PogoWasRight.org

Menu
  • About
  • Privacy
Menu

Background checks: Why 603(y) doesn’t apply

Posted on September 9, 2015June 26, 2025 by Dissent

Lesley Fair writes:

Does your company use background checks in evaluating job applicants? If so, are you complying with the Fair Credit Reporting Act’s notice, consent, and disclosure requirements? A closing letter the FTC staff sent to California Health & Wellness elaborates on the applicability – or, in this instance, the inapplicability – of a narrow FCRA exception.

When it comes to background checks, the FCRA put a premium on notice, consent, and disclosure. That makes sense because the background check may determine whether someone ultimately gets the job.

Under the FCRA, if a potential employer intends to use a background screening report, it must disclose that to the job applicant and get the applicant’s consent. If the potential employer thinks it may not hire the applicant, it must give the applicant a “pre-adverse action” notice that details his or her right to review the report and explain any negative information.

If the company ultimately decides not to hire the person based on information in the report, it must give the applicant an adverse action notice. The notice explains the applicant’s right to dispute the accuracy or completeness of the report and to ask for another free copy within 60 days.

The FCRA includes a few very narrow exceptions to that procedure in Section 603(y), titled Exclusion of Certain Communications for Employee Investigations. For example, the law excludes from the definition of “consumer report” communications made to an employer in connection with an investigation of “(i) suspected misconduct relating to employment; or (ii) compliance with Federal, State or local laws and regulations, the rules of a self-regulatory organization, or any preexisting written policies of the employer.”

Among other things, staff’s letter to California Health & Wellness examines whether screening reports about job applicants are exempt from the FCRA’s notice, consent, and disclosure requirements because of Section 603(y). In a letter to the company, the FTC staff said no: “We view Section 603(y) as covering only investigations of current employees, rather than investigations of both current employees and job applicants.”

The staff offered three reasons for its conclusion:

  1. The language of Section 603(y) assumes an existing employer-employee relationship. Phrases like “suspected misconduct related to employment” and “preexisting written policies of the employer” suggest an investigation of someone who is already on the job, not a person who has an application pending. Even the title of the section refers to “employee investigations.”
  2. The legislative history of the provision refers to it as “a narrow technical correction.” At the time, employers were concerned the FCRA might be misconstrued to require them to prematurely notify employees of pending investigations of misconduct. The “correction” made it clear that employers don’t have to tip their hand. But that concern is utterly unrelated to background checks of job applicants.
  3. Courts have established that the FCRA is “undeniably a remedial statute that must be read in a liberal manner in order to effectuate the congressional intent underlying it.” Applying Section 603(y) to the background screening of applicants would allow the exception to swallow the rule.

That said, FTC staff decided not to recommend enforcement action against California Health & Wellness, citing the company’s current policy of notifying applicants of its intent to use screening reports, getting their authorization, and following the FCRA’s adverse action procedures. As with similar letters, it doesn’t conclude one way or the other whether the staff thought the law had been violated. Furthermore, “The Commission reserves the right to take further action as the public interest may warrant.”

What does the letter suggest to other companies? Maybe it’s time to reread the FTC brochure, Using Consumer Reports: What Employers Need to Know, and make sure your hiring procedures comply with the FCRA.

SOURCE: FTC

Related posts:

  • How Your Shadow Credit Score Could Decide Whether You Get an Apartment
  • “We would be less confidential than Google” – Proton threatens to quit Switzerland over new surveillance law
  • Two Data Brokers Settle FTC Charges That They Sold Consumer Data Without Complying With Protections Required Under the Fair Credit Reporting Act
Category: LawsU.S.Workplace

Post navigation

← License to connive: Boston still tracks vehicles, lies about it, and leaves sensitive resident data exposed
Meet The Former Palantir Crew Plotting To Blind Big Brother With Crypto’s Holy Grail →

Search

Contact Me

Email: info[at]pogowasright.org
Security Issue: security[at]pogowasright.org
Mastodon: Infosec.Exchange/@PogoWasRight
Signal: +1 516-776-7756
DMCA Concern: dmca[at]pogowasright.org

Research Report of Note

A report by EPIC.org:

State Attorneys General & Privacy: Enforcement Trends, 2020-2024

Categories

Recent Posts

  • Always watching: How ICE’s plan to monitor social media 24/7 threatens privacy and civic participation
  • Who’s watching the watchers? This Mozilla fellow, and her Surveillance Watch map
  • EPIC Publishes New Whitepaper Detailing Privacy Risks of Government Data Mining Programs
  • Modern cars are spying on you. Here’s what you can do about it.
  • Attorney General James and Multistate Coalition Secure $5.1 Million from Education Software Company for Failing to Protect Students’ Data       
  • EU Parliament committee votes to advance controversial Europol data sharing proposal
  • DHS offers “disturbing new excuses” to seize kids’ biometric data, expert says

RSS Recent Posts at DataBreaches.net

  • Manassas City Public Schools close on Monday due to cyberattack
  • San Joaquin County Superior Court concludes sensitive info leaked in data breach
  • NCCIA arrests man over massive data breach involving millions of Pakistanis
  • Defense Contractors Are Silencing Their Cybersecurity Watchdogs
  • Fourth Circuit Weighs in on Standing in Data Breach Class Actions
©2025 PogoWasRight.org. All rights reserved.