Equifax Data Breach Survival Tips

As you may have seen all over the news recently, Equifax, who is one of the three major credit bureaus, announced they suffered a data breach that may have affected 143 million US consumers. 

Below are some tips to consider to help minimize your exposure to identity theft. 

• Check the following link to first determine if Equifax believes your data was part of the breach: https://www.equifaxsecurity2017.com/potential-impact/
• Request a free copy of your credit report: https://www.annualcreditreport.com/index.action
• Review your bank and financial statements often and use multi-factor authentication with online account as available
• Based on your individual situation, consider placing fraud alerts and/or credit freezes on your accounts with all 3 of the major credit reporting agencies. Some agencies may charge a nominal fee (i.e. $10) each time you place/lift a credit freeze on your report. A detailed comparison between a fraud alert and a credit freeze can be found here: http://www.idtheftcenter.org/Fact-Sheets/fs-124.html
• Do not disclose personal, financial, or password related info over the phone if you did not initiate the call or if you are not dealing with an institution that you are familiar with.
• Be extremely cautious with fake news and fictitious websites offering to help. 
• Below is the contact information for the three credit bureaus if you need to contact them directly:
  • Equifax: 800-349-9960 or Freeze Equifax
  • TransUnion: 888-909-8872 or Freeze Transunion 
  • Experian: 888-397-3742 or Freeze Experian
  • Innovis: 800-540-2505 or Freeze Innovis

Using Credit and Criminal Background Checks

Employers should make sure that any background check they perform is job related and consistent with business necessity. As advised during the recent 2013 Workplace Strategies seminar, the Equal Employment Opportunity Commission (EEOC), worker advocacy groups and plaintiff attorneys are not giving employee and applicant credit and criminal background checks intense scrutiny.

 

To avoid EEOC charges of disparate treatment or disparate impact based on a background check, an employer should follow four essential steps:

 

1. Determine whether it can request a background check
2. Find out how it may request a check
3. Determine how it may consider and use the information obtained through a background check
4. Learn how to communicate a notice of an adverse employment action based on a background check

 

These steps involve the interplay of federal law including Title VII and the federal Fair Credit Reporting Act (FCRA) as well as state mini FCRAs.

 

When an Employer May Request a Background Check

According to the EEOC, employers must ensure that there is a direct connection between the type of background check performed and the individual applicant’s or employee’s job duties and that a particular type of background check is done for all applicants and employees in certain positions (not just certain applicants or employees) if there is not an individualized, specific reason for the background check.

 

The starting place is the job title. For example, while there would be a strong business justification to run a credit check on a CFO, there would not be a justification for a credit check for a janitor. The next step is to consider the nature of the job –whether it involves activities like data entry or just lifting boxes- and the circumstances in which the job is performed.  Consider the level of supervision involved and whether there is interaction with vulnerable adults. Finally, take into account the location where the position is performed.

 

Requesting a background check requires the employee or applicant to sign a disclosure and authorization form that is separate from other documents, such as the employment application. Be sure to list and describe the background check information being requested and reviewed but don’t include a release from liability as that would invalidate the consent.

 

If the employer receives negative information about the applicant or employee, the FCRA requires that a pre-adverse- action letter be sent to the individual if there is potential for an adverse employment action. Title VII requires the employer to conduct an individualized assessment and send an action letter.

 

The individualized- assessment process must give the applicant or employee an opportunity to provide additional facts or context to explain why the background check’s finding should not be applied in his or her case. It is advised to ask for the response from the employee in writing as it exhibits the seriousness of your position and establishes a record. If the individual does not respond, the employer may make the employment decision without the extra information.

 

Criminal Checks

It is cautioned that employers generally should not use arrest information in making employment decisions, but rather consider if you would exclude the applicant if there was a conviction.

 

With regard to convictions, EEOC’s 2012 guidance on Title VII and background checks strongly recommends that employers use a targeted screening process that takes into consideration the nature and gravity of the offense or conduct; the time that has passed since the offense, conduct and/or completion of the sentence; and the nature of the job held or sought.

 

The EEOC does not provide guidance on the time period to cover when looking into criminal records. Many employers use a seven year period, but it is best to consider a longer time frame if it is deemed appropriate for your business activities.

 

State Law

Several states have mini-FCRAs that restrict employers from requesting certain types of background checks. Currently, 11 states (California, Connecticut, Hawaii, Illinois, Maryland, New Jersey, Ohio, Oregon, Pennsylvania, Vermont, and Washington) limit an employer’s ability to run a credit background check. Similar legislation is pending in 13 other states as of 2013.

 

In addition, 12 states have state-specific disclosures that must be included on the disclosure and authorization form and some states require an employer to customize its form by position or type of check being run. In California, for example, employers must identify the specific state statutory basis authorizing them to request and use a credit report.

 

There are no state law restrictions on requesting criminal check however.