FCRA Compliance

How We Implement FCRA Compliance

Indicia implements the following FCRA-required procedures within our platform. These are not aspirational — they are built into the screening workflow:

1. Standalone Disclosure & Authorization

Before any background screening is initiated, candidates are required to review and electronically sign a standalone FCRA Disclosure & Authorization form per §1681b(b)(2)(A). This form:

• Is a separate document consisting solely of the disclosure (not bundled with the job application)
• Clearly describes the types of information that may be obtained
• Requires an electronic signature (typed legal name) with timestamp, IP address, and user agent recorded
• Is stored with a complete audit trail and version tracking

2. Summary of Consumer Rights

A Summary of Your Rights Under the FCRA is available to all candidates. This document is also provided with every pre-adverse action notice, as required by §1681g(c). It covers rights under FCRA, PIPEDA (Canada), and GDPR (EU/UK).

3. Pre-Adverse Action Notice

Before any adverse employment decision is made based on screening results, our system enforces a pre-adverse action notice per §1681b(b)(3)(A):

• The candidate receives a copy of the consumer report and the Summary of Rights
• A mandatory 5 business-day waiting period is enforced before final action can be taken
• The system prevents final adverse action until the waiting period expires
• All notices and timelines are tracked with full audit trail

4. Adverse Action Notice

After the waiting period expires, if the decision stands, a final adverse action notice per §1681m(a) is sent to the candidate, containing:

• Name and contact information of the consumer reporting agency
• Statement that the CRA did not make the adverse decision
• Notice of the right to obtain a free copy of the report within 60 days
• Notice of the right to dispute the accuracy or completeness of any information

5. Dispute Process

If you believe information in your screening report is inaccurate or incomplete, you have the right to dispute that information. Contact us at:

disputes@indicia.confidion.com

We will investigate all disputes within 30 days and notify you of the results, as required by FCRA §1681i, PIPEDA Principle 9, and GDPR Article 16.

6. International Compliance (PIPEDA & GDPR)

In addition to FCRA, our platform implements compliance with:

• PIPEDA (Canada) — All 10 fair information principles including accountability, consent, limiting collection/use, accuracy, safeguards, openness, individual access, and challenging compliance
• GDPR (EU/UK) — Data subject rights including right of access, rectification, erasure, restriction, portability, and objection. Data Subject Access Requests (DSARs) are tracked and processed within 30 days
• Consent Management — Version-controlled consent records with full lifecycle tracking (granted, withdrawn, expired, superseded, erased)
• Right to Erasure — Complete data erasure capability with PII redaction across all related tables

State and Local Compliance

In addition to federal and international requirements, Indicia complies with applicable state and local background screening laws, including ban-the-box laws, state-specific adverse action requirements, and additional consumer protection regulations.