Compromising Compliance

September 20, 1999 Published Work

Legal Times

September 20, 1999 vol. XXII, no. 18

A Practice Focus

Throughout the 1990's, companies have increasingly heeded the government's strong urging that they become good corporate citizens and self-police.

Pivotal in that effort has been the implementation of corporate compliance programs designed to prevent and detect wrongdoing. In great numbers, companies are promptly and thoroughly investigating allegations of corporate misconduct, rather than turning a blind eye to such problems. However, a recent misguided opinion from a Federal Trade Commission staff attorney could set this corporate compliance trend back more than a decade.

The April 5, 1999, opinion concluded that employer-sponsored sexual harassment investigations are subject to the Fair Credit Reporting Act. As a result, any employer who uses experienced outside counsel or investigators to conduct internal investigations would be subject to the FCRA's stringent disclosure and consent requirements. Notably, the opinion would require employers to obtain written consent from all suspect employee before commencing internal investigations. What's more, the opinion would require employers to provide full copies of investigative reports to employees responsible for misconduct before taking any adverse employment action against them.

Not surprisingly, the opinion has come under strong attack by employment attorney's who point to the conflict between the opinion and the Supreme Court's recent mandate that employers conduct prompt and effective investigations of sexual harassment allegations.

However, if the opinion is adopted by the courts, its impact will extend well beyond sexual harassment probes to inhibit corporate compliance investigations of all kinds. By suggesting that employers must obtain employees' consent before having experienced counsel investigate misconduct-and then requiring disclosure of the results of the investigation to affected employees-the opinion is fully at odds with the federal government's vision of corporate compliance programs.

In recent years, the federal government and the courts have all but mandated that companies implement overall corporate compliance programs. In particular, the federal Organizational Sentencing Guidelines create significant incentives for companies to meet the guidelines' seven criteria for an effective compliance program. Similarly, the Delaware Chancery Court's decision in In re Caremark International Derivative Litigation (1997) essentially shields officers and directors from certain civil claims if their companies successfully implement corporate compliance programs.

Not surprisingly, companies and other organizations have heeded the government's strong suggestions. Compliance programs have proliferated, and compliance officers are very much in demand. Indeed, corporate compliance has become an industry in itself.

One of the most important requirements established by the Organizational Sentencing Guidelines for an effective compliance program is that companies take "reasonable steps to achieve utilizing monitoring and auditing systems reasonably designed to detect criminal conduct by [their] employees and other agents and by having in place and publicising a reporting system whereby employees and other agents could report criminal conduct by others within the organization without fear of retribution."

In short, this requirement translates into: (1) a confidential process by which employees can report suspected illegal conduct in good faith without fear of retribution, and (2) prompt and effective internal investigations based on those or other reports.

Requiring a suspect employee's consent prior to an investigation and the full disclosure of investigative information to that employee would all but eliminate a company's ability to receive information from employees and to act effectively on that information. Many suspect employees would simply not consent, thus ending the employer's liability to obtain outside assistance in undertaking an investigation right from the start. And those employees who did consent would eventually obtain a full investigative report, including all memos of interviews with co-workers, thus dooming or limiting future employee cooperation.

Misapplication of FCRA

In addition to conflicting with the goals of corporate compliance, the opinion serves no legitimate purpose of the FCRA. As its name suggests, the FCRA is concerned solely with issues of "credit worthiness, credit standing, credit capacity" or otherwise affecting the "general reputation of consumers," 15 U.S.C. §1681(a)(2), not with corporate misconduct by employees.

The FCRA was enacted to protect consumers against the misuse of, and inaccuracies in, consumer reports used to determine eligibility for credit, insurance, and employment purposes, See 15 U.S.C. §1681(a), (b). Specifically, the intent of the FCRA was to assure, by means of fair and accurate credit reports, "public confidence...essential to the continued functioning of the banking system." 15 U.S.C. §1681(a)(1). Supporters of the FCRA recognized that when inaccurate or arbitrary information bearing on a consumer's credit trustworthiness was circulated to lending institutions or used as a factor in employment, such information could unjustly damage th consumer. With the enactment of the FCRA, the FTC had the power to require consumer reporting agencies to maintain records, prevent the unreasonable or careless invasion of consumer privacy, and encourage consumer reporting agencies to use fair and impartial procedures.

