FCRA stands for Fair Credit Reporting Act, a federal law that regulates how consumer credit reports are collected, used, and shared1. It aims to protect consumers from inaccurate or unfair information in their credit reports

Almost everyone has heard the terms DWI and DUI, and many think that both are interchangeable. New York law uses a third term – DWAI. None of these terms are interchangeable, and New York law does not use the term DUI or driving under the influence.

In New York, there are two main “drunk driving offenses” – DWI and DWAI. DWI stands for “driving while intoxicated,” while DWAI stands for “driving while ability impaired.” A DWI means that the driver is legally intoxicated, with a blood alcohol content of at least 0.08 percent. A DWAI involving alcohol means the driver’s blood alcohol content is between 0.05 and 0.07 percent.

Although the penalties for a New York DWI and DWAI are nearly the same, there is a big difference between them regarding the offense level. A DWI conviction is a criminal offense, while a DWAI conviction is a violation – which in New York is a non-criminal offense.

The practical effect of this distinction is that a DWAI conviction will appear on a New York driving record (usually stated as “driving while impaired”), but the court conviction will not appear on a New York Statewide CHRS report because these reports do not include non-criminal offenses such as violations.

Some states allow a defendant convicted of a crime to apply for a court order limiting public access to the conviction record or to restore rights and remove disabilities caused by the conviction. This type of order is commonly referred to as an expungement; however, the qualifications for obtaining an expungement and the effect of the expungement vary among the states that allow expungements.

California has an expungement procedure set forth in Penal Code 1203.4. If a defendant meets the qualification of Penal Code 1203.4, the court will allow the defendant to withdraw a plea of guilty or no contest, to reenter a plea of not guilty, and to have the case dismissed. The defendant is also relieved from many of the negative consequences of a criminal conviction.

When reviewing California criminal records showing a conviction, it is important to note if there is also a reference to a Penal Code 1203.4 dismissal because this can impact whether the record is reportable in a background check for a California employer. For example, California law does not allow the reporting of criminal records that result in a non-conviction in employment-purpose reports. Even though the record shows a conviction, the Penal Code 1203.4 dismissal effectively means the conviction never happened.

The reference to the code section will typically be found on the case docket, dated a year or so after the conviction date.

Although several states have laws analogous to the federal Fair Credit Reporting Act (FCRA), the District of Columbia does not. As a rule, the District of Columbia follows the federal FCRA regarding the limitations on reporting negative information in background check reports used for employment purposes. However, there are three notable exceptions where district law differs from the FCRA regarding reporting criminal records:

(1)        Records of arrests or criminal accusations that did not result in a conviction cannot be reported (unless the charges are pending);

(2)        Inquiries about criminal convictions cannot be made unless a conditional offer of employment is made; and

(3)        Convictions with a completed sentence that is more than 10 years old cannot be reported.

The first two exceptions are found in the district’s Fair Criminal Record Screening Amendment Act of 2014 codified at Sections 32-1341 – 32-1346 of the Code of District of Columbia, and the third exception is found in Section 2–1402.66 of the district’s Human Rights Law.

The NY FCRA sets forth notice and authorization requirements for investigative consumer reports as shown in “https://law.justia.com/codes/new-york/2017/gbs/article-25/380-c/” NY Gen Bus L § 380-C. However, this section is silent on the issue of employee misconduct investigations and we found no  language in NY FCRA law that is analogous to the federal FCRA exemption for employee misconduct investigations as provided in 15 U.S.C.1681a(y)(1).

When analyzing this question, we reviewed a 2006 opinion by the Oklahoma Attorney General that addressed a very similar issue. A state senator wanted to know whether OK employers could rely on the FACTA amendment to the federal FCRA that provides the exemption for employee misconduct investigations and dispense with the OK notice requirements for consumer reports. The OK AG said “no,” the reason being that the OK statute (which specifically references the previously enacted federal FCRA) was enacted before FACTA and the OK legislature did not indicate in the statute that amendments to the original FCRA would also be adopted.

Of course, the AG opinion is not a binding law anywhere, including in OK. But it does show how the issue may be analyzed to the detriment of the employer if it arose in litigation. Like the OK statute, the NY FCRA was enacted well before the FACTA amendment in 2003 (NY FCRA was enacted in 1977). However, unlike the OK statute, the NY FCRA does not include any references to the federal FCRA and, therefore, does not rely on any of its language as originally enacted. That is a distinction that can undermine an OK AG-type analysis to the NY FCRA.

