Before an employer pulls employee driving records, two federal laws set the rules: the Driver’s Privacy Protection Act controls how the state releases the record, and the Fair Credit Reporting Act controls how a third-party screening company delivers it and how the employer acts on what it finds. Both require the employee’s written consent, and the FCRA adds a specific notice sequence if anything in the report leads to a hiring or job decision. Getting the process right also protects the company on a separate front: negligent entrustment claims when an unscreened driver causes a crash.
What Shows Up on the Report
A motor vehicle report comes from the state that issued the driver’s license and shows whether the license is active, suspended, revoked, or expired. It lists any endorsements, including commercial and hazardous materials authority. It also shows moving violations, reportable accidents, and serious convictions such as DUI or reckless driving, with dates and dispositions. Most states keep this history for three to seven years depending on the severity of the offense, so an employer can usually see patterns rather than a single old mistake.
Why the Screening Matters Legally
Insurance costs are the everyday reason. The stronger reason is negligent entrustment. Under that common-law doctrine, an employer that lets someone drive for work when it knew or should have known the person was unsafe can be held directly liable for a resulting crash. The claim doesn’t hinge on what the driver did in the moment; it targets the decision to hand over the keys. A company that never bothered to check an employee whose record is full of DUI convictions has a hard time arguing it didn’t know.
This sits alongside ordinary vicarious liability, which attaches simply because the driver was on the clock. Negligent entrustment is an independent second basis, and because the failure to screen looks reckless, it often supports punitive damages. Regular record checks are the most direct defense.
Consent and Disclosure Rules
Two federal statutes apply at different stages of the process, and both need to be satisfied.
The Driver’s Privacy Protection Act
The DPPA, at 18 U.S.C. § 2721, bars state motor vehicle agencies from releasing personal information from driver records unless the request fits a listed exception. Two matter for employers. One lets an employer or its insurer access records of commercial driver’s license holders to verify information required by federal transportation regulations. The other, broader exception permits any requester to obtain records with the individual’s written consent.1Office of the Law Revision Counsel. 18 U.S. Code 2721 – Prohibition on Release and Use of Certain Personal Information From State Motor Vehicle Records
For non-CDL employees, that means signed written consent before the state will release the record. Skipping it exposes the company to a private lawsuit carrying liquidated damages of at least $2,500, plus potential punitive damages and attorney fees.2Office of the Law Revision Counsel. 18 U.S. Code 2724 – Civil Action
The Fair Credit Reporting Act
When an employer uses a third-party background screening company rather than going directly to the state, the FCRA treats that vendor as a consumer reporting agency and the driving record as a consumer report. The employer must give the employee a written disclosure that a report will be pulled and get written authorization before ordering it.3Office of the Law Revision Counsel. 15 U.S. Code 1681b – Permissible Purposes of Consumer Reports
The disclosure has to appear in a standalone document. The statute uses the phrase “a document that consists solely of the disclosure,” and courts read it strictly. Employers who tuck the disclosure into a job application, an offer letter, or a handbook acknowledgment risk having the whole authorization invalidated.3Office of the Law Revision Counsel. 15 U.S. Code 1681b – Permissible Purposes of Consumer Reports
Willful violations of the FCRA carry statutory damages between $100 and $1,000 per violation, or actual damages if higher, plus potential punitive damages.4Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance Negligent violations recover actual damages and attorney fees, which can still add up quickly in a class action.5Office of the Law Revision Counsel. 15 U.S. Code 1681o – Civil Liability for Negligent Noncompliance
Pulling the Record
Either route requires the employee’s full legal name, date of birth, driver’s license number, and the issuing state. Wrong details can pull the wrong person’s record or return nothing.
Direct state requests go through the motor vehicle agency, usually an online portal that returns results in minutes. Fees generally run between about $3 and $25 per report. Mail-in requests, still used by some states, can take two weeks or more. Not every state allows third-party online access without the driver initiating the request, so check the issuing state’s rules first.
Third-party screening vendors handle the state-level request after the employer uploads the signed standalone disclosure and authorization along with the employee’s identifiers. Results often come back within hours. Going this route triggers full FCRA compliance, including the standalone disclosure, the certification to the reporting agency, and the adverse action steps below.
Electronic signatures on the authorization form are valid. The federal ESIGN Act recognizes them for this purpose, and an FTC advisory opinion confirmed that electronic authorization satisfies the FCRA’s written-consent requirement, as long as the record can be retained and reproduced.
If the Record Leads to an Adverse Decision
When something in the report might drive a denial, reassignment, or termination, the FCRA requires a two-step notice sequence whenever the report came through a third-party agency.