The 1996 FCRA amendments (made effective in 1997) created additional restrictions on an employer's use of "consumer reports" from outside "consumer reporting agencies." A "consumer reporting agency" is defined as "any person which, for monetary fees...regularly engaged in whole or in part in the practice of assembling or evaluating...information on consumers for the purpose of furnishing 'consumer reports' to third parties." A "consumer report" is defined as "any communication of any information...bearing on a consumer's credit worthiness, credit standing, credit capacity [or] character...which is used or expected to be used or collected in whole or in part for...employment purposes." 15 U.S.C. §1681a(d), (e).

The 1996 amendments require an employer to disclose in writing its intention to obtain a consumer report and to receive written authorization from the consumer before initiating the inquiry. The employer is also required to give notice to the "consumer" (i.e., the employee), along with a copy of the report and a written description of the consumer's rights under the FCRA, before taking adverse action against him or her based on information contained in the report. 15 U.S.C. §1681b(3)(A). A consumer who alleges that an employer or consumer reporting agency has willfully failed to comply with the act may bring a civil action, seeking actual and punitive damages and attorneys fees. 15 U.S.C.§1681n. A claim of negligent noncompliance may result in actual damages, as well as attorney fees and costs (but no punitive damages). 15 U.S.C.§1681o.

Notably, as the Labor and Employment Section of the American Bar Association argued in a recent letter to the FTC, neither the FCRA nor its amendments say anything about regulating the employment relationship in any respect unrelated to "credit." The act on its face simply has no application whatsoever to internal employer investigations limited to misconduct in the workplace.


The opinion was issued in response to an inquiry by Judi Vail, a Vancouver, Wash. Attorney, regarding the applicability of the 1996 FCRA amendments to an employer's sexual harassment investigation. Vail raised two important questions; (1) whether the act's reporting requirements apply to outside organizations that regularly assist employers with investigation for a fee "if the scope of their investigation does not exceed the employers, work force or company documents," and (2)whether an employer releasing such a consumer report or "investigative consumer report" to the employee pursuant to the act may redact identifying information.

The opinion entirely disregards both the import of the questions asked and the implication of the answer given. The FTC staff attorney simply cites the FCRA's definitions of "consumer report" and "consumer reporting agency," applies these terms broadly and nonsensically to the facts presented, and, completing the tautology, concludes that an employer who engages such outside investigators must in fact comply with the act's consent and disclosure requirements.

A closer look at the FCRA makes startlingly clear the absurdity of the FTC opinion. The FCRA applies only when employers hire "consumer reporting agencies, which, by definition, must "regularly engage [ ] ... in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties." The opinion concludes that "once an employer turns to an outside organization for assistance in investigation of harassment claims ... the assisting entity is a CRA [consumer reporting agency] because it furnishes "consumer reports" to a "third party'(the employer)."

Yet even under this broad reading, the FCRA would not apply to internal investigations conducted by companies without outside assistance or by companies that hire firms that do not "regularly engage" in internal investigations. Since the act's purpose is to protect the integrity of information reflected in a consumer report, the legislation is ill-served by distinguishing between an employer's internal investigation and an investigation that makes use of an experienced third-party investigator, where both investigations rely entirely on documents and information found in the workplace. Worse yet, the opinion would apply the FCRA to investigations conducted by experienced investigative counsel, but would not extend the act's protection to outside counsel who do not "regularly" conduct internal investigations.

As a practice matter, removing the option of using experienced outside help in internal investigations would undermine the effectiveness of such probes. Experienced outside assistance enables an employer to address an issue immediately and confidentially, and to take action as needed. Outside counsel generally have greater investigative experience, greater perceived independence, and greater familiarity with the legal restrictions on internal investigations and the substantive laws at issue. Yet those are the only investigations restricted by the opinion.

The FTC opinion is both indefensible and against public policy. If enforced by the courts, it would unreasonably impair employers' ability to investigate potential employee wrongdoing and satisfy the government's compliance directives.

These restraints are inconsistent with the letter and spirit of the FCRA and place employers in an untenable and absurd dilemma. They must conduct internal investigations without outside help - or at least with experienced outside help - or obtain the consent of any suspected employees before investigating, and then disclose all results of the investigation to those employees. The drafters of both the FCRA and the federal Organizational Sentencing Guidelines could not have envisioned, and would certainly be dismayed by, this outcome.

Reprinted with permission of Legal Times, 1730 M. St., N.W., Suite 802, Washington, DC 20036. Phone: 202-457-0686. Copyright, Legal Times, 1999.