If you use an outside company to run background checks on your applicants or employees, you need to review your disclosure forms asap to make sure you don’t run afoul of the Fair Credit Reporting Act (FCRA).

In a case of first impression by a federal court of appeals, the Ninth Circuit recently ruled that a prospective employer willfully violated the FCRA by including a liability waiver in its FCRA-mandated disclosure form it provided to job applicants. Syed v. M-I, LLC, 846 F.3d 1034 (9th Cir. 2017). In fact, any extraneous writing on the disclosure form can lead to significant liability for a willful FCRA violation. And if you think you are safe by using forms provided by your background check company, think again.

FCRA Refresher

Background checks that inquire into a person’s criminal history, driving record, employment history, professional licensing, credit history, or other similar records, can either be done in-house or by an outside third party. In other words, your HR department may make calls, check online resources, or contact law enforcement or the DMV to obtain this information directly, or your company may outsource this function to a background check company that can do the leg work for you. If you use a background check company or another third party to compile this information on your behalf, the information provided to you is considered a consumer report and is subject to the FCRA.

Because of the private nature of this information, the FCRA limits the reasons for which consumer reports may be obtained. Using consumer reports for employment purposes is a permissible purpose under the FCRA, but such use comes with numerous obligations. In 1996, concerned that prospective employers were obtaining and using consumer reports in a way that violated applicant’s privacy rights, Congress amended the FCRA to impose a disclosure and authorization provision. Pursuant to that provision, a prospective employer is required to disclose that it may obtain the applicant’s consumer report for employment purposes and it must obtain the individual’s consent prior to obtaining the report.

FCRA Disclosure Must Consist “Solely” of Disclosure

Specifically, the FCRA provision states that a person may not procure a consumer report for employment purposes with respect to any consumer unless “(i) a clear and conspicuous disclosure has been made in writing to the consumer at any time before the report is procured or caused to be procured, in a document that consists solely of the disclosure, that a consumer report may be obtained for employment purposes; and (ii) the consumer has authorized in writing (which authorization may be made on the document referred to in clause (i)) the procurement of the report by that person.”

It is clear that the required disclosure should be its own standalone document and should not be included within a job application or other onboarding documents. It is also clear that the authorization (consent form) may be included on the disclosure document. But what about other information? May the disclosure form include a statement that the applicant releases the employer (and/or the background check company) from any liability and waives all claims that may arise out of use of the disclosure and obtaining the background check report?

Court Nixes Liability Waiver As Willful FCRA Violation

What may or may not appear in an FCRA disclosure form has been a hot topic in recent years. Numerous class actions have been filed by job applicants (and their aggressive attorneys) alleging that any extraneous language in a disclosure form violates the requirement that the document consist “solely” of the disclosure. Although numerous lower federal courts have grappled with the meaning of that provision, the Ninth Circuit became the first federal appellate court to examine it. (The Ninth Circuit’s rulings apply to Montana, California, Idaho, Washington, Oregon, Nevada, Arizona, Alaska, and Hawaii.)

In Syed’s case, the prospective employer provided applicants with a document labeled “Pre-employment Disclosure Release” that appears to have been obtained from its background check company, PreCheck, Inc. The third paragraph on the single-page document included the following statement:

“I hereby discharge, release and indemnify prospective employer, PreCheck, Inc., their agents, servants and employees, and all parties that rely on this release and/or the information obtained with this release from any and all liability and claims arising by reason of the use of this release and dissemination of information that is false and untrue if obtained from a third party without verification.”

On behalf of a class of over 65,000 job applicants, Syed alleged that by including this liability waiver, his prospective employer and the background check company violated the statutory requirement that the document consist “solely” of the disclosure. The Ninth Circuit agreed.

The Court found that the text of the FCRA provision was unambiguous and that even though the law permits the authorization to be included on the disclosure document, that was an express exception authorized by Congress. The Court further explained the difference between an authorization and a waiver by stating that the authorization requirement granted authority or power to the individual consumer whereas the waiver requires the individual to give up or relinquish a right. Therefore, the Court rejected the employer’s argument that the FCRA somehow explicitly permits the inclusion of a liability waiver in the disclosure.

Moreover, the Court deemed this FCRA violation to be willful. Stating that “this is not a ‘borderline case,’” the Court ruled that the employer acted in reckless disregard of its statutory duty under the unambiguous disclosure requirement. As a willful FCRA violation, the employer faces statutory damages of between $100 and $1,000 per violation (remember, there were over 65,000 class members), plus punitive damages and attorneys’ fees and costs.

$1.6 Million Settlement By Background Check Company

In early 2016, PreCheck, Inc. agreed to settle the class action. The class members alleged that PreCheck willfully violated the FCRA by providing consumer reports for employment purposes without first obtaining from M-I and other employers a certification of compliance that the employers had complied with the disclosure requirements. PreCheck agreed to pay $1.6 million out of which class representative Syed was awarded $5,000 as an incentive payment, and the attorneys for the class were paid $400,000 in attorney’s fees.

Review Your FCRA Disclosure and Authorization Forms Now

FCRA violation cases are tailor-made as class actions as the use of a non-compliant form can apply to hundreds, if not thousands, of job applicants and employees of a single employer. And the potential liability is significant. If you conduct background checks through a third party, pull out your disclosure and authorization forms now. Read them carefully and remove any liability waivers, releases, and indemnity clauses. These sorts of provisions are not permitted under the Ninth Circuit’s recent ruling.

Then, as a best practice, remove any other extraneous information on the disclosure form, such as at-will employment statements, state law notices, requests for personal references, etc. Although not specifically addressed in the recent case, these additional statements could also violate the FCRA requirement that the document consist solely of the disclosure. If you need to provide other information to applicants or employees, even as it applies to background checks, put it on a separate document with a separate title.  Keeping your disclosure and authorization document short and without additional information or waivers will go a long way in avoiding FCRA class actions.