting period.” This waiting period allows candidates to receive the notice, review the background report, and dispute it if the information is incorrect. Most companies provide at least 5 business days or 7 calendar days to give the candidate opportunity to respond.

To see the status of all candidates in the adverse action process, including those in the waiting period, log in to the Checkr Dashboard, go to the Adverse action section, and set any status or date filters you want to use.

Here, you can see the status of your candidates in adverse action.  

Individualized assessment

In 2012, the Equal Employment Opportunity Commission (EEOC) issued guidelines advising employers to consider the specifics of each candidate who might be denied employment based on a background check.

Namely, you should consider:

• The nature and gravity of the offense or conduct
• The time that has passed since the offense, conduct and/or completion of the sentence
• The nature of the job held or sought

The criteria mentioned above is also known as the 'Nature-Time-Nature' test. You are also encouraged to consider other factors like the number of offenses, employment history before and after the offense, rehabilitation efforts, and other circumstances.

The cities of New York and Los Angeles specifically require this type of individualized assessment as part of the hiring process, including that you “show your work” to the candidates to document your decision making. If you’re hiring candidates in these locations, Checkr will add an additional, optional step so you can “show your work.” To learn more, see our article on individualized assessment.

Cancel or pause an adverse action

During the waiting period, the candidate can contact you and provide evidence of rehabilitation or other context that makes you reconsider your adverse action decision. You can then cancel or pause the adverse action process. 

Canceling the adverse action process stops delivery of the post-adverse action email. After you cancel the adverse action process, you can engage the candidate.

Pausing the adverse action process delays delivery of the post-adverse action email to give you more time to consider the candidate’s information. Depending on your decision, you can take an action below:

• Cancel the adverse action process and engage the candidate.
• Continue with the adverse action process and send the post-adverse action email.

Resolve undeliverable adverse actions

Sometimes your adverse action notices might be undeliverable due to a misspelled or incorrect email address provided by the candidate. Checkr will try 4 times over 24 hours to deliver the adverse action notice, but if it cannot be delivered at that point, it will be considered undeliverable.

For any notices that are undeliverable, correct the candidate’s email address to ensure that the required notices are properly delivered.   

If an adverse action is undeliverable, you will receive an email at your adverse action email contact with the following message (to change your adverse action email address, have your admin go to Account Settings > Adverse action email):

Resolve the error by following the link in the email, then correcting the email address in the Guided Resolution for undeliverable adverse action notice.

In the case that there is no email to correct, click I’m manually handling this, resolve this notice. You’ll see downloadable copies of the pre-adverse action notice and the post-adverse action notice so that you can send them by alternate means.

The Adjudication status of these reports will be designated as manual to remind you to complete the process manually.

On the Checkr Dashboard, go to the adverse action section and filter by Undeliverable to see which notices couldn't be delivered. You can then update the candidate’s email address to re-send communications. If you do not have a correct email address, you should resolve the adverse action offline.

Checkr's guidance should not be construed as legal advice, guidance, or counsel. Companies should consult their own legal counsel about their compliance responsibilities under the FCRA, Title VII, and applicable state laws. Checkr expressly disclaims any warranties or responsibility or damages associated with or arising out of information provided.

This document describes Checkr’s process in collecting and determining aliases for candidates when conducting background check screenings, and includes the following information:

• Checkr's sources for aliases
• Checkr's alias types:
  • Request alias
  • Validation alias
• How Checkr uses aliases
• How Checkr evaluates 'partial' names

Alias sources

Aliases are different names or permutations of the same name associated with a candidate. When applicable, Checkr uses aliases to identify records under names that differ from the candidate’s provided name, thus increasing the comprehensiveness of the background check report.

Aliases are identified through names returned from various sources, including candidate creation, SSN Trace records, Motor Vehicle Records check, and document transcriptions. These returned names are stored as “name occurrences”, and evaluated to generate aliases.

• Candidate submission: The information submitted by the candidate to Checkr acts as a starting point for the candidate’s profile.
• SSN Trace: Checkr identifies additional names from SSN Trace data. These names are aggregated into the candidate’s record and stored.
• Motor Vehicle Records: MVR checks often return name variants. These names are aggregated into the candidate’s record and stored.
• Document transcription: Customer and Checkr support team document transcriptions may introduce additional names for the candidate.
• Name normalization: Checkr software identifies potential nicknames for a candidate. For example, if a candidate submits Bob as a first name, our software automatically recognizes that Bob is a nickname for Robert and stores Robert as a first name for that candidate.

Checkr uses name occurrences from all previous reports associated with an individual candidate when computing aliases

Alias types

Checkr leverages a variety of algorithms to evaluate returned name occurrences, and aggregates this raw data to generate aliases for a candidate. Two types of aliases are generated in this process:

• Request alias: Request aliases are used to initiate screenings for the candidate. Package configuration will determine whether and how many distinct aliases are used in requests.
• Validation alias: Validation aliases are used to confirm that the records returned by our vendors match the candidate. In order to ensure accuracy, alias matches are only one of several identifiers used to match.

Request alias name selection

The selection process of request aliases ensures that distinct name components are represented and therefore searched. When generating request aliases, Checkr evaluates all available first, middle, and last names for each candidate returned in the sources listed above.

First name evaluation

When two different first names are collected, Checkr will select both as request aliases. For example, given Patricia Stewart and Martha Stewart, Checkr will select both Patricia and Martha as distinct request aliases.

Last name evaluation

When two different last names are collected, Checkr selects both as request aliases. For example, given Martha Jones and Martha Stewart, Checkr will select both Jones and Stewart as distinct request aliases.

