19

I was asked to authorize a background check. The company performing the check is called GoodHire. Their authorization letter was fairly innocuous. It stated the candidate authorized the check. When I checked GoodHire privacy policy I found it was obscene. The company provided a list of ways they were going to share private information with others that were not authorized in the letter.

Very sneaky. I declined the authorization.

The company and I now need to find a way to perform a background check that respects a candidate's privacy. In particular, the information provided is for purposes of a background check and nothing more. No additional usages are approved, and no leaking information to external parties or sharing of information with data brokers.

How does one obtain a background check that does not leak information to external companies or share information with data brokers?


I'm fairly certain this can be done. I've had both Public Trust and Top Secret clearances in the past, and neither involved leaking information to external parties. I just don't know how to obtain the same level of diligence outside US Federal or US DoD.

4
  • 1
    Thanks @Joe. The company and I are on the same page. We are having trouble locating a company to perform the background check under reasonable terms. Do you know what company or firm US Federal or US DoD use? I assume someone with HR experience in the vertical would probably know.
    – user25792
    Aug 16, 2019 at 10:34
  • 5
    @JoeStrazzere "The defense activity known as Defense Industrial Security Clearance Office (DISCO) is part of the Defense Security Service (DSS), an agency of the. DISCO processes and adjudicates Personnel Clearances." military.com/veteran-jobs/security-clearance-jobs/…
    – shoover
    Aug 16, 2019 at 14:40
  • 6
    "in the past, and neither involved leaking information to external parties." - If you have held Secret and Top Secret clearances then your information has been leaked to external parties (OPM data breach that affected all DoD employees). The previous comment about the DoD conducting their own background checks via OPM is indeed correct though. The linked page is not accurate information for direct government employees by the way (so it wouldn't apply to the author's past employment (DoD).
    – Donald
    Aug 16, 2019 at 17:46
  • Which part do you find so objectionable? It seems like they share PII "With our service providers, but only to the extent necessary to provide services to you", which is true of literally any company that doesn't own 100% of their own infrastructure. If they use AWS, GCP, Rackspace or any other hosting company to run their servers, they need something like that. The DOD certainly can and does run a lot of its own infrastructure, but most companies don't.
    – Vinay Pai
    Aug 29, 2019 at 17:50

4 Answers 4

9

This privacy policy is perfectly normal. You have unreasonable standards.

Here's the section that I think outlines best what they do.

Table of info sharing from privacy policy

The first two rows are the personal information of the candidate, and the information I would be most cautious with. The first row is your account information, and the only parties they share it with are those they use to directly provide the services. For example, if they use a third-party to host their website, then your information would need to be provided to the third-party to create the account. There is probably a similar clause for any website you create a user account on.

The second row is your government ID, which is certainly sensitive, but they only share it so that they can verify your identity. If they don't know who you are, then they can't perform a background check. There's really no way around this one.

The last three rows are all information that almost any website gathers simply by you visiting the site. If you are worried about this information getting out, you should probably stop reading this and get off the internet all together.

I'm no security expert, so by all means feel free to verify this over at Security SE, but I think you'll get a pretty similar answer. They only way you'll get around these data "leaks" is by doing the background check yourself.

6
  • 1
    Thanks @David. I did not like the fine print on "our service providers". They share the information with their parent company and their partners, which are free to share with their partners, ad infinitum. They really should call it a Sharing Policy rather than a Privacy Policy. Welcome to the United States of Corporate America, I suppose...
    – user25792
    Aug 28, 2019 at 15:53
  • 1
    @jww Where does it say they are free to share it with their partners ad infinitum? For the parent company, data is stored on their servers. Third parties are "required to secure your information and only use it to provide the services described".
    – David K
    Aug 28, 2019 at 16:01
  • 1
    Thanks again @David. "They only way you'll get around these data "leaks" is by doing the background check yourself" - Yeah, we basically came to the same conclusion. I sent the company links to Motor Vehicle Administration and Background Investigations provided by the states I have lived in. We'll just order the reports ourselves. It looks like it will be cheaper, too.
    – user25792
    Aug 29, 2019 at 19:13
  • 1
    Regarding "feel free to verify this over at Security SE..." - I actually have some subject matter expertise. I've worked as a Security Architect in US Financial for three investment banks (among other verticals, like DoD). I know exactly what goes on here because I've reviewed these systems. I also helped technical edit Peter Gutmann's Engineering Security, which is one of two books on the subject of building secure systems. My standards are commensurate with the knowledge I have. They are not arbitrary or unreasonable.
    – user25792
    Aug 29, 2019 at 19:24
  • There is no fine print on "our service providers", what in the world are you talking about? Aug 30, 2019 at 19:52
4

TLDR: That's pretty standard and they don't have permission to sell your PII used for background checks.

