New Laws Impacting Employers Conducting Background Checks Effective July 1, 2024
Source: Forbes, Alonzo Martinez
Photo: Getty
July 1st. Image of july 1, close-up wooden color calendar on yellow background. Summer day
As of July 1, 2024, employers across the United States will face a series of new laws affecting employment practices, particularly in the areas of background checks, data privacy, pay equity, and workplace safety. These changes demand immediate attention and necessitate that employers update their policies and procedures to ensure compliance.
California Labor Code § 6401.9: Workplace Violence Prevention Plans
California employers must develop and implement a comprehensive workplace violence prevention plan as part of their Injury and Illness Prevention Plans under the new Labor Code Section 6401.9. This legislation mandates that employers create strategies to prevent workplace violence, which may include conducting thorough background checks as a crucial component. Additionally, employers must provide employee training on these plans to ensure all workers know the procedures and protocols. This initiative aims to enhance workplace safety and reduce incidents of violence, emphasizing the importance of pre-employment screening to identify potential risks.
Cal/OSHA is developing a workplace violence prevention standard that meets the requirements of Labor Code Section 6401.9 and will submit it to the Occupational Safety and Health Standards Board (OSHSB) no later than December 31, 2025. OSHSB is required to adopt the standard no later than December 31, 2026.
Colorado SB 58: Job Application Fairness Act
Starting July 1, 2024, the Job Application Fairness Act (JAFA) will take effect in Colorado, prohibiting employers from seeking any information that might reveal a job applicant’s age during the initial application process. This includes inquiries about dates of attendance or graduation from educational institutions. The legislation aims to combat age discrimination and foster a fairer hiring environment. Employers must revise their job applications and interview procedures to comply with this new law, ensuring that no age-related questions are posed directly or indirectly. This change seeks to create a more inclusive and equitable job market by emphasizing applicants’ skills and qualifications rather than their age. Similar prohibitions on requesting age-related information during the hiring process are already in place in California, Connecticut, Minnesota, and Pennsylvania.
New York City Workers’ Bill of Rights
New York City employers must display the multilingual “Your Rights at Work” poster in a visible location for all employees and provide a copy of the Workers’ Bill of Rights to current employees and new hires on their first day of work. This document contains essential information about worker classification, job applicant rights, pay transparency, salary history bans, rights when using an employment agency, and automated employment decision tools. By ensuring employees are well-informed of their rights, this legislation aims to promote workplace transparency and fairness, regardless of a worker’s immigration status. Employers must integrate this requirement into their onboarding processes and ensure ongoing compliance.
South Dakota SB 12: Medical Cannabis in the Workplace
South Dakota’s SB 12 clarifies that employers are not required to accommodate medical marijuana use in the workplace. Specifically, employers are not prohibited from taking adverse employment action, based solely on a positive test result for cannabis metabolites, against an employee if they are employed in a safety-sensitive job. Additionally, the law specifies that no cause of action for employment discrimination or wrongful termination arises from an employer’s enforcement of a drug-free workplace policy. Employers in South Dakota can continue to enforce their drug-free workplace policies without fear of legal repercussions related to medical cannabis use, maintaining a safe and productive work environment.
Data Privacy Laws: Florida, Oregon, and Texas
Three new data privacy laws are set to take effect on July 1, 2024, in Florida, Oregon, and Texas, each establishing responsibilities and privacy protection standards for businesses collecting personal data. These laws share a common goal of safeguarding consumer privacy while including exceptions for background checks conducted in accordance with the Fair Credit Reporting Act.
Florida SB 262: Florida Digital Bill of Rights (FDBR)
The FDBR applies to for-profit entities operating in Florida that collect personal data of Florida residents, control data processing, and have annual global revenues exceeding $1 billion. It specifically targets businesses that:
Derive 50% or more of their global annual revenue from online advertisement sales;
Operate consumer-smart speaker and voice command services with an integrated virtual assistant connected to cloud computing, activated hands-free; or
Run an app store or digital distribution platform with at least 250,000 different software applications for consumers to download and install.
The FDBR grants consumers the right to access, correct, delete, and opt out of the sale of their personal data and targeted advertising. It includes provisions related to the data of children under 18, sensitive data consent, data minimization, annual privacy notice updates, data retention schedules, and impact assessments, and prohibits government officials from moderating content.
Although the FDBR does not provide a private right of action, enforcement is carried out by the Florida Attorney General, who has a discretionary 45-day cure period. The FDBR authorizes civil penalties of up to $50,000 per violation, with potential treble damages if an online platform knowingly violates children’s rights.
Oregon SB 619: Consumer Privacy Act (OCPA)
The OCPA applies to entities that either:
Collect personal data from at least 100,000 Oregon residents (excluding payment transaction data); or
Process personal data from at least 25,000 Oregon residents and derive over 25% of their revenue from data sales.
The OCPA grants consumers the rights to access, obtain, correct, delete, and opt out of the sale of their personal data, targeted advertising, and certain profiling. Additionally, the OCPA includes provisions for data minimization, children’s data, sensitive data consent, opt-out preference signals, and data protection assessments.
Data controllers must provide consumers with a clear and accessible privacy notice. This notice must list the categories of personal data processed, the purposes for processing, how consumers can exercise their rights, categories of data shared with third parties, and all categories of third parties with whom data is shared.
While the OCPA does not grant a private right of action, it is enforced by the Oregon Attorney General, who has a 30-day cure period for violations, ending January 1, 2026. The Attorney General can seek civil penalties of up to $7,500 per violation.
Texas HB 4 (HB 1844): Data Privacy and Security Act (TDPSA)
The TDPSA applies to entities that determine the purpose and means of processing personal data and:
Conduct business in Texas by providing products or services consumed by state residents;
Process or sell personal data; and
Are not small businesses as defined by the U.S. Small Business Administration unless the small business sells sensitive data.
The TDPSA grants consumers rights to access, correct, delete, and opt out of the sale of their personal data and targeted advertising. It also includes provisions for data minimization, sensitive data consent, biometric data, and impact assessments.
Although the TDPSA does not provide a private right of action, it is enforced by the Texas Attorney General, who has a 30-day cure period for violations. The Attorney General may seek various forms of relief, including declaratory judgment, injunctive relief, civil penalties, attorney fees, and investigative costs. Civil penalties can reach up to $7,500 per violation, with treble damages for willful or knowing violations.
Parting Thoughts
The new laws, effective July 1, 2024, bring significant changes to employers conducting background checks across various states. If your organization is not yet prepared to comply with these regulations, it is crucial to take immediate action to revise your policies and procedures. Swift compliance is essential to avoid potential legal issues.