For the first time, private employers will have easier access to criminal information about their employees through iCORI, Massachusetts’ online criminal records database. This will enable responsible employers to assure they are not exposing their business to unacceptable risk. But every new resource has its price. Among the highlights of the new law are stringent record-keeping and notification requirements. Along with new penalties.
Attorneys at Seyfarth Shaw LLP offer the following summary of the recordkeeping rules:
The new CORI law requires employers to follow certain procedures in order to access an individual’s criminal record through DCJIS. Before an employer conducts a criminal record check, it must have the subject of the criminal check sign a CORI Acknowledgment Form authorizing the employer to obtain his or her record and verify the subject’s identity by reviewing a form of government-issued identification. M.G.L. c. 6, § 172(a)(30)(c). Pursuant to the proposed regulations, acceptable types of government-issued identification include: (i) a state-issued driver’s license; (ii) a state-issued identification card with a photograph; (iii) a passport; or (iv) a military identification. 803 CMR 2.09(3). The proposed regulations require the employer’s representative to sign and date the CORI Acknowledgment Form certifying that the subject was properly identified. In the event that an employer is unable to verify an individual’s identity and signature in person, the proposed regulations allow the individual to sign an Acknowledgement Form before a notary public. 803 CMR 2.09(5). CORI Acknowledgment Forms must be maintained by the employer for at least one year.2 M.G.L. c. 6, § 172(a)(30)(c).
To obtain CORI from DCJIS, the individual requesting the record must provide DCJIS with information identifying the subject (name, date of birth, and last six digits of social security number) and certify under oath that: (i) he or she is the authorized designee of the employer; (ii) the request is for the purpose of evaluating an applicant or current employee; (iii) the applicant or employee has signed an acknowledgement form authorizing the employer to obtain criminal record information; and (iv) the requestor has verified the identity of the applicant or employee by reviewing a form of government-issued identification. M.G.L. c. 6, § 172(a)(30)(c). Although not specified in the statute, the proposed regulations state that the employer must submit the subject’s executed CORI Acknowledgment Form to DCJIS. 803 CMR 2.09(1)(a).
The proposed regulations also provide that the Acknowledgment Form is valid for one year from the subject’s having signed the form or until the subject’s employment ends, whichever occurs first. 803 CMR 2.09(9). An employer that submits a new CORI request within one year of the subject’s having signed the original Acknowledgment Form must provide the subject with written notice at least 24 hours prior to submitting the request. 803 CMR 2.09(9)(a). If the employee revokes his or her authorization upon receiving such notice, the employer may not request the employee’s CORI. 803. CMR 2.09(9)(c).3
Employers should be aware that DCJIS will maintain a log of all requests for criminal records, which includes the name of the requesting entity, the date of the inquiry, and the certified purpose of the inquiry. An individual may request a “self-audit” and obtain information from DCJIS regarding requests for the individual’s own CORI. M.G.L. c. 6, § 172(g); 803 CMR § 2.24.