Employment Decisions

California Consumer Privacy Act (CCPA) and Employment Background Screening

Key Points:

  1. Limited Applicability Due to AB 25

Initially, the CCPA broadly defined “consumer” to include job applicants and employees. However, Assembly Bill 25 (AB 25) amended the CCPA to temporarily exclude personal information collected from job applicants, employees, and independent contractors from most CCPA provisions.

This exclusion was in effect until January 1, 2023, after which some CCPA rights were extended to employees and job applicants. As of now, employers must comply with the following CCPA provisions when using background screening services:

  • Notice at collection–employers must inform applicants about:
  • What personal data is being collected (e.g., criminal history, credit data, identifiers)
  • The purpose of data collection (e.g., hiring decisions)
  • Data security obligations:
    Employers must implement reasonable security measures to protect personal data. If a breach occurs due to negligence, affected individuals may sue for statutory damages.
  1. Overlap with Other Laws

Employers in California must also comply with:

  • Fair Credit Reporting Act (FCRA)
  • Investigative Consumer Reporting Agencies Act (ICRAA)
  • Consumer Credit Reporting Agencies Act (CCRAA)

These laws govern how background checks are conducted, what disclosures are required, and how adverse actions must be handled.

 

Disclaimer: This communication is for general informational purposes only and does not constitute legal advice. The summary provided in this alert does not, and cannot, cover in detail what employers need to know about the amendments to the Philadelphia Fair Chance Law or how to incorporate its requirements into their hiring process. No recipient should act or refrain from acting based on any information provided here without advice from a qualified attorney licensed in the applicable jurisdiction.

Takeaways for Employers from the Grijalva v. ADP Screening Decision

The Ninth Circuit’s August 2025 ruling in Grijalva v. ADP Screening clarified how exclusions from federally funded healthcare programs and similar long-term listings, such as sex offender registries, can be reported under the Fair Credit Reporting Act (FCRA).

Key Implications for Employers:

  • Ongoing exclusions are reportable. Even if the exclusion began over seven years ago, it’s considered a current status and can appear in a background report.
  • The reason for the exclusion may not be reportable. If the underlying cause (e.g., an administrative action) occurred more than seven years ago and isn’t a criminal conviction, Consumer Reporting Agencies (CRAs) generally cannot report it unless the candidate is expected to earn $75,000 or more annually.
  • Employers can ask candidates directly. If you need context behind an exclusion or listing, you’re free to ask the candidate. CRAs may be restricted from providing that information due to FCRA limitations.
  • Convictions are treated differently. Criminal convictions are reportable regardless of age under the FCRA, but several states impose their own time-based restrictions.

 

Disclaimer: This communication is for general informational purposes only and does not constitute legal advice. The summary provided in this alert does not, and cannot, cover in detail what employers need to know about the amendments to the Philadelphia Fair Chance Law or how to incorporate its requirements into their hiring process. No recipient should act or refrain from acting based on any information provided here without advice from a qualified attorney licensed in the applicable jurisdiction.

Pitfalls of Delegating the Employment Adverse Action Process to Consumer Reporting Agencies

In the complex landscape of employment background screening, compliance with the Fair Credit Reporting Act (FCRA) and state-specific laws is critical. One area that demands particular attention is the adverse action process, that is, the legal steps an employer must follow when deciding not to hire a candidate based on information in a background report. While some employers may be tempted to outsource this process to their consumer reporting agency (CRA), doing so can expose them to legal and regulatory risks.

The Employer’s Legal Responsibility Under the FCRA

The FCRA requires employers to follow a two-step process before taking adverse action:

  1. Pre-Adverse Action Notice: Along with this notice, the employer must provide the candidate with a copy of their consumer report and a summary of rights under the FCRA.
  2. Adverse Action Notice: After a reasonable waiting period–typically at least five business days, per Federal Trade Commission (FTC) guidance–the employer may send a final notice if they decide not to hire the candidate.

