6 notes on background checks rules worth reading

The rules that govern background checks are set locally, and they change. Anyone who states a threshold, a time limit, or a right as a fact on a page like this is guessing on your behalf.

What does not change is the shape. Nearly every system that allows a check on a person is built from the same four ideas, and knowing them lets you tell an ordinary request from one that is off. This page is that shape, plus the places to get the current detail for where you actually live.

What to take away

Four ideas run through almost every version of these rulesconsent, purpose, notice, and correction.
The binding detail sits in named statutesthe Fair Credit Reporting Act in the US, PIPEDA and provincial police record check laws in Canada.
The strongest signal that a request is not legitimate is that it wants money or credentials from you rather than permission.

The four ideas

Short answer: consent, purpose, notice, correction. Everything past that is local detail.

Consent. A check on you is normally something you agree to, in writing, and separately from the rest of an application. A request that treats your permission as automatic, or that buries it inside a long form, is worth slowing down.

Four rules that hold anywhere

Consentwritten, separate, not automatic
Purposea stated reason for the check
Noticetold before the decision closes
Correctiondispute route to the reporting company

Purpose. A check exists for a stated reason, such as employment, tenancy, or volunteering with a particular group, and the depth allowed usually tracks the reason. A request that cannot say what decision the check is for is not really a check.

Notice before the decision. Where a report is going to count against you, systems generally require that you are told, and given the report, before the door closes rather than after. That gap is the only practical window in which an error can be caught.

Correction. There is a route to dispute what a reporting company holds about you, and the dispute goes to the company that produced the report as well as to whoever supplied the information. This is the part people do not know exists, and it is the part that changes outcomes.

What this page cannot tell you

The specifics are jurisdictional. How far back a report may go, what categories may be included, and how long an employer must wait are set by statute. The same goes for what a landlord may consider and what a volunteer organization is required to do.

In the United States the base layer is the Fair Credit Reporting Act, at 15 U.S.C. 1681 and following. It requires written consent before an employment check.

The act puts most non-conviction items on a seven year clock: arrest records, civil suits, civil judgments, paid tax liens and accounts placed for collection. Bankruptcies may be reported for ten years.

The seven year limits do not apply to some higher paid roles. The statutory salary threshold is 75,000 dollars, set in 1998 and not adjusted since.

Where a report may count against you, the employer must send you a copy and a summary of your rights before deciding, and tell you afterwards. A disputed item must be reinvestigated free of charge, normally within 30 days.

In the US, employment screening sits with the Equal Employment Opportunity Commission's guidance for employers on background checks. Consumer reporting sits with the Consumer Financial Protection Bureau, whose explanation of credit reports and scores covers the file most checks draw on.

The Federal Trade Commission enforces the act against reporting companies. Many states go further, with ban the box laws that delay when an employer may ask about a criminal record.

In Canada, the Personal Information Protection and Electronic Documents Act applies to private sector checks where a province has not passed substantially similar legislation. Consent has to be meaningful. You have a right to see and correct your file, and an organization has 30 days to answer an access request.

Alberta, British Columbia and Quebec have their own private sector statutes and their own commissioners. The federal regulator is the Office of the Privacy Commissioner of Canada. Police record checks follow provincial rules, such as Ontario's Police Record Checks Reform Act, 2015, which separates a criminal record check from a vulnerable sector check and limits disclosure of non-conviction records.

Reading a request you have received

Most people meet these rules from the receiving end, so this is the practical version.

Ordinary vs worth stopping over

Ordinary

Written consent: Named purpose
Identity details: Name, DOB, address
Payment from you: Never
Bank details: After an offer
Bank or email login: Never needed
Phone verification code: Never needed

Worth stopping over

Written consent: No stated purpose
Identity details: Documents by message
Payment from you: Always a red flag
Bank details: Before any offer
Bank or email login: Always a red flag
Phone verification code: Account takeover

Ordinary

Written consent to a check for a named purpose: Yes
Full name, date of birth, and address history: Yes, for identity matching
A payment, bank details, a bank or email login, or a code from your phone: No

Worth stopping over

Written consent to a check for a named purpose: A consent form with no stated purpose
Full name, date of birth, and address history: Copies of documents sent by ordinary message
A payment, bank details, a bank or email login, or a code from your phone: Always. This is the strongest single signal

That is what makes the row useful. You do not need to know the local rules to know that something has gone wrong. The recruitment version of this pattern is described in the FTC's advice on job scams.

Where the rules leave a gap

Two gaps are worth knowing because they explain situations that feel wrong but are not unlawful.

A private person can search public sources about you without any of the above applying. Consent and notice attach to formal checks run through reporting companies, not to someone typing your name into a search engine.

So the practical protection is what is visible. That is a settings question, not a legal one, covered in privacy settings.

The second is that a report can be accurate and still be about somebody else. Matching is done on names and dates, and common names collide. The correction route exists because this happens, not as a formality.

If something in a report is wrong

Act in this order, because the order affects what you can prove later.

What to do when a report is wrong

Get the report in writing and the company name
Dispute specific entries, with documents not explanations
Tell the organization the report is under dispute
Keep every reference number
Escalate to your regulator if unresolved

Get the report itself, in writing, along with the name of the company that produced it. Write to that company, dispute the specific entries rather than the report in general, and include documents rather than explanations.

Tell the organization that ran the check that the report is under dispute, so the decision is not closed while you are correcting it. Keep every reference number.

If the company does not resolve it, escalate to a regulator rather than to the organization that asked for the check. In the US that means the Consumer Financial Protection Bureau. In Canada it means the Office of the Privacy Commissioner of Canada.

The identity-side version of this, for the case where a report contains somebody else's activity because your details were used, is in identity verification.

Rules for you, rather than about you

There is a set of ordinary rules you can hold yourself, and they cost nothing.

Rules you can hold yourself

Give permission, never credentials
Pay nothing to be checked
Ask what the check is for and who produces it
Ask for the report before the decision is final
Keep your own copy of what you sent

Ask what the check is for.Find out what decision it feeds before you agree to anything.
Consent on a separate page.Sign a dated consent that names the purpose, and keep a copy.
Documents through the portal.Send identity documents through the employer's own system, never by ordinary message.
No payment, no passwords.Never pay for a check, and never share a bank login or a code from your phone.
Read the report first.Ask for the report before a decision is made, then check that the names and dates are yours.

The situations these rules apply to are set out in background checks examples, and the wider treatment is in background checks.

Common questions

Can somebody run a background check on me without my knowledge?

A formal check normally needs your consent. Informal searching of public sources needs nothing, and that gap is where most of what people worry about actually happens.

A prospective employer asked me to pay for my own check. Is that normal?

Treat it as a stop. Whatever the local rules say, a request for payment from the applicant is the most reliable signal in this whole area that something is wrong.

How far back can a report go?

It depends where you are and what the check is for. In the United States, the Fair Credit Reporting Act puts most non-conviction items on a seven year clock. Canadian police record checks follow provincial rules, and PIPEDA covers the rest.

Complaints go to the Consumer Financial Protection Bureau in the US or the Office of the Privacy Commissioner of Canada.

Someone I met online asked me to verify myself through a service they sent. Should I?

No. Verification you are sent a link for, by the person asking you to trust them, is a collection method rather than a check.

What if the organization refuses to show me the report?

Ask in writing, keep the reply, and take it to the Consumer Financial Protection Bureau in the US or the Office of the Privacy Commissioner of Canada. The right to see what was used against you is one of the four ideas above and it is the one worth insisting on.