The most we can say is that the NY FCRA does not address employee misconduct investigations and that the federal FCRA does set forth an express exemption from its notice requirements for such investigations. Whether there is a conflict between the NY notice requirements (or any other state’s notice requirements) and the federal exemption for employee misconduct investigations remains to be seen and there are no court opinions addressing the issue.

In the absence of guidance from NY FCRA regarding employee misconduct investigations, the employer can follow the federal FCRA exemption for these investigations. It would be prudent for the employer to document the need for confidentiality of the investigation, specifying the reasons why alerting the employee would undermine the investigation.

Since the COVID-19 pandemic, employees working from home (WFH) have created a host of new wrinkles for employers, many of which are still being ironed out.

For employees, the WFH option can be safer (less chances of contracting COVID) and easier (no more commute); for employers, WFH reduces the cost of overhead and can result in happier, more productive employees.

While it may sound easy to simply hire a worker on the other side of the country, there are several legal questions for employers who want to recruit and hire an out-of-state employee who will WFH. The following are some of the important issues that employers should consider.  

  • Recruiting. Looking for a new employee beyond state lines appears to present a limitless supply of potential new workers. But employers need to familiarize themselves with the laws of the state where the applicant lives, particularly with regard to issues such as background checks, criminal record searches and compensation.

Several states – including New Jersey and New York – prohibit employers from inquiring about a job applicant’s salary, benefits and other compensation history.

Other factors may make certain locations a more advantageous space to find new WFH hires.

Some states offer financial incentives to remote workers. Alabama, Georgia, Oklahoma, and West Virginia offer bonuses to entice remote workers, ranging from reimbursement of moving expenses to $12,000 in cash (West Virginia will pay $10,000 divided over the course of 12 months with $2,000 paid at the end of the second year in residence).

  • Employee benefits and protections. Once an out-of-state employee has been hired to WFH, employers have a whole new list of individual state laws to learn. Each state has its own variations on employee benefits as well as legal protections – and in many cases, additional differences at the county and/or municipal level.

These differences can present the possibility of additional liability for employers on issues such as paid sick leave, paid family leave, minimum wage, disability, unemployment and vacation days, among others. 

State laws on minimum wage vary widely, along with differences for tip credits and minimum salary thresholds for exemptions. The current minimum wage in Texas is $7.25 per hour, for example, while New York’s minimum wage is $11.00.

Paid family leave is now mandatory (or will be soon) in California, Colorado, Connecticut, Massachusetts, New Jersey, New York, Oregon, Rhode Island, Washington, and Washington, D.C.

As for overtime, most states follow the standard payment of time-and-a-half for hours worked over 40 in a workweek, but a handful (including California) have more stringent requirements, while some states (California again) mandate that earned vacation days never expire. 

Without a physical location in the state where a WFH employee resides and a breakroom to hang various notices, an employer must still remember to fulfill poster and notification obligations as well as various mandatory training. Remote employees do not need to tape posters up on their walls to satisfy state laws, but employers do need to provide certain information and documentation to out-of-state WFH employees to achieve compliance by sharing – and updating – federal, state, and local notices.

Even if an employer has a single WFH employee in another state, workers’ compensation insurance is necessary, along with registration with the appropriate state agency. Some states have their own fund that employers must contribute into, while a third-party insurance company will suffice in others.

In addition, each state has different laws on employee protections, sometimes with variations at the local level. Employers should be careful to consider state, county and/or municipal statutes and regulations with regard to non-compete agreements, discrimination and retaliation protections and the requirements to legally terminate an employee.

  • Tax implications. Employees must be registered for tax purposes in the state where they reside, which means the company itself needs to register its presence in those states for tax purposes. That potentially newfound “tax nexus” to another state may mean sales and use taxes, income taxes and franchise taxes for the employer as well, depending on the requirements of the other state. The failure to properly register and pay the appropriate taxes can result in fines and penalties.

The registration process requires paperwork, time and patience, as it can take several weeks for an employee and the employer to be property registered. And some states – Pennsylvania, for example – also have local city or township registration requirements in addition to those at the state level.

