Imagine a woman — let's call her Suzie — has opened a surfing school somewhere on the shores of the West Coast. To keep up with demand from tourists, Suzie realizes she needs to hire someone to man the school's quarters while she's out in the waves. This employee would be responsible for the register, communicating with customers, scheduling lessons and several other tasks. After interviewing a few applicants, she decides to move forward with one. The woman seems friendly and capable, but Suzie wants to conduct a background check to verify her employment history and ensure her good character.

What should happen next? What steps does Suzie need to take in order to accomplish the background check and comply with federal law?

As I pondered these questions, I recalled reading a couple of headlines in the past year that had something to do with background checks. My memory proved correct; just last month, Delta Air Lines coughed up $2.3 million to settle a class-action lawsuit that alleged it failed to provide 44,000 applicants with proper background check disclosure, violating the Fair Credit Reporting Act (FCRA) and California law. Frito-Lay paid just a bit more in settling a similar case in May 2018. And a class of approximately 5 million people who once applied to Walmart sued the store for FCRA violations.

Rereading these stories made me want to know where employers are getting the FCRA wrong and what this law entailed. I called up Matthew Simpson, a partner with Fisher Phillips, and he helped me understand the FCRA and what standards it sets for background checks with much more clarity. In the context of employment, he told me, the FCRA most frequently comes up when employers need to do criminal background checks on potential hires.

"The FCRA is a law that's designed to help protect consumers when they have background information reported on them," Simpson told me in an interview. "It's designed to ensure that when you have background information recorded on you that that information is accurate and up to date."

How background checks should play out

Suzie has landed herself at a crossroads; she hasn't made a mistake yet, but she must make a couple precise moves to ensure her background check does not violate the FCRA. This process should be replicated anytime an employer moves to obtain background information, like a credit or criminal background report.

Step one: Notify the applicant or employee

First, she needs to disclose to her candidate that she will carry out the background check. This notice must communicate to the applicant that Suzie may use the information for decisions about her employment. Here's the important part about this: Suzie must provide this notice in writing and in a stand-alone format, according to both Simpson and guidelines jointly published by the Federal Trade Commission (FTC) and the U.S. Equal Employment Opportunity Commision (EEOC). Suzie can include "minor additional information" alongside the notice, EEOC says on its website, but that can't take away from the main message.

Employers also need to notify the applicant or employee if they require an "investigative report," EEOC noted. These provide more details on a person's life -- his or her character, general reputation, personal traits, lifestyle and so on.

Step two: Get permission

Once Suzie — or any employer that uses a third-party background check company — discloses all of that, the applicant needs to authorize her to move forward.

Before moving forward, Suzie will need to certify to the background check company that she: has notified her candidate about the report and received her permission to get it; has complied with all FCRA requirements; and "won't discriminate against the applicant or employee, or otherwise misuse the information in violation of federal or state equal opportunity laws or regulations," according to EEOC.

Step three: If necessary, say no

Now that Suzie has received the report, she realizes her applicant has a history of theft. This shatters her confidence that the candidate could operate the cash register, handle merchandise and work with financial information without her supervision. But Suzie can't stop there. Before taking any adverse action against the applicant, Suzie must give her a copy of the report and a summary of her rights, Simpson said.

Once she has affirmatively decided not to hire, the FCRA obligates Suzie to tell the applicant a couple of things: that she decided against hiring her because of the information of the report; the name, address and phone number of the company that sold the report; that the company vending the report did not make the hiring decision; and that she has the right to dispute the accuracy or completeness of the report and to request another free report from the company within 60 days, EEOC said.

Step four: Throw out the information

EEOC says employers need to keep personnel or employment records for one year after the records were produced, or after the personnel action was carried out — whichever comes later.

Once Suzie has satisfied all recordkeeping requirements, she can get rid of applicable information, according to FTC. She must do so, however, in a secure fashion. She can burn, pulverize or shred paper documents. And she can dispose of electronic information in such a way that it can't be read or reconstructed.

Where employers mess up

It's not terribly difficult for Suzie or any employer to comply with the FCRA, Simpson said. But employers still get in trouble for violating this law, as demonstrated by Delta, Frito Lay and Walmart. Simpson said he sees employers making two common mistakes: including extraneous language in the form that notifies employees of the background check and making adverse employment decisions before providing applicants with copies of the report and their rights.

Best practices

That said, Simpson's best practice recommendations have to do with avoiding those common pitfalls.

Employers should audit the background check forms they currently use to spot any problem areas, he said. "This would not only be for FCRA compliance, but many states have what we call mini-FCRAs, which are state-equivalent laws that are similar but have slightly different requirements," Simpson told me. He added that it would serve businesses to have an attorney or HR professional do this — "case law is developing quite quickly."

Employers also need to train their managers and supervisors — especially those involved in hiring — on FCRA compliance, Simpson said. When they receive background reports, they need to know to go through HR to properly communicate next steps to the applicant. "Managers themselves shouldn't be communicating to the applicants themselves," he said. Sometimes, managers speak too quickly or jump to conclusions based on the contents of a report, Simpson told me, and these actions can sometimes violate the FCRA.