Background check information is not fully confidential, but it is not open either. Under the Fair Credit Reporting Act (FCRA), a consumer reporting agency can only hand your report to someone with a specific legal reason to see it, that person has to follow strict rules on how they use it, and most negative items eventually drop off. You can see your own file, correct what’s wrong in it, and collect damages if someone breaks the rules.
Who Is Allowed to Pull Your Report
The FCRA lists the reasons a consumer reporting agency may release your report, and the list is exhaustive. If the reason isn’t on it, the report can’t be furnished. The common ones are a credit decision, employment screening, insurance underwriting, or a business transaction you started yourself.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
Government agencies can pull reports in narrow situations, such as setting child support or determining license eligibility. A court order or federal grand jury subpoena also works. Someone who is simply curious about you has no legal basis to obtain the report, and an agency that releases one without a permissible purpose is exposed to liability.
Employment screening carries extra steps. Before an employer runs the check, it has to give you a written disclosure saying so, and that disclosure has to stand alone as its own document rather than being folded into a job application or a liability waiver. You then have to authorize the check in writing.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The FTC has warned employers that stuffing extra acknowledgments or releases into that document can itself violate the FCRA.2Federal Trade Commission. Background Checks on Prospective Employees – Keep Required Disclosures Simple
Inside a company, access to the completed report is generally kept to the people who need it for the decision, such as the hiring manager or HR. A report left in a shared folder that anyone in the office can browse would defeat the confidentiality the statute is built around.
How Long Information Stays on Your Report
The FCRA puts time limits on most negative information, so old items don’t follow you forever. The rules have real exceptions, though.
Most adverse items come off after seven years. That covers civil judgments, civil lawsuits, arrest records, paid tax liens, and accounts sent to collections. Bankruptcies get ten years from the filing date.3Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports
Criminal convictions are the big exception. The FCRA sets no federal time limit on reporting a conviction, so a conviction from decades ago can still show up.3Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports Roughly a dozen states cap conviction reporting on their own, often at seven years, but not every state does.
The seven-year and ten-year limits also drop away in higher-stakes situations: a credit transaction of $150,000 or more, a life insurance policy with a face amount of $150,000 or more, or employment at an annual salary of $75,000 or more.3Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports For well-paid jobs, that means the time limits give you less cover than you might expect.
What Has to Happen Before Someone Uses It Against You
If an employer, landlord, or other user decides to reject you based on something in your report, the FCRA forces a two-step notice process, and this is one of the strongest protections you have.
First comes a pre-adverse action notice. That notice has to include a copy of the report the decision is based on and a summary of your FCRA rights.4Federal Trade Commission. Using Consumer Reports – What Employers Need to Know The point is to give you time to look at the report and flag errors before the decision is final. Skipping straight to rejection is a violation.
After a reasonable window for you to respond, the user can take the adverse action and then must send a second notice. That notice has to give the name, address, and phone number of the reporting agency that furnished the report, state that the agency didn’t make the decision and can’t explain it, and tell you about your right to dispute the report’s accuracy and get a free copy within 60 days.5Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
Your Right to See and Correct the File
You’re entitled to see what’s in your file. Every nationwide consumer reporting agency has to give you a free copy of your report once every 12 months on request.6Office of the Law Revision Counsel. 15 USC 1681j – Charges for Certain Disclosures You also get a free copy after an adverse action, as long as you ask within 60 days of the notice.5Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
You can also ask where the information came from. When you request a file disclosure, the agency has to identify its sources.7Office of the Law Revision Counsel. 15 USC 1681g – Disclosures to Consumers The one carve-out is for sources used solely for an investigative consumer report, which relies on personal interviews. Those sources stay protected unless you sue, at which point they become discoverable.
If something in the file is wrong or incomplete, you can dispute it with the reporting agency. The agency has to investigate within 30 days and either correct, delete, or verify the information. If you send additional relevant information during the investigation, the agency can extend the window by up to 15 days, but not if it has already found the item inaccurate or unverifiable.8Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy Once the investigation is done, the agency has five business days to tell you what it found.9Consumer Financial Protection Bureau. How Long Does It Take to Repair an Error on a Credit Report?
How the Information Has to Be Handled and Destroyed
The FCRA’s purpose statement says consumer reporting agencies must handle information with regard to its confidentiality, not just its accuracy.10Office of the Law Revision Counsel. 15 USC 1681 – Congressional Findings and Statement of Purpose In practice, agencies and the entities receiving reports are expected to maintain reasonable safeguards: encryption in transit, access controls limiting who can view a report, and training for employees who handle sensitive information.
Protection continues once the report is no longer needed. The FTC’s Disposal Rule requires anyone holding consumer report information to destroy it by reasonable methods when they’re done. Paper records have to be shredded or pulverized so they can’t be reconstructed. Electronic files have to be destroyed or erased beyond recovery. Organizations that outsource disposal are expected to vet those vendors through audits, references, or certification by a recognized trade association.
What You Can Recover if the Rules Are Broken
The FCRA has teeth. If a reporting agency, employer, or other user willfully violates the statute, you can recover statutory damages between $100 and $1,000 per violation without proving any specific financial loss. Courts can add punitive damages and order the violator to pay your attorney’s fees.11Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance If someone obtains your report under false pretenses or knowingly without a permissible purpose, the minimum recovery is the greater of your actual damages or $1,000.
Negligent violations still carry consequences. If an agency or user fails to follow the FCRA through carelessness, you can recover actual damages plus attorney’s fees and court costs.12Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance Proving concrete loss makes negligence claims harder than willful ones, but the fee-shifting provision means lawyers will sometimes take them on contingency.
What the FCRA Does Not Cover
The FCRA governs formal consumer reports compiled by a reporting agency. When an employer searches your social media profiles directly, without going through a third-party screening company, the FCRA doesn’t apply. Some states separately bar employers from demanding social media passwords or making applicants log in during interviews, but those protections vary. If a third-party company compiles social media information into a report for an employer, that report is treated as a consumer report and all the FCRA rules on consent, accuracy, and adverse action kick in.