Employers may also be subject to higher corporate income tax rates, which is calculated in part based on the employee’s role and seniority. So a WFH executive in a state with a high tax rate may cost an employer more money than a lower-level WFH employee in that state.

WFH employees themselves may face a tax conundrum with the “convenience of employer” rule that applies in seven states. In Arkansas, Connecticut, Delaware, Massachusetts, Nebraska, New York and Pennsylvania, if an employee works in a different state than her employer by choice – not because the job mandates – then the employer’s state has the right to tax her, and the employer would be required to withhold taxes from her paycheck in both her home state and the employer’s.

Alternatively, some states have reciprocity agreements that expressly forbid this double taxation. A total of 16 states and Washington, D.C. have such deals, where an employee who lives in Wisconsin and works for an Illinois employer, for example, only pays income taxes in Wisconsin. States that have reached such agreements typically share a border, although Arizona has gone above and beyond, with reciprocity in California, Indiana, Oregon and Virginia.

One additional complication: some states have issued temporary guidance to deal with the out-of-state WFH situation during COVID. Alabama and Georgia stated that they would not enforce payroll withholding requirements for employees who are temporarily working from home due to government-mandated stay-at-home orders; Connecticut said that employees WFH due to the pandemic is a necessity for work but New York reached the opposite conclusion, stating that it is for the employee’s convenience.

Employers should consider all of the legal ramifications before hiring an out-of-state WFH employee.

On January 10, 2021, the New York City Council passed an amendment (Local Law 4) to the city’s Fair Chance Act (FCA) which significantly expands protections for job applicants and employees. The amendment goes into effect July 28, 2021. Below are highlights of Local Law 4:

  • Expands scope of “criminal history” to include pending arrests and other criminal accusations.
    The FCA process must be used to determine if a pending arrest or other “criminal accusation” may be the basis to rescind a conditional job offer. Such rescission may only occur if, after considering the relevant fair chance factors “the employer determines that either (i) there is a direct relationship between the alleged wrongdoing that is the subject of the pending arrest or criminal accusation and the employment sought or held by the person; or (ii) the granting or continuation of the employment would involve an unreasonable risk to property or the safety or welfare of specific individuals or the general public.”
  • Adds new factors to the individual assessment for pending arrests or criminal charges, or convictions that occur during employment.
    Employers will have to consider the following factors, in lieu of the Article 23-A analysis:
  • The New York City policy “to overcome stigma toward and unnecessary exclusion of persons with criminal justice involvement in the areas of licensure and employment”;
  • the specific duties and responsibilities “necessarily related” to the job;
  • the bearing, if any, of the criminal offense or offenses for which the applicant or employee was convicted, or that are alleged in the case of pending arrests or criminal accusations, on the applicant’s or employee’s fitness or ability to perform one or more such duties or responsibilities;
  • whether the employee or applicant was 25 years of age or younger at the time the criminal offense(s) for which the person was convicted occurred, or that are alleged in the case of pending arrests or criminal accusations;
  • the seriousness of such offense(s);
  • the employer’s “legitimate interest” in “protecting property, and the safety and welfare of specific individuals or the general public”; and
  • any additional information produced by the applicant or employee, or produced on their behalf, regarding their rehabilitation or good conduct, including history of positive performance and conduct on the job or in the community, or any other evidence of good conduct.
  • Prohibits inquiries about specified criminal matters.
    At no time may an employer take an adverse action against an applicant or employee based on that person’s (i) violations; (ii) non-criminal offenses; (iii) non-pending arrests or criminal accusations; (iv) adjournments in contemplation of dismissal; (v) youthful offender adjudications; or (vi) sealed offenses, if disclosure of such matters would violate the New York State Human Rights Law.
  • Requires employers to solicit from the candidate information related to the FCA process.
    Currently, the FCA requires employers to only solicit evidence of rehabilitation and good conduct.
  • Expands the time for candidates to respond to the employer’s writtenassessment from three to five days.
  • Codifies guidance from the New York City Commission on Human Rights on revoking a conditional offer of employment.
    Employers may only revoke the conditional offer based on (i) the findings of a criminal background check following an individual assessment conducted pursuant to the FCA process, (ii) the results of a medical examination, consistent with the Americans with Disabilities Act; or (iii) other information obtained by the employer after making the conditional offer, if the employer could not be reasonably expected to have that information prior to making the offer and the employer would not have made the offer if it had possessed such information.
  • Requires production of evidence to the applicant or employee where the employer takes adverse action pursuant to an alleged misrepresentation by the applicant or employee.
    Under the existing FCA, an employer may take adverse action against candidates who intentionally misrepresent information to the employer. The Law will continue to allow an employer to take such action, but will require the employer to provide to the candidate the documents or other materials that support the employer’s claim of misrepresentation and permit the individual a “reasonable” amount of time to respond prior to taking the adverse action.

