CIPP-US - Workplace Privacy - Section 4.1

Apply FCRA and applicable state law requirements governing background checks, consumer reports, and automated decision-making tools used in hiring.

Apply FCRA's requirements for employer use of consumer reports in hiring, including written disclosure, written authorisation, and the two-step pre-adverse and adverse action notice process before rejecting an applicant. Recognise that automated decision-making tools in hiring may trigger additional obligations under emerging state laws on algorithmic employment screening.

FCRA adverse actionBackground checkAutomated decision-makingConsumer report

Practice question for this objective

Free sampleWorkplace Privacymedium

A logistics employer orders a consumer report on a final candidate from a consumer reporting agency. The report shows a criminal conviction, and the hiring manager wants to reject the candidate on that basis. Counsel pauses the rejection and asks what the employer must give the candidate before it acts. Under the Fair Credit Reporting Act, what must the employer provide before taking the adverse action?

  • AA signed authorisation form re-confirming that the candidate still consents to the employer obtaining and relying on the consumer report.
  • BA copy of the consumer report and the document A Summary of Your Rights Under the Fair Credit Reporting Act, before the adverse decision is taken. Correct
  • CA written certification to the consumer reporting agency confirming that the employer has a permissible purpose for using the report in hiring.
  • DA final adverse action notice naming the agency and stating that the candidate may obtain a free copy of the report within sixty days.
Before taking adverse action on a consumer report, an FCRA user must give the applicant the report and the summary of rights. The FCRA imposes a two-step adverse-action process for employment users: before the decision, the employer must supply the report and the prescribed summary of consumer rights so the applicant can review and contest it, and only afterwards may it issue the final adverse-action notice.

Why A is wrong: Authorisation is collected before the report is pulled, not at the adverse-action stage, so re-confirming consent here misplaces a step that has already occurred and is not what the FCRA requires before action.

Why B is correct: The FCRA's pre-adverse-action duty requires the employer to give the candidate the report and the statutory summary of rights before acting, so the candidate can review and dispute inaccuracies first.

Why C is wrong: The permissible-purpose certification is a duty the employer owes the agency before procurement, not a document owed to the candidate before adverse action, so it answers the wrong stage of the process.

Why D is wrong: These elements belong to the notice given after the decision is final, but the FCRA first requires a pre-adverse-action step, so issuing the final notice now skips the candidate's chance to respond.

See more CIPP-US practice questions, answers explained.

More in this domain

Back to all Workplace Privacy objectives, or the CIPP-US cert hub.

Examworthy is not affiliated with or endorsed by IAPP. Original, blueprint-aligned practice material only.