When the internet and AI put so much data at our fingertips, it can seem quaint to think that there would be limits on the information that individuals can access with regard to job applicants and employees.  Recent amendments to New York State’s Fair Credit Reporting Act thereby serve as a reminder that limits do exist in the workplace setting, and those restrictions are expanding to impose barriers at a time when data access has never been easier. 

What is the Fair Credit Reporting Act? 

The federal Fair Credit Reporting Act places certain restrictions on a third-party provider (referred to as a “Credit Reporting Agency”) conducting a background check on individuals.  FCRA has several unique requirements with respect to background checks conducted for employment purposes, and these requirements apply to background checks conducted both for employees and for independent contractors.  In particular, FCRA requires notice and consent before a background check can be conducted, as well as disclosures if an employer plans to take adverse actions based on the results of the background check. 

Before You Conduct a Background Check 

Prospective and current workers (whether they are employees or contractors) must receive a clear and conspicuous written disclosure, notifying them that a background check is being conducted and of certain rights they have under FCRA.  They need to be provided with a Summary of Rights, which outlines their rights under the Fair Credit Reporting Act.    The subject of the background check must also provide authorization, consenting to the background check.  If the background check will include personal interviews conducted by the Credit Reporting Agency (“CRA”), the subject of the background check can request additional information concerning the nature and scope of the investigation, and the employer must respond to that request in writing within five days of receiving the request. 

Many employers outsource both the background check process and compliance with these notice and consent requirements to a CRA.  While this is legally permissible, it is important that the employer have legal counsel review in advance the documentation being provided by the CRA to confirm that it complies with FCRA.  The notice and authorization cannot be combined in a single document, and the notice cannot be cluttered with release language, disclaimers or other extraneous information. 

Expanded New York State Requirements 

While federal FCRA requirements focus on disclosures related to conducting background checks, New York State law regulates the types of information that can be gathered by an employer.  A recent amendment to New York State law, which took effect April 18, 2026, prohibits consideration of an employee’s credit history in making employment decisions, except in limited circumstances. 

New York State law also limits employers’ consideration of employees’ criminal history.  The state law requires that, prior to conducting a criminal history check on any job applicant or employee, that individual be provided with a notice of rights pursuant to Article 23-A of the NYS Correction Law.   

Credit History Checks Are Restricted 

New York State law recognizes only limited circumstances when a credit history check is permissible: 

• to comply with other federal or state laws;  

• when hiring certain public officials;  

• where bonding or security clearance is legally required (such as certain financial jobs); and  

• where the nature of the position will grant the individual regular access to certain sensitive information, signing authority or fiduciary responsibilities over money in excess of $10,000, or responsibility for setting secure systems access. 

These provisions are similar to the more long-standing limitation on use of credit history reports under New York City law.  Unless one of these exceptions apply, an employer or its authorized CRA should not be conducting a credit history check. 

Negative Criminal History Must Be Relevant to the Job 

Article 23-A of the New York State Correction Law prohibits an employer from denying employment or otherwise acting adversely toward a job applicant or employee based on prior criminal conviction history unless:  

• there is a direct relationship between one or more of the previous criminal offenses and the specific job sought or held by the individual; or  

• given the crime for which the individual was convicted, hiring or continuing to employ the individual would involve an unreasonable risk to property or to the safety or welfare of specific individuals or the general public. 

When evaluating the applicability of those criminal history exceptions, the employer must base its consideration of the mitigating factors listed in Article 23-A, which include: 

• the state public policy to encourage employment of those previously convicted of a crime; 

• the specific duties and responsibilities necessarily related to the job;   

•  the relevance on the person’s fitness or ability to perform one or more duties or responsibilities; 

• the time which has elapsed since the occurrence of the crime; 

• the age of the person at the time the crime occurred; 

• the seriousness of the offense or offenses; 

• any information reflecting the person’s rehabilitation and good conduct; 

• the employer’s legitimate interest in protecting property, and the safety and welfare of specific individuals or the general public.  

New York City law imposes far more extensive requirements, both with respect to the sequencing of when in the hiring process a criminal history check can be conducted, and in substantively limiting the grounds on which an employer can base a decision to withdraw an employment offer.  These requirements were discussed in more detail in a prior blog post. 

FCRA’s Pre-Action Notice Requirements 

While FCRA does not impose obligations on employers with regard to the substance of their background check decisions, it does become relevant and impose procedural requirements upon the conclusion of a background check.  If the results of a background check present negative history that the employer is considering, then the worker who was the subject of the background check needs to be provided with written notice that adverse action is being contemplated, and also receive a copy of the background check report.   

The worker or prospective worker also needs to be provided with some time (and the Consumer Financial Protection Bureau has recommended five business days) to react to the written notice.  It may be that the applicant/employee was a victim of mistaken identity or has other mitigating factors to present for consideration.  Under federal law, an employer is not required to consider those mitigating factors.  Under New York State law, with respect to criminal history, the employer should be considering the additional information provided by the employee, and New York City requires that those factors be considered and documented. 

Following the review period, if the employer wishes to proceed with the adverse action (not hiring the applicant, disciplining or terminating the employee), then FCRA requires providing a second written notice of the adverse action being taken, together with additional information about the Consumer Reporting Agency and the applicant’s/employee’s legal rights.  Legal counsel can assist with providing the appropriate language for those notices.  Under NYS law, if adverse action is being taken then the impacted individual can request a written statement of the reasons for the denial, and the employer has 30 days to provide that written statement. 

Where That Leaves NYS Employers 

Background checks are not to be undertaken lightly by employers in New York.  Procedural requirements under the federal Fair Credit Reporting Act must be followed, substantive analysis of adverse criminal history must be considered in relation to specific mitigating factors, and credit history should not be checked at all unless the nature of the work falls within an exception to the ban on credit history checks.  Employers that have outsourced these processes to third-party vendors should work with legal counsel to confirm that the vendor and the employer are meeting the legal requirements. 

By Tracey I. Levy