Bookmark and Share
 

Legal Updates

Hidden Trap In Employee Investigations: Potential FCRA Liability

Imagine that an employee comes to you and reports that a co-worker has been subjecting her to prolonged, severe sexual harassment and will not stop calling her personal phone number.  You immediately arrange for an investigation.  You want your investigation to be airtight, so you engage a human resources consultant to conduct it.  The outside party investigates and finds the complaint substantiated, so you decide to terminate the alleged harasser.  You immediately do so, revealing little to the alleged harasser about the nature and substance of the investigation.  After all, you are convinced that he is guilty and knows it.  Now, you expect that your company may face a legal claim from the victim.  But, what about the alleged harasser?  Well, …

Under the federal Fair Credit Reporting Act (“FCRA”), employers that engage third parties to conduct investigations into alleged employee misconduct (such as theft, harassment, violence in the workplace, and noncompliance with laws, rules, regulations or policies) and take adverse action based on the investigation must provide the employee with a summary of the “nature and substance” of the investigation.  Fortunately, however, employers do not need to disclose the investigation to the employee or get the employee’s authorization prior to the investigation, as with other third-party reports under the FCRA.  Additionally, in the summary, employers need not identify the sources of the information obtained in the investigation.

This article discusses the extension of the FCRA to employee investigations, identifies the purposes for which employers can use third-party reports in connection with employment decisions, and clarifies the procedures that employers must follow.

Extension Of FCRA To Employee Investigations

The FCRA generally requires employers to provide notice and obtain authorization from applicants and employees prior to engaging a third party “consumer reporting agency” to run a background check or conduct certain other types of investigations concerning them.  The term “consumer reporting agency” is interpreted broadly and generally includes any outside party engaged to investigate an applicant’s or an employee’s background or workplace conduct.

In 1999, the Federal Trade Commission (the “FTC”), the agency that enforces the FCRA, issued an opinion letter stating that sexual harassment investigations conducted by third parties were subject to the advance notice and authorization requirements of the FCRA.  This concerned employers, who believed that having to provide the subject of an investigation with advance disclosure of the investigation and to obtain the subject’s authorization to conduct the investigation would greatly hamper the investigation itself.

In response to this concern, Congress amended the FCRA in 2003 to set forth a new procedure for investigations of employee misconduct.  This procedure applies whenever a consumer reporting agency furnishes communications to an employer “in connection with an investigation of (i) suspected misconduct relating to employment; or

(ii) compliance with Federal, State, or local laws and regulations, the rules of a self-regulatory organization, or any preexisting written policies of the employer.”

Under the 2003 FCRA amendment, an employer may engage an outside organization to investigate allegations of employee misconduct without first notifying and obtaining authorization from the employee.  However, if the employer takes adverse action, such as termination or suspension, as a result of the investigation, then, after taking the adverse action, the employer must provide the employee with a summary of the nature and substance of the investigation.  The amendment does not specify the time period within which the employer must provide the summary.

Significantly, the summary does not need to identify the sources of the information obtained in the investigation.  Therefore, if co-workers, vendors, customers, patients, or other individuals (depending on the nature of the business) provided the investigator with damaging information about the employee, then their identities would not need to be disclosed to the employee in the FCRA summary.

Different FCRA Requirements For Different Purposes

While the 2003 FCRA amendments cleared the way for employers to conduct workplace investigations without tipping off the subjects of the investigation in advance, they also resulted in different procedures for obtaining third-party reports about applicants and employees, depending on the purpose of the report.  It is important for employers to understand the various types of third-party reports that may be obtained about applicants and employees under the FCRA and the corresponding procedural requirements.

Technically speaking, when an employer uses a third party (most of which will constitute “consumer reporting agencies” under the law) to provide a report about an applicant or employee, the employer is obtaining a “consumer report.”  There are two types of consumer reports, a “consumer report” and an “investigative consumer report.”

A “consumer report” includes “any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living,” including criminal history.

An “investigative consumer report” is “a consumer report or portion thereof in which information on a consumer’s character, general reputation, personal characteristics, or mode of living is obtained through personal interviews with neighbors, friends, or associates of the consumer reported on or with others with whom he is acquainted or who may have knowledge concerning any such items of information.”

The reports obtained through third-party background checks on applicants and employees are generally considered to be consumer reports.  And when the third-party background check involves interviews to assess character, general reputation, personal characteristics and the like, this portion of the report is generally considered to be an investigative consumer report.

