Legal Trends: Just the FACT Act, Please

Using outside experts to investigate workplace misconduct just got easier.

The recently enacted Fair and Accurate Credit Transactions Act (FACT Act) amends the Fair Credit Reporting Act (FCRA) in various ways, but one new provision of great significance to employers is an exception to the law’s definition of “consumer report.” The exception liberates employers from following the FCRA’s exacting consent and disclosure requirements when they engage third parties to investigate workplace misconduct.

Specifically, the amendment excludes from the FCRA’s definition of consumer report communications made to employers in connection with investigations of: “(i) suspected misconduct relating to employment; or (ii) compliance with Federal, State, or local laws and regulations, the rules of a self-regulatory organization, or any preexisting written policies of the employer.”

The amendment thus frees employers to hire outside consultants, investigators or law firms to investigate and report on a variety of workplace issues without first notifying targets of the investigation or obtaining their consent. The FCRA’s notice requirements still apply, however, when employers use third parties in other contexts—for example, to conduct background or credit checks.

Past Is Prologue

To fully understand the significance of the legislative changes as well as the requirements that remain unaltered, some definitions and history are in order.

Enacted in 1970, the FCRA is a consumer protection law that calls for full disclosure of consumer reports by consumer reporting agencies (CRAs) so individuals subject to them can dispute the wrongful use or interpretation of information.

Definitions. A CRA is anyone who, for monetary fees, dues or on a cooperative nonprofit basis, regularly assembles or evaluates credit or other information about consumers for the purpose of furnishing reports to third parties.

The FCRA recognizes two types of reports—“consumer reports” and “investigative consumer reports.”

Consumer reports are communications from a CRA that bear upon a consumer’s credit worthiness, character, general reputation, personal characteristics or mode of living, and are used as factors in establishing eligibility for employment.

Investigative consumer reports go one step further than consumer reports by relying on personal interviews of the neighbors, friends or associates of the person being investigated.

Developments. Before 1997, the FCRA required employers—in limited circumstances—only to notify job applicants and/or employees that credit checks would be conducted with respect to their employment or application for employment.

Effective Sept. 30, 1997, however, the FCRA was amended, imposing burdensome new compliance requirements on employers who used CRAs to obtain background information on employees—whether or not the CRA’s report contained credit information. These requirements, as summarized later in this article, remain in effect today.

In 1999, an interpretation of the FCRA by the Federal Trade Commission’s (FTC) legal staff created significant challenges for human resources professionals seeking to use third-party experts to investigate allegations of workplace misconduct.

In response to an inquiry by attorney Judy Vail, FTC lawyers stated that “outside organizations utilized by employers to assist in their investigations of harassment claims are CRAs” and that oral or written reports resulting from the investigation “most likely” are investigative consumer reports.

Plot Thickens

The FTC’s interpretation in the so-called “Vail letter” created serious problems for employers with legal and ethical obligations to promptly investigate and take corrective action in cases of workplace misconduct.

Many employers simply did not have the expertise or resources to conduct effective in-house investigations and thus avoid the FCRA’s notice requirements. But when employers hired outside entities to investigate complaints of sexual harassment or other misconduct, they risked violating the FCRA if they failed to inform alleged miscreants ahead of time about the investigation, obtain their consent to proceed and, ultimately, give them the complete investigation report.

In short, the Vail letter interpretation deterred employers from using skilled and experienced outside consultants to conduct employment-related misconduct investigations because any misstep in compliance with the FCRA’s many detailed, technical provisions easily could increase the threat of litigation.

Further, an employer’s disclosure of the consumer report—including the names of those interviewed—to the targeted employee could compromise the privacy rights (or, in some circumstances, safety interests) of victims and witnesses. Thus, the employer’s obligation to disclose had the potential to chill co-workers from coming forward with relevant information, and, of necessity, tipped off wrongdoers about the investigation and the possibility of suffering adverse action.

Moreover, application of the FCRA to workplace misconduct investigations added unnecessary cost and time to the process because CRAs are subject to extensive reinvestigation requirements designed to ensure the accuracy of information contained in consumer reports. Reinvestigation may be an effective tool when the consumer report at issue addresses an individual’s credit history, but it poses significant problems for an outside organization conducting a workplace misconduct investigation. To wit, under some circumstances, the outside organization might have to reinterview witnesses because, for example, an alleged harasser protested the findings of the original investigation report.

Misplaced Motives

The FCRA’s legislative history and express provisions made it evident that the act was not designed to apply to employment-related misconduct investigations. Rather, the FCRA’s protections were drafted to protect consumers from credit-related information transmitted between banks, credit bureaus, other financial institutions and background investigators.

What’s more, applying the FCRA to employment-related misconduct investigations arguably was unnecessary because a multitude of laws and regulations already required workplace investigators to be fair with regard to confidentiality, accuracy, relevance and proper use of information.

Applying the FCRA to employment-related misconduct investigations also heightened the risk of litigation. Lawsuits involving employment-related misconduct were prone to include boilerplate FCRA counts in plaintiffs’ hope of flushing out employers’ inadvertent missteps that might trigger unlimited punitive damages.

More than one court disagreed with the FTC’s Vail letter, holding that workplace investigations by attorneys are not covered by the FCRA. And the dilemma employers faced in trying to comply with both the conclusion of the Vail letter as well as with their legal duties to promptly and fairly investigate workplace misconduct dictated that change to the FCRA was needed.