Middle name evaluation

When evaluating multiple middle names, Checkr selects the most representative name variation as the request alias, allowing our providers to return all data that is likely to be related to the candidate.

• Given Patrick and P, Checkr selects Patrick
• Given Patrick, Pete and Paul, Checkr selects P
• Given Patrick and Neal, Checkr selects neither

Validation alias name selection

While request aliases are selected to broaden search coverage and increase comprehensiveness, validation aliases are generated to ensure all components from various name occurrences are represented when validating records.

The following example is constructed to illustrate these differences.

For example: Checkr receives the following name occurrences for a candidate from various sources:

• JOHN J SMITH
• JOHN SMITH
• JOHN S SMITH
• JOHN SAM SMITH
• JOHN JONES SMITH

Because “JOHN SMITH” is the name that can represent all other name occurrences, Checkr will select the name “JOHN SMITH“ as a request alias.

And, to ensure all name components are represented in record validation, Checkr will use both “JOHN SAM SMITH” and “JOHN JONES SMITH” as validation aliases to ensure maximum possible accuracy.

Alias use

Checkr enables the use of aliases for the following screenings:

• National Criminal Database Check
• Sex Offender Registry Check
• Global Watchlist Records Check
• Federal Criminal Records Check
• Federal Civil Records Check
• County Criminal Records Check
• County Civil Records Check
• State Criminal Records Check
• Municipal Criminal Records Check

Partial name handling

In some cases, candidates may not have both first and last names. In these cases FNU is used in place of first name to designate First Name Unknown, and LNU is used in place of last name to designate Last Name Unknown. Because the same designations are also used in public records, Checkr accepts FNU and LNU as valid name input, as they will function as regular name values in searches, and provide a basis for matching records to be returned.

While it’s common for candidates to have no “first” name (or FNU) on the record, it is very rare for candidates to have no “last” name (or LNU). Candidates with a single name often submit it as their last, rather than their first for United States documents.

Checkr does not accept single letter last names as valid input, and customer API calls that POST single letter last names will be responded to with an error.

Checkr does accept single character first names as valid input.

Question

The National Criminal Database Search casts a wide net to search for potential records. Although this search is extensive, the records returned are often incomplete, lacking identifying information and/or the final disposition of the case (for example, whether the case was dismissed). 

When a potential record is identified in the National Criminal Database Search, what happens next? 

Answer

The report is automatically upgraded using County Level Verification to ensure that public record information is complete and up to date. This means that Checkr then runs a search in the county indicated by the National Criminal Database, with the goal of obtaining:

• Additional identifiers to determine whether or not the record belongs to the individual in question; and 
• Up-to-date case information (such as disposition or status)

In addition, Checkr also sends a “Contemporaneous Notice” or “613 Notice” to the candidate. The County Level Verification and the notice help Checkr comply with Section 613 of the Fair Credit Reporting Act.

When a County Criminal Check was not ordered as part of the background check package but there is a hit on a National Criminal Database Check, please expect a County-Level Verification fee and possible county-level passthrough fees to appear on your invoice. 

Also see What are the additional fees on our invoice?

As more states pass fair hiring laws encouraging you to assess the individual circumstances of each candidate’s background check, Checkr helps you keep your hiring process fair and compliant through individualized assessment tools.

What is individualized assessment, and why is it important?

Individualized Assessment refers to how you review criminal records on a pre-employment background check. Rather than focus simply on the name of an identified criminal offense, individualized assessment means that you take into account the specific circumstances of the candidate and the crime(s) to make a fairer and more job related determination. All of this happens before you initiate adverse action against a candidate.

Unlike the Adverse Action process, which is required under the Fair Credit Reporting Act (FCRA), your Individualized Assessment responsibilities stem from federal, state, and municipal fair hiring laws. 

In 2012, the Equal Employment Opportunity Commission (EEOC), under title VII of the Civil Rights Act of 1964, issued guidelines advising employers to consider the specifics of each candidate who may be denied employment based on a background check.

Here’s how the EEOC defines Individualized Assessment:

Individualized assessment generally means that an employer informs the individual that he may be excluded because of past criminal conduct; provides an opportunity to the individual to demonstrate that the exclusion does not properly apply to him; and considers whether the individual's additional information shows that the policy as applied is not job related and consistent with business necessity.

The EEOC specifically mentions three criteria to consider when reviewing criminal records, known as the "nature/time/nature" test:

• The nature and gravity of the offense
• The time that has passed since the offense, conduct, and/or completion of sentence
• The nature of the job held or sought

In other words: “How severe was the offense? How much time has passed since the offense? How relevant is the offense to the job?”

The EEOC encourages you to consider other factors, such as:

• The facts or circumstances surrounding the offense or conduct.
• The number of offenses for which the individual was convicted.
• The candidate's age at the time of conviction, or release from prison.
• Evidence that the individual performed the same type of work, post-conviction, with the same or a different employer, with no known incidents of criminal conduct.
• The length and consistency of employment history before and after the offense or conduct.
• Rehabilitation efforts, such as education or training.
• Employment or character references and any other information regarding fitness for the particular position.
• Whether the individual is bonded under a federal, state, or local bonding program.

Also note the disposition of the records as you review them, because even dismissed records can still be reported in most states.

No individualized assessment is needed when there is a “demonstrably tight nexus” between the job duties and responsibilities and the offense or conduct. This occurs in specific and limited situations, for example:

• A recently convicted sexual predator applying to work supervising children at a day care.
• A candidate with recent convictions for identity theft applying to work in a position handling sensitive personal financial information like Social Security and credit card numbers.

