Albert Einstein believed “Everything should be made as simple as possible, but not simpler.” The Ninth Circuit seems to agree. In Gilberg v. Cal. Check Cashing Stores, LLC, No. 17-16263, 2019 WL 347027 (Ninth Cir. Jan. 29, 2019), the Ninth Circuit held a single form combining nearly identical federal and state disclosures violates both federal and state laws. Employers who conduct pre-employment background checks must now provide applicants with two separate standalone forms: (1) disclosure and consent under Fair Credit Reporting Act; and (2) disclosure and consent under California’s Investigative Consumer Reporting Agencies Act (or other applicable state law). This decision applies to employees providing services in the Ninth Circuit (California, Arizona, Hawaii, Alaska, Idaho, Montana, Nevada, Oregon and Washington).

Some Background on Background Checks Laws

Consumer privacy and background checks continue to be a complex area for legislation, compliance, and lawsuits. Only a year has passed since California’s Ban the Box went into effect and employers were forced to substantially revise employment applications, policies and hiring practices before conducting criminal background checks. After an employer makes a conditional offer of employment, they can conduct a criminal background check. Federal, state and local laws require employers to give specific and often duplicative disclosures about an applicant’s rights under the applicable laws and obtain express consent. Given their redundancy, many organizations simplify the forms and use a single disclosure and consent form that explains federal and various state laws. In light of this new decision, such simple solutions are no longer acceptable.

Fair Credit Reporting Act (“FCRA”)

Congress passed FCRA in 1970 to address concerns regarding inaccurate reporting by consumer reporting agencies and protect the privacy rights of consumers. In addition to more general consumer privacy rights, FCRA applies to any background check conducted by an employer concerning current or prospective employees.

Under FCRA, employers must provide applicants with a “clear and conspicuous disclosure” explaining the employer may seek and obtain a consumer report concerning the applicant. 15 U.S.C. § 1681b(b)(2)(A) (emphasis added). The disclosure must be “in a document that consists solely of the disclosure.” Id. This is referred to as the “standalone document requirement.” Employers must also obtain written consent prior to obtaining any report.

In Syed v. M-I, LLC, 853 F.3d 492 (Ninth Cir. 2017), the Ninth Circuit clarified FCRA’s standalone document requirement and held the employer violated FCRA by including a liability waiver in the same document as the FCRA disclosure. The court based this decision on the plain language of FCRA and the use of the term “solely” in the statute.

Failure to follow FCRA carries significant risk. FCRA allows plaintiffs to recover actual damages, costs and attorney’s fees. If the alleged FCRA violation is found to be “willful,” plaintiffs may recover statutory damages of $100 to $1,000, per violation.

Investigative Consumer Reporting Agencies Act (“ICRAA”)

Five years after the passage of FCRA, California passed ICRAA to ensure that consumer reporting agencies exercise their responsibilities with fairness, impartiality and respect for consumers’ right to privacy. Although there are some differences, ICRAA largely mirrors FCRA.

Specifically, ICRAA requires that employers wishing to obtain a consumer report concerning prospective employees: “provide[] a clear and conspicuous disclosure in writing to the consumer at any time before the report is procured or caused to be made in a document that consists solely of the disclosure….” Cal. Civ. Code § 1786.16(a)(2)(B).

Not to be outdone by its federal counterpart, ICRAA also requires that the disclosure inform prospective employees: (1) the purpose of the report; (2) that the disclosure “may include information on the consumer’s character, general reputation, personal characteristics, and mode of living”; (3) identify the name, address and telephone number of the investigative consumer reporting agency conducting the investigation; and (4) the scope of the investigation. Id.

The potential liability for violations of ICRAA is also substantial. Both the company issuing the report and the company using the report may be liable for actual damages or $10,000, per violation, whichever is greater. Moreover, attorney’s fees and costs may be awarded to a prevailing plaintiff alleging a violation of ICRAA.

Background Leading Up to Litigation

In Gilberg, the plaintiff applied for a position with CheckSmart. Two weeks after completing an employment application, Gilberg received and signed a single page form entitled “Disclosure Regarding Background Investigation.” The form was in 8 point font and consolidated consumer disclosures mandated under federal and multiple state laws. Ultimately, CheckSmart hired Gilberg and she worked for the company for five months before her employment was terminated.

Gilberg then filed a putative class action alleging CheckSmart failed to provide appropriate disclosures under both FCRA and ICRAA.

Stand-Alone Document Requirement Mandates Separate Federal and State Disclosure and Consent Forms

In Gilberg, the Ninth Circuit held CheckSmart’s disclosure form violated FCRA because it failed to meet the standalone document requirement consisting “solely of the FCRA disclosure.”

CheckSmart’s one-size-fits-all form applied to multiple jurisdictions and included mandatory disclosures under FCRA, ICRAA and a number of other states (in which Gilberg did not reside or work). The form also referenced “Notice Regarding Background Investigation” and a “Summary of Your Rights Under the Fair Credit Reporting Act.” The court found that the inclusion of additional disclosures, beyond those required under FCRA, violated FCRA’s requirement that the disclosure be a standalone document.

“Clear and Conspicuous” Means Only FCRA Disclosures

The court found that the combo form violated FCRA’s “clear and conspicuous” requirement because “extraneous information [was] as likely to confuse as it [was] to inform.” The holding of the court is clear: the FCRA disclosure should only contain those disclosures explicitly required by FCRA. Simply put, including any additional information pursuant to another federal, state or local law violates FCRA under Gilberg.

In addition to the extraneous language included in the disclosure, the court found that the form “contain[ed] language that a reasonable person would not understand.” The court found the following sentence was not clear: “The scope of this notice and authorization is all-encompassing; however, allowing CheckSmart Financial, LLC to obtain from any outside organization all manner of consumer reports and investigative consumer reports now and, if you are hired, throughout the course of your employment to the extent permitted by law.” First, the court found that this sentence did not explain how the notice was all-encompassing and did not disclose the impact that authorization would have on a prospective employee’s rights. Second, the court focused on the portion of the sentence after the semicolon, finding that it was incomplete, lacked a subject and that the drafting may have caused confusion as to the possible limits of the authorization.

ICRAA Violations Were Also Found

Not surprisingly given their similarities, the court held that CheckSmart’s disclosure also violated ICRAA. Since ICRAA contains the same “clear and conspicuous” and standalone document requirements, CheckSmart’s single document violated ICRAA.

Simple Takeaways

Employment background checks continue to be a focus for legislation and litigation. Below are a few steps to reduce risk in light of this new Ninth Circuit opinion:

• Companies operating within the Ninth Circuit that perform employment background checks should immediately review all background check disclosures and consent forms to ensure that such forms meet the stand-alone document requirements in compliance with Gilberg.

• In order to ensure that FCRA and ICRAA disclosures are “clear and conspicuous,” consider the following:

  • Create a standalone document;

  • Use clear and readable font (at least 10 – 12 point);

  • Break up the disclosure with simple headers as appropriate;

  • Draft the disclosure with simple clear language;

  • Avoid legalese; and

  • Refrain from including any extraneous disclosures, releases or information.

• If your company uses third-party background check vendors to procure consumer reports, request a copy of their disclosure and consent forms to make sure they are compliant with Gilberg.

• Revise your agreements with background check vendors to confirm consumer disclosures and consents are obtained in compliance with federal, state and local laws. Update indemnity provisions in those agreements to shift the risk back to the vendors that often provide disclosures and consent forms.