PogoWasRight.org

Menu
  • About
  • Privacy
Menu

Background checks: Why 603(y) doesn’t apply

Posted on September 9, 2015June 26, 2025 by Dissent

Lesley Fair writes:

Does your company use background checks in evaluating job applicants? If so, are you complying with the Fair Credit Reporting Act’s notice, consent, and disclosure requirements? A closing letter the FTC staff sent to California Health & Wellness elaborates on the applicability – or, in this instance, the inapplicability – of a narrow FCRA exception.

When it comes to background checks, the FCRA put a premium on notice, consent, and disclosure. That makes sense because the background check may determine whether someone ultimately gets the job.

Under the FCRA, if a potential employer intends to use a background screening report, it must disclose that to the job applicant and get the applicant’s consent. If the potential employer thinks it may not hire the applicant, it must give the applicant a “pre-adverse action” notice that details his or her right to review the report and explain any negative information.

If the company ultimately decides not to hire the person based on information in the report, it must give the applicant an adverse action notice. The notice explains the applicant’s right to dispute the accuracy or completeness of the report and to ask for another free copy within 60 days.

The FCRA includes a few very narrow exceptions to that procedure in Section 603(y), titled Exclusion of Certain Communications for Employee Investigations. For example, the law excludes from the definition of “consumer report” communications made to an employer in connection with an investigation of “(i) suspected misconduct relating to employment; or (ii) compliance with Federal, State or local laws and regulations, the rules of a self-regulatory organization, or any preexisting written policies of the employer.”

Among other things, staff’s letter to California Health & Wellness examines whether screening reports about job applicants are exempt from the FCRA’s notice, consent, and disclosure requirements because of Section 603(y). In a letter to the company, the FTC staff said no: “We view Section 603(y) as covering only investigations of current employees, rather than investigations of both current employees and job applicants.”

The staff offered three reasons for its conclusion:

  1. The language of Section 603(y) assumes an existing employer-employee relationship. Phrases like “suspected misconduct related to employment” and “preexisting written policies of the employer” suggest an investigation of someone who is already on the job, not a person who has an application pending. Even the title of the section refers to “employee investigations.”
  2. The legislative history of the provision refers to it as “a narrow technical correction.” At the time, employers were concerned the FCRA might be misconstrued to require them to prematurely notify employees of pending investigations of misconduct. The “correction” made it clear that employers don’t have to tip their hand. But that concern is utterly unrelated to background checks of job applicants.
  3. Courts have established that the FCRA is “undeniably a remedial statute that must be read in a liberal manner in order to effectuate the congressional intent underlying it.” Applying Section 603(y) to the background screening of applicants would allow the exception to swallow the rule.

That said, FTC staff decided not to recommend enforcement action against California Health & Wellness, citing the company’s current policy of notifying applicants of its intent to use screening reports, getting their authorization, and following the FCRA’s adverse action procedures. As with similar letters, it doesn’t conclude one way or the other whether the staff thought the law had been violated. Furthermore, “The Commission reserves the right to take further action as the public interest may warrant.”

What does the letter suggest to other companies? Maybe it’s time to reread the FTC brochure, Using Consumer Reports: What Employers Need to Know, and make sure your hiring procedures comply with the FCRA.

SOURCE: FTC

No related posts.

Category: LawsU.S.Workplace

Post navigation

← License to connive: Boston still tracks vehicles, lies about it, and leaves sensitive resident data exposed
Meet The Former Palantir Crew Plotting To Blind Big Brother With Crypto’s Holy Grail →

Now more than ever

Search

Contact Me

Email: [email protected]

Mastodon: Infosec.Exchange/@PogoWasRight

Signal: +1 516-776-7756

Categories

Recent Posts

  • DeleteMyInfo Wins 2025 Digital Privacy Excellence Award from Internet Safety Council
  • TikTok Loses First Appeal Against £12.7M ICO Fine, Faces Second Investigation by DPC
  • German court offers EUR 5000 compensation for data breaches caused by Meta
  • How to Build on Washington’s “My Health, My Data” Act
  • Department of Justice Subpoenas Doctors and Clinics Involved in Performing Transgender Medical Procedures on Children
  • Google Settles Privacy Class Action Over Period Tracking App
  • ICE Is Searching a Massive Insurance and Medical Bill Database to Find Deportation Targets

RSS Recent Posts on DataBreaches.net

  • McDonald’s McHire leak involving ‘123456’ admin password exposes 64 million applicant chat records
  • Qilin claims attack on Accu Reference Medical Laboratory. It wasn’t the lab’s first data breach.
  • Louis Vuitton hit by data breach in Türkiye, over 140,000 users exposed; UK customers also affected (1)
  • Infosys McCamish Systems Enters Consent Order with Vermont DFR Over Cyber Incident
  • Obligations under Canada’s data breach notification law
©2025 PogoWasRight.org. All rights reserved.