When Is A Company That Does Background Checks Considered A Consumer Reporting Agency?

April 9, 2021

By a Biometrica Staffer

According to an October 2019 report from the Consumer Financial Protection Bureau (CFPB), there were 1,954 background screening companies operating in the United States in that year, with a total revenue of about $3.2 billion. According to the report, 32.1% of revenue was estimated to come from prospective tenant reports, and the remainder from employers. Criminal record check services accounted for 36.5% of industry revenue, credit check services account for 46.4%, while reference check services for 17.1%.

A June 2018 survey of employers, conducted by HR.com and commissioned by what was then the National Association of Professional Background Screeners (NAPBS) and is now the Professional Background Screening Association (PBSA), found that 95% of employers surveyed stated they conduct one or more types of background screening; 94% of those employers that conducted background screening include some form of criminal history check in their reports.

But are the organizations conducting background checks considered Consumer Reporting Agencies? According to the FTC, which, along with the CFPB enforces actions under the Fair Credit Reporting Act (FCRA), “even if you don’t think of your company as a consumer reporting agency, it may be one if it provides information about people to employers for use in hiring or other employment decisions.” So, when is your company a Consumer Reporting Agency (or a CRA)?

Before we can answer that question, it’s probably important to define two things:

1. What is a consumer report; and
2. What is a Consumer Reporting Agency?

The term “Consumer Reporting Agency” is a reference to “any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties,” and that uses any means or facility of interstate commerce for the purpose of preparing or furnishing those consumer reports. It’s important to note here that the term “person” — with relation to consumer reporting agencies — can denote an individual, or signify a partnership, corporation, trust, estate, cooperative, association, government or governmental subdivision or agency, or other entity.

The term “consumer report” really refers to any communication, whether oral, written, or in some other form, provided by one company to another organization, generally for the purpose of determining an individual’s — called the “consumer” — eligibility for a certain permissible purpose.  

According to 15 U.S. Code § 1681b, in general, for a report to be furnished legally, these permissible purposes must reflect one of the following criteria:

First, that the report is in response to the order of a court having jurisdiction to issue such an order, or a subpoena issued in connection with proceedings before a Federal grand jury. Second, it is in accordance with the written instructions of the consumer to whom it relates.

Then, the report must be furnished to a person (individual or organization), which it has reason to believe —

• intends to use the information in connection with a credit transaction involving the consumer and involving an extension of credit to, or review or collection of an account of, the consumer; or
• intends to use the information for employment purposes; or
• intends to use the information in connection with the underwriting of insurance involving the consumer; or
• intends to use the information in connection with a determination of the consumer’s eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant’s financial responsibility or status; or
• intends to use the information, as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation; or
• otherwise has a legitimate business need for the information in connection with a business transaction that is initiated by the consumer; or to review an account to determine whether the consumer continues to meet the terms of the account.

The permissible criteria could also include furnishing a report

• to the executive departments and agencies in connection with the issuance of government-sponsored and individually billed travel charge cards; or
• in response to a request by the head of a state or local child support enforcement agency (or state or local government authorized by the head of such agency), if the person making the request certifies to the CRA that
• the consumer report is needed for the purpose of establishing an individual’s capacity to make child support payments, determine the appropriate level of such payments, or enforce a child support order, award, agreement, or judgment; or
• the parentage of the consumer for the child to which the obligation relates has been established or acknowledged by the consumer in accordance with State laws under which the obligation arises (if required by those laws); and
• the consumer report will be kept confidential, will be used solely for a purpose described (in a) above, and will not be used in connection with any other civil, administrative, or criminal proceeding, or for any other purpose.

A report can also be furnished to an agency administering a State plan under section 654 of title 42 for use to set an initial or modified child support award.

In addition, a report is permitted to be provided to the Federal Deposit Insurance Corporation or the National Credit Union Administration as part of its preparation for its appointment or as part of its exercise of powers, as conservator, receiver, or liquidating agent for an insured depository institution or insured credit union under the Federal Deposit Insurance Act [12 U.S.C. 1811 et seq.] or the Federal Credit Union Act [12 U.S.C. 1751 et seq.], or other applicable Federal or State law, or in connection with the resolution or liquidation of a failed or failing insured depository institution or insured credit union, as applicable.

