New England Biz Law Update
With the Hewlett-Packard scandal putting the possible risks of private investigation on the radar screen, management lawyers are advising clients about what they should and should not do when they want to investigate an employee.
H-P is under scrutiny for hiring a third party investigator in an attempt to crack down on suspected board member leaks of private company information. At issue is the investigation company’s use of a practice known as “pretexting” – which involves posing as someone else – to obtain board members’ and journalists’ phone records.
But according to management attorneys, the recent scandal should cause employers to reevaluate what kinds of private investigation they can do – not just of board members, but of current employees suspected of wrongdoing.
Currently, 12 states have laws barring the use of pretexting to obtain phone records: Arizona, California, Colorado, Connecticut, Georgia, Maryland, Michigan, Minnesota, Oklahoma, Rhode Island, Virginia and Washington. (The California law was signed last week and goes into effect Jan. 1.)
Making pretexting illegal is also on the federal legislative agenda. In September, a House Energy and Commerce subcommittee held hearings on the issue, focusing on pending legislation that would allow the Federal Trade Commission to seek civil penalties against companies that obtain personal information under false pretenses – and scolding H-P executives who testified.
Given all of this, it’s generally agreed that allowing private investigators to engage in pretexting is a mistake, regardless of state or federal law – but there are other techniques employers can use.
“A prudent employer should prohibit the use of pretexting by a third party or itself,” said Lisa Cassilly, a management attorney with Alston & Bird in Atlanta who focuses on privacy. But “in most jurisdictions there really are fewer limits than the average citizen might believe exist in an employer’s right to make an inquiry.”
A wide range of circumstances would make an employer consider investigating an employee – including suspected sexual harassment, embezzlement, lying about a workers’ comp injury, leaking of trade secrets, employee theft or fraud and non-compete violations.
Legally, employers can use private investigators to:
The key is to know what you can do without informing the employee, and what types of investigation require consent.
And, noted Joseph Sanscrainte, a telecommunications and privacy attorney with Bryan Cave in New York, “companies can’t rely on the entity providing the investigative service to give them correct and up-to-date legal advice.”
Suspected misconduct
In 2003, the Fair and Accurate Credit Transaction Act (FACTA), which amended the Fair Credit Reporting Act (FCRA), clarified that an employer who suspects employee misconduct or wrongdoing may use the services of an outside agency to conduct an investigation without giving advance notice to the employee.
Until that point, said Cassilly, it was unclear whether private investigators were “agencies” covered by the FCRA.
But certain activities, such as running employees’ credit histories or performing criminal background checks, still require authorization from the employee under the Fair Credit Act, said Jason Rosenberg, an attorney with Moran Kiker Brown in Richmond, Va.
Further, state privacy laws can limit how far an investigation can go, and the federal Gramm-Leach-Bliley Act – intended to protect personal financial information – makes it difficult to obtain an employee’s bank records.
As a result, Sanscrainte recommended applying for a subpoena or search warrant if such information is needed to complete an investigation.
Some guidelines
Give these constraints, below are suggestions on how employers can use private investigators without running afoul of the law:
Surveillance is generally permissible if “the information you’re getting is publicly available,” said William Hannum, a partner with Schwartz Hannum in Andover, Mass.
For example, Cassilly said, “if an employee is suspected of dealing drugs on your premises or stealing, investigators can come in and conduct surveillance without triggering Fair Credit Act responsibility.”
Surveillance outside the workplace can also be okay.
If a workers’ comp claimant “is out there playing softball and they videotape him, that’s permissible,” Cassilly said.
Hannum said his clients have interviewed friends or neighbors to ascertain an employee’s condition.
However, there are limits. For example, Sanscrainte said many states have laws “geared towards making sure people aren’t being videotaped in the locker room or bathroom.”
But work computers and servers are fair game.
“There are all kinds of readily available, fairly inexpensive monitoring software that allow you to track whether secure documents are being sent outside the company,” Cassilly said.
Sanscrainte noted some types of software can be installed by e-mail, and then if that employee forwards a certain sensitive e-mail message his computer will indicate that to the employer.
If in the course of this periodic monitoring the employer finds personal financial information, Cassilly said it doesn’t really have the right to use it against the employee.
Monitoring a home computer is problematic, even if it is sometimes used for work purposes.
“A personal home computer strikes me as dangerous territory,” said Hannum.
When employers make the proper disclosures in advance, it’s much easier to conduct a complete investigation.
For example, to facilitate possible future investigations, an employer might want to have all employees sign a document authorizing it to obtain a consumer report at any time during their tenure.
“The disclosure must clearly state the authorization is intended to cover both the application for employment and, if the consumer is hired, any additional consumer reports obtained while the individual is an employee,” Rosenberg said.
Hannum agreed.
“We advise clients to go with as broad a disclosure as possible because you don’t know what you’re going to want later on,” he said.
If the proper disclosure wasn’t signed at the time of hire, an employer might want to get an authorization for the employer to obtain a consumer report as a condition of continued employment, Rosenberg said, citing a recent unpublished decision from the 3rd Circuit. (Kelchner v. Sycamore Manor Health Center, 135 Fed. Appx. 499 (2005).)
It also important to make clear employees’ work computers are subject to search.
“The employer should have a policy that puts people on notice that they don’t have an expectation of privacy in the employer’s server, Internet or e-mail connection,” Cassilly said.
Sanscrainte said companies can get themselves into trouble if they don’t monitor the activities of third party investigators carefully.
“Let’s say the outside investigator takes an employee’s Social Security number and runs with it,” he said. “It might be difficult for the employer to argue that it didn’t know what they were going to do with it.”
Cassilly agreed. “Because they are acting on the employer’s behalf, if the investigator steps beyond the law, the employer could be liable.”
She recommended including language in the hiring agreement making clear the investigator’s activities must comply with state and federal law.
“You don’t necessarily need to say, ‘We prohibit you from engaging in pretexting.’ You could have more expansive language which indicates the third party acknowledges any acts undertaken with that investigation must comply with the law,” she suggested.
