According to FACTA (the Fair and Accurate Credit Transactions Act of 2003), all credit and background screening report information must be disposed of properly. To properly dispose of this type of information, paper records must be shredded or otherwise destroyed in such a way that there is no way to reconstruct the information. Any such information stored on a computer must be completely erased before that computer is sold, donated, or disposed of.

In order to stay within the laws of the Fair Credit Reporting Act, an employer has several obligations:

• You must get the applicant or employee’s written permission for the background check, if it will be performed by an outside company. This permission cannot be a part of the employment application or other documents; it must be on a separate form).
• You must also give specific notice if the background report will include medical information.
• You should always check your state and other local regulations for additional requirements, because the FCRA guidelines are the minimum required.
• It’s important to provide proper notice in the event of adverse action (such as deciding not to hire) based on information in a background screening report. The first step is to give a ‘pre-adverse action disclosure’ along with a copy of the background report and a ‘summary of rights.’ Even if the background report is not the only reason for not hiring, this notice still must be given. At the time of the adverse action itself, you are required to give a second notice. The second notice must identify the source of the report (such as the screening company), explain it was not the source of the report who made the adverse decision, and include a notice of the right to dispute the accuracy or completeness of the report.