Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vivamus convallis sem tellus, vitae egestas felis vestibule ut.

Error message details.

Reuse Permissions

Request permission to republish or redistribute SHRM content and materials.

The Increasing Risks of Background Checks

New laws and emerging privacy rights complicate an already-difficult process.

An image of a folder with a pen and a pencil.
​​Illustration by Dale Glasgow for HR Magazine


In the wake of new legislation, background checks that used to take place as a matter of course may now be worth reconsidering. At a minimum, HR should be prepared to navigate more carefully the intersection between privacy laws and employment practices to comply with multiple state and federal requirements.

Roughly half of all employers use credit checks in the job application process, according to Society for Human Resource Management research. But at a time when many people are struggling to make ends meet, some legislators and employment experts argue that using credit reports in this manner is unfair—and not particularly useful, since these screens are irrelevant to many positions and may be more likely to reflect economic hardship than a lack of judgment. 

Indeed, a growing number of states, including California, Colorado, Connecticut, Hawaii, Illinois, Maryland, Nevada, Oregon, Vermont and Washington, restrict companies from making employment decisions based on an applicant’s credit report.

Moreover, even when companies are permitted to use such information in adverse decisions, the Fair Credit Reporting Act (FCRA) requires employers to provide applicants with a copy of their credit report. In addition, a clear and concise description of their rights under the FCRA is required before the report is procured. This gives job seekers the opportunity to correct inaccuracies before the prospective employer makes any decisions based on the information.

Criminal Checks

Over the past several years, the Equal Employment Opportunity Commission has sought to limit employers from asking applicants about their criminal records based on a growing concern that such policies disproportionately affect black and Hispanic individuals from job opportunities. National data show that people in these groups are arrested and incarcerated at rates disproportionate to their numbers in the general population. 

Meanwhile, at the state and local levels, a movement to “ban the box”—that is, to refrain from asking job seekers to check a box on an employment application if they have a criminal history—has caught fire. At least 24 states and 150 cities and counties have passed laws that require companies to wait to ask about a job seeker’s criminal background until after he or she has been found to have met the initial qualifications for a position. 

When HR professionals do ask applicants about their criminal histories, they must be careful not to seek too much information or to improperly use what they learn. The FCRA generally permits consumer reporting agencies to report on adverse items relating to crimes other than convictions of crimes for only up to seven years. Nonconviction adverse information is limited to seven years; there is no time limit on conviction data.

Additionally, many states have legislation with specific restrictions on the types of inquiries employers are allowed to make. These states include California, Colorado, Kansas, Maryland, Massachusetts, Montana, Nevada, New Hampshire, New Mexico, New York and Washington. 

Such state laws also typically disallow companies from asking about sealed or expunged convictions or about juvenile crimes. California and several other states prohibit the use of sex-offender information obtained from their respective Megan’s Law websites. For all the states that have this restriction, improper use can result in the company being held liable for actual and punitive damages, attorney fees, and civil penalties. 

Safeguarding Information

It’s important for HR to properly safeguard and dispose of any information collected during the hiring process. 

Federal law, specifically the Fair and Accurate Credit Transactions Act (FACTA) Disposal Rule, requires “any person who maintains or otherwise possesses consumer information for a business purpose” to properly dispose of this data. 

If employers must retain these records—for example, to comply with a law requiring them to keep information used in employment decisions—both FACTA and state privacy laws mandate that the data be protected from unauthorized access or use. 

California, for example, requires that “a business that owns, licenses or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect that information from unauthorized access, destruction, use, modification or disclosure.”

A Checklist for Employers

  • Are credit checks relevant to the job for which you’re hiring? 
  • Have you provided all applicants with a copy of their credit report and a written description of their rights, as required by the Fair Credit Reporting Act?
  • Are criminal background checks aligned with Equal Employment Opportunity Commission guidance asking employers to consider the nature and gravity of an offense, the time that has passed since conviction, and the nature of the job sought?
  • Have you protected data collected during the hiring process against unauthorized use?

  • Have you made an effort to prevent the person making the hiring decision from learning information collected through social media about a candidate’s political or religious views?

  • Has information gathered about applicants who are not hired been properly disposed of, in accordance with the Fair and Accurate Credit Transactions Act?

  • Have you met state and local legal requirements regarding all background screening?

New Technologies

Some employers use vendors to provide background information in the pre-employment screening process. But regardless of how the data is collected, the Federal Trade Commission has made it clear that the information constitutes “consumer reports” under the FCRA. (Consumer reports can include information from a variety of sources, including credit reports and criminal records.)  That means that anyone who uses such reports is subject to a slew of requirements, including getting applicants’ written permission before gathering data and informing job seekers that hiring decisions may be made based on what is found. This is true even when companies use mobile apps to collect or process information.

Seeking insight about candidates by having them log in to their social media accounts also warrants caution. About half of states, including California, prohibit employers from requiring applicants to disclose passwords for social networks such as Twitter or Facebook. 

Public Sites

Even viewing job seekers’ public profiles or blog posts can be tricky. Companies must take care not to allow the person making the hiring decision to become aware of a candidate’s political or religious views—or any other information that could lead to a claim of hiring discrimination. For this reason, some employers opt to use third-party services for scanning social media sites or otherwise separate any social media scanning from any hiring manager’s duties.

Technology has both improved and complicated the pre-employment screening process. But there is one thing that hasn’t changed: the need for HR professionals to ensure that any information they gather is relevant to the job at hand and used with fairness and discretion.   

Kelly O. Scott and Patrick A. Fraioli Jr. are attorneys at Ervin Cohen & Jessup LLP in Beverly Hills, Calif. Scott is head of the firm’s Employment Law Department. Fraioli is a firm partner.