As someone who works in the background check industry what I say "hopefully" will carry some weight.

If you are in the United States the FCRA (Federal Credit Reporting Act) covers the rights of individuals whose backgrounds are being checked. The FCRA has strict guidelines that must be adhered to including the disclosure of how the information will be used, and which information can be shared. Goodhire is FCRA Accredited and Compliant which is not easy to do and requires strict adherence to the FCRA, along with audits to esnure FCRA compliance.

The FCRA was developed to protect consumers, and CRAs (like Goodhire) are fined a minimum $1,000 for each breach of the FCRA. This highly discourages them from using your data incorrectly. Many lawsuits against a CRA become a class action lawsuit, and their databases and systems are scrutinized to see if there are any other violations when they are found. As such either your data is protected or you might be part of a multi-million dollar settlement (like the recent Equifax settlement).

Most CRAs use or are integrated with an ATS (Applicant Tracking System). Goodhire might be both in one, but often a CRA shares PII with ATS and vice versa in order to complete the background check. Data Vendors are another 3rd party most CRAs use. These vendors house the criminal records, driving records, etc, and need your PII shared with them to do their work. ATSs and CRAs are both subject to the same FCRA rules and regulations for usage of data.

Hopefully this help clears it up for you a little.

3
  • +1 Great answer with good experience to back it!
    – David K
    Aug 29, 2019 at 12:13
  • Thanks @Nick. I'm probably splitting hairs, but I did not say "sell", I said "share". The site's documentation clearly states they do it, even though it is not clearly stated on the authorization form.
    – user25792
    Aug 29, 2019 at 12:51
  • 2
    The sharing of your PII they refer to would be through vendors, ATS, and CRA systems. Other data, like your browsing data, is data that already exists on their system. For my purposes above you can subsitute "sell" with "share". Their sharing section is pretty standard and include PII only when necessary for the background check to continue. With the FCRA accreditation I wouldn't worry much. A lot of companies demand FCRA certifications in order to hire a CRA for background checks, and they won't want to lose that. (Generally, of course.) Aug 29, 2019 at 13:32
2
+50

As @David commented, "They only way you'll get around these data "leaks" is by doing the background check yourself". We came to the same conclusion, and it is what we opted to do. A side benefit is, the checks costs about $75.00 in total. It was a fraction of the price these "HR as a Service" firms were charging.

I'll provide the details here for others who have similar concerns and problems. It also assumes the customary work history and reference checks since the HR departments still do it.

First, obtain the unofficial list of residencies from the candidate. In my case, I lived in Atlanta GA, New York NY, and Baltimore MD.

Second, perform a quick smoke-test on the candidate by visiting online court case searches. In my case, one can perform a court case search at:

Third, verify residency using Motor Vehicle records. Motor Vehicle records can be found at the administration's website.

Fourth, for each state, request a background check from the state. In my case, here are the state websites.

The background checks are free or reasonably priced. For example, New York does not charge for the records, and Maryland charges $18.00 for state background check, and provides a full criminal background check for free.

We are not sure how to proceed with financial records at the moment. I attempted to obtain a consumer credit report under FCRA after being alerted to fraudulent activity several years ago. I requested the report by phone and then in writing. Neither request was fulfilled. (Don't believe the crap you read about the FCRA. I can say for certain they won't be provided).

For minimum cost and effort it is relatively easy to ensure data brokers do not obtain and disseminate personal information about someone. The data brokers can probably provide more details, like what toppings I prefer on my vanilla ice cream, but they are not needed here.

0

I'm reading the policies you provided under the section, "When We Share Your Information" and none of it sounds too bad. I think you're misunderstanding it and thinking the company can go willy-nilly with PII data. Instead, the way I read it is they will store the data necessary to conduct their business and payment. That's true with any website you visit, even Amazon is tracking your information, and even Stackoverflow is tracking our usage right now. They're probably selling that data off to other people as we speak. It's no big deal and it's doubtful even with your name attached that anything meaningful can be concluded by such information.

My thought is take the agreement to your company's lawyers and ask them if it is within reason. This is more of a contract legal question than it is a workplace question.

However you have a right to be paranoid. Matter of fact, several big companies recently found sensitive databases available in the open cloud space that anyone can connect to and query. But that's why there are credit protection and so on, something beyond the control of a simple investigation company.

0

You must log in to answer this question.