Create an individualized assessment process

The best practice is to create and document a fair individualized assessment process that goes hand-in-hand with your adverse action process. You should then distribute and train your adjudicators and hiring managers on these processes. In general, these processes may govern:

• Which factors to examine on a criminal record during an individualized assessment.
• When, if at all, to ask about criminal history (to comply with “Ban the Box” laws).
• How to reach out to candidates to gain additional information or context on a criminal record.
• How to account for severity, age, relevance, and disposition during adjudication.
• How to document individualized assessments for candidates with whom you will initiate an Adverse Action process.

For example, you may create a worksheet similar to the following:

"Show your work” laws and ordinances

Taking the EEOC guidance a step further, some municipalities (for example, the cities of New York and Los Angeles) specifically require that employers not only conduct individualized assessments, but also “show their work” to candidates. These jurisdictions require that you send a written analysis to the candidate explaining why the criminal record disqualifies them from employment in a given position.

For example, in July of 2017, the City of Los Angeles began enforcement of the Fair Chance Initiative for Hiring Ordinance. In keeping with a general trend towards increased transparency in the hiring process, the Ordinance requires employers to provide their written individualized assessment with the pre-adverse action notice (i.e. “show your work”). New York City implemented a similar requirement in August 2017.

Individualized assessment in the Checkr platform

Checkr allows you to add your written individualized assessment directly into the adverse action notice.

Specifically, if you’re hiring candidates in locations with “show your work” laws or ordinances, such as the cities of Los Angeles and New York, or the state of Illinois, Checkr will prompt you to use our Individualized Assessment tool during the adverse action process.

We use the following logic to determine whether to activate the Individualized Assessment Tool:

• If your candidate's Work or Home ZIP code is in New York City or Los Angeles, we will activate the assessment form for that candidate.
• If your candidate is in California, Illinois, or New York Geo, we will activate the assessment form for that candidate.
• By request, we can activate the assessment form for all candidates. Please contact Checkr Customer Support.

Provide your rationale in the Initial Assessment field.

For candidates in the cities of New York or Los Angeles, use the Upload document section to download the New York or Los Angeles Individualized Assessment forms, fill in the details, and then upload directly into the form. Whatever you enter or upload will also be sent to the candidate with the Pre-Adverse Action notice.

When you preview the pre-adverse action notice, you’ll see the individualized assessment show up as well. In the screenshot below, the text inside the red box (“Company’s Initial Assessment”) comes directly from the text you entered on the previous screen within the “Initial Assessment” field.

The candidate has 7 days by default to provide an explanation or to dispute the accuracy of the report by visiting the Candidate Portal. Based on the information that the candidate provides, conduct a reassessment or consider the additional information in the Reassessment field.

If, based on this reassessment, you decide that you would like to hire the candidate, you can cancel the Pre-Adverse Action notice at this point.

Checkr is honored to be your partner, not just in background checks, but in compliance best practices that allow you to improve your hiring process and mitigate legal risk from legal violations. 

Checkr is a member of the National Association of Professional Background Screeners (NAPBS), the industry trade association for Consumer Reporting Agencies (CRA). The NAPBS offers an accreditation program for consumer reporting agencies. Governed by a strict and thorough set of professional standards, the Background Screening Agency Accreditation Program (BSAAP) has become a widely recognized seal of approval that brings national recognition to an employment background screening-affiliated organization for its commitment to excellence, accountability, high professional standards, and continued institutional improvement. We are proud that the Background Screening Credentialing Council (BSCC) awarded Checkr its accreditation in April 2015.

We’ve put together this guide to help you understand how you can use Checkr’s solutions to make your hiring processes more compliant.

What do you need to comply with, and why?

All background checks for employment screening are governed by the Fair Credit Reporting Act (FCRA) and comparable state laws. Under the FCRA, employment also covers independent contractor and volunteer relationships.

Many states and municipalities also have locality-specific fair hiring laws such as “ban the box” laws, salary bans, and individualized assessment ordinances, based on guidance from the Equal Employment Opportunity Commission (EEOC).

Not complying with the FCRA or EEOC guidelines potentially exposes you to risk, including lawsuits from applicants or government investigations. The FCRA does not have a limitation on class action damages, so failure to comply can lead to extensive damages.

Your compliance checklist

We’ll help you set up your compliance framework using Checkr’s solutions with this checklist. This is not an exhaustive list, but it covers the main areas of opportunity to implement fairer hiring practices and avoid common areas of legal risk. Work with your legal counsel to check your state and local laws to make certain that you remain industry compliant. 

• You must have a permissible purpose to initiate a background check under the Fair Credit Reporting Act (FCRA). Permissible purposes under the FCRA include extending credit to a consumer, a "legitimate business purpose", and for an employment purpose. International background checks also require a permissible purpose. International lawful permissible purposes may be different from the FCRA permissible purposes, and will vary by country. We recommend you work with your legal counsel to ensure you choose the appropriate permissible purpose for the applicable location and your business needs. 
• Set up your disclosure and consent forms. Before you screen a candidate you’ll need to inform them clearly of the background check process with a standalone disclosure. Then they’ll need to authorize you to proceed. Checkr hosts these forms when you order through the dashboard, but if you use manual orders or our API to order background checks, you’ll need to make sure that you deliver disclosures and gain consent.
• Create an adverse action procedure, and stick to it. If you decline to hire, engage, retain, or promote a candidate based on information in the background report, protect yourself from legal exposure by making sure you give the candidate notice and maintain a reasonable waiting period before taking final action.
• Use the individualized assessment tool. Some cities will issue fines if you don’t “show your work” for why you declined a candidate based on criminal history. Checkr’s assessment tool walks employers through the individualized assessment process, documents the analysis, and provides the assessment to the candidate. Train your team not to skip this step, and to use the required forms in the cities of New York and Los Angeles.
• If doing credit reports, certify your purpose with Checkr. Several states and cities have laws limiting credit checks for employment purposes. Many require that the credit report relates to the job position (e.g. the job requires access to financial assets or confidential information). Contact Checkr’s Customer Success Team to verify that you have a permissible purpose before requesting a credit report in these locations.
• Observe "Ban the Box" laws where you hire. Several states and cities have laws limiting how you discuss criminal or salary history with candidates. Each law is slightly different and may govern whether you can mention criminal history on a job description or application, when you can order a background check, and how you consider criminal records on a background report.

