Background Check Processes

The Case for Maximal Referencing of PMs: In a past job, I worked with two product leaders with equal skill in building products. But they had completely divergent skills in hiring. One hired phenomenal PMs. They quickly grew to be company-wide favorite PMs due to their strong viewpoints. The other hired on paper phenomenal PMs. But they just weren’t right for the company. It’s not really a surprise the first got promoted - and the other left for greener pastures. 𝗥𝗲𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝗰𝗵𝗲𝗰𝗸𝘀 𝗮𝗿𝗲 𝘄𝗼𝗿𝘁𝗵 𝘁𝗵𝗲 𝘁𝗶𝗺𝗲 One of the practices the first hiring manager swore by was lots of reference checking. She was a master of back channel reference checking throughout the interview process. And her reference checks were notoriously long. The other just did one reference check after he had already decided he was giving out the offer. 𝗢𝗻𝗲 𝗼𝗳 𝘁𝗵𝗲 𝘁𝗵𝗶𝗻𝗴𝘀 𝘁𝗵𝗮𝘁 𝗺𝗶𝗴𝗵𝘁 𝘀𝘂𝗿𝗽𝗿𝗶𝘀𝗲 𝘆𝗼𝘂 𝗺𝗼𝘀𝘁 𝗮𝗯𝗼𝘂𝘁 𝘁𝗵𝗲 𝗵𝗶𝗿𝗶𝗻𝗴 𝗺𝗮𝗻𝗮𝗴𝗲𝗿 𝘄𝗵𝗼 𝗱𝗶𝗱 𝗾𝘂𝗶𝘁𝗲 𝘄𝗲𝗹𝗹 𝗶𝘀: 𝘚𝘩𝘦 𝘦𝘷𝘦𝘯 𝘥𝘪𝘥 𝘳𝘦𝘧𝘦𝘳𝘦𝘯𝘤𝘦 𝘤𝘩𝘦𝘤𝘬𝘴 𝘣𝘦𝘧𝘰𝘳𝘦 𝘱𝘢𝘴𝘴𝘪𝘯𝘨 𝘢 𝘤𝘢𝘯𝘥𝘪𝘥𝘢𝘵𝘦 𝘧𝘳𝘰𝘮 𝘩𝘪𝘳𝘪𝘯𝘨 𝘮𝘢𝘯𝘢𝘨𝘦𝘳 𝘴𝘤𝘳𝘦𝘦𝘯. I, too, have found it works really well. Nowadays, I’ve started to do these reference checks at three stages. Let’s break this approach. 𝗖𝗵𝗲𝗰𝗸 𝟭 - 𝗦𝗰𝗿𝗲𝗲𝗻𝗶𝗻𝗴 𝗦𝘁𝗮𝗴𝗲 Committing to a conversation with a candidate means I’ll also tap into: • Previous workplace colleagues • Mutual connections Direct collaborators get a call, a brief 10-minute check-in. My aim here is to pinpoint standout candidates that I really want to push through. 𝗖𝗵𝗲𝗰𝗸 𝟮 - 𝗣𝗼𝘀𝘁-𝗜𝗻𝘁𝗲𝗿𝘃𝗶𝗲𝘄 𝗦𝘁𝗮𝗴𝗲 The second reference check I like to do is post-interview. I’ll use this to 𝘷𝘦𝘵 𝘵𝘩𝘦 𝘢𝘤𝘤𝘶𝘳𝘢𝘤𝘺 of what people said in the interview. If the pass this second reference check, they’re almost ready to hire. 𝗖𝗵𝗲𝗰𝗸 𝟯 - 𝗣𝗿𝗲-𝗢𝗳𝗳𝗲𝗿 𝗦𝘁𝗮𝗴𝗲 The third and final reference check is the one most companies do. But I like to focus it on supervisors and skip levels. All PMs need to make an impact on leadership. This is the only round I actually use references supplied by the candidate. Everything else is back-channels. 𝗜𝘁 𝗺𝗮𝗸𝗲𝘀 𝗮 𝗱𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝗰𝗲 “𝘉𝘶𝘵 𝘈𝘢𝘬𝘢𝘴𝘩, 𝘐’𝘷𝘦 𝘨𝘰𝘵 𝘵𝘩𝘳𝘦𝘦 𝘳𝘰𝘭𝘦𝘴 𝘵𝘰 𝘧𝘪𝘭𝘭 𝘵𝘩𝘪𝘴 𝘲𝘶𝘢𝘳𝘵𝘦𝘳!” I know that it seems a lot of work to add two stages of reference checks to your process when you probably only have the pre-offer stage right now. The thing is, getting your hiring right makes you much more impactful. But getting them wrong really hurts you. 𝗧𝗵𝗶𝘀 𝗽𝗼𝘀𝘁 𝗶𝘀 𝗵𝗲𝗿𝗲 𝘁𝗼 𝘁𝗲𝗹𝗹 𝘆𝗼𝘂: 𝘆𝗼𝘂 𝗻𝗲𝗲𝗱 𝘁𝗼 𝗱𝗲𝗹𝗲𝗴𝗮𝘁𝗲 𝗺𝗼𝗿𝗲 𝗼𝗳 𝘆𝗼𝘂𝗿 𝗰𝘂𝗿𝗿𝗲𝗻𝘁 𝘄𝗼𝗿𝗸 𝘁𝗼 𝗺𝗮𝗸𝗲 𝗺𝗼𝗿𝗲 𝘁𝗶𝗺𝗲 𝗳𝗼𝗿 𝘁𝗵𝗶𝘀 𝘄𝗼𝗿𝗸.

