Privacy In The Workplace and Conducting An Internal Investigation

Prepared in connection with the seminar, "Employment Law Update," presented by Sterling Education Services, LLC in Chattanooga, Tennessee in October, 2008

A. PRIVACY IN THE WORKPLACE

1. The Developing Law and Practical Applications

Privacy in the workplace is a developing area of law. There are dozens of privacy-related considerations in the employment law setting, and many of the current issues being considered by courts, employees' lawyers and employers' lawyers are novel, so that guidance is scarce. These novel, developing issues include:

Searches of employees, employees' property, or employee workspace
Monitoring of employee communications or conduct (including e-mails, internet usage, telephone calls, etc.)
Psychological screening
Credit checks
Controlling employees' off-duty conduct, including use of alcohol, drugs, and tobacco products
Conducting investigations

In today's workplace, it is common for an employer to provide an employee with a variety of technological devices in an effort to enhance productivity. These include computers, e-mail accounts, internet access, cell phones, pagers, handheld "Blackberry®" devices, PDAs, and similar devices.

According to a survey by the American Management Association in 2004, twenty-five percent (25%) of employers had terminated an employee for violating the employer's e-mail policies, up from seventeen percent (17%) in 2001.

Most employers recognize that they need specific, detailed policies concerning such matters as e-mail and internet usage. One of the primary purposes of such policies is to eliminate any expectation of privacy on the part of an employee utilizing these technologies. However, even when an employer has a policy limiting the use of technology to work-related purposes, it is nonetheless common for employers to tolerate some degree of private usage by employees. This is one dilemma for employers – should there be a "zero tolerance" policy, or should some degree of extracurricular usage be tolerated. In any event, the employer's written policy and actual practice should prohibit employees from using technologies to do such non-work things as accessing pornography, gambling, accessing hate-group sites, circulating off-color jokes, or sending abusive, hostile, intimidating or threatening messages.

Many employers are taking advantage of software which blocks access to certain types of web-sites. Other software identifies when certain prohibited language is used in e-mail correspondence.

Why should employers be concerned? Consider that in 1997, Chevron Oil Company paid $2.2 Million to settle a sexual harassment lawsuit which was brought by a group of employees whose primary claim was that the company had allowed its internal e-mail system to be used to disseminate sexually offensive content, including a message touting "25 Reasons Beer is Better Than Women."

But employers have other reasons to monitor e-mails and the like, besides their efforts to avoid liability for such things as sexual harassment. For example, e-mail usage can result in the introduction of harmful programs such as viruses, which can harm the company's IT infrastructure. In addition, employees who become distracted by e-mails, internet usage, and the like can cause significant costs in lost productivity. E-mail misuse can also place at risk a company's intellectual property, trade secrets, and even the company's public image and good will.

2. Screening Job Applicants; Reference Checks, Credit Checks, Drug Testing, Etc.

Pre-employment screening of job applicants is an important part of any company's employment policies and procedures. Screening can not only help a company avoid hiring mistakes, but it can also help a company avoid liabilities (such as respondeat superior liability and claims of negligent hiring or retention). On the other hand, screening which actually eliminates or differentiates applicants in "protected classes" (e.g., age, disability, etc.) may expose the employer to liability for unlawful discrimination.

Reference checks and any investigations conducted or reports prepared by a third party may be "consumer reports" or "investigative consumer reports," subject to the Fair Credit Reporting Act (discussed further below).

"Googling" an Applicant or Employee. It has been estimated that at least 50 Million persons in the U.S. maintain "blog" diaries of daily activities, and at least 100 Million persons in the U.S. maintain persona web page "profiles" on social networking sites, such as My Space, Facebook, etc. Are there any limitations or special problems when an employer learns about an applicant or employee by conducting a "Google" or other internet search engine search? According to one source, roughly half of employers in the U.S. are using internet searches to "vet" job candidates.

This is understandable. According to one source from 2006, 44% of job applicants lied about their work histories, 41% lied about their education, and 23% falsified credentials or licenses. In addition, employers are interested in locating employees who "fit" within their organizations. Finally, employees will not want to hire persons who are "known" to be threats to others, with such knowledge being readily available through a simple internet search. In this sense, failure to conduct a search could lead to a claim of negligent hiring.

Because information posted on internet sources is generally considered public, and because information posted on web page "profiles" generally consists of voluntary disclosures, employers are not restricted from accessing such information. However, employers should be aware of two important caveats: first, everything located on the internet is not infallibly true and correct; and second, an employer cannot use information gathered in this manner to screen out applicants based upon membership in protected classes, such as racial groups, ethnic groups, religious persuasions, etc. Finally, because a "Google" search is likely to retrieve isolated bits of personal information, the employer who utilizes such a search risks making judgments out of context.

3. Evaluating Performance and Investigating Misconduct: Surveillance of Phone Calls and E-Mail, Searches of the Workplace, Polygraph Tests, Etc.

E-mail monitoring. It is generally well-settled than an employer may monitor an employee's use of company-provided e-mail systems and the like. But what happens when an employee has, and uses, a personal, web-based e-mail account (such as a Yahoo® account) when the employee is at work? Workers commonly use e-mail for both business and personal reasons at work.

If an employee decides to pursue a tort-type invasion of privacy claim based upon an employer's review of e-mails, the employee must establish some reasonable expectation of privacy in the communications. In the cases which have considered such claims, this has proved to be a very difficult thing for employees to so. See, e.g. United States v. Hassoun, 2007 U.S. Dist. LEXIS 3404 (S.D. Fla. Jan. 17, 2007)(in light of employer's written policies, employee had no reasonable expectation of privacy in his office computer or e-mail); Garrity v. John Hancock Mutual Life Ins. Co., 2002 U.S. Dist LEXIS 8343 (D. Mass., May 7, 2002)(employee had no reasonable expectation of privacy in folders marked "personal"); Smyth v. Pillsbury Co., 914 F. Supp. 97 (E.D. Pa. 1996)(no reasonable expectation of privacy in work e-mail, even in the absence of a written e-mail policy).

Electronic Privacy Communications Act. The Electronic Privacy Communications Act ("EPCA") protects most electronic communications, including e-mail, from interception, attempted interception, disclosure, and unauthorized access. Whether the statute applies depends upon the medium of the message, the system upon which the message is located, and whether the message is in transit or stored. Among the exceptions under the EPCA, there are three which would relieve an employer from liability for monitoring its employees' e-mails: (1) consent (which includes implied consent), (2) the "provider" exception (which applies when a company provides its own e-mail service or communications systems), and (3) the "intra company communications" exception (when the employer accesses stored communication files).

In Fraser v. Nationwide Mutual Ins. Co., 352 F.3d 107 (3d Cir. 2003), the terminated employee argued that his employer had improperly "intercepted" his e-mails which were stored on the company's central file server. The Court held that no "interception" had occurred under the EPCA.

Blogs and Internet Message Boards. What may – and what should – an employer do if it learns that an employee has posted offensive or even defamatory information on a blog or internet message board? For example, in Varian Med. Sys., Inc. v. Delfino, 113 Cal. App. 4th 273 (2003), rev'd on other grounds (yes, a California case), an employee had posted derogatory messages about certain company executives on an internet message board, including accusations of lies, mental incompetence, discrimination, stalking, and sexual references implying that one supervisor had obtained her job by granting sexual favors. What may an employer do in such circumstances, and what should an employer do? Generally, the employer may legitimately terminate the employment for business reasons and to shield itself from potential liability. In fact, if the off-duty conduct could be in furtherance of some type of sexual harassment, then the employer certainly should take strong measures.

As a caveat, the rules