A vast majority of the laws regarding background reports under the FCRA are employer requirements. Employers being sued for violations of the FCRA are a high area of litigation. Class action suits can fine you, up to five years, per violation. Delta airlines in Feb, 2019 just paid out 2.3 Million dollars in a settlement over the proper authorization and disclosure forms. 

There is also an increase in Privacy laws to consider, that limit the amount of time personal information can be retained. The GDPR includes data retention restrictions and in the US, the FCRA considerations often affect how we approach data retention issues.The Federal Trade Commission (FTC) encourages retention limits for data. Consider that each piece of data being held is a potential risk for your company and the more sensitive the data, like background checks, the greater the potential risk is.  Data can be lost, mis-used, stolen, therefore the FTC views retention limits as an important element of a data security program and encourages that organizations practice good data minimization and data destruction once data is no longer needed. 

Limiting the amount of information retained reduces the risk to an organization if a data breach occurs. We are ultimately protecting individuals Personal Identifying Information (PII) by implementing this policy. 

What you can expect:

 Any Consumer report 2 years or older will be destroyed/erased/no longer available. 

The 2 years will be initiated from the date that the report was completed and made available to you. The only exception to this policy will be for a consumer report involved in litigation or investigation by a government agency. We will need to be notified, by you, of any such reports involved in litigation for us to retain them on your behalf. 

If you have any questions or concerns regarding this policy please contact our Compliance Department at 316-263-4400 x 118 or email Cherith@natsb.com for assistance.

We will start implementing this policy Effective 08/01/2020.