Over a year ago, our colleagues at the Information Intersection blog warned that employers should think twice before using websites such as Spokeo.com, which are aggregators of personal information collected from online sources, including social media.  They warned that:

…the information available through some of these sites might be incomplete, inaccurate or dated…The reality is that most online information brokers, in their current versions, are not designed to be used for employment screening purposes.  They typically do not meet or even purport to meet the strict rules that apply to pre-employment screening databases.

These warnings proved to be very prescient, as last month the Federal Trade Commission (FTC) hit Spokeo Inc. with an $800,000 fine for violating the Fair Credit Reporting Act by selling consumer profiles to potential employers for screening purposes.  In particular, the FTC stated that Spokeo failed to make sure that the information it sold would be used only for legally permissible purposes; failed to ensure the information was accurate; and failed to tell users of its consumer reports about their obligation under the FCRA, including the requirement to notify consumers if the user took an adverse action against the consumer based on information contained in the consumer report.

The determination hinges upon the FTC’s finding that Spokeo is a consumer reporting agency under the FCRA.

Spokeo’s founder and vice president stated on Spokeo’s blog that “it has never been our intention to act as a consumer reporting agency…We are a technology company organizing people-related data in innovative ways. We do not create our own content, we do not possess or have access to private financial information, and we do not offer consumer reports.”

What does this mean for employers?

The FCRA imposes numerous technical, procedural, notice and timing obligations on employers who use credit reporting agencies to obtain background reports.  Among other things, employers must provide a clear, written notice disclosing the intention to obtain a consumer report for employment purposes.  Employers must also obtain written authorization from applicants, and allow sufficient time for applicants to contest any of the information contained in a consumer report prior to denying employment or taking some other type of “adverse action” against the individual. If the employer takes an “adverse action” based upon the information contained in a consumer report, the employer then must provide the applicant or employee with notice (an “adverse action notice”) of this fact along with providing other disclosures.  Failure to do so may lead to claims from individual applicants or, worse yet, an entire class of applicants, alleging that their rights under the FCRA were violated.

So, if your company conducts background checks for employment purposes–and there are very good reasons for doing so–you should consult legal counsel to make sure that you are complying with the specific requirements of the FCRA, and any other applicable state and local laws governing the use of background checks.

Further, you should caution your employees that such third party data sources about individuals should only be used in ways that have been specifically approved by the employer.  Otherwise you may find out that one of your managers has been conducting his or her own background checks of applicants using such resources.  Such activity could subject the company to liability under FCRA.

The moral of the story?  As always, have good policies about the use of and manner of conducting background checks, and make sure that they are consistently applied.  There is valuable information out there, but also many traps for the uninformed.