Eleven Finalists, One Personnel File, and a 74-Day-Old Invoice
A staffing client of three years sends a request covering 11 warehouse finalists: a seven-year criminal search, a credit report, a driving record, 'their social media passwords so we can log in and look,' and a check on whether any of them 'has ever filed a workers' comp claim.' The CEO also wants you to obtain one finalist's personnel file from her current employer, where your firm owner's brother is the HR manager, and to bill the whole job as 'management consulting' because 'we don't want to deal with the FCRA paperwork.' The client owes you $14,000 on an invoice 74 days past due, and there is no signed engagement letter, only a 2021 email saying 'standard terms.' The warehouse roles involve no driving and no handling of cash or financial records.
1. Sort the request line by line into permissible, permissible only with additional authorization, and must refuse - and explain the basis for each.
Read the worked answer
Criminal search (seven years) - permissible with authorization. The client must give a clear, standalone written disclosure and obtain written authorization before the report is procured, and must follow adverse-action procedures. Pull from court records directly rather than a database that returns arrests without dispositions; a 2014 arrest with no disposition is exactly the record that generates a lawsuit. Note that Michigan's ban-the-box rules apply to public employers, so the private client is not covered statewide, but local ordinances and job-relatedness still matter.
Credit report - permissible with authorization, but challenge it. Employment is a recognized purpose, but a warehouse role with no financial duties makes job-relatedness hard to defend, and regulators have scrutinized credit checks for low-level positions. Recommend dropping it or documenting the business necessity.
Driving record - refuse as framed. The Driver's Privacy Protection Act (18 U.S.C. 2721) permits access for employment only when driving is an essential function or with the individual's written consent; Michigan's driver-record privacy provisions point the same way. There is no driving in this job. Refuse unless the client obtains specific written consent and can state a reason.
Social media passwords - refuse. Michigan's Internet Privacy Protection Act (MCL 37.271 et seq.) bars an employer from requesting an employee's or applicant's social media credentials. You would be the instrument of the client's violation. Lawful alternative: review publicly available content.
Workers' comp claim history - refuse. There is no legitimate public source, the data is confidential, and the request invites a decision based on protected activity.
'Consulting' billing - refuse.
2. Analyze the conflict and confidentiality problems with the brother and the personnel file.
Read the worked answer
The personnel file. It belongs to another employer and is confidential to that employer and to the finalist. There is no subpoena, no authorization from the candidate, and no lawful basis to obtain it. Using a relative to pull it is a breach of that employer's confidence, exposes the brother to discipline and termination, exposes the firm to tortious-interference and invasion-of-privacy claims, and may implicate statutory protections for personnel records.
The conflict. Your owner's brother is an HR manager at an entity whose interests are adverse to your client's. Even if the brother never touches the file, the relationship creates the appearance of a channel and gives the finalist's attorney a motive narrative. Run a conflict check: does the firm do any work for the current employer? Is the brother in a position to be a witness? Document the check.
What to do. Decline the file in writing, using a single sentence: not available through this firm, obtainable only by subpoena or the candidate's written release. Tell the owner's brother nothing about the engagement. Wall the relationship off formally, and consider whether the staffing client's apparent willingness to use family channels should itself change how you staff the account. If the conflict cannot be managed - for example, if the current employer is a firm client - decline the finalist's file entirely and say why.
Never ask the brother to 'just take a look.' That request is the violation, whether or not he complies.
3. The past-due invoice, the missing contract, and the 'consulting' label: what do you do and what goes in writing?
Read the worked answer
The billing label. Refuse it, in writing, once. The disclosure and authorization duties belong to the client, but restructuring the invoice to disguise a consumer report as consulting is a misrepresentation you would be signing. It also destroys your ability to enforce the invoice if the arrangement is later characterized as a sham.
The contract. The 2021 email may be an enforceable agreement - electronic assent is generally valid - but it almost certainly does not fix scope, pricing, limitation of liability, indemnification, compliance allocation, or payment terms. Treat the account as undocumented.
The invoice. Send a written account statement with the invoice date, amount, days outstanding, and a demand for payment or a signed payment plan. Do not begin work on the 11 finalists while the balance is open; suspend new intake and say so plainly. Continue no free work in the hope of collection.
The engagement letter you should send before any further work: scope and deliverables; per-item pricing and a deposit; a statement that you will not do the refused items; allocation of FCRA and DPPA compliance between firm and client; a limitation of liability that does not purport to cover intentional acts; record retention and destruction periods; confidentiality; a stop-work right for nonpayment; and a signature block for both parties.
Keep the tone commercial. The client has been with you three years; the goal is a compliant account that pays, not a moral victory.