The California Consumer Privacy Act of 2018 (CCPA) gives California residents more control over their personal information that businesses collect about them. The CCPA took effect on January 1, 2020, and final regulations for the statute were approved on August 14, 2020. Enforcement of the CCPA by the California Office of the Attorney General has begun and affected business not in compliance can be fined up to $2,500 per violation or $7,500 for each “intentional” violation.

Who has to Comply with the CCPA?

For-profit businesses doing business in California that collect and control California residents’ personal information must comply with the CCPA if they meet one of three requirements: (1) have annual gross revenues more than $25 million; (2) possess the personal information of 50,000 or more consumers; or (3) earn more than half of its annual revenue from selling consumers’ personal information. For further information about affected employers, see our previous article on the CCPA.

Compliance Strategies to Minimize Enforcement Risk

Businesses required to comply with the CCPA should consider several actions to avoid the risk of enforcement by the attorney general’s office:

  • Update existing privacy policy with information on how, why, and what personal information is collected and processed
  • Update existing privacy policy with information on how users can request access, change, or erase their personal data
  • Introduce a method to verify the identity of the person making requests to access or change their data
  • Introduce a “Do Not Sell My Personal Information” link on their home page to allow users to prohibit the sale of their personal data
  • Obtain consent from minors 13-16 years old before selling their personal data and obtain consent from parents for minors younger than 13

Responding to Consumer Requests and Protecting Personal Data

As more and more companies shift to remote work and digital systems, compliance with the CCPA has become more critical, and for some, burdensome. Companies with limited resources that are struggling to create remote work policies and procedures inside the office are now faced with the challenge of managing data beyond the office. It is important to note that under the CCPA, the California attorney general can also take enforcement action against a business for failing to respond to consumer requests to view or delete personal information, as well as for an unauthorized sale of a consumer’s personal information (or sharing of that data).

Avoiding these compliance pitfalls may require using artificial intelligence and implementing digital tools. Here’s how companies can adapt to CCPA requirements.

Look to analytics and automation technologies to meet consumer and auditor requests efficiently and affordably. Under the CCPA, consumers may request a copy of the data categories being gathered or for their data to be deleted. This is where digital solutions can come in handy. Virtual assistants can help employees ensure that requests are addressed by identifying which consumers have a higher compliance risk and placing them into an automated workflow. Furthermore, analytic tools can make it possible to identify all requests mentioning certain key words, such as “CCPA,” “personal information,” “remove,” or “disclose.” Such tools can ensure efficient and reliable compliance with consumer or auditor requests.

Ensure that third-party partners who collect consumer data are compliant with CCPA requirements. For companies that fail to store consumer data in one central location, they may find it harder to comply with CCPA regulations. Such companies often give third-party providers access to consumer data. In these scenarios, companies should make sure that the third-party providers themselves are compliant with the CCPA.

During these times especially, the CCPA has taken on a new urgency and this is probably just the beginning of the era of consumer data protection.

Unless a California employer has been hiding under a rock, chances are that the company is aware of the impending California Consumer Privacy Act (CCPA).

Signed into law in June 2018 as a quickly-enacted compromise to prevent an even stricter initiative from appearing on the ballot, the CCPA is the most far-reaching consumer privacy and data protection measure in the United States.

The new law applies to any for-profit company doing business in the state that (1) collects consumers’ personal information (PI) solely or jointly with others and (2) either (i) exceeds $25 million in annual gross revenues; (ii) annually transacts in the PI of 50,000 or more consumers, households or devices; or (iii) derives half or more of its annual revenues from PI sales.

