An employer that obtains a background report from a consumer reporting agency enters a regulated process. The procedural steps are simple, and litigation over them is common because they are so often done sloppily.
Disclosure. A clear and conspicuous written disclosure that a report may be obtained, in a document consisting solely of that disclosure. Including a liability waiver or extraneous language in the same document is a recognised violation.
Authorisation in writing from the applicant.
Pre-adverse action. Before acting on the report, provide a copy of it and the summary of rights, and allow a reasonable period to respond — commonly five business days. This step exists so an applicant can correct an error, and skipping it is the most frequent claim.
Adverse action notice afterwards, identifying the agency, stating it did not make the decision, and explaining dispute rights.
State and local law adds layers. Ban-the-box rules restrict when criminal history may be asked; some jurisdictions require an individualised assessment weighing the offence, time elapsed and job relevance; others limit credit history use.
Blanket exclusions based on any criminal record invite disparate impact claims. The defensible approach ties the inquiry to the role.