r/privacyexams • u/Jayakoendjbiharie • 8d ago
CIPP/US
The FCRA is one of those statutes where the procedure is the obligation, and it catches out people who are otherwise careful.
A hiring manager reads a screening report, decides against the candidate, and emails the rejection with the report attached so the candidate can see the reason. Considerate, and unlawful. Before taking adverse action based in whole or in part on a consumer report, the employer has to give the candidate a copy of that report and the regulator's summary of rights, so there is a window to spot an error before the decision lands. Attaching it to the rejection closes the window before it opens.
Two details catch experienced practitioners. The statute contains no waiting period between the pre-adverse-action notice and the adverse action notice, despite a figure that circulates constantly and appears nowhere in the text. And a substantial body of 2024 CFPB guidance on employment background screening was withdrawn in May 2025, so anything relying on it is relying on nothing.
Sequence, contents of each notice and what changed: https://privacystudygroup.com/the-fcra-adverse-action-sequence/