Today, a recruiter invited me to a call about a potential role I was very interested in learning more about. But, less than an hour before the meeting, I received a sudden calendar update: “Fred from Fireflies will join to record and transcribe the conversation.” - No prior request for consent. - No explanation of how the recording would be stored. - No clear details on how my data might be used. What should have been a straightforward conversation instantly shifted into a scramble to protect my privacy (voice, image, and data). Recording an interview, without clear, advance permission, erodes trust before the first question is even asked. Consent is a deliberate agreement that lets everyone show up prepared and comfortable. This is an ethical issue. No doubt, an AI note-taker could be valuable to this recruiter. But, they also raise questions about data retention, confidentiality, and intellectual property. A candidate discussing career history, research, or sensitive client details deserves to know exactly how those records will be used and who will have access. If you truly aim to build an inclusive hiring process, plan for ethical recording practices from the first email. - State your intentions. - Outline how the file will be stored and data retention policies. - Offer alternative accommodations. - Secure explicit consent well before the call. Anything less feels like surveillance disguised as efficiency. How are you making sure your use of AI tools in interviews respects privacy, consent, and accessibility? *Note, I am fortunate to be able to walk away from situations that violate my privacy, and I did exactly that in this case. I recognize that many candidates cannot afford to decline and must navigate similar scenarios without the option to stay no. If you are in that position, I see you and stand with you. #CyberSecurity #DataPrivacy #Consent

Dear HR Managers, Pre employment decisions can attract liability. This case proves it. In Obiora Victor Emeka v Jaya Confectioneries Ltd & Anor (Unreported Suit No. NICN/LA/348/2021), the National Industrial Court made it clear that recruitment and pre employment processes are subject to constitutional and statutory obligations. Here's what happened: Mr. Emeka resigned from his job after accepting a customer service role at Jaya Confectioneries. Before starting, he was required to complete a "food handlers' test." What he didn't know? It included an HIV test. When the results came back positive, his HIV status was shared without consent, and his job offer was revoked. The court ruled as follows: 1. Mandatory HIV testing without the claimant's informed consent was unlawful. The court emphasized that conducting an HIV test without the applicant's prior knowledge informed consent, and proper counseling violates Section 9 of the HIV/AIDS [Anti-Discrimination Act], and the National Guidelines for HIV Counselling and Testing.  2. The court held that withdrawing a job offer solely based on someone's real or perceived HIV status constitutes discrimination on the grounds of health status, and violates Section 42 of the Nigerian Constitution and Section 14[5] of the HIV and AIDS [Anti-Discrimination] Act, 2014 3. The medical facility's disclosure of confidential HIV test results to the employer and a third party without the applicant's express authorization was ruled as a grave violation of the constitutional right to privacy as enshrined in  Section 37 of the Constitution of the Federal Republic of Nigeria 1999 [as amended] and Article 12 of the Universal Declaration of Human Rights of 1948, and Section 13 of the HIV and AIDS [Anti-Discrimination] Act, 2014. The defendants’ actions were declared unconstitutional, unlawful, and discriminatory. The Court awarded damages equivalent to three years’ salary, that the claimant would have earned.

Texas made healthcare AI disclosure mandatory starting January 1. A few other states got there first, but what makes Texas different is the scope. The Texas Responsible Artificial Intelligence Governance Act requires healthcare providers to disclose AI use to patients before or during interaction. Emergencies get an exception, but otherwise disclosure is required and must be clear. California passed AI disclosure rules in 2025 for generative AI in clinical communications. Illinois passed rules for AI in mental health therapy to administrative tasks with consent. Texas went broader, covering AI in diagnosis or treatment across all healthcare settings. Here is what their implementation looks like. Providers must give conspicuous written disclosure, not just verbal mention. This means updating intake forms, consent documents, and patient communication templates where AI touches the workflow. Practitioners must personally review all AI-generated content before clinical decisions. Staff need training on when to disclose, how to explain AI use to patients, and what counts as an emergency exception. Texas included a 60-day cure period. After violation notice, providers get 60 days to fix the issue and document corrections before penalties apply. Europe is heading the same direction. The AI Act puts medical AI under high-risk rules that include transparency requirements. European providers have until August 2026, so there is time to watch how Texas handles the practical challenges. Implementation details can matter more than the law itself.