Step one is the pre-adverse action notice. Before the decision becomes final, the employer sends the employee a copy of the report and a copy of “A Summary of Your Rights Under the Fair Credit Reporting Act,” published by the Consumer Financial Protection Bureau. This gives the employee a chance to review the report and flag errors.
Step two is the final adverse action notice, sent after a reasonable waiting period, commonly at least five business days. It must include the name, address, and phone number of the consumer reporting agency, a statement that the agency did not make the decision and cannot explain it, and notice of the employee’s right to request a free copy of the report from the agency within 60 days and to dispute inaccurate information.3Office of the Law Revision Counsel. 15 U.S. Code 1681b – Permissible Purposes of Consumer Reports
Skipping the pre-adverse step is one of the most common triggers for FCRA lawsuits. A two-email sequence built into the hiring workflow prevents it.
Judging the Record Itself
A DUI conviction or a string of tickets doesn’t automatically justify rejection. The EEOC’s enforcement guidance warns that blanket exclusion policies can violate Title VII when they disproportionately screen out applicants in a protected class without being tied to the specific job.6EEOC. Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions
The EEOC recommends an individualized assessment weighing three factors: the nature and seriousness of the offense, how much time has passed, and the nature of the job. An eight-year-old reckless driving conviction matters less for a desk job than for a long-haul trucking role. A rigid “any DUI is automatic rejection” rule applied across all positions carries unnecessary discrimination risk.6EEOC. Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions
Document why a specific driving record disqualifies a specific person for a specific role. A written policy that ties driving standards to actual job duties and allows individualized review sits on firmer legal ground than a blanket ban.
How Often to Re-Check
Outside commercial trucking, no federal law sets a review schedule. Many companies pull records annually for anyone whose job involves driving. That mirrors the DOT standard for motor carriers and gives a reasonable answer if a negligent entrustment claim asks what the employer was doing. The weakness is the gap. An employee could have a license suspended in January and keep driving until the December pull.
Continuous monitoring services close that gap by tracking driver records in near real-time and alerting the employer when a new violation, suspension, or revocation posts. The per-driver cost is higher than a single annual pull, but for larger fleets or higher-risk operations, a single negligent entrustment verdict can dwarf years of monitoring fees.
Commercial Drivers Have Extra Rules
If your drivers are subject to FMCSA regulations, the baseline changes. Under 49 CFR § 391.25, every motor carrier must obtain and review a fresh MVR for each driver at least once every 12 months, and must pull records from every state where the driver held a license during the preceding year.7eCFR. 49 CFR 391.25 – Annual Inquiry and Review of Driving Record8Federal Motor Carrier Safety Administration. Driver’s Motor Vehicle Record
The FMCSA Drug and Alcohol Clearinghouse adds pre-employment and annual queries on safety-sensitive drivers to catch violations that don’t appear on a standard driving record.9Federal Motor Carrier Safety Administration. Drug and Alcohol Clearinghouse Frequently Asked Questions Motor carriers also have to keep a driver qualification file for each commercial driver, retained for the duration of employment plus three years after the driver leaves.10eCFR. 49 CFR 391.51 – General Requirements for Driver Qualification Files None of these apply to a standard non-CDL workforce, but they are strict where they do.
Retention and Secure Disposal
Any driving record obtained through a third-party screening agency is a consumer report, which means the FTC’s Disposal Rule applies when the record is no longer needed. The rule requires reasonable and appropriate measures to prevent unauthorized access during disposal.11Federal Trade Commission. Disposing of Consumer Report Information Rule
For paper records, that means shredding, burning, or pulverizing. For electronic files, it means permanent deletion or overwriting so the data can’t be recovered. If a document destruction contractor is used, the FTC expects due diligence: checking references, reviewing security procedures, and confirming certification by a recognized industry association.11Federal Trade Commission. Disposing of Consumer Report Information Rule
Do not destroy records while an investigation, compliance review, or enforcement action is pending, even if the normal retention window has closed. A retention schedule that tags each record with a destruction-eligible date and includes a litigation-hold override handles both concerns.
When an Employee Disputes the Record
Errors on driving records are more common than most employers expect. A conviction can post to the wrong license number, a dismissed ticket can still show as pending, and name confusion can put someone else’s violations on the employee’s record.
Corrections have to go through the state DMV that issued the license, because the DMV is the only entity that can update the official record. The employee usually submits a written dispute with supporting documents, such as court records showing dismissal or identity documents to resolve a name mix-up.
From the employer’s side, the FCRA’s adverse action process exists to catch these errors before they cost someone a job. The pre-adverse action notice is the window the employee needs to pull their own record, spot the mistake, and start the dispute. Acting on an inaccurate record without giving the employee that window opens the company to FCRA liability and, depending on the jurisdiction, a wrongful termination claim on top of it.