For Employers

Yes. Under the FCRA, you must give the applicant a clear standalone written disclosure and obtain their written authorization before a consumer reporting agency runs a report. The disclosure has to be its own document, not buried in the job application. Authorization is required for each report, though a properly worded authorization can cover reports obtained later during employment.

The FCRA sets no specific retention period, but EEOC rules require you to keep hiring and personnel records for at least 1 year from the date the record was made or the employment action was taken, whichever is later. Because FCRA claims can be filed up to 5 years after a violation occurs, many employers retain screening records for 5 years. When the retention period ends, the information must be disposed of securely.

Be cautious. The EEOC’s position is that an arrest alone does not establish that criminal conduct occurred, so excluding someone based on an arrest by itself is not job related or consistent with business necessity. You may consider the underlying conduct if you determine it makes the person unfit for the specific position. Several states restrict or prohibit the use of non-conviction records entirely, so check the law where the candidate will work.

The applicant has the right to dispute inaccurate or incomplete information directly with the consumer reporting agency, which must reinvestigate, usually within 30 days. Do not finalize an adverse decision while a dispute is pending. Giving the applicant a copy of the report and a summary of their rights before taking adverse action is what makes this possible.

The FCRA requires a two-step process. First, send a pre-adverse action notice with a copy of the report and the Summary of Your Rights, then allow a reasonable period to respond. Second, if you proceed, send a final adverse action notice identifying the consumer reporting agency, stating that the agency did not make the decision, and explaining the right to a free report and to dispute the information. Some states add longer waiting periods or extra notice requirements.

The most common FCRA violation is combining the disclosure with other content. The disclosure must be a standalone document containing nothing but the disclosure itself. Adding a liability waiver, state law notices, or the job application to the same page has produced significant class action exposure for employers.

Rejecting a candidate immediately after seeing a report skips a required step. You must first send the pre-adverse action notice with a copy of the report and the summary of rights, then give the person a reasonable opportunity to respond before making the decision final.

The FCRA restricts reporting of most non-conviction items older than 7 years for positions paying under $75,000. Many states impose their own limits, including on convictions, regardless of salary. Beyond timing, the EEOC expects you to weigh how much time has passed, the nature of the offense, and whether it relates to the job.

Screening some candidates more strictly than others invites a discrimination claim. Running checks or weighing results differently based on race, national origin, sex, religion, disability, genetic information, or age 40 and over is unlawful. Apply the same criteria to everyone considered for the same role, and document your standards in writing.

You remain responsible for compliance even when a vendor runs the check. A provider that cuts corners on accuracy, dispute handling, or state law compliance creates liability for you. Look for FCRA-compliant procedures, documented dispute processes, and familiarity with the states where you hire.