It started with one resume. A mid-sized company was hiring. As usual, HR created a shared Google Drive folder—“HR_CVs_2024”—and began storing every resume that came in. No passwords. No expiry. No consent. During a pitch presentation, someone accidentally copied the Drive link and pasted it into the client's briefing deck. That link made it to 30 inboxes. Within two days, 150+ resumes were accessed by people outside the organization. Names, phone numbers, home addresses, academic history—everything was out there. Panic set in. Applicants began writing in, angry and confused. One even sent a legal notice. Why? Because those resumes contain personal data. And under the Digital Personal Data Protection Act, 2023 (DPDPA), even just storing that data counts as “processing” (Section 2(x)). Here’s what companies often miss: Collecting resumes = Collection of personal data Saving them on cloud = Storage Forwarding internally = Disclosure Searching later = Retrieval Each of these requires valid, informed consent under the law. Simple fix? Add a clause in your HR emails like this: "By submitting your resume, you consent to the collection, processing, and storage of your personal data for recruitment purposes by [Company Name]. Your data will be retained only for as long as necessary and will not be shared without your prior consent." This isn’t about making hiring harder. It’s about making it respectful, secure, and lawful. If you're storing resumes for "future use" without a clear policy, it’s time to rethink the process. #DPDPA #DataPrivacy #HRCompliance #ResumeHandling #HiringPractices #IndianLaw #PrivacyByDesign #LegalForBusiness #Recruitment

Your lead form has a checkbox for TCPA consent. Your competitor's doesn't. Their conversion rate is 30% higher. And their lawyers signed off on it. Welcome to the "above the button" consent debate. One of the most consequential design decision in lead generation right now. Companies are removing the standalone consent checkbox entirely and placing TCPA disclosure language directly above the submit button. The consumer sees the disclosure, clicks submit, and that click constitutes consent. No checkbox. No separate affirmative action. Just placement and prominence. And courts are giving this approach room to breathe. Here's the legal framework: online agreements — including TCPA consents — are only enforceable if the consumer had knowledge of the terms. Courts focus on two things: was there reasonably conspicuous notice of the terms, and did the consumer take some action that unambiguously manifests assent? A checkbox is one way to satisfy that. It's not the only way. Recently, a court laid out four questions to evaluate whether consent language is conspicuous: Was the page uncluttered, or was it designed to draw attention away from the terms? Were the terms placed close to the button the user clicks? Did the font size or color draw attention to the disclosure? Does the website operate in a way that users would expect to include contractual terms? That's the test. Not "was there a checkbox." Conspicuousness is the standard. But there's a critical difference between doing this well and doing it recklessly. Done well: readable font, visually distinct from surrounding text, immediately above the button, with specific language about who will contact the consumer and how. Done recklessly: tiny gray text crammed between the password field and a submit button, hoping "technically above" counts as conspicuous. The companies winning this bet are treating compliance as a design discipline, not an afterthought. Before you ditch the checkbox, run your form through those four questions. If your disclosure wouldn't survive that analysis on a mobile screenshot in front of a judge who's never seen your site — the checkbox isn't your problem. Your design is.

The Digital Personal Data Protection Rules, 2025 have now been officially notified. This is a structural shift in how data will be protected, governed, and challenged across India. For businesses, legal teams, and data fiduciaries, here is what requires immediate focus: ✅ Consent is the baseline, not a formality You cannot collect or process personal data without explicit, informed and voluntary consent. You must explain why the data is being collected, where it will be stored and how it will be used. Users now have the legal right to refuse, withdraw consent or ask for their data to be deleted at any time without explanation. This is the heart of Rule 5 and it rewrites the power dynamic between users and platforms. ✅ Everything must leave a trail Rule 8(3) mandates a one year retention of all logs, traffic data and processing records. Even if the user exits, their data trail must be preserved for audit, breach investigation or legal oversight. This includes every action across every category of personal data. ✅ Rollout is staged and the direction is clear Some rules are already in effect. Consent manager obligations activate in November 2026. The full compliance engine goes live in May 2027. This phased structure gives time to act thoughtfully rather than reactively. ✅ National interest overrides disclosure If government requests relate to national security, Rule 23(2) prohibits informing the user unless specifically authorised. This introduces legal sharpness into an area where ambiguity has long prevailed. The time to wait has passed. - Review your contracts. - Reassess your breach protocols. - Update your website policies.  - Ensure your vendors and systems are aligned. - Legal awareness is one part. Operational readiness is the real test. When the regulator begins asking questions, your answers must be built into your systems, not just in a policy document. #India #Digital #Law #Legal #Future

