When your company conducts background checks on job applicants or current employees, you receive consumer reports containing some of the most sensitive personal information imaginable—credit history, criminal records, employment verification, and in some cases Social Security numbers and financial account details. Federal law under the Fair Credit Reporting Act (FCRA) doesn’t just regulate how you obtain and use these reports; it also imposes specific obligations around FCRA employment screening record disposal. For HR managers and compliance officers at New York businesses, understanding these disposal requirements is non-negotiable—failure to comply exposes your organization to FTC enforcement, private lawsuits, and class action liability.
The FCRA’s Disposal Rule, implemented through an FTC rulemaking, applies to any person or entity that possesses consumer report information for a business purpose. This includes employers who receive background check reports on job candidates, staffing agencies throughout New York City, and any business that uses third-party screening vendors. The rule requires that you “properly dispose” of consumer information by taking “reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.” For paper records, that standard clearly requires shredding, burning, or pulverizing documents so they cannot be read or reconstructed—meaning your office’s strip-cut shredder likely doesn’t meet the bar.
What the FCRA Disposal Rule Requires
The FCRA Disposal Rule (16 C.F.R. Part 682) establishes that any business possessing consumer report information—including background check results, credit reports, and investigative consumer reports used for employment purposes—must dispose of that information securely once it is no longer needed for a legitimate business purpose.
The rule applies to both paper and electronic records, and “consumer report information” is broadly defined to include not just the full report but any information derived from a consumer report—meaning handwritten notes your HR team made while reviewing a background check, interview memos that reference credit or criminal findings, and spreadsheets that summarize screening results across multiple candidates all fall within scope.
Specific disposal methods deemed compliant under FTC guidance include:
- Burning, pulverizing, or shredding physical documents so they cannot be read or reconstructed
- Destroying or erasing electronic files or media containing consumer report data
- Hiring a qualified third-party disposal contractor with appropriate data security controls and contractual protections
The third option—using a qualified third-party contractor—is the most defensible approach for most New York employers because it creates a documented chain of custody and a Certificate of Destruction that can demonstrate compliance during an FTC investigation or employment litigation. Learn more about our compliance-focused services that satisfy FCRA disposal requirements.
Which Employment Records Trigger FCRA Disposal Obligations
HR departments typically accumulate consumer report information in several formats that may not be immediately obvious. Understanding which documents are covered by the FCRA Disposal Rule is essential to building a compliant disposal workflow.
Records clearly covered by the FCRA disposal requirement include:
- Third-party background check reports from vendors like HireRight, Sterling, or Checkr
- Credit reports obtained through a consumer reporting agency for employment purposes
- Investigative consumer reports, including reference checks conducted by third parties
- Drug test results obtained from third-party testing labs that qualify as consumer reports
- Any internal documents or notes that incorporate, summarize, or are derived from the above
Records less obviously covered—but potentially within scope—include job applications containing self-reported background information obtained in conjunction with a consumer report, offer letters that reference background check conditions, and rejection notices that document the reason for adverse action based on consumer report findings. When in doubt, treat any document containing personal information about a job candidate as subject to FCRA disposal obligations. Our professional shredding services provide secure destruction for all these document types.
FCRA Disposal and New York’s Unique Employment Privacy Landscape
New York employers face a particularly complex regulatory environment when it comes to employment screening and record disposal. In addition to federal FCRA requirements, New York City’s Fair Chance Act restricts when employers can conduct criminal background checks (generally only after a conditional offer of employment), and New York State law places additional restrictions on the use of criminal records in employment decisions under Article 23-A of the Correction Law.
These restrictions don’t reduce your FCRA disposal obligations—they potentially expand them. Because NYC employers must go through a formal multi-factor analysis before withdrawing a conditional offer based on a criminal record, the paper trail around that analysis (including the background check report and your written assessment) must be retained for a period sufficient to defend against discrimination claims, then securely destroyed once that retention period has passed.
Similarly, New York State’s SHIELD Act imposes data security obligations on private information including Social Security numbers, financial account information, and biometric data—all of which may appear in employment screening records. The SHIELD Act’s “reasonable safeguards” requirement for disposal aligns with but extends beyond FCRA, meaning New York employers are operating under a layered compliance framework for background check record disposal. Visit our areas serviced page to confirm we cover your location throughout the New York metro area.
Building a Compliant FCRA Record Disposal Workflow
The most effective approach to FCRA employment screening record disposal is to integrate it into your standard HR document management lifecycle rather than treating it as a separate compliance task. Here’s a framework that works well for New York employers:
First, establish a clear retention period for employment screening records. Most employment attorneys recommend retaining records for the duration of the employment relationship plus the applicable statute of limitations for employment discrimination claims—typically two to four years in New York depending on the claim type. For applicants who were not hired, retention of one to two years from the application date is generally sufficient to defend against discrimination claims.
Second, implement a physical or digital flag system that marks records for destruction once they reach their retention expiration date. Third, use locked consoles in your HR area to collect expired screening records securely until your scheduled shredding service arrives. Fourth, document each disposal event with a Certificate of Destruction and retain that certificate in your compliance files—ironically, this is one record you should keep indefinitely. Learn about our chain-of-custody process and how it supports your HR compliance program.
Consequences of Non-Compliance with FCRA Disposal Requirements
The penalties for violating FCRA disposal requirements are substantial. The FTC can bring enforcement actions against employers who fail to properly dispose of consumer report information, and the FCRA provides for private rights of action that allow affected individuals to sue for actual damages, statutory damages of $100 to $1,000 per violation, punitive damages, and attorneys’ fees.
In a class action context—where a single employer’s failure to properly dispose of background check records for hundreds of applicants becomes the basis for a lawsuit—the exposure can reach into the millions. High-profile FCRA class action settlements routinely exceed $1 million, and plaintiff’s attorneys actively look for systemic disposal failures as evidence of willful non-compliance (which triggers the higher statutory and punitive damages provisions). For New York employers competing for talent in a tight labor market, the reputational damage of an FCRA enforcement action can be equally costly.
A straightforward, documented shredding program with a certified partner is one of the most cost-effective risk management investments an HR department can make. Request a free quote from New York Shredding today to get your employment records program compliant.
Why New York Businesses Choose New York Shredding
For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.
Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.
Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services.