Business Interests vs. Privacy Rights

Generally, the FCRA requires employers to disclose that an “investigative consumer report” will be obtained about an employee, to obtain the employee's advance authorization for the report, and to provide notices prior to and following any adverse employment action based on the report.

The Federal Trade Commission (FTC) held in 1999 that investigations of employee misconduct were covered under FCRA. See, Advisory Opinion to Vail (04-05-99). In other words, an employer who suspected an employee of misconduct would first have to provide the employee with notice that it intended to investigate the conduct, obtain the employee's written consent in advance, and provide the employee with a full copy of the report following the investigation.

Had the FTC's ruling been allowed to stand, employers would be unable to covertly investigate suspected misconduct. Fortunately, the Fair and Accurate Credit Transactions Act of 2003 (FACTA) amended the FCRA to provide that under certain conditions, an employer is no longer required to notify an employee when it uses a third party, such as a private investigator or background research firm, in the context of an internal investigation. See, Pub. L. 108-159, 117 Stat. 1952.

Under FACTA, communications relating to employee investigations are excluded from FCRA's definition of “consumer report” if three requirements are met:

1. The communication is made to an employer in connection with the investigation of: i) suspected misconduct relating to employment; or ii) compliance with federal, state, or local laws or regulations, the rules of a self-regulatory organization or any preexisting written policies of the employer;
2. The communication is not made for the purpose of investigating a consumer's credit worthiness, credit standing or credit capacity; and
3. The communication is not provided to any person except: i) the employer or an agent of the employer; ii) any federal or state officer, agency or department, or any officer, agency or department of a unit of general local government; iii) any self-regulatory organization with authority over the activities of the employer or the employee; iv) as otherwise required by law; or v) pursuant to Section 1681f of FCRA, which addresses disclosures to government agencies.

15 U.S.C.1681a(y)(1).

FACTA also obligates employers to make certain disclosures to employees who have been investigated. Specifically, after taking any adverse action based in whole or in part on a report meeting the above requirements, the employer must disclose to the employee a summary containing the nature and substance of the communication upon which the adverse action was based, except that the sources of information acquired solely for use in preparing what would be an investigative consumer report absent FACTA's exception need not be disclosed. See, 15 U.S.C.1681a(y)(2). In other words, the employer does not have to provide the employee with a copy of the full report; it need only provide a summary, and then only after an adverse employment action (suspension, demotion, termination, etc.) has been taken. The summary does not have to include the names of people who were interviewed by the third-party investigator.

While FACTA makes it possible for employers to conduct undercover investigations, the law is often criticized for containing too many undefined terms. FACTA covers investigations based on violations of “pre-existing written policies,” but it is not clear how detailed these written policies must be. FACTA is also silent as to whether off-duty conduct can trigger a FACTA-covered investigation.

The good news is that courts have interpreted FACTA liberally in favor of employers, finding that off-duty conduct and even conduct occurring following termination can serve as the basis of an investigation covered under FACTA. One court held that an employer was not required to obtain a former employee's consent prior to pulling her credit report for the purpose of analyzing her credit card activity based on a suspicion that the employee had made false representations in connection with her workers' compensation claim. See, Millard v Miller, No. 05-C-103-S (W.D. Wis. Aug. 9, 2005).

Employers also need to be cognizant of state laws that provide additional protections to employees who are the subjects of internal investigations. In California, for example, an employee who is suspected of misconduct may be entitled to copies of all public records reviewed during the investigation, regardless of the outcome of the investigation.

Using Social Media

In many instances, an employer might seek to gain access to information posted to an employee's personal social media account. For example, if the employer has reason to believe that the employee is violating confidentiality policies through social media, or if one employee reports that another has engaged in harassing behavior online, the employer might seek to access the online account of the suspected employee.

The problem is that while use of social media is not encumbered by geographic boundaries, an employee's physical location has significant implications for the employer's internal investigation.

As of December 2015, 21 states have enacted “password protection” laws. Most of these laws generally prohibit an employer from requesting or requiring that applicants or employees disclose login credentials for their social media accounts. Some go further and prohibit an employer from requiring employees to divulge protected social media content. Most, but not all, contain exceptions for workplace investigations. But the statutes differ as to which accounts are covered and which conduct can trigger an employer's right to access content. This makes it particularly difficult for multi-state employers to develop uniform policies addressing access to social media in the context of workplace investigations.

