1
Workplace Investigations and the Fair Credit Reporting Act
Is Vail a Dead Letter?
Randy M. Stedman
Workplace Practices Group
October 18, 2003
Many employers were astonished upon reading an April 1999 FTC Staff Opinion letter (the “Vail” opinion)[1] that concluded a lawyer’s investigation of a sexual harassment complaint by a client’s employee likely constituted an investigative consumer report triggering application of the Fair Credit Reporting Act (FCRA).[2] The Vail opinion reasoned that a sexual harassment investigation conducted by a lawyer would constitute an investigative consumer report because it would involve the collection of information about an individual (the accused) from friends and associates (the coworkers) by a third party (the lawyer), resulting in a report to the employer (report of findings and conclusions). Accordingly, the Vail opinion stated that if the investigation were the basis for an adverse action, the accused would be entitled to the full panoply of notice and disclosure rights under the FCRA, including a complete, unredacted copy of the report. Indeed, under the FCRA an employer is even required to obtain the accused’s consent before initiating an investigation.
Many commentators observed that applying the FCRA’s notice and disclosure requirements to workplace investigations of misconductwould have a chilling effect on the employer's ability to fulfill its duty to investigate pursuant to the U.S. Supreme Court’s 1998 decisions in Faragher v. City of Boca Raton[3] and Burlington Industries, Inc. v. Ellerth.[4] Thus, on the basis of the Vail opinion, many lawyers advised their clients early on to take their workplace investigations in-house. In-house investigations avoid application of the FCRA altogether. However, conducting workplace investigations in-house simply to avoid application of the FCRA may be the cure that kills the patient. There have been a number of cases in which employees—both victims of sexual harassment and those accused of it—have sued employers successfully for failing to conduct workplace investigations of adequate quality or speed.
Fortunately, legal developments since the FTC published the Vail opinion largely have rendered it irrelevant. Moreover, the courts have uniformly refused to adopt its reasoning. As one court put it, agency staff opinion letters such as the Vail opinion “are entitled to respect but not deference.”[5]
Workplace Practices Group * 7327 SW Barnes Rd. # 603 * Portland, OR 97225
(503) 345-9456 *
1
This article reviews the legal landscape surrounding workplace investigations, the FCRA, and current legislative developments. Current legislative developments, if enacted, carve out an exception to the FCRA for workplace investigations. Arguing that the Vail opinion is essentially a dead letter, this article also suggests the factors an employer should consider when choosing an investigator of workplace misconduct in a post-Vail era unconstrained by the FCRA.
Before reviewing court cases and legislative backlash against the Vail opinion, a brief review of FCRA notice and disclosure requirements may be helpful.
A. FCRA Notice and Disclosure—Basic Requirements
The obligations imposed by the FCRA depend upon whether the investigation is a “consumer report” or an “investigative consumer report” (See Attachment 1: “FCRA Notice and Disclosure Requirements In A Nutshell”). A “consumer report” is a report from a “consumer reporting agency” that includes “any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for . . . employment purposes.”[6] An “investigative consumer report” is a consumer report obtained through personal interviews.[7] A “consumer reporting agency” (CRA) is “any person which, for monetary fees…regularly engages…in the practice of assembling…information on consumers [in]…reports to third parties….”[8] Most investigations of the type implicated by the Vail opinion involve personal interviews and therefore constitute investigative consumer reports.
FCRA imposes two initial obligations on employers seeking to obtain either a consumer report or an investigative consumer report. First, the employer must notify the applicant or employee and receive the employee’s express written consent before obtaining a report. The notice must be clear and conspicuous, and must be on a document separate from other information.[9]
If the report is an investigative report, then the employer has additional obligations. The employer must provide a second written notice to the employee within three days of its request for an investigative consumer report. This notice must include a statement of the employee’s right to request a complete and accurate disclosure of the nature and scope of the investigation and a summary of the employee’s consumer rights.[10] The employer also must certify to the outside investigator that all required disclosures have been made.[11]
If an adverse employment decision is made based on either a consumer report or an investigative consumer report, then the employer must provide another notice to the employee.[12] Specifically, the employer must provide the employee with oral, written, or electronic notice of the adverse employment action and the name, address, and telephone number of the consumer reporting agency making the report, including a toll-free number if the reporting agency compiles and maintains files on consumers on a nationwide basis.[13] The employer must also provide a statement that the CRA did not make the adverse employment decision and that it is unable to provide the specific reasons why the adverse action was taken.[14] Finally, the employer must provide the employee against whom an adverse employment action is taken a copy of the report and a summary of the employee’s consumer rights.[15] According to the FTC, an employer is not entitled to redact any information from the report, regardless of possible claims of attorney client privilege.[16] Note that most of the process burden imposed by FCRA’s notice and disclosure requirements fall upon the employer rather than the CRA.