This process allows candidates to dispute inaccurate or incomplete information before a final decision is made.

Timing Matters: The Risk of Premature Decisions

The timing between the pre-adverse and adverse action notices is not explicitly defined in the FCRA, but courts and regulators have consistently held that five business days is the minimum acceptable waiting period. If a CRA sends both notices too close together or simultaneously, it undermines the candidate’s right to dispute the report and may be seen as a violation of the FCRA.

Who Is Making the Hiring Decision?

The most critical issue arises when a CRA appears to be making the hiring decision rather than the employer. If a CRA sends adverse action notices without the employer’s review or discretion, it could be construed that the CRA is deciding the candidate’s eligibility for employment. This is problematic because:

  • Only the employer can assess job-relatedness and business necessity.
  • CRAs are not equipped to perform individualized assessments, which are required under many state and local laws.

Fifteen states (California, Colorado, Connecticut, Hawaii, Illinois. Maine, Maryland, Massachusetts, Minnesota, New Jersey, New Mexico, Oregon, Rhode Island, Vermont and Washington) have “Ban-the-Box” laws, several of which require employers to conduct individualized assessments before taking adverse action based on criminal history. Additionally, cities and counties like Los Angeles, New York City, and San Francisco have their own ordinances that include more stringent requirements for these assessments. These assessments typically involve evaluating the nature and gravity of the offense, its relevance to the job, and the time that has passed, and must be documented and provided to the applicant. They cannot be delegated to a CRA.   

Legal Precedent: When a CRA Crosses the Line

While there is limited case law directly holding that a CRA made the decision instead of the employer, courts have scrutinized situations where employers failed to retain control over the adverse action process. In Goode v. LexisNexis Risk & Information Analytics Group, Inc., the court emphasized that employers must make the final employment decision and cannot rely solely on automated decision tools provided by CRAs.

Additionally, in Henderson v. CoreLogic, the court found that the CRA’s automated scoring system used to filter candidates could be interpreted as making employment decisions, raising serious FCRA compliance concerns.

These cases underscore the importance of employer discretion and the legal risks of outsourcing the hiring decision.

Conclusion

Delegating the adverse action process to a CRA may seem efficient, but it can lead to serious compliance failures. Employers must remain actively involved in evaluating background check results, conducting individualized assessments, and making final hiring decisions. The stakes are too high to outsource this critical function.

 

Disclaimer: This communication is for general informational purposes only and does not constitute legal advice. The summary provided in this alert does not, and cannot, cover in detail what employers need to know about the amendments to the Philadelphia Fair Chance Law or how to incorporate its requirements into their hiring process. No recipient should act or refrain from acting based on any information provided here without advice from a qualified attorney licensed in the applicable jurisdiction.

Philadelphia City Council Amends and Expands Fair Criminal Record Screening Standards Law (commonly referred to as the “Fair Chance Law” or “Ban-the-Box”)

What is this about?

On September 25, 2025, the Philadelphia City Council passed a bill amending and expanding the existing Philadelphia Fair Chance Law. This legislation introduces several changes to enhance protections for job applicants and employees with criminal records. It becomes effective on January 6, 2026, and applies to employers in Philadelphia.


Key Changes:

Shortened Lookback Period for Misdemeanors

Under the existing Fair Chance Law, employers are prohibited from considering conviction information that is older than seven years from the date of the inquiry. The new amendments reduce the lookback period for misdemeanors to four years. The lookback period for felony convictions remains subject to the
seven-year window.

Summary Offenses Excluded From Employment Decisions:

The amendments reconcile the limitations under the Fair Chance Law with those imposed by the Pennsylvania Criminal Records Information Act (CHRIA) by confirming that employers may not consider summary offenses—offenses that do not rise to the level of a felony or misdemeanor—in making
employment decisions.

Added Protections for Expunged or Sealed Records:

Employers may not consider expunged or sealed criminal records. Furthermore, if such records appear in a background check or in PennDOT driver history reports, employers must allow applicants to provide proof of sealing or expungement before making a final decision.