FCRA Requirements Applicable To Background And Reference Checks

When employers use third parties to conduct background and reference checks on applicants and employees, the following steps generally must be followed.

Step 1:  Disclosure and Authorization.  Prior to obtaining a “consumer report,” the employer must provide the applicant or employee with a detailed disclosure and obtain a signed authorization from the applicant or employee.  If the consumer report will be an “investigative consumer report” in whole or in part, then the disclosure must (a) specify that an investigative consumer report including information about the individual’s character, general reputation, personal characteristics and mode of living may be made, and (b) notify the applicant or employee of the right to request an additional disclosure regarding the specific nature and scope of the investigative consumer report.  If an employer initially seeks only a “consumer report” but later decides to request an “investigative consumer report,” then the employer must provide this specialized disclosure within three days after making the request.

Step 2:  Pre-Adverse Action Notice.  If an employer decides to take adverse action against an applicant or employee based in whole or in part on a consumer report or investigative consumer report, then the employer must provide the applicant or employee with (a) a copy of the consumer report or investigative consumer report, and (b) a  Summary of Rights under the FCRA sufficiently in advance of the adverse action that the applicant or employee has a reasonable opportunity to dispute the information contained in the report.  (The FTC has stated that the employer must provide at least five days’ notice, but courts have suggested that five days may not be enough.)

Step 3:  Adverse Action Notice.  At the time that the employer takes an adverse action against an applicant or employee based on a consumer report or an investigative consumer report, the employer must provide the applicant or employee with an adverse action notice, along with another copy of the Summary of Rights under the FCRA.

FCRA Requirements Applicable To Employee Investigations

When employers use third parties to investigate potential employee misconduct or noncompliance with laws, rules, regulations or policies, the following steps generally must be followed.

Step 1:  Engage the consumer reporting agency to conduct the investigation.

Step 2:  If the employer takes an adverse action based on the investigation, then the employer must provide a summary of the nature and substance of the report to the employee.  The summary need not be written, but we recommend that it be written to establish that the summary was provided.  As noted, the summary does not need to identify the sources of the information contained in the report.  We recommend that this summary be provided when the employee is first advised that the employer intends to take adverse action.  If at all possible, this should be prior to taking adverse action.

Employer Liability For Noncompliance With FCRA

An aggrieved  individual may bring a civil action—including a class-action lawsuit—based on alleged violations of the FCRA.  For negligent noncompliance, actual damages, attorneys’ fees, and costs may be awarded to successful plaintiffs.  For willful noncompliance, punitive damages also may be assessed.  The FTC also may bring administrative actions based on alleged FCRA violations.

Don’t Forget To Check State Laws

Many states have enacted fair credit report laws that impose obligations above and beyond those required by the FCRA.  The FCRA provides that similar state laws must be followed “except to the extent that those laws are inconsistent with any provision of this title, and then only to the extent of the inconsistency.”  This standard can be confusing, so we recommend seeking counsel whenever there is a potential inconsistency between the FCRA and an applicable state law.

In addition, many states are considering legislation that would significantly restrict an employer’s right to obtain and use credit reports in connection with employment decisions.  It has been reported that such laws are being considered in Arkansas, California, Connecticut, Georgia, Indiana, Louisiana, Michigan, Missouri, Montana, Nebraska, New Jersey, New York, Ohio, Oklahoma, Pennsylvania and Vermont.  Hawaii, Illinois, Maryland, Oregon and Washington have already passed such laws.  Thus, all employers – particularly multi-state employers – must follow these developments closely to ensure compliance.

Recommendations For Employers

Whether your organization presently uses third parties to conduct background checks, reference checks and employee investigations, or is just considering doing so, you should confer with counsel to ensure that all required forms are being used and all required processes are being followed.

We also recommend providing training to those supervisors, managers and human resources personnel involved in conducting background checks, reference checks and employee investigations to ensure that they are versed in all applicable FCRA and state law requirements and in how to handle any negative results.

The Firm has developed an FCRA Compliance Package to assist employers and conducts seminars, as well as individually-tailored training sessions, on numerous topics relating to background and reference checks, employee investigations and the use of third-party reports in employment decisions.  We would be happy to answer any questions that you may have about this topic or assist in any way.