In recent years, negligent hiring and retention lawsuits have seen a dramatic rise, with settlement payouts averaging over a million dollars. These cases are predicated on the theory that an employer may be held liable for its negligence in placing a person with certain known propensities for criminal or other unfit behavior in an employment position where the individual poses a threat to others. The most common defense against negligent hiring or retention actions is based on foreseeability, which is often determined through a background investigation. Some courts have been more flexible than others in damage awards, but regardless of their stance, the closer the connection between the perpetrator’s dangerous propensity and the actual tortious conduct, the stronger the case against the employer. The law in both negligent hiring and negligent retention also recognizes that a company’s duty to avoid employing dangerous people does not end when an individual is hired–it extends to negligent supervision, negligent training and negligent firing.

Nearly every investigation that touches on employment is covered by the Fair Credit Reporting Act (FCRA), which defines employment (purposes) as “evaluating a consumer for employment, promotion, reassignment or retention as an employee.” If an employer uses a third party screening service to conduct a background investigation of an applicant or employee, that company is considered a “consumer reporting agency” (CRA) under the FCRA. The CRA’s reports, known as consumer reports, may contain information from educational institutions, professional licensing boards, former employers, courts, credit bureaus, references, motor vehicle departments, regulatory entities, media sources, etc.

The FCRA is a complex federal statute that has been significantly revised since 1970. But the Act’s primary mandate remains that CRAs adhere to “reasonable procedures” to protect the confidentiality, accuracy, and relevance of consumer information. Under its Fair Information Practices, the FCRA has established rules concerning personal information that include rights of data quality (to access, dispute and correct), data security, usage limitations, data destruction, disclosures, user consent, and accountability. The FCRA requires the employer/user to affirm to the CRA that it is in compliance (with FCRA) and has enacted the following directives prior to the initiation of a consumer report:

• Verified that there is a legitimate need for requesting a consumer report
• Certified that written permission was obtained from the applicant or employee and proper disclosures were provided
• Stated the reason for requesting a consumer report
• Certified that the information will be used for employment purposes only.

Before any adverse action is taken based on information in the consumer report, the FCRA obligates the employer to provide the applicant or employee a copy of the report and summary of consumer rights prescribed by the FCRA. And if adverse action is taken, the employer must deliver an “adverse action notice” to the affected individual. Further, the employer must certify that it will not use any information from a consumer report in violation of the applicable federal or state equal opportunity laws and regulations.

The FCRA makes a distinction between a “consumer report” and “investigative consumer report.” Its delineation of a “consumer report” is that it is comprised of verifications of facts about education, employment or other claims made by the applicant, while an “investigative consumer report” is a compilation of information about character, general reputation, personal characteristics, or mode of living through interviews. Thus, an employer who uses investigative consumer reports must comply with the provisions of the FCRA that apply generally to consumer reports as well as the provisions that are specific to investigative consumer reports which include “clearly and accurately” disclosing in writing that it may obtain the aforementioned information. This notice must contain a statement advising the individual of the right to request additional disclosures concerning the nature and scope of the inquiry, along with a written summary of consumer rights. Also, for an investigative consumer report, the disclosure must be made within three days after such report is requested, while in a consumer report, notice must be given before the report is procured.

The FCRA rules also apply when an employer uses a third party to investigate employee misconduct. The employee must be notified “clearly and conspicuously” and authorize, in writing, the undertaking of an investigative consumer report. If the employer disciplines or adversely treats the employee based upon the information in the report, the employer must provide the employee, within 60 days of the adverse decision, the following:

• Notice of the disciplinary action
• Name, address and telephone phone number of third party that prepared the report
• Statement that said third party had no input into the decision to discipline the employee and thus will not provide information about the action taken
• Notice that the employee is entitled to a free copy of the report and can request that the employer state the reason for the disciplinary action.

The FCRA does not apply to investigations of misconduct conducted by internal personnel or by third parties which do not regularly prepare such reports.

Violations of the FCRA can lead to civil and/or criminal penalties for the CRA and the employer. Civil penalties may carry nominal damages (up to one thousand dollars if no actual damages exist), actual and punitive damages, and attorneys’ fees and costs, if there is “willful noncompliance.” Civil penalties for “negligent noncompliance” are confined to actual damages and attorneys’ fees and costs. Criminal penalties may be imposed when a party knowingly and willfully obtains information from a CRA under false pretenses.

Establishing a relationship with a reputable CRA is one of the best assurances of FCRA compliance. An experienced company can provide guidance not just in the legal process of the FCRA, but also instill trust that it has met its related obligations.