How Checkr assists with compliance

There are several areas of legal and compliance risk when it comes to fair hiring and employment-related background checks. That’s why Checkr automates areas where manual work can lead to errors. For example:

• Based on candidate/employer location, Checkr can provide locality-specific compliance assistance.
• For states that have separate disclosure requirements, Checkr will serve those disclosures to candidates in the hosted application flow.
• For localities that have longer waiting periods than 7 days for adverse action notices, Checkr will automatically enforce the longer waiting period.
• If you are hiring candidates in locations that require employer to “show their work” through individualized assessment, Checkr will automatically insert a step into the adverse action process to provide the individualized assessment, and send the documentation (or upload city-issued forms) to the candidate.

Checkr's guidance should not be construed as legal advice, guidance, or counsel. Companies should consult their own legal counsel about their compliance responsibilities under the FCRA, Title VII, and applicable state laws. Checkr expressly disclaims any warranties or responsibility or damages associated with or arising out of information provided.

If your company engages contractors (using a 1099 tax form) instead of full-time employees (using a W-2 form), you may wonder whether you have the same obligations under the Fair Credit Reporting Act, Equal Employment Opportunity Commission guidelines, and state "Ban the Box" laws as you would for full-time W-2 employees.

Fair Credit Reporting Act (FCRA): According to commonly accepted interpretations of the Fair Credit Reporting Act (FCRA), purchasing and reviewing background checks as part of the screening process for independent contractors or volunteers falls under "Employment Purposes," making reports for contractors/volunteers subject to the same FCRA guidelines as for employees.

EEOC guidelines and state/local laws: Each state and local law (such as "Ban the Box" laws that are becoming more common) takes a slightly different position on how it applies to independent contractors. That said, the spirit of the EEOC guidelines and the guidance they provide on non-discrimination is intended to cover all types of employment relationships.

Co-employment Risk: Co-employment risk arises when individuals hired as contractors (often through staffing agencies) are effectively treated like full-time employees, and must then be subject to the same employer obligations as full-time employees. Just because you engage 1099 contractors instead of full-time employees, it is not a guarantee that you are exempt from co-employment risk. The IRS lists 20 factors that are used to determine whether an independent contractor relationship is valid. Having even some of those factors, not all, may lead to the determination that your 1099 contractors are actually in an employment relationship with you.

Checkr's Information Security Management System (ISMS) is ISO/IEC 27001:2013 certified by ANAB-accredited A-LIGN, SOC 2 type II compliant, and uses modern encryption methods to both transfer and store all user information. 

Encryption: Data is always transferred using Secure Sockets Layer (SSL) and AES-256 encryption. Sensitive information like Social Security Numbers are truncated and stored encrypted in our protected databases.  

Security: Checkr has established an ISMS (Information Security Management System) based on the ISO 27001:2013 Information Security Standard because it is one of the most recognized frameworks worldwide.

Risk Management: Checkr has established a risk management program to demonstrate our commitment to information security. We leverage ISO 27005 Risk Management framework to prioritize risks identified.

Download our latest ISO 27001 certificate from Checkr's Trust & Security page.

Checkr retains reports in accordance with applicable laws and agreements between Checkr and its customers and affiliates. For example, for FCRA purposes Checkr generally retains reports for at least 5 years. If a candidate asks you to, you can use both the Checkr Dashboard and the Checkr API to request that Checkr delete their data.

Delete candidate data using the Checkr Dashboard

To delete candidate data using the Checkr Dashboard, use the steps below:

1. Open the candidate's report.
2. In the candidate information, select Delete candidate data.
3. Confirm that you received and verified the candidate’s request to delete their data.
4. To confirm the request, select Delete candidate data.

After deletion, the candidate loses access to the Candidate Portal, and Checkr deletes the candidate’s data, such as the candidate’s report, from your account.

Checkr can't recover deleted data for your account.

Compliance considerations

Don’t delete a candidate’s data unless the candidate asks you to. Candidates can also contact Checkr directly to request removal of their personal data.

Checkr designed this feature in accordance with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Checkr offers this feature to maintain Fair Credit Reporting Act (FCRA) obligations and align with the CCPA and CPRA. It helps provide transparency and gives candidates more control over their data.

For more information about the CCPA and your candidates' reports, refer to What CCPA Compliance Means in the Context of Background Checks.

This information doesn't constitute and isn't intended as legal advice. Consult your legal counsel about your compliance obligations and best practices.

This article will help you:

• Familiarize yourself with various state-by-state reporting requirements that affect background checks
• Determine why you may not see all possible criminal records reported
• Determine why you may or may not see dismissed records reported

In addition to federal laws that pertain to background checks, companies that use background checks should be aware that some individual states may also have their own laws that affect a background check and what can be reported by consumer reporting agencies (“CRAs”) like Checkr.

