California SB 909 Requires Consent to Send Personal Information Offshore

In case you haven’t heard, employers in California have a new rule to follow when conducting employment background checks.  It’s a rule that we firmly support. California SB 909 was signed into law on September 29, 2010 and requires Consumer Reporting Agencies (a.k.a. background screening firms) that instigate an investigative consumer report for employment purposes to provide the subject of the report with a Disclosure and Request for Consent in order for the subject’s information to be sent outside of the United States or its territories.

Consumer Reporting Agencies (CRAs) will need to disclose the countries to which the subject’s information will be off-shored, supply truncated social security numbers to off-shore processors, and have a privacy policy related to off-shored data. Furthermore, CRAs can be held liable for consumer harm that occurs as a result of off-shored data.

Proforma Screening Solutions NEVER sends applicant data offshore.

As a member of  ConcernedCRAs, we are strongly opposed to the practice of off-shoring of sensitive personal information, including social security numbers and financial account information. This practice is used by some employment background screening firms and unfortunately, it places both applicants and employers at risk. SB 909 says that if a Consumer Reporting Agency sends such data off-shore, they must first receive the informed consent of the subject of the background check

How Does SB 909 Affect Your Business?

First, recognize that in recent years, many states (not just California) have taken measures to prevent the misuse of personally identifiable information (PII) in order to combat the increasing threat of identity theft. The federal government has also stepped in with federal protections contained in the Gramm-Leach-Bliley Act (“GLBA”) and the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Furthermore, the federal Fair Credit Reporting Act (FCRA) was amended in 2003 to provide additional identity theft protection.  So it’s not just SB 909 you need to be thinking about.

SB 909 provides that an Investigative Consumer Reporting Agency is liable to a consumer who is harmed by any unauthorized access of the consumer’s personally identifiable information, act, or omission that occurs outside the United States or its territories.  In turn, we would argue that any company that knowingly hires a consumer reporting agency that off-shores sensitive personal information, with or without consent, is taking unnecessary risks.

Once your applicant or employee data leaves the shores of the United States, our nation’s privacy protection laws no longer apply.  And while data theft certainly can also occur in the U.S., we do have legal protections, resources, and recourse mechanisms to help victims of identity theft. Once the data goes off-shore, those protections quickly disappear.

This is an important point that all employers should be aware of and often the issue rears its head when it comes to price shopping. You’re looking for the least expensive background checks you can find but you may be putting your applicants, your employees, and your business at risk if you unknowingly rely on cheap background checks that are off-shored for processing.  Risking an individual’s personally identifiable information to make more money is simply not justifiable, particularly when you consider than an average high quality U.S. background check can cost just as little as $30.

Read the complete SB 909 bill.

Let us answer your questions. Drop a comment here or contact us.
If you’re ready to work with a reputable background screening firm, open an account with us.

About Michael Gaul

A security industry professional since 1988, Michael has extensive expertise in the fields of human capital risk management, physical security, and background screening process management. Michael leads Proforma’s sales, marketing, and strategic customer relations efforts.
View all posts by Michael Gaul →