The Reason Matters

So, basically, background screening reports are “consumer reports” under the FCRA when they serve as a factor in determining a person’s eligibility for employment, credit, insurance, housing, or other permissible purposes and they include information “bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.”

In the main, all companies that sell or provide consumer reports are “consumer reporting agencies” under the Fair Credit Reporting Act. If you believe that your employment background screening company is a consumer reporting agency under the FCRA, what does the law require you to do? It’s pretty detailed but fairly clear.

Follow reasonable procedures to assure accuracy. 

Among other things, the FCRA requires you to establish and follow “reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.” Certain practices may be indicators that a background screening company isn’t following reasonable procedures. For example, if a report lists criminal convictions for people other than the applicant or employee — for instance, a person with a middle name or date of birth different from the applicant’s — that raises FCRA compliance concerns. Other indications that a company’s procedures might not be reasonable include screening reports with multiple entries for the same offense or that list criminal records that have been expunged or otherwise sealed.

Get certifications from your clients.  

As detailed above, consumer reporting agencies may provide consumer reports only to those with a specific permissible purpose, like employment. The FTC makes it clear that organizations providing consumer reports have to verify that their clients are legitimate and requires them to certify that they will use the reports only for employment purposes. In addition, the FCRA mandates that job applicants and employees have the right to know that information about them is being reported to employers or potential employers.

According to the FTC, a background checking company must, therefore, get certifications from their clients attesting that:

1. The employer notified the applicant and got the applicant’s written permission to get a background report; and
2. The employer will comply with the FCRA’s requirements; and
3. The employer won’t discriminate against the applicant or employee, or otherwise misuse the information in violation of federal or state equal opportunity laws or regulations. 

Provide your clients with information about the FCRA. 

The FCRA also requires that a background checking company provide their clients with information about their responsibilities under the statute Notice To Users of Consumer Reports, and a copy of A Summary Of Your Rights Under the FCRA, along with the background report.

Honor the rights of applicants and employees. 

The FCRA gives consumers certain rights that must be complied with, including providing access to consumer files when they ask for them, conducting a reasonable investigation when they dispute the accuracy of information, and giving them written notice of the results of investigations. The FTC states that it is a “violation of the FCRA not to respond in a timely way to consumers’ inquiries and disputes.” Another FCRA violation? “Creating unreasonable obstacles for consumers trying to exercise their rights under the FCRA.”

What if background screening reports include public record information?

The FCRA has special provisions if reports contain public record information — for example, courthouse records — and are used for employment purposes. Broadly speaking, if an organization includes public record information in the reports they provided for employment purposes, the law gives them two options:

1) Notify the person who is the subject of the report when public record information is being reported; or

2) Maintain what the FCRA calls “strict procedures” designed to ensure that reported public record data is complete and up to date.

For instance, under the FCRA, a CRA generally may not report records of arrests that did not result in entry of a judgment of conviction, where the arrests occurred more than seven years ago. However, the FCRA also does clarify that items of public record relating to arrests, indictments and convictions are considered up to date if the CRA reports the current public record status of the item at the time of the report. For example, the FTC has issued guidance that if a CRA reports an indictment, it must also report any dismissal or acquittal available on the public record as of the date of the report.

Similarly, if a CRA reports a conviction, it must report a reversal that has occurred on appeal. Because the requirement to report complete and up-to-date information is item-specific, the report has to include the current, complete, and up-to-date public record status of each individual item reported. While the FTC has not indicated that a company has an obligation to continually update reports that it has already provided, the report should be up to date at the time it is provided.

With Biometrica, for instance, as we carry real-time data, which is updated on an hourly basis, our records match the most current available public records for an arrest. We also update all law enforcement updates to the case as it moves through the system, when law enforcement updates the case concerned. Any report provided is always current and updated at the time and date the report is provided.

You can see more on Biometrica’s FCRA guidance here.

Do note that Biometrica, while being a technology (SaaS and data) company, is an associate member of the PBSA and has a PI license.