B. Initial SHRM Reaction to Vail
After stewing on the Vail opinion for a few months, SHRM official Susan Meisinger wrote the FTC to express concerns about its implications. Citing the U.S. Supreme Court’s 1998 companion decisions in Faragher and Ellerth, Meisinger noted the dilemma inherent in providing notice to and obtaining consent from an employee before investigating his or her misconduct.
In Faragher, the U.S Supreme Court held that in order for an employer to avoid presumed liability for the bad acts of a supervisor in a hostile workplace sexual harassment case, where the employee has suffered no loss of tangible employment benefits, the employer must make two related showings: 1) the employer exercised “reasonable care to prevent and correct promptly any sexually harassing behavior”; and 2) showing the employee “unreasonably failed to take advantage” of the preventive or corrective measures available under the employer’s policies and procedures. Thus, to avoid liability, the employer must:
1)Have effective sexual harassment policies;
2)Conduct a prompt, thorough, and effective investigation; and
3)Implement and document appropriate corrective action.
To Meisinger, and to many SHRM members and their lawyers, heaping the FCRA’s notice and disclosure requirements on top of an employer’s obligation to conduct prompt, thorough, and effective investigations into workplace discrimination seemed nonsensical. Fear of retaliation does not promote candor, and employers worried about the chilling effect on witness candor once a witness learned an accused would be given a copy of the investigation report.
Apart from mounting an affirmative defense to liability, and against the backdrop of employee suits—both by alleged victims[17] and alleged harassers[18]—forfailing to conduct an adequate investigation or reaching the wrong conclusion after conducing one, employers were frustrated that the Vail opinion put them in a damned-if-you-do-damned-if-you-don't position.[19]
In response to Meisinger (the Meisinger opinion), FTC staff expressed sympathy for the practical implications inherent in Vail, but wrote that if the effects of its 1996 FCRA amendments created conflicts for employers under the 1998 Faragher and Ellerth decisions, then the ball was in Congress’s court to fix it.
Citing earlier FTC opinion letters, the FTC staffer did suggest, however, “that an employee’s consent to procurement of a consumer report . . . can routinely be obtained at the start of employment, thereby relieving the employer of the awkward prospect of having to ask a suspected wrongdoer for permission to allow a third party to provide an investigative (or other) consumer report to the employer.”[20] The staffer also suggested that, if an employer had not obtained such prior notice, it could ask all employees to sign a consent form so as not to alert the wrongdoer.[21] The FTC staffer noted that the third party investigator might wish to exercise discretion in drafting the report “to minimize risks attendant to such disclosure, most importantly by not naming parties that provide negative information regarding the employee.”[22] Finally, somewhat prophetically, the FTC staffer observed in a footnote that the FCRA is not implicated unless the third party investigator “regularly engages” in producing consumer reports.
Almost immediately after the FTC published the Vail opinion, both the courts and Congress reacted.
C. The Courts Reject Vail
1. Investigators Not “Regularly Engaged” in Producing Consumer Reports Are Not CRAs
The definition of a consumer reporting agency under the FCRA requires that the person “regularly engages” in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties.”[23] Courts have seized upon that provision in rendering decisions favorable to employers.
Just a month after the Meisinger opinion, the court in Friend v. Ancilla Syst., Inc.[24] concluded that the FCRA did not apply to an internal investigation of a company’s CFO conducted by a law firm that used an accounting firm to review financial documents on behalf of a client. The investigation led to the CFO’s termination. Plaintiff alleged that the defendant violated the FCRA by failing to make copies of the reports available to him or to his attorney and by failing to inform plaintiff of his rights under the FCRA. The court held there was no evidence the law firm was a consumer reporting agency because plaintiff had presented no evidence the law firm “had ever before or since created reports of the kind at issue in the instant case.”[25]
In another case, McIntyre and Hibbitts v. Main Street and Main Inc.,[26] plaintiff complained of sexual harassment by a coworker. The employer conducted an in-house investigation into her complaint. Thereafter, a law firm conducted a second, more comprehensive investigation into plaintiff’s allegations of sexual harassment and race and sex discrimination. Plaintiff argued that the investigation by the law firm was improper under the FCRA and that the firm was a CRA. The court, however, held that plaintiff had failed to show the firm regularly engaged in the practice of assembling credit and information, relying on one of the attorney’s declarations that the firm “very rarely…conduct[s] internal investigations into internal employment harassment, discrimination, or other complaints asserted by employees of clients.”[27] Thus, the court held that the FCRA did not apply.
