Employer Access vs. Your Privacy: Where the Line Falls on Background Checks
Employers have legitimate screening rights, but so do applicants. Understand the legal boundaries that govern what employers can request and use.
Photo: searchopenrecords editorial
—— In This Article
Key Takeaways
- Employers must obtain written consent before ordering a background check under the FCRA.
- Applicants have the right to see any report used against them and to dispute inaccurate information.
- Certain categories — medical history, genetic data, and some arrest records — are off-limits or restricted.
- State law can impose stricter limits than federal law, including ban-the-box rules and shorter look-back periods.
- A pre-adverse action notice must be provided before a hiring decision is finalized based on negative findings.
The Legal Framework That Governs Employer Access
When an employer hires a Consumer Reporting Agency (CRA) to run a background check, the process is regulated primarily by the Fair Credit Reporting Act (FCRA) — a federal statute enforced by the Federal Trade Commission and the Consumer Financial Protection Bureau. The FCRA defines what employers can request, how CRAs must handle data, and what rights applicants hold throughout the process.
Before any search begins, an employer must provide a clear, standalone written disclosure and obtain the applicant's written authorization. This is not a formality — it is a legal prerequisite. See why the consent step carries legal weight for a fuller breakdown of what that authorization must contain.
The FCRA also governs what a CRA may report. Criminal records, credit history (where job-relevant), civil court records, and verified employment history may appear — but the law places firm limits on how far back certain data can reach and how it can be used. Understanding which records are public and which are aggregated private data is essential context here.
What Employers Can Legitimately Access
Within FCRA boundaries, employers may — with consent — obtain reports covering:
- Criminal history: Convictions are generally reportable; arrests without conviction are treated with more caution, and some states restrict their use entirely.
- Credit history: Only where it is demonstrably relevant to the role (e.g., financial management positions), and only in states that permit it.
- Employment history verification: Confirming job titles, dates, and sometimes reasons for separation. What background checks can actually confirm about your work history varies more than many applicants realize.
- Education credentials: Degree verification through institutions or clearinghouses.
- Driving records: For roles involving vehicle operation, via state motor vehicle records.
| Employer Rights | Applicant Rights | |
|---|---|---|
| Initiating a check | May order a check with written consent | Must provide written authorization before any search |
| Data access scope | Criminal, credit (where permitted), employment, education, driving | Right to know exactly what was requested and reported |
| Restricted information | Cannot access medical, genetic, or protected data pre-offer | Cannot waive FCRA rights as a condition of employment |
| Adverse action process | Must issue pre-adverse action notice before deciding | Right to receive report copy and dispute before decision is final |
| Look-back limits | Bound by FCRA 7-year rule and any stricter state limits | Can dispute records that exceed reportable timeframes |
| Dispute handling | Must wait for dispute resolution before finalizing adverse decisions | Can dispute inaccuracies; CRA must investigate within 30 days |
Employers may not access medical records, genetic information, or data protected under laws like the Americans with Disabilities Act and GINA before a conditional offer is made. These are categorical off-limits, not judgment calls.
Your Rights as an Applicant
The FCRA establishes enforceable rights that apply every time an employer-ordered check is run. These include:
- Right to disclosure and consent: You must be notified in writing that a check will be conducted, and you must authorize it before it begins.
- Right to receive a copy of the report: If an employer intends to take adverse action — declining to hire, for example — based on findings, they must provide a pre-adverse action notice along with a copy of the report and a summary of your FCRA rights before the decision is finalized.
- Right to dispute inaccuracies: If information is incorrect or outdated, you have the right to dispute it with the CRA, which must investigate within 30 days under the FCRA.
- Right to know the CRA's identity: Employers must tell you which agency compiled the report so you can contact them directly.
For a comprehensive guide to these protections, see your legal rights when a background check is run on you. Separately, what CRAs are required to tell you covers the disclosure obligations on the screening company's side.
Where State Law Expands the Boundary
Federal law sets a floor — states can and often do go further. Several protections that applicants may not realize they hold come from state statutes rather than the FCRA itself:
- Ban-the-box laws: Over 35 states and many municipalities restrict when an employer may ask about criminal history, often delaying the question until after a conditional offer.
- Shorter look-back periods: Some states limit how far back criminal convictions can be reported — often to seven years — for positions below a salary threshold.
- Expanded dispute timelines: Certain states require faster resolution than the FCRA's 30-day window.
- Credit check restrictions: Many states prohibit or limit using credit history in employment decisions.
State-level protections that go further than federal law provides a state-by-state overview of where those expansions apply. Because these rules vary significantly, applicants should research the laws specific to their state and the employer's location.
It is also worth noting that using public record information in discriminatory or retaliatory ways is prohibited even when that information is technically accessible.
Correcting Errors Before They Cost You an Opportunity
Inaccurate background check data is more common than many applicants expect — records may be misattributed, outdated, or include expunged entries that should not appear. The most effective defense is a proactive one: reviewing your own background report before an employer does allows you to identify and dispute errors before they affect a hiring decision.
When a dispute is filed with a CRA, the agency is obligated to investigate and correct or delete information that cannot be verified. If an employer has already received a flawed report, the pre-adverse action notice window gives you a critical opportunity to flag the error before the decision becomes final. Document all disputes in writing and retain copies.
For context on what differentiates a self-initiated check from an employer-ordered one — including differences in scope and permissible purpose — see how personal and employer-ordered checks differ.
This article provides general legal information about background check rights under federal and state law. It is not legal advice. Readers with specific concerns about a background check, employment decision, or dispute should consult a qualified attorney familiar with consumer protection or employment law in their jurisdiction.
Background Checks Editorial Team
Background Checks Editorial Team is the collective byline for our editorial team and contributor network. Articles published under this byline or an editorial pen name are researched, written, and reviewed according to our editorial standards for clarity, consistency, and independence before publication.
View author profile