Some password protection laws contain limited exceptions allowing employers to use social media to investigate certain types of conduct. The laws in Maryland and Colorado, for example, contain exceptions that only apply to investigations: i) to ensure compliance with applicable securities or financial law or regulatory requirements; or ii) based on information that an employee has downloaded proprietary or financial data without authorization. See, Md. Labor & Emply. '3-712; Co. St. '8-2-127.

Other laws, such as New Jersey's legislation, permit an employer to ask for login credentials if the employer has specific information pertaining to employee misconduct or violation of laws. See, N.J. St. 34:6B-10. But absent such specific information, New Jersey employers face particularly strict prohibitions on access to employees' social media content. The law is broad enough so that it arguably prohibits an employer from asking a complaining employee to print out the employee's own social media timeline to give the employer access to another user's potentially harassing content.

Some statutes, such as Illinois' law, contain no exception at all that would allow an employer to access information from employees' personal social media accounts. See, Il. St. Ch. 820 '55/10(B). The Illinois law does not apply to e-mail accounts, however, so employers have more latitude if they suspect an employee has used a Gmail or similar account for improper purposes.

Some laws attempt to strike an appropriate balance between protecting the employee's privacy interests and the legitimate business interests of the employer. As an example, California's password protection legislation defines “social media” broadly, to include any “electronic service or account, or electronic content ' .” Cal. Labor Code '980. The law generally makes it illegal for an employer to require or even request an employee to disclose the username and password for a social media account, even in the context of an investigation of alleged employee misconduct. Employers also are not permitted to “shoulder surf” (i.e., to observe the employee's social media content after the employee has accessed an account).

The statute does contain a provision allowing an employer to ask the employee to divulge related account content (such as through printouts or screen shots), but not login information, in the context of an internal investigation of allegations of an employee's misconduct or violation of applicable laws and regulations. Any such content obtained by the employer may not be used for any purpose other than the investigation.

Given the variation among password protection laws as to which accounts are covered and what exceptions apply, employers should become familiar with the requirements in all states where they have employees. Employers should consult with legal counsel before seeking to access an employee's social media content.

Investigative Interviews

When an employer interviews witnesses as part of an investigation, it will need to carefully consider several issues that implicate the privacy of the subject employee as well as other members of the workforce. Employers should establish written policies and apply them consistently to avoid creating negative precedent.

Many employers question whether or not they should require employees to participate in investigative interviews. The answer depends on the circumstances. In cases where an employee's participation would ultimately support the employer, such as situations involving alleged discriminatory conduct, taking an adverse action because an employee elects not to participate could be deemed improper retaliation under Title VII of the Civil Rights Act of 1964. But in other instances, an employer is well within its rights to require participation. In fact, failure to require participation could expose the employer to liability under state and federal law. This is particularly true where legitimate interests of the employer, such as the requirement to provide a work environment free of violence, arguably outweigh an employee's privacy interests.

An employee's request to be accompanied by a third party during the interview should generally be denied. Of course, there are certain exceptions, including when employees have the right under a collective bargaining agreement to assistance from a union representative. But the presence of a third party (whether or not this individual is also an employee) may result in unnecessary dissemination of some of the company's most sensitive information.

If an employee requests that an attorney accompany him or her, the employer should consult with legal counsel before proceeding. Generally, an employee does not have the right to be accompanied by an attorney in the context of an informal investigation. But employers should not reject such requests out of hand. If an employee refuses to participate without his or her attorney, the employer could face a retaliation claim if it suspended or discharged the employee for failure to cooperate.

An employer should reject any request to record the interview. When participants (including the interviewer) know they are being recorded, they may be uncomfortable speaking freely. Also, the company has no control over the dissemination of the recording. Given the relative ease to make audio and video material available online, the employer can legitimately state that it prohibits all recording of investigative interviews in order to protect its trade secrets and the privacy of its employees.

Angela R. Matney is an attorney with Hirschler Fleischer in Fredericksburg, VA, who counsels employers on information privacy compliance. She is a Certified Information Privacy Professional (CIPP), and may be reached at 540-604-2117 or by e-mail at [email protected].