Specifications

Continuous Monitoring

A standing monitoring program is not a standing permission — every hit re-earns its purpose.

What it ensures

Post-hire monitoring re-pulls information over time, and permissible purpose attaches to each use, not to the program. This control re-confirms a permissible purpose on every hit before it can be acted on, and routes any adverse hit into the full adverse-action sequence.

It ensures an ongoing program doesn’t convert one onboarding certification into perpetual, unexamined access.

Watch it run

Ongoing monitoring surfaces a new record on a current employee — and the agent is ready to act on it.

Illustrative run — one case moving through the Continuous Monitoring specification.

Monitoring hit Purpose re-confirmed Purpose lapsed No action Adverse action
Permitted transition Forbidden move Start Terminal state
Post-hire monitoring re-pulls information over time. Each hit is a fresh use that must re-confirm permissible purpose, and an adverse hit routes into the full adverse-action process. Acting on a hit without reconfirming purpose is in red.
✕ Act on hit 1 ✓ New hit 2 ✓ Purpose 3 ✓ Adverse action
Ready

Ongoing monitoring surfaces a new record on a current employee.

  1. Ready

    The new hit

    Monitoring runs after hire. A hit arrives — but a standing program isn’t a standing permission.

  2. Blocked

    The wrong move

    The onboarding certification authorized the first pull, not every future one. Acting on the new hit without re-confirming purpose is refused.

    Where it comes from

    Permissible purpose attaches to each use under §1681b; a continuous program does not convert one certification into perpetual authorization.

    What it satisfies

    Re-confirming permissible purpose on each hit enforces §1681b per use; an adverse hit then routes into the §1681m adverse-action process.

    FCRA §1681b Statute 15 U.S.C. § 1681b(a) Subject to subsection (c), any consumer reporting agency may furnish a consumer report under the following circumstances and no other: U.S. Code · Cornell LII ↗ §1681m(a) Statute 15 U.S.C. § 1681m(a) If any person takes any adverse action with respect to any consumer that is based in whole or in part on any information contained in a consumer report, the person shall— (1) provide oral, written, or electronic notice of the adverse action to the consumer; … (3) provide to the consumer … (A) the name, address, and telephone number of the consumer reporting agency … that furnished the report …; and (B) a statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide the consumer the specific reasons why the adverse action was taken; and (4) provide to the consumer … notice of the consumer’s right— (A) to obtain … a free copy of a consumer report …; and (B) to dispute … the accuracy or completeness of any information in a consumer report furnished by the agency. U.S. Code · Cornell LII ↗
  3. Permitted

    Purpose, again

    The use is checked afresh against an allowable basis before the hit is acted on.

  4. Permitted

    Into adverse action

    If the hit would support adverse action, it enters the same pre-adverse → wait → notice path the law requires.

  5. On the record

    The proof

    The file shows every monitoring hit re-earned its purpose and followed the process.

Why it holds

Why the whole holds

No standing program is a standing permission. What holds is that each hit must re-confirm its purpose, and an adverse one cannot skip the adverse-action path. Reliability isn’t a one-time sign-off; it’s that no monitoring hit acts on yesterday’s authorization.

Why it matters

Acting on a monitoring hit without a current permissible purpose is an impermissible use under §1681b; treating an adverse hit as actionable without the §1681m process compounds it.