Similar to how the FCRA restricts CRAs from reporting non-convictions over seven years old, some states have passed their own legislation that further restricts CRAs from reporting both conviction and non-conviction information. For this reason, you may not see information reported in an employment background check, even if it is available on an unvetted source (like a mugshot database).

Checkr automates reporting in line with each state’s requirements using our Compliance Engine to help you avoid seeing information that is not reportable.

Which states restrict reporting on convictions?

Under the FCRA, convictions can appear on a background report regardless of when they occurred. However, some states have limited the scope of conviction reporting to seven years (unless an exemption applies), including California, Kansas, Maryland, Massachusetts, Montana, New Hampshire, New Mexico, New York, and Washington.

Which states restrict reporting on non-convictions?

Under the FCRA, non-convictions are reportable for seven years from the filing date and can appear on a background report for seven years.

However, some states prohibit non-convictions from being reported. These states are California, Kentucky, New Mexico, and New York.

A "non-conviction" could include dismissed cases, not-guilty verdicts, alternative adjudications (programs that result in dismissed charges if the defendant completes certain conditions), and nolle prosequi (formal abandonment of prosecution).

While the states listed above don't allow dismissed records to be reported, Checkr can report dismissed records in the states that permit it. It's important to consider the totality of the reported record, charge(s), disposition (guilty, dismissed, pending) and sentencing, and give an individualized assessment.

Note: By default, the setting to show dismissed records is turned off. This means that customers will not see dismissed records unless they request to. Contact Customer Support to request a change to this setting. 

Why don’t I see all possible criminal records?

You may notice that not all criminal records are reportable on a background check. In fact, a record may not be reportable due to state laws.

Some states limit the scope of reporting criminal conviction records to the last 7 years. That said, how the scope is defined can vary depending on data availability. For example, the 7 years can start from

• the date of the disposition of the record
• the date the candidate is released from incarceration
• the date the candidate is paroled

Public court records often do not include release information. When these later dates are unknown, the scope is measured by the earlier available date.

For more information on the scope of a check, see our article on lookback periods. 

Other Considerations

Below is a non-exhaustive list of other state-specific and industry-specific considerations to be aware of.

• California:
• Marijuana Misdemeanors: Non-Felony (Misdemeanor) convictions for marijuana possession can only be reported for 2 years from the disposition date. Furthermore, end users (employers) are also prohibited from seeking or considering this information when making employment decisions.
• Transportation Network Company(TNC): Regulatory exception under California Public Utilities Code 5445.2 allows CRAs like Checkr to report convictions beyond 7 years when preparing reports for TNCs. Under this regulatory reporting exception, TNCs can see convictions for CA candidates regardless of when they occurred.
• Maryland: Transportation Networks (TNCs) are required to search the "entire adult history" of candidates for TNC roles.
• Kentucky: Pending criminal cases are never reportable.
• Salary exceptions: Some states provide salary exceptions, allowing convictions to remain reportable for more than 7 years for candidates who expect to make more than a certain amount of money a year, such as $20,000 ($25,000 in New York).

What other location-specific laws should be considered?

This article deals with common state-based reporting requirements for CRAs like Checkr, which helps explain why certain records may not appear on the background check report.

Keep in mind, however, that states and municipalities also have specific laws regarding how end users and employers use and consider criminal records during an employment pre-screening process.  The laws include individualized assessment of offenses, “Ban the Box,” salary bans, permissible purposes for employment credit checks, disclosure and authorization, and waiting periods for adverse action notices.

Checkr uses in-product compliance features to assist with many of these, but you should consult with your legal counsel on the specifics of the localities where you hire candidates.

This article will help you:

• Compare name-based background checks with biometric/fingerprinting approaches
• Understand the limitations of each type of check

The term “background check” can refer to either name-based checks (which are used by the majority of background check companies) and biometric or fingerprint checks (which are used primarily by law enforcement).

Fingerprinting or biometricchecks such as "Live Scan" are required by law for certain industries, and it is also used in law enforcement, but the approach has drawbacks that many employers aren’t aware of.

Name-based checks

The majority of pre-employment background checks are conducted using a name-based approach.

When background check companies conduct a name-based checks, they use a candidate’s personally identifiable information (PII) to search for criminal history and other information. PII includes not just the candidate’s name, but also information like:

• Date of Birth (DOB)
• Social Security Number (SSN)
• Driver’s License Number

The candidate’s PII allows the background check company to look broadly for information using national and local sources. If the check turns up records that match the candidate’s PII, that information will be used as a “pointer” to specific county, state or federal jurisdictions. The background check company then conducts a search, at the source, in these jurisdictions.

As a result of this process, name-based searches can return information from national and local databases, as well as federal and county courts, in a matter of days.

Fingerprinting and biometric checks

Certain law enforcement groups, such as the Federal Bureau of Investigations (FBI), use fingerprinting or other biometric data as a way to find suspects’ criminal histories. FBI database screenings are only available to employers who have legal authority. In other words, access is authorized by statute, and not all parties can be granted access.

The FBI fingerprinting database, like many other criminal record databases, collects criminal record information from state and local law enforcement sources. Checks return an FBI Identification Record, which contains information tied to arrests, federal employment, naturalization, or military service -- in other words, times when an individual would have been fingerprinted.

However, because the information in the database is meant for law enforcement and not for employers, it is often missing information such as the final disposition of a record.

In other words, it may reveal an arrest record, but not show that the arrest later led to a dismissal. This type of information is missing in roughly 50% of cases, according to the U.S. Attorney General’s report (https://www.gao.gov/assets/670/668505.pdf page 19).