Notice of Background Checks:

Employers who choose to provide notice of their intention to perform a
background check during the hiring process, such as in a job advertisement or in a job offer, must now also state that any consideration of the background check will be an individualized assessment based on the applicant’s or employee’s specific record and the requirements and duties of the particular
job.

Notice and Rebuttal Opportunities
Employers will have additional pre-adverse action requirements, which include
providing applicants or employees with:

  1. A summary of the applicant’s or employee’s rights under the Fair Chance Law.
  2. A statement that the employer will consider evidence of any error in the criminal history records, evidence of rehabilitation, or other mitigation if provided by the applicant or employee. A list of the types of evidence that may be offered includes:
      • the completion of a mental health or substance use
        disorder treatment program
      • the completion of a job training program
      • the completion of a GED or post-secondary education
        program
      • service to the community
      • work history in a related field since the time of conviction
        or incarceration
      • an active occupational licensure, commercial driver

    licensure, or other licensure necessary to perform the specific duties of the job.

  3. Instruction as to how the applicant or employee can exercise their right to provide evidence or explanation directly to the employer.

Anti-Retaliation Protections

The amendments provide a rebuttable presumption of retaliation if an employer takes adverse action within 90 days of an applicant or employee asserting their rights under the Fair Chance Law. Employers must demonstrate that any adverse action was taken in good faith and unrelated to the protected activity.

Why compliance matters:

Employers with operations in Philadelphia—including those hiring remote or hybrid workers—who may fall under the city’s jurisdiction, should use the time before January 6, 2026, to review their policies and prepare for implementation of the Fair Chance Law’s amended requirements. Most notably, employers should update their pre-adverse action notices to comply with the expanded notice and rebuttal rights to ensure that they are based on objective criteria that are unrelated to the applicant’s or employee’s exercise of their rights under the
Fair Chance Law.

What SI is doing:

SI provides employment-related background check reports that comply with federal, state, and local employment laws. SI stays current with changes in the laws that affect how an employer can use an individual’s personal information in an employment decision. SI’s policies and procedures will include compliance with the new Fair Chance Law amendments.

 

Disclaimer: This communication is for general informational purposes only and does not constitute legal advice. The summary provided in this alert does not, and cannot, cover in detail what employers need to know about the amendments to the Philadelphia Fair Chance Law or how to incorporate its requirements into their hiring process. No recipient should act or refrain from acting based on any information provided here without advice from a qualified attorney licensed in the applicable jurisdiction.

Do Employers Still Use Credit Reports for Hiring Decisions?

The short answer is yes, but not as often, and with certain limitations.

As hiring practices evolve, many employers are rethinking the use of credit reports in the hiring process. While still common in finance, government, and executive roles, credit checks for other positions are increasingly scrutinized for their relevance, fairness, and legal risk.

Why Some Employers Still Use Them:

  • To assess financial responsibility for roles involving access to money or sensitive data
  • To comply with industry regulations
  • To help mitigate fraud or identity risks

Why Many Do Not Use Them:

  • Credit history does not equal job performance
  • Risk of discrimination or bias
  • Growing legal restrictions at the state and local levels
  • FCRA compliance requirements are strict and costly if mishandled

Several states and localities have laws that limit or ban private employers from conducting employment credit checks, except in specific roles.

Best Practices for Employers:

  • Use credit checks only when job-relevant
  • Have policies in place defining what information on a credit report is disqualifying (note: credit reports do not show judgments or tax liens)  
  • If you’re a multi-state employer, consider eliminating credit checks if laws in one or more of your locations prohibit or limit these checks
  • Always follow FCRA guidelines

Credit checks are no longer a default step in hiring–they’re a strategic choice that requires careful consideration.

