Objectives in this domain

Apply FCRA and applicable state law requirements governing background checks, consumer reports, and automated decision-making tools used in hiring.
Section 4.1medium
Identify the legal boundaries for monitoring employee communications, location, and activities, including ECPA consent exceptions and state wiretapping laws.
Section 4.2hard
Describe privacy obligations that persist after employment ends, including data retention, references, and duties to protect former employee records.
Section 4.3medium

Sample question from this domain

Free sampleWorkplace Privacymedium

A US employer engages a consumer reporting agency to run a pre-employment background check on a finalist. The returned consumer report shows a conviction, and the hiring manager intends to reject the candidate because of it. Counsel pauses the rejection to confirm the steps the FCRA requires the employer to take around this adverse action. Which two obligations does the FCRA impose on the employer in this situation? (Select TWO.)

AGive the candidate a GLBA privacy notice describing the data and an opportunity to opt out of sharing it with non-affiliates.
BWait a fixed statutory cure period of exactly 30 calendar days after notice so the candidate may correct the record before any decision is finalised.
CBefore acting, provide the candidate a copy of the report and the CFPB summary of FCRA rights as a pre-adverse-action notice. Correct
DNotify the EEOC of the planned rejection so the agency can review whether the criminal record creates a disparate impact.
EAfter acting, send an adverse-action notice naming the agency, stating it did not make the decision, and noting the right to a free report. Correct

FCRA employment screening requires a pre-adverse-action package then a separate post-decision adverse-action notice, neither of which a GLBA notice or an EEOC filing satisfies. The FCRA splits the duty into two steps: before adverse action the employer must deliver the report copy plus the CFPB summary of rights so the candidate can respond, and after adverse action it must send a notice naming the agency, disclaiming the agency's role, and explaining dispute and free-report rights. A GLBA opt-out notice, a fixed 30-day cure window, and EEOC pre-notification are not FCRA requirements.

Why A is wrong: Tempting because both statutes touch sensitive data, but the privacy-notice and opt-out regime belongs to the GLBA for financial institutions, not to FCRA background checks.

Why B is wrong: Plausible because FCRA expects a reasonable interval before adverse action, but the statute fixes no 30-day cure period; the waiting time is judged by reasonableness, not a set count of days.

Why C is correct: Correct because FCRA section 604(b)(3) requires the report copy and the summary of consumer rights to reach the candidate before adverse action is taken.

Why D is wrong: Tempting because criminal-record screening raises Title VII disparate-impact concerns, but FCRA imposes no duty to notify the EEOC before rejecting a candidate.

Why E is correct: Correct because FCRA section 615(a) requires the post-decision adverse-action notice identifying the agency, disclaiming its role, and noting the rights to a free report and to dispute.

Other domains in this exam

Introduction to the U.S. Privacy Environment24% of the exam
Limits on Private-Sector Collection and Use of Data31% of the exam
Government and Court Access to Private-Sector Information12% of the exam
State Privacy Laws23% of the exam

See also the CIPP-US cert hub, the study guide, and the cheat sheet.