According to the National Association of Professional Background Screeners (NAPBS), fingerprint-based background checks are a useful tool when conducting background screening, but they don’t provide a comprehensive history and should not be solely relied upon for obtaining complete and up-to-date information.

Comparing name-based and fingerprinting approaches

While both name-based and fingerprint-based approaches both have pros and cons, it is widely accepted among background check experts that name-based checks are the preferred method for conducting background checks for employment-related or tenant screening purposes. The primary exception is for industries or locations that require fingerprint searches by law -- and even then, they should be used to supplement, not replace, name-based searches.

Consider the following when comparing fingerprinting to name-based checks.

Comprehensiveness

Although there is a commonly held belief that fingerprinting is the most comprehensive way to identify criminal records, the FBI database (like any individual source) does not always contain complete information. A fingerprint check only reflects information received by the FBI from states and municipalities. When you use the FBI database, you’ll find information collected when a suspect was arrested and fingerprinted, which doesn’t apply to 100% of the information in a background check.

In 2015, the Government Accountability Office (GAO) found significant gaps in the FBI database as many state and local jurisdictions fail to report arrest records or dispositions to the FBI.

Among the GAO’s recommendations:

• To improve disposition reporting that would help states update and complete criminal history records, the Director of the FBI should task the FBI Advisory Policy Board to establish a plan with timeframes and milestones for achieving its Disposition Task Force's stated goals.
• To better equip states to meet the regulatory requirement to notify individuals of their rights to challenge and update information in their criminal history records, and to ensure that audit findings are resolved, the Director of the FBI, in coordination with the Compact Council, should determine why states do not comply with the requirement to notify candidates and use this information to revise its state educational programs accordingly.   

According to a report from the U.S. Attorney General, “The FBI’s system is not a complete national database of all criminal history records in the United States” and that it was not intended to be used for pre-employment background checks. Furthermore, “Users may not want to rely exclusively on an FBI and state repository checks and may also want to check other record sources, such as commercial databases and local courthouses, to obtain more complete and up-to-date information.”

Accuracy

Consumer Reporting Agencies (CRAs) like Checkr are required by federal law to conduct checks with “maximum possible accuracy.” This means that we must ensure that the records returned are as complete and up-to-date as possible.

According to research by the Consumer Data Industry Association (CDIA), FBI database information can take as long as 24 days to report, and court disposition information can take over a month. This means that information in the FBI database may not be as up-to-date as information from a CRA.

Additionally, when you evaluate criminal records, the Equal Employment Opportunity Commission advises you to avoid disparate impact, where a seemingly neutral policy actually has an outsized effect on minority populations. Remember that many FBI arrest records don’t include final dispositions; in some jurisdictions with active police presence, relying on incomplete arrest data can potentially lead you to consider records that were dismissed, or that aren’t relevant to the job position. Making decisions based on incomplete information can unnecessarily disqualify candidates and create legal risk for your business.

Unlike pre-employment background checks, FBI records are not affected by consumer protection laws like the Fair Credit Reporting Act (FCRA). They often lack personally identifiable information (PII), such as full name and date of birth. If this PII is missing, it becomes difficult to ensure maximum possible accuracy of records, increasing the risk of litigation.

Turnaround time

For pre-employment background screenings, turnaround time is essential. As you support your candidates’ placement and onboarding schedules, you generally don’t want to wait any longer than possible for sources to return information.

Another overlooked difference between name-based and fingerprint background checks is access to fingerprinting facilities. Because name-based background checks do not require the physical submission of biometric data, they introduce much less friction into the onboarding process. Individuals living in small towns and rural areas may find it difficult and time consuming to access a fingerprinting facility.

The average name-based background check takes three to five days to complete, while FBI fingerprinting results typically take longer -- in some cases, even weeks.

In summary, while fingerprinting may be used as a component of background checks in certain regulated industries, they should neither be used as the only source of information, nor regarded as a comprehensive source of records. Name-based checks return more comprehensive data than fingerprints, are completed faster, and ensure maximum possible accuracy of records.

This article will help you:

• Decide whether to request a pre-employment credit report based on location
• See which locations have requirements around permissible reasons for pre-employment credit requests

In recent years, it has become less common to request credit checks as a standard pre-employment process. A candidage's credit history has little bearing on most job positions, especially those that don't directly involve financial transactions. Barring candidates for non-financial job positions based on credit history can result in an unnecessarily small candidate pool, as well as potential violations of disparate impact under Title VII of the Civil Rights Act of 1964.

Many states and municipalities have created requirements for when a credit check can be performed for pre-employment purposes.

To help you decide when to run credit checks, we've compiled a list of location-specific permissible reasons for requesting pre-employment credit reports. This is not an exhaustive list, but it does provide several examples of permissible reasons.

Scroll to the bottom of this article to see it as a downloadable PDF.

California

Colorado

Connecticut

District of Columbia

Hawaii

Illinois

Maryland

Nevada

New York, NY

Oregon

Philadelphia, PA

Rhode Island

Vermont

Washington

This article will help you:

• Differentiate between SSN Traces (a common step in background checks) and ID verification
• Decide which level of identity verification is necessary for your business

High-volume, online onboarding differs from traditional hiring

Companies who hire independent contractors at scale, like on-demand, marketplace, or online staffing businesses, must embrace high-volume hiring processes. These processes differ from traditional face-to-face hiring processes, where a candidate walks in for an interview, brings a resume, and often submits personal or professional references.

