July 28, 1998
Mr. Stephen Kilgo
President
Intelnet Inc.
320 Westcott, Suite 108
Houston, TX 77007
Re: Record Retention Requirements of the FCRA
Dear Mr. Kilgo:
This is in response to your letter concerning the application of the Fair Credit Reporting Act ("FCRA") to background checks on applicants for employment. The questions that you raise are summarized below, followed by our answers.
1. Is a consumer reporting agency required to save for an indefinite period the"stand alone" release forms granting authorization to do a background check from an applicant?
Your question raises several different issues and requires some clarification. When an employer asks a consumer reporting agency (CRA) to provide a consumer report for employment purposes, Section 604(b)(1)(A)(i) of the FCRA requires that the CRA obtain the employer's certification that, among other things, (1) the employer has complied with Section 604(b)(2)(A) by disclosing to the applicant or employee in a stand-alone document that a consumer report may be procured, and (2) that the employer has obtained the applicant or employee's written authorization to procure the report as required by Section 604(b)(2)(B). Thus, while an employer is required to procure the written authorization (release form) from the consumer, the CRA is required to obtain the employer's certification before furnishing the report.
With this in mind, we understand your question to be how long a CRA is required to keep the employer's certification. Technically speaking, a CRA has no duty to keep the certifications for any length of time because the FCRA does not contain an express record keeping provision. However, Section 618 of the FCRA imposes a two-year statute of limitations on actions to enforce liability arising under the statute. Accordingly, a CRA might want to retain certifications for at least a two-year period. As a practical matter, a CRA might consider maintaining certifications for an even longer period, depending on their scope. For example, if an employer submits a blanket certification for purposes of obtaining consumer reports on an employee during the term of that individual's employment, the CRA might wish to maintain a record of the certification indefinitely.
2. Many consumer reporting agencies allow an employer to order background checks over the internet on the website of the consumer reporting agency. The employer may have the applicant's written approval on file but not the consumer reporting agency. Does the consumer reporting agency have to have the written approval of the employee on file if it already has the FCRA certificate on file from the employer agreeing to comply with the FCRA?
No. As explained above, Section 604(b)(1) of the FCRA requires only that a CRA receive the employer's certification before furnishing a consumer report for employment purposes. Accordingly, a CRA is not required to maintain a record of the consumer's underlying written authorization in order to comply with the FCRA.
This is an informal staff opinion and is not binding on the Commission.
Sincerely,
Shoba Kammula