💊 The ADA Applies Before the Hire - Especially when it comes to pre-employment drug testing A Florida jury just hit a senior living facility with a $405,083 verdict for violating the Americans with Disabilities Act (ADA). The case? EEOC v. The Princess Martha, LLC—and it deals with how NOT to handle post-offer drug testing when an applicant discloses a disability. Here’s what went down: 🔹 A veteran applied for an activities coordinator role at a retirement community. 🔹 During her interview, she disclosed that she had PTSD and was taking legally prescribed medications that could trigger a positive drug test. 🔹 The activities director acknowledged this, said it wouldn't affect her job, and told her to provide prescriptions at the testing site. 🔹 The applicant did offer her prescriptions—but was told, “Don’t worry, we’ll call you if there’s a problem.” They never called. 🔹 Six days later, after hearing nothing, she followed up. She expressed concern and reiterated her medication disclosure in a voicemail to HR. 🔹 The next day, her offer was revoked. The EEOC sued for disability discrimination. The jury responded with: 💵 $5,083 in back pay 💵 $100,000 in compensatory damages 💵 $350,000 in punitive damages Why this matters for employers: ✅ Under the ADA, employers can conduct drug tests—but when someone discloses a disability and legally prescribed medications, you can’t just shrug and disqualify them. ✅ This applicant’s disclosure was, effectively, a request for reasonable accommodation. The employer should’ve engaged in the interactive process. Instead, they ghosted her and pulled the offer. ✅ The ADA requires that, post-offer, employers ask all applicants in a job category the same disability-related questions—but they must also allow individuals to explain non-negative drug test results tied to legal prescriptions. Key lesson: If someone flags potential issues with a drug test due to a medical condition—believe them, follow up, document the process, and consult counsel before making a decision. Employers, don’t let your drug testing policy become a $400,000 mistake. #law #hr #humanresources #employmentlaw

If we're going to do reference checks, let's do them properly. Reference checks are among the most widely accepted parts of the hiring process. They're also one of the least scrutinised. We ask candidates to hand over the names of people who will speak well of them. We call those people. We ask a handful of questions. We tick a box. And somehow we've collectively agreed that this constitutes meaningful due diligence. It doesn't. The reference check, as currently practised, is a one-dimensional view of a person, filtered entirely through relationships the candidate has chosen and curated. That's not useless, but it's a long way from insight. Here's a practical example of what better actually looks like. If you're hiring a people leader, ask for references from the people they've led. Not just the executive who sponsored their last promotion, but the team members who reported to them, and the peers who watched how they behaved when things went wrong. We all know that leadership styles don't show up in a reference from a CEO. It shows up in the experience of the people sitting in the weekly team meeting, wondering if they can raise a problem without it becoming one. If a reference check is worth doing, it's worth doing with more than one lens.

Most candidates treat reference checks like a formality. Sonam used them to gather intel and control the narrative. Result: +$15K on base and a clearer view of the job. Two weeks into final rounds at a Fortune 500, HR said, "We're ready to check your references." She didn't just say "great." She asked: "Before you call them, what red flags are you checking for? What would make you hesitate on my candidacy?" Silence. Then: "Our last hire struggled with cross-functional influence. We need someone who can navigate ambiguity without formal authority." Gold. She prepped her references that night: Manager: "Open with the roadmap story where I aligned engineering and sales." Peer: "Mention how I handled pushback on the new workflow. Use 'navigate' once." They echoed the signal HR was listening for. After the checks, she made one more move: "I'd like to speak with 2–3 future peers to ensure I can add value from day one." Those chats revealed the real job: VP micromanages for 90 days Budget approvals need 3 sign-offs Last hire left after promised resources never arrived Final call, she priced the friction: "Given the 90-day ramp and multi-layer approvals, I'm targeting 115K to offset delayed impact." They closed at 110K. Takeaway: most people hand over references and hope. Winners use them as an advance team and as reconnaissance. Steal this (10 minutes) Before checks: ask HR, "Which risks are you validating?" Write down the exact words. Prep your references: 1 story each that proves you beat that risk. Include scope, stakes, and outcome. Request peer calls: "To hit the ground running, I'd like to speak with 2–3 peers." Use what you learn to calibrate your offer. Ethics note: brief, don't script. Ask peers for a candid read, then decide. Have you ever asked, "Which risks are you validating?" before a reference check? ���️ Share this with someone in final rounds ➕ Follow me (Yogi Gnanavel) for strategies that actually get you hired faster