In a traditional hiring model, identity verification is built into the process--someone on the employer side sees the candidate and has the opportunity to catch false information during the interview and reference checks. Furthermore, with full-time employees, you can verify their identities when they submit their information for an I-9 (employment eligibility verification) form.

For businesses that hire independent contractors at scale, most of these steps don’t occur. While some businesses have in-person onboarding centers, many don’t, meaning that they will never actually see the candidate in person. Absent traditional verification procedures, these businesses rely on other mechanisms to ensure an individual's submitted information is valid.

What personal information is checked during a background check?

In most cases, the Consumer Reporting Agency (CRA) performing the background check also never sees the candidate in person. Employers generally pass on their candidates information to the CRA as a last step after most of the hiring process is completed. The CRA receives personally identifiable information (PII) like the candidate’s name, date of birth, and Social Security Number (SSN), to find previous addresses, aliases, DMV records, and possible criminal records.

Because the candidate has provided a SSN, the CRA can run a trace to identify known names and addresses associated with that SSN. The SSN Trace also identifies which state the SSN was issued in, and approximately which year. The CRA can also detect whether the candidate is using a SSN that is known to be false based on the structure of the number itself.  

Is a Social Security Number trace the same as ID Verification?

A SSN trace is not the same thing as ID verification. The SSN trace is designed to check whether submitted information (like the candidate’s name and age) matches commercially available  database information associated with the particular SSN. The SSN Trace is not designed to determine whether the person entering that information is who they claim to be.

To alleviate this issue, some companies use additional Identity Verification (IDV) or Knowledge-Based Authentication (KBA) services as part of their onboarding process.

IDV or “identity proofing” is used for purposes ranging from opening a bank account, to age verification, to onboarding for high-volume hiring companies. KBA provides an additional level of verification by asking candidates to answer certain questions that hopefully only they would know the answers to. These questions are often based on their credit history, such as what street they lived on or which bank they have a line of credit with. However, because these questions are often based on credit history, KBAs won’t work for every type of candidate, such as younger or first-time workers who lack a sufficient credit history.

That said, no matter what technology you use, you’re still relying on technology to prove that a person is who they say they are, and technology can be susceptible both to fraud and to imperfect information -- for example, in the case that a person changed their name, got married, or simply made a typo when entering information, you may still end up in a situation where the information entered does not precisely match other available records.

Although Checkr is not an ID Verification service, we flag areas where we find data discrepancies and reach out to the candidate for more accurate information.

While background screening is a common practice in most countries, navigating each jurisdiction’s unique regulations can be challenging for companies with a global presence. This resource is intended to provide companies with a general overview of common regulatory principles as well as illustrative examples of specific legislation governing data privacy and background check processing.

Data Privacy Legislation

Background checks inherently involve the collection and processing of sensitive personal information. And while there are many laws affecting the proper usage of the information collected (such as industry specific employment and anti-discrimination laws that vary by country), data privacy laws tend to impart the most stringent requirements on on all parties involved in the collection and processing of that personal information.

The primary example is the General Data Protection Regulation (GDPR), which is the overarching law governing companies processing personal data on individuals residing in the European Union (EU). Today, the GDPR offers the most comprehensive list of data rights granted to the individual, as well as broader data protection principles. Many companies choose to align their global data collection practices with GDPR as they scale their international hiring in the EU and beyond.

GDPR Party Classifications

The General Data Protection Regulation (GDPR) is the primary data privacy law in the European Union (EU). It came into effect on May 25th, 2018, replacing the EU’s Data Protection Directive. This legislation introduced new data privacy and security principles and regulations on companies handling personal data collected  on individuals residing or located in the EU.

GDPR covers three classifications of persons and organizations: (1) data subjects, (2) data controllers, and (3) data processors. The law primarily protects the rights and freedoms of data subjects while placing regulations on organizations controlling and processing their personal data. Below is a description of each party classification and how the relationship between Checkr and the company requesting the background check fits into them.

General Data Protection Principles

Article 5 of the GDPR outlines a set of principles related to processing of personal data (which includes background check information). These principles are outlined broadly below. As the responsible party, Data Controllers may incorporate these principles beyond their EU regional compliance to scale their global privacy program.

Lawfulness, Fairness and Transparency

Prior to requesting international background checks from your Data Processor, you as the Data Controller must (1) establish a lawful basis for processing, and (2) ensure that the data processing is being conducted in a fair and transparent manner. When considering the lawful basis for processing outlined in Article 6, companies often rely on the consent of the data subject (see Article 6(1)(a)). Some Member States do not accept consent as a legitimate basis (see Country Specific Analysis section for examples), leading many companies to instead rely on the balance of interests assessment, which indicates that you, as the data controller, have a legitimate interest for processing that is not overridden by the interests or rights of the data subject (see Article 6(1)(f)). It is your responsibility to specify which lawful basis (or bases) your company relies upon.

Under GDPR, lawfulness must also be met with fair and transparent processes, including respecting the rights allotted to data subjects and providing clear, plain, and intelligible information to them regarding the purpose and means of processing, such as through an updated Privacy Policy and notices to candidates prior to the background check request (see Article 5(1)(1)).

Prior to requesting background checks with Checkr, customers must ensure they have a legal basis on which to process personal data. The GDPR provides a list of approved conditions on which processing may be deemed as lawful. They are:

• Data subject has provided consent
• Processing is necessary for contract fulfillment
• Processing is necessary for a legal obligation
• Processing is necessary to protect the interests of the data subject
• Processing is for the public interest
• Processing is necessary to support the legitimate interests of the data controller and those interests do not outweigh those of the data subject

In addition to supporting and complying with the GDPR’s fairness and transparency principles for EU residents, Checkr follows those principles for all candidates, regardless of location. We provide insight into our data practices for both candidates and businesses in our Privacy Policy as well as background check notifications to candidates directly. Checkr also hosts aCandidate Portal, where individuals can access their background check results, make requests for data access, request rectification (also known as dispute), or provide additional context around their records. For more information, read Checkr’s Fairness commitment.