At least one district court has attempted to define the term “regularly” because neither the FCRA nor its legislative history does so. In Johnson v. Federal Express Corp.,[28]the court looked to the Fair Debt Collection Practices Act (“FDCPA”), as that statute has similar language to the FCRA and both statutes protect consumers. The Johnson court thus held that “a consumer reporter must provide consumer reports as part of his usual, customary, and general course of business if he is to qualify as a ‘consumer reporting agency’ under the FCRA.”[29] Thus, despite the fact that the employer had hired the investigator before, in that case a forensic document examiner, the examiner was not a consumer reporting agency because evaluating consumer information for reporting purposes comprised less than ten percent of his work.[30]
Courts have not defined the upper level that would meet the “regularly engages” threshold. However, unless a law firm or outside consultant spends quite a significant amount of its time conducting workplace investigations, the FCRA simply will not be applied.
- The “Transactions or Experiences” Exception”
Although the court in Friend held the FCRA did not apply because the law firm conducting the investigation did not regularly engage in producing such reports, the court also held that even if the law firm did regularly engage in such conduct, “it is undisputed that any report made in the instant case involved plaintiff’s transactions or experiences as defendant’s CFO. A report containing information solely as to transactions or experiences between the consumer and the person making the report is specifically excluded from the term ‘consumer report.’”[31] The FCRA excepts from the definition of a consumer report “any report containing information solely as to transactions or experiences between the consumer and the person making the report.”[32]
Hodge v. Texaco, Inc.[33] is the seminal case in this area. In Hodge, an employee argued an employer violated the FCRA by not complying with its notice and disclosure provisions before terminating him for failing a drug test. The employer sent the employee’s urine sample to an outside lab for analysis, and the lab returned the results to the employer. Thus, the court held that the report fell within the transactions or experiences exception because it only included the lab’s first-hand experience with the sample; there was no reliance on information from a third party.[34]
A number of courts have used the transactions or experiences exception to preclude application of the FCRA to workplace investigations. For example, in Salazar v. Golden State Warriors,[35] the court found a private investigator that conducted video surveillance of an employee for an employer in order to determine whether the employee was using illegal drugs did not thereby create a consumer report on the employee. Defendant did not disclose to plaintiff that the investigator firm had been hired, nor did it obtain plaintiff’s consent for video surveillance. Because the investigator was merely relaying to the employer his own firsthand transactions and experiences from his covert surveillance, the court held that although the private investigator was a consumer reporting agency, his activities fell “squarely within the FTC interpretive regulations.”[36]
In Johnson v. Federal Express Corp.,[37] FedEx hired an outside forensic examiner to review threatening letters the company had received and to determine whether plaintiff had sent them. FedEx had obtained several writing samples of plaintiff and sent them to the forensic examiner, who tested them first-hand and drew conclusions based on his personal knowledge. The examiner issued a report expressing his belief that plaintiff had sent the letters. Plaintiff did not allege FedEx had altered the handwriting samples before submitting them for analysis, nor did plaintiff claim the forensic examiner had shared the information with anybody other than FedEx. Therefore, the report was based entirely on information supplied by the consumer (her handwriting samples) and was exempted from the FCRA requirements based on the “transactions or experiences” provision.[38]
By its terms, the exception applies to the investigator’s transactions and experiences with the person investigated, not the transactions or experiences between the employer and the person investigated. However, courts have worked hard to stretch the exception.
In Hartman v. Lisle Park Dist,[39]plaintiff, an administrative services manager for a park district, alleged she had been fired because she spoke to the state’s attorney’s office and testified before a grand jury regarding the park district director’s improper use of public funds. The employer retained an attorney to conduct an internal investigation. Plaintiff alleged the park district had violated the FCRA because it failed to give notice of an investigation, did not obtain her consent, and failed to provide her a copy of the resulting report. In dismissing plaintiff’s FCRA claim, the court held that:
“[N]othing in the FCRA or its history that indicates Congress intended to abrogate the attorney-client or work-product privileges, as would be the effect of applying the FCRA’s requirements (which include disclosure of the report)…. Moreover, we think that a report prepared by an attorney about an employee’s transactions or experiences with the attorney’s client (the employer) qualifies as a ‘report containing information solely as to transactions or experiences between the consumer and the person making the report’ within the meaning of § 1681a(d)(A)(i), even though the report is prepared by an entity other than the employer.”[40]