Compliance with Checkr

This article explains how Checkr’s solutions can make your hiring processes more compliant.

Checkr's credentials

Checkr is a member of the Professional Background Screening Association (PBSA), the industry trade association for consumer reporting agencies (CRAs). The PBSA's accreditation program recognizes consumer reporting agencies for their adherence to the principles below:

• Accountability
• Continued institutional improvement
• Excellence
• High professional standards

The PBSA first accredited Checkr in 2015. 

What do you need to comply with, and why?

The Fair Credit Reporting Act (FCRA) and state and local laws govern background checks for employment purposes. Under the FCRA, "employment" likely includes independent contractor and volunteer relationships.

Incorporating guidance from the Equal Employment Opportunity Commission (EEOC), many states and municipalities also have fair hiring laws such as the ones below:

• “Ban the box” laws
• Individualized assessment ordinances
• Salary history bans

Not complying with the FCRA or state and local laws can increase your compliance and litigation risk, including class action lawsuits from candidates or government investigations.

Compliance checklist

The list below highlights the main ways of implementing fairer hiring practices and avoiding common areas of legal risk. Consult your legal counsel to check what laws apply to you and to implement practices that meet your compliance and industry needs. 

• Under the Fair Credit Reporting Act (FCRA), you must have a permissible purpose to order a background check. Consult your legal counsel to choose the appropriate permissible purpose for your location and business needs. 
• Set up your disclosure and consent forms. Checkr provides your forms to the candidate when you order through the dashboard. If you use manual orders or our API to order background checks, you must deliver disclosures and gain consent.
• Create and consistently use an adverse action process. If you decide not to engage, hire, or retain someone because of their background check, inform them and wait enough time before finalizing your decision.
• Use the individualized assessment tool. Some cities have regulations that require companies to demonstrate their reason for declining a candidate based on criminal history. Train your team on how to complete this step, and to use the required forms in New York City and Los Angeles. Checkr’s assessment tool helps with the steps below:
  • Guide you through the individualized assessment process.
  • Document the analysis.
  • Provide the assessment to the candidate. 
• Before adding credit reports to your account, confirm your permissible purpose. Several states and cities have laws limiting pre-employment credit reports. 
• Observe "Ban the Box" laws where you hire. Several states and cities have laws limiting how and when you discuss criminal or salary history with candidates. 

This information doesn't constitute and isn't intended as legal advice. Consult your legal counsel about your compliance obligations and best practices.

When you use individualized assessment, you consider each candidate's circumstances and the context around their violations. With the additional information you get from individualized assessment, you can make fairer, more job-related hiring decisions.

Individualized assessment is a best practice that the federal Equal Employment Opportunity Commission (EEOC) recommends, and in some places, requires. Individualized assessment can include the factors below:

• Candidate rehabilitation efforts
• Case disposition
• Job-relevance of the offense
• Offense type and severity
• Time since the offense

Play the Checkr Academy video below to learn how to conduct an individualized assessment.

Individualized assessment and adverse action

If after individualized assessment you still decide not to move forward with the candidate, you can document your assessment during the adverse action process.

During the adverse action process, the Checkr Dashboard prompts you to provide your individualized assessment of the candidate in the "Initial Assessment" field.

"Show your work" laws and ordinances

Certain locations, including the ones below, have "show your work" laws or ordinances:

• City of Los Angeles, CA
• City of New York, NY
• The state of Illinois

These laws require that employers put their individualized assessment in writing that the candidate receives upon adverse action. If the candidate works in a location that requires showing your work, Checkr prompts you to complete the worksheet provided by the appropriate municipal or state agency. To enable individualized assessment for all candidates, contact Checkr.

Candidates’ right to dispute and your review

After the candidate receives the pre-adverse action email, they have time to provide additional information directly to you so that you can individually assess the candidate again.

You can set the time between seven and 30 days. If you need more time to assess the information, you can pause the adverse action process.

You can also cancel the adverse action process.

Candidates can dispute the report at any time. If they dispute the report during the adverse action process, it automatically cancels the post-adverse action email.

As a consumer reporting agency, Checkr must have reasonable procedures to ensure maximum possible accuracy when reporting records. Record matching is a process Checkr relies on to help prevent the errors below:

• Over-reporting: Reporting a record that belongs to someone other than the candidate
• Under-reporting: Failing to report a candidate's reportable record

For Checkr to report a record, the record and the candidate-provided documents must have sufficient matching personally identifiable information (PII). Social Security numbers are usually unavailable to the public, so Checkr uses other PII instead. If the candidate has a common name, Checkr needs more information for a match. Checkr has additional processes to ensure report accuracy.

Candidates can dispute a report’s accuracy with Checkr (or any consumer reporting agency) under the Fair Credit Reporting Act.

Restriction types

Convictions

Under the Fair Credit Reporting Act (FCRA), a background check can report criminal convictions of any age.

Certain states limit the reporting of convictions to only the last seven years. Some of those states provide an exception allowing background checks to report convictions older than seven years. These exceptions specify that the position's salary must exceed a specific amount.

Nonconvictions

Under the Fair Credit Reporting Act (FCRA), a background check can report nonconvictions up to seven years old.

Nonconvictions include the case outcomes below:

• Alternative adjudication
• Dismissed cases
• Formal abandonment of prosecution, called nolle prosequi
• Not-guilty verdicts

Data sources report various dates, so seven years might start from a context date below:

• Disposition
• Incarceration release
• Parole

State-specific reporting restrictions

States have specific reporting restrictions.

Checkr retains reports in accordance with applicable laws and agreements between Checkr and its customers and affiliates. For example, for FCRA purposes Checkr generally retains reports for at least 5 years. If a candidate asks you to, you can use both the Checkr Dashboard and the Checkr API to request that Checkr delete their data.

Delete candidate data using the Checkr Dashboard

To delete candidate data using the Checkr Dashboard, use the steps below:

1. Open the candidate's report.
2. In the candidate information, select Delete candidate data.
3. Confirm that you received and verified the candidate’s request to delete their data.
4. To confirm the request, select Delete candidate data.

After deletion, the candidate loses access to the Candidate Portal, and Checkr deletes the candidate’s data, such as the candidate’s report, from your account.

Checkr can't recover deleted data for your account.

Compliance considerations

Don’t delete a candidate’s data unless the candidate asks you to. Candidates can also contact Checkr directly to request removal of their personal data.

Checkr designed this feature in accordance with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Checkr offers this feature to maintain Fair Credit Reporting Act (FCRA) obligations and align with the CCPA and CPRA. It helps provide transparency and gives candidates more control over their data.

For more information about the CCPA and your candidates' reports, refer to What CCPA Compliance Means in the Context of Background Checks.

This information doesn't constitute and isn't intended as legal advice. Consult your legal counsel about your compliance obligations and best practices.

Checkr's Information Security Management System (ISMS) is ISO/IEC 27001:2013 certified by ANAB-accredited A-LIGN, SOC 2 type II compliant, and uses modern encryption methods to both transfer and store all user information. 

Encryption: Data always transfers using Secure Sockets Layer (SSL) and AES-256 encryption. We truncate sensitive information like Social Security numbers and store them encrypted in our protected databases.  

Security: Checkr has established an ISMS (Information Security Management System) based on the ISO 27001:2013 Information Security Standard because it is one of the most recognized frameworks worldwide.

Risk Management: Checkr has established a risk management program to demonstrate our commitment to information security. We leverage ISO 27005 Risk Management framework to prioritize identified risks.

Download our latest ISO 27001 certificate from Checkr's Trust & Security page.