Purpose limitation

This principle relates to your specific purpose for requesting processing of the data. The GDPR states that personal data shall be, “collected for specified, explicit and legitimate purposes” and indicates that use of the data should be limited to that specific purpose (see Article 5(1)(b)). Determining this purpose is the control you are exercising as the Data Controller.

When requesting background checks with Checkr, our customers certify that they have a specific and lawful purpose for the request, and that use of the data will be limited to fulfilling that request. This purpose determination is the primary control that our customers exercise as the Data Controllers.

As your Data Processor, Checkr also ensures that the data collected on your behalf is not used for any of our own purposes (such as marketing resources) outside of fulfilling our contractual obligation with customers.

Data minimisation

The personal data that’s collected and processed must be limited to what’s adequate, relevant and necessary for the purpose you specified in your agreements with Checkr and the data subject (see Article 5(1)(c)). When determining which international screenings to request from Checkr, it is important to consider the nature, scope, and context of your purpose to ensure you are only requesting what is relevant and necessary to fulfilling that purpose. This relevancy and necessity criterion is prevalent in nearly every country’s data privacy law.

Country-Specific Analysis

While the general principles described above are applicable in most jurisdictions, individual countries often introduce additional requirements in the collection, processing and proper use of personal data. These country specific regulations may introduce additional risks for Data Controllers as the users of such information .

Listed below are a few examples of legal parameters particular to individual countries. This list is non-exhaustive and is meant to highlight the need for companies to conduct their own country-specific analysis prior to requesting screenings from Checkr.

The Netherlands and Spain

Even within the EU, the GDPR does not provide for a uniform law to comply with as Member States are permitted to implement specifications, restrictions or additions that meet the needs of their respective countries. For example, in the Netherlands and Spain, consent is not considered to be ‘freely given’ in the employment context due to the imbalance of power between the candidate and the potential employer. Thus consent is not a reliable basis for processing and companies must ensure they are covered by an alternative basis when requesting screenings in these countries. (See Lawfulness, Fairness and Transparency section above.)

Israel and Ireland

In the international landscape, the most common background checks include education and employment verifications. Criminal screenings are less common and multiple countries restrict the permissibility of conducting such checks to limited circumstances. In Israel, access to criminal records from the national registry is strictly prohibited for private employers except in limited circumstances, such as where there are specific legal restrictions on hiring applicants with criminal convictions (e.g., positions at schools, daycares and hospitals). Similarly, Irish law specifies the specific situations under which criminal checks are permissible, including when the roles involve working with children or vulnerable persons, working for the State in sensitive areas, or working as security staff. As the Data Controller and ultimate user of this information, Companies must ensure they meet such local requirements and only request information permitted by law.

Brazil and Mexico

In both Brazil and Mexico, background screening has been strongly prevalent and contested in consumer litigation. A number of court filings have resulted from candidates being rejected based on background check information that was not directly related to the position they applied for. Court rulings have often been in favor of the candidate, deeming the background check process to have violated their right to privacy and/or right to work. Again, to mitigate risk of litigation, it is important to ensure you are only requesting information that is directly relevant to the position at hand and are able to demonstrate that relationship.

Under the Fair Credit Reporting Act (FCRA), a background check can report criminal convictions of any age.

Certain states limit the reporting of convictions to only the last 7 years. Some of those states provide an exception allowing background checks to report convictions older than 7 years. These exceptions specify that the position's salary must exceed a specific amount.

As a consumer reporting agency, Checkr must have reasonable procedures to ensure maximum possible accuracy when reporting records. Record matching is a process Checkr relies on to help prevent the errors below:

• Over-reporting: Reporting a record that belongs to someone other than the candidate
• Under-reporting: Failing to report a candidate's reportable record

For Checkr to report a record, the record and the candidate-provided documents must have sufficient matching personally identifiable information (PII). Social Security numbers are usually unavailable to the public, so Checkr uses other PII instead. If the candidate has a common name, Checkr needs more information for a match. Checkr has additional processes to ensure report accuracy.

Candidates can dispute a report’s accuracy with Checkr (or any consumer reporting agency) under the Fair Credit Reporting Act.

A background check report for employment purposes may include public record information that is likely to have an adverse effect on a candidate’s ability to obtain employment.  Where there is public record information that is likely to have an adverse effect on the candidate’s employment, the consumer reporting agency (CRA) has two options under the Fair Credit Reporting Act (FCRA).  The CRA, i.e. Checkr, must either: 

1. Notify the consumer at the time the public record information is reported, that such public record information is being reported by the CRA (with the name and address of who the information is being reported to, i.e. the end-user a.k.a. employer).  This is what is often called a “613 notice.”

or

2. Maintain strict procedures to ensure that public record information is complete and up-to-date.

When a CRA sends the 613 notice, or Option 1 above, it satisfies this section of the FCRA.

This page lists legislation related to expungements and criminal justice reform.

As states expand the number and type of records eligible for expungement, employers should revisit their review procedures and evaluation criteria to ensure eligible records are not being considered. Taking adverse action on charges that are otherwise eligible for expungement may create inconsistency in your adjudication practices because not all individuals will know about or be able to afford expungement services. 

This page lists legislation related to employment and background checks.