5 Steps To Ensure Compliance With The FCRA by Crimcheck - HTML preview

FCRA Compliance: Step 5

Disposing of Background Information

Once you have no further use of the information gathered through background checks, you may want to dispose of it. The legal guidelines which govern such a disposal are contained in Federal Trade Commission (FTC) regulations which are collectively referred to as “the Disposal Rule. ”

The Disposal Rule governs the disposal of what it refers to as “consumer information.” In the context of background checks, consumer information can mean two things. First of all, it refers to any reports or documents which contain the background information.

Secondly, it refers to any other information which is derived from the background reports, as long as the individual is identifiable. For instance, notes about a candidate made by a recruitment manager can be classified as “consumer information” – as long as there is sufficient information to identify the candidate.

The Disposal Rule provides guidelines on how such information should be disposed of. According to the Disposal rule, the term “disposal” can mean two things. The first is destruction of the information. The second is transfer of electronic equipment which contained the information (relevant for electronic information). We shall look at each of these in detail shortly.

In terms of destruction, the Disposal Rule does not stipulate specific methods by which background information should be destroyed. However, it states that whatever method is used should make it impossible to reconstruct the information in a manner which can be reused. It recommends methods such as shredding, burning or pulverizing for paper documents, and deleting, wiping or magnetically swiping for electronic records.

The Disposal Rule permits an employer to hire a disposal company to destroy the consumer information on its behalf.

Before hiring the company, the FTC advises the employer to perform due diligence which includes the following:

• review an audit of the disposal company’s operations, including whether its operations comply with the Disposal Rule
• use information from several references to evaluate the disposal company
• require that the company possess certification from a reputable trade organization
• review and evaluate the company’s policies or procedures, especially the ones regarding information security

It is important to note that the due diligence detailed above is not part of the Disposal Rule. As such, observing it isn’t a must. However, it is a recommendation which is offered by the FTC to guide employers on how to vet disposal companies. Given the sensitivity around consumer information, the due diligence can provide a rigorous framework through which an employer can select the perfect disposal company.

The Disposal Rule requires strict storage procedures to be observed before and during the destruction process. Under no circumstances should an unauthorized party be granted access to the consumer information – not even when it is on the verge of being destroyed.

The one aspect which the Rule doesn’t explicitly spell out is how long the background information may be kept before destruction. It states that employers should consult the relevant federal and state laws which deal with storage of consumer information.

This is because there are different laws and regulatory bodies which require information to be kept for various lengths of time.

The EEOC  and the Department of Labor both have guideline for record retention.

However, setting time limits to keeping background records isn’t limited to federal departments and regulatory bodies. Most state anti-discrimination statutes require employees to keep information regarding the hiring process for two years or more. In the event that a discrimination claim has been made, most states require that the relevant documents be kept until the case is closed.

There are also certain state laws which can influence how long background information is kept. For instance, in Oregon, employers are supposed to keep any records used to determine a person’s suitability for hire, promotion and other personnel decisions for at least 60 days after termination of employment. If background information is among the records, then employers would be legally bound to keep them for that time period.

Once you have ascertained that it is perfectly legal to destroy the background information, then the Disposal Rule comes into play. The Disposal Rule provides every guideline you need in order to destroy the background information. In case you don’t have the technical capacity to carry out a proper disposal, you can always hire a disposal company. Just remember to use the due diligence process which is recommended by the FTC.

With that, we come to the end of our Fair Credit Reporting Act (FCRA) compliance series. Hopefully, you now have a fair idea of the different FCRA provisions. So, the next time you intend to use background checks to inform your hiring decisions, please remember that there are legal guidelines which need to be followed.

Make sure you diligently follow the FCRA guidelines so that you don’t join the infamous list of employers who violated the FCRA and ended up paying millions of dollars in court settlements.

Crimcheck.com is a consumer reporting agency providing screening services since 1991. For more information go to, www.crimcheck.com or visit the FTC.

Disclaimer:

The materials available in this document are for general informational purposes only and not for the purpose of providing legal advice. These laws change frequently and varies from jurisdiction to jurisdiction. Being general in nature, the information and materials provided may not apply to any legal set of circumstances. You should contact your attorney to obtain advice with respect to any employment issue.