In a case involving the potential overlap between the Investigative Consumer Reporting Agencies Act (ICRAA) and the Consumer Credit Reporting Agencies Act (CCRAA), the state’s high court ruled that employers must comply with the more restrictive of the two laws.

In a recent unanimous decision, the California Supreme Court ruled that an employer obtaining an investigative background check must comply with the stricter of two state laws—which requires it to obtain the individual’s prior written authorization before doing so. Connor v. First Student, Inc. (No. S229428). The August 20 decision will impact those employers, lenders, and landlords who frequently conduct background checks under these two laws when making any number of hiring, employment, credit, and housing decisions.

In the case at hand, 1,200 bus drivers filed suit against First Student, Inc., claiming that the company violated the state background check law. The employees pointed to the company’s actions with respect to the 2007 acquisition of LaidLaw International, Inc., where First Student retained third-party HireRight Solutions to run background checks on the thousands of acquired employees. The background reports elicited information about the employees, including criminal records, sex offender registries, address history, driving records, and employment history.

At issue, in this case, was overlap between two general consumer and credit reporting laws in California. 

• The Investigative Consumer Reporting Agencies Act (ICRAA) covers background checks in which information on a consumer’s “character, general reputation, personal characteristics, or mode of living” is obtained through any means. Among other things, ICRAA requires the person procuring the report to certify that they made certain required disclosures, and that the consumer gave written authorization for the report’s procurement.
• The Consumer Credit Reporting Agencies Act (CCRAA), on the other hand, covers information “bearing on a consumer’s credit worthiness, credit standing, or credit capacity,” and does not have a written authorization requirement.

At issue, in this case, were those employment background checks that potentially implicated both laws—because they obtained information relating both to character and creditworthiness. The employer, relying on prior case law, argued that the overlap between these two laws renders the ICRAA unconstitutionally vague whenever the CCRAA also might apply. However, the court rejected that argument and the prior case law, stating:

“In interpreting ICRAA and CCRAA, we agree with the Court of Appeal and find that potential employers can comply with both statutes without undermining the purpose of either. If an employer seeks a consumer’s credit records exclusively, then the employer need only comply with CCRAA. An employer seeking other information that is obtained by any means must comply with ICRAA. In the event that any other information revealed in an ICRAA background check contains a subject’s credit information and the two statutes thus overlap, a regulated party is expected to know and follow the requirements of both statutes, even if that requires greater formality in obtaining a consumer’s credit records (e.g., seeking a subject’s written authorization to conduct a credit check if it appears possible that the information ultimately received may be covered by ICRAA).”

Employer Takeaways

Employers in California must now pay close attention to the types of information you solicit in background checks regarding employees or potential employees – and make sure you are following the applicable law and any specific procedural requirements. 

Background checks that inquire into a person’s “character, general reputation, personal characteristics, or mode of living” fall under ICRAA and require written authorization, among other things. As the California Supreme Court has made clear, merely because the background check may also contain “credit” information that falls under CCRAA does not absolve you from complying with ICRAA—and the latter law’s more strict written authorization requirements.