“Personal information” includes an IP address, Internet activity, geolocation, education information and biometrics, among other data. A “consumer” is defined as “a natural person who is a California resident,” easily encompassing both employees and job applicants.

Covered entities are required to provide consumers with access to the data collected about them as well as the ability to opt out of the sale of their information to third parties and request that their PI be deleted. Businesses must disclose and deliver the information to consumers free of charge within 45 days of receiving a verifiable request.

Violations of the CCPA are actionable by the California Attorney General’s Office and a limited private right of action also exists for data breaches, with civil penalties of up to $7,500 per violation.

The expansive definitions and broad reach of the law have many employers concerned about the application of the CCPA to their business when the statute takes effect on January 1, 2020.

But – for those employers that do fall under the statute’s coverage – a last-minute amendment to the CCPA will provide a one-year reprieve.

In an effort to alleviate the burden on employers, state lawmakers enacted Assembly Bill 25 in September. The measure amended the CCPA to provide a one-year exemption for the personal information “collected from a natural person by a business in the course of the natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business.”

This tweak grants employers 12 months of breathing room as long as they are collecting the data of employees and job applicants solely for purposes relating to employment. Governor Gavin Newsom signed the bill into law on October 11, 2019.

Despite the reprieve, covered employers would be well-served to continue preparing themselves to comply with the law. The requirements of the CCPA will still apply with regard to PI about non-employees and/or non-exempt uses of employee and applicant data. And the statute will take full effect for employee and applicant data as of January 1, 2021, absent some future change to the law if lawmakers decide to extend the exemption or make it permanent.  

One of the hottest trends in employment in recent years has been the passage of “ban-the-box” and salary inquiry prohibitions in states and cities across the country.

Limitations on salary inquiry have popped up in recent years as part of the legislative fight against wage discrimination and the gender pay gap. Proponents of such prohibitions argue that salary history questions feed into the discrepancy between what male and female employees are paid by continuously repeating history.

Currently, California, Delaware, Massachusetts, Oregon and Puerto Rico have banned inquiries about prior salary, as have cities including New Orleans, New York and Philadelphia, with dozens of other states and local governments considering such measures.

The colloquial term “ban-the-box” refers to a box that applicants check to indicate they have a criminal record on standardized application forms. About 20 states and more than 150 local entities have already enacted legislation addressing inquiries into criminal history. The trend even went federal in 2015 with the Fair Chance Act introduced in Congress. Although the measure did not pass, it demonstrated the popularity of the movement.

The proposed federal legislation also shined a light on the situation facing multistate employers, with different laws in different states and in some situations, different laws in different cities or municipalities within the same state. One law may contain an outright ban on inquiries into salary or criminal history while another may place restrictions on the timing of the questions. Some laws define covered employers to include businesses with five or more employees; another may not apply its limitations to employers with less than 50 workers.

As an example, although the state already limited employers’ ability to ask job applicants about any juvenile court matters, the California legislature broadened its ban-the-box protections for employees with a new law in 2017. Employers in the state are restricted from making hiring decisions based on an applicant’s convictions records and forbidden from considering conviction history until a conditional offer of employment has been extended.

If an employer elects not to hire an applicant because of a prior conviction, the employer is required to conduct an individualized assessment to determine whether the history has a “direct and adverse relationship” with the job duties that justifies denial of the position. Written notice must be provided to an applicant that his/her conviction history has disqualified the applicant from employment, along with five days to respond and dispute the decision. A second notice must be provided with the final decision not to hire.

In contrast, Vermont’s ban-the-box measure takes a different approach, allowing employers to question applicants about their criminal records during the job interview, albeit providing an applicant with the opportunity to explain their record. And under New York City’s law, an employer commits a per se violation of the statute by using recruiting materials of any kind (including advertisements, solicitations or applications) that express, directly or indirectly, any limitation or specification regarding criminal history.

While the overarching principle remains consistent, the details of the laws vary from jurisdiction to jurisdiction. For multi-state employers, coping with such a patchwork of legal requirements poses a serious challenge.

As the number of state and local jurisdictions with laws addressing salary inquiries or criminal history continues to expand, multi-state employers should brace themselves for a giant compliance puzzle – and consider getting help from an expert.