A relatively new federal agency, the Consumer Financial Protection Bureau ("CFPB"), created as part of the Dodd-Frank Act of 2010, has replaced the Federal Trade Commission ("FTC") as the primary rulemaking and enforcement authority for background checking of individuals under the federal Fair Credit Reporting Act ("FCRA"). The CFPB has issued regulations revising the Summary of Consumer Rights form used by employers, as well as two forms used by Consumer Reporting Agencies ("CRA"). The new forms take effect January 1, 2013.

The FCRA regulates employers that use CRAs to conduct background checks for hiring, promotion or other employment-related decisions. Before obtaining a consumer report about an applicant or employee, the employer must (1) provide a disclosure stating that it may request a consumer report and (2) obtain authorization from the individual. Additionally, before taking an adverse employment action based on information contained in a consumer report, the employer must provide the individual with (1) a written notice enclosing a copy of the consumer report and (2) a copy of the Summary of Consumer Rights form. This is commonly known as the "Pre-Adverse Action Notice."

The new Summary of Consumer Rights, available here, replaces FTC contact information with references to the CFPB, and directs consumers to visit the CFPB's website for further information about their rights. No substantive changes have been made in the FCRA background-checking procedures. Therefore, the new Summary of Consumer Rights must be provided as part of the Pre-Adverse Action Notice packet, as explained above. In addition, the Summary of Consumer Rights must be given when disclosing the nature and scope of "investigative consumer reports," which are conducted via personal interviews by a CRA.

Now is a good time for employers to revisit their background-checking procedures and forms to ensure compliance with applicable federal and state laws. In addition to the new federal Summary of Consumer Rights, employers should also consider checking compliance with specific state laws, as many states have passed similar, or more restrictive, background-checking laws. For example, California has its own state Summary of Rights that must accompany the initial disclosure and authorization form, as well as a general prohibition on seeking credit reports unless one of a small number of narrow exceptions applies. Massachusetts has special timing requirements that differ from the FCRA, and New York has specific factors that must be considered.