Exciting Denouement

Soon after issuance of the Vail letter, a coalition of interested companies and organizations—including the Society for Human Resource Management—began working to draft and promote an amendment to the FCRA that would address the need for effective and efficient workplace investigations while still respecting employees’ privacy rights. The resulting FACT Act balances both interests. The FTC recently issued final rules setting an effective date of March 31, 2004, for the workplace misconduct investigation aspects of the FACT Act.

The amendment is broad enough not only to include investigations regarding suspected violations of the law, but also to cover violations of a company’s written policies and procedures. However, if the investigation gathers information related to an individual’s creditworthiness, credit standing or credit capacity, the FCRA notice and consent provisions still apply.

The amendment also addresses the privacy rights of both the investigation’s target and of potential victims and witnesses. First, any workplace investigation report generated can be disclosed only to the employer; federal, state or local officers, agencies or departments; any organization with regulatory authority over the employer; or as otherwise required by law.

Additionally, if an employer takes adverse action based on the report, it must disclose to the target of the investigation a summary of the communications on which the adverse action is based. The summary must include the nature and substance of the communications, but need not include sources of information—such as the identity of individuals who have been interviewed.

Because the amendment to the FCRA is so new, the exact scope of the exclusion is not yet precisely defined. However, numerous kinds of common workplace investigations will be excluded from the definition of consumer report, and thus are not subject to the FCRA notice and consent requirements. Investigations into (1) complaints of sexual and other types of harassment or employment discrimination; (2) incidents of workplace theft, drug use or violence; (3) violations of workplace safety rules and regulations; and (4) workers’ compensation claims most likely will be considered within the scope of the new exclusions.

The amendment will not exclude all investigative consumer reports, however. Investigations of applicants pursuant to the hiring process—for example, employment and/or education verification that involves interviews with prior employers/educators—probably fall outside the ambit of the amendment. For this reason, existing FCRA compliance forms still serve an important purpose.

The FTC’s legal staff has announced that it will no longer issue opinion letters interpreting the FCRA’s requirements, ostensibly so that staff members can concentrate on generating new regulations for the twice-amended act. As the release of those regulations is by no means imminent, human resources professionals may experience a void of guidance from official sources for some time. While, as a general rule, the new exceptions will apply to most workplace misconduct investigations involving current employees, human resources professionals still are urged to consult with experienced employment counsel if they have questions about whether a planned workplace investigation falls under the new exceptions to the FCRA.

Even if the exceptions do apply, human resources professionals may want to consult with counsel regarding the appropriate disclosure of the nature and substance of communications if adverse action is taken based on a workplace investigation report.

The amendment to the FCRA goes a long way toward correcting some of the problems employers faced in trying to comply with competing legal obligations when investigating workplace misconduct. Employers who lack either the resources or expertise to conduct effective investigations in-house are now free to use outside experts for workplace investigations without choosing between the risk of violating the FCRA or stalling the investigation by informing the target ahead of time.

Continued Vigilance

While the new exclusion from the definition of consumer report relieves employers of many of the challenges associated with FCRA’s application to misconduct investigations, employers must continue to be vigilant about FCRA compliance in other contexts, such as in hiring and where credit information is involved.

Here’s a brief refresher to help you to do that.

Consumer report rules

The FCRA requires employers that obtain consumer reports to do three things:

• Before asking a CRA for a report, employers must provide applicants or employees with clear, written notice that the report will be commissioned. This notice must be in a separate document; it cannot be incorporated into an employment application.

• Employers must receive written authorization from the applicant or employee before they ask the CRA for the report.

• Prior to requesting the first report from a CRA, employers must certify to the CRA that they will comply with the FCRA and all other applicable equal employment opportunity laws and regulations.

Before taking any adverse action based in whole or in part on the report from a CRA, employers must give applicants or employees a copy of the report and a summary of their rights under the FCRA. (The summary is a standard document created by the FTC, and can be found on the agency’s web site at www.ftc.gov.) Then, the employer must wait approximately five days (the proper amount of time must be judged on a case- by-case basis) before actually taking the adverse action. The FTC has opined that this waiting period is designed to allow the applicant or employee to come forward with information for the employer to consider before taking adverse action.

After deciding to take adverse action, the employer must provide the applicant or employee with the following five things:

• Notice of the adverse action taken.

• The name, address and toll-free telephone number of the CRA that furnished the consumer report.

• A statement that the CRA did not make the decision to take the adverse action and is unable to provide the consumer the specific reasons why the adverse action was taken.

• Notice of the consumer’s right to obtain a free copy of the consumer report from the CRA within 60 days.

• Notice of the consumer’s right to dispute the accuracy or completeness of any information in the consumer report furnished by the CRA.

Investigative consumer report rules

The FCRA imposes even more stringent requirements on employers seeking investigative consumer reports. Not later than three days after first requesting a report from the CRA, an employer must disclose in writing to the applicant or employee its intention to obtain an investigative consumer report. That disclosure must include both the summary of consumer rights described above and a statement informing the applicant or employee of the right to request additional disclosures regarding the nature and scope of the investigation.

If the applicant or employee requests additional information within a reasonable time, the employer must make a complete disclosure of the nature and scope of the investigation. The disclosure must be in writing and must be given to the applicant or employee no later than five days after the date on which the employer received the request or first requested the report, whichever is later.

Compliance with the FCRA always has been tricky. The recent amendments to the act—although ameliorative—add yet another element to the human resources professional’s compliance strategy. Understanding the act as amended, however, can be an important tool to ensuring a productive and safe workplace.