District of Columbia: Limitations on Reporting Negative Information in Background Checks Used for Employment Purposes

Although several states have laws analogous to the federal Fair Credit Reporting Act (FCRA), the District of Columbia does not. As a rule, the District of Columbia follows the federal FCRA regarding the limitations on reporting negative information in background check reports used for employment purposes. However, there are three notable exceptions where district law differs from the FCRA regarding reporting criminal records:

(1)        Records of arrests or criminal accusations that did not result in a conviction cannot be reported (unless the charges are pending);

(2)        Inquiries about criminal convictions cannot be made unless a conditional offer of employment is made; and

(3)        Convictions with a completed sentence that is more than 10 years old cannot be reported.

The first two exceptions are found in the district’s Fair Criminal Record Screening Amendment Act of 2014 codified at Sections 32-1341 – 32-1346 of the Code of District of Columbia, and the third exception is found in Section 2–1402.66 of the district’s Human Rights Law.

April 25th, 2022|Compliance Corner, Guidance|

New York Civil Cases and the RJI

State courts often have some quirky procedures, and the New York Supreme Court is no exception. Civil records from the New York Supreme Court typically include a reference to an “RJI” and whether it has been filed. What does “RJI” mean?

Definition: RJI is an abbreviation for “Request for Judicial Intervention.” It’s a form that is filed by either a plaintiff or defendant sometime after the summons and complaint is served on the defendant in a civil case.

Filing Effect: When an RJI is filed, the civil case is assigned to a judge.

What does this mean? When a plaintiff files a complaint in the New York Supreme Court to start a civil case, the court’s only action is to assign the case an index number. The court will not take any other action regarding the case – such as deciding a motion or order to show cause or hold a conference or trial – until either the plaintiff or defendant files an RJI. When the RJI is filed, the case is assigned randomly to a judge who will decide everything in the case until it is over.

How long will a case stay in the pre-RJI status? Because New York law does not specify a time limit for pre-RJI status, a civil case could be pending for years without any activity showing on the publicly available docket other than the filing and service of the summons and complaint.

That is the quirk in the New York Supreme Court civil case procedures – the possibility of a lengthy period of no case activity during the pre-RJI status.

To ensure that a civil case is timely prosecuted, many state courts assign a judge to a civil case when the summons and complaint are filed.

March 21st, 2022|Compliance Corner|

How to consider sex offender registry records in California (Updated)

For California employers concerned about hiring sex offenders, there are a few important points to keep in mind.

An employer has a duty to keep the workplace free of sexual harassment and other forms of discrimination under state law. Under the California Fair Employment and Housing Act (FEHA), an employer can face significant liability if it knowingly employs a sex offender and fails to take actions to protect its other employees from unlawful behavior by that person.

To avoid this problem, employers would like to know if they are hiring a registered sex offender. But how can they find out?

Since 2005, the state has operated a Megan’s Law website with a database to obtain access to the state’s list of more than 100,000 registered sex offenders. Created to help state residents better protect their families by being able to search for an individual registrant or by geographic location, the site (https://www.meganslaw.ca.gov/Default.aspx) contains the sex offender’s name, aliases, age, gender, race, address, physical description and, in some cases, a photograph.

While the site would appear to be a boon for employers, state law expressly forbids use of the state’s sex offender registry information for employment purposes. California Penal Code section 209.46(l)(2)(E) prohibits the use of information disclosed on the website for purposes relating to health insurance, insurance, loans, credit, education, housing and employment, among other uses.

Statutory exceptions provide for use “to protect a person at risk,” a term not defined by the Penal Code, as well as for employers required by law or authorized to request criminal history from the California Department of Justice. Examples of businesses that meet this standard may include child care centers, financial institutions and governmental agencies.

An employer who runs afoul of the Penal Code’s prohibition can face actual and exemplary damages, attorneys’ fees and a civil fine. Legislative history explains that the website attempts to protect the public while not inflicting additional punishment on registrants.

For employers trying to walk the fine line of protecting other employees and third parties, such as customers, from potential sex offender registrant employees while not violating the Penal Code, two alternate avenues exist to try to find out information about a sex offender: conviction records and employee/applicant self-disclosure.

Following applicable state and federal law, employers can conduct a criminal background check on applicants and employees and learn of a sex offense conviction. (However, convictions past the seven-year cut-off date in California may not appear on a background check report while the individual may still appear in the sex offender registry). An applicant or employee may also self-disclose a conviction.

Providing another wrinkle for California employers, the state’s Fair Chance Act took effect on January 1, 2018, mandating that employers with five or more employees must wait until after a conditional offer of employment has been made to ask any questions about criminal history. This includes inquiries about convictions, running a background check or other efforts to find out about an applicant’s criminal past.

If the employer decides not to hire the applicant, it must conduct an individualized assessment of the conviction at issue to evaluate whether it has a “direct and adverse relationship with the specific duties of the job that justify denying the applicant the position.” Other legal requirements, based on both state and federal law, must also be satisfied if an employer takes an adverse action on the basis of the background check (see our prior blog post (https://scherzer.co/reminder-to-california-employers-about-requirements-when-taking-adverse-action-based-on-a-criminal-record/) for more details).

What if an employer learns that an employee is a registered sex offender from another employee’s perusal of the Megan’s Law website? This situation could trigger liability under section 290.46 and employers should be careful to take action only after evaluating any potential risk the sex offender employee may pose to coworkers or customers, considering all the facts and circumstances.

March 17th, 2022|Compliance Corner|

Consent for International Searches

A basic principle of conducting international searches on an individual is that you need a lawful basis for processing personal data. This principle applies to both employment-purpose and commercial background checks.

Although the number and type of lawful bases vary from one country to another (especially with the enactment of new data protection and privacy laws in many countries over the last several years), a lawful basis for processing personal data common to all international searches is the consent of the individual search subject. From a compliance perspective, obtaining an individual’s consent for the searches is the best practice.

Other than the requirements that the subject’s express consent be unambiguous and freely given, there is no universally prescribed format or wording for an international consent form.

If the subject’s consent cannot be obtained, you can look to a country’s data protection and privacy laws to determine if a different legal basis may be applicable for processing personal data that does not require the subject’s consent. It is always up to the controller of the data to determine the appropriate legal basis for processing personal data.

For individuals located in the EU or UK, there are several legal bases that will satisfy the compliance requirements under the EU GDPR, the UK GDPR and the Data Protection Act of 2018 (UK) if consent cannot be obtained. The controller can still request these searches if it has a legitimate interest in obtaining the individual’s personal data or needs the data to perform a contract.

If the request for the searches is based on a legitimate interest or performance of a contract, the individual must receive a notice of the controller’s intention to process the data. Notice can be given in several different ways, including directly to the individual, in an engagement letter or similar document, or by publication on the client’s website. The way the controller gives notice is their decision.

February 25th, 2022|Compliance Corner|

Reporting Employment-related Civil Lawsuits

For employment-purpose reports, the federal Fair Credit Reporting Act (FCRA) and its state law counterparts  are the laws that most often deal with when determining whether certain information is or isn’t reportable. However, federal laws prohibiting workplace discrimination can also limit what information can be included in these reports. This issue can arise when civil lawsuits are located in which a search subject has sued a former employer.

Although there are several types of federal laws dealing with workplace discrimination, taken together, these laws make it illegal to discriminate against someone (applicant or employee) because of that person’s race, color, religion, sex (including gender identity, sexual orientation, and pregnancy), national origin, age (40 or older), disability or genetic information. It is also illegal to retaliate against a person because they complained about discrimination, filed a charge of discrimination, or participated in an employment discrimination investigation or lawsuit.

Providing any such information to a prospective employer in a background screening report could be a violation of anti-discrimination laws which are typically enforced by the U.S. Equal Employment Opportunity Commission (EEOC).

February 17th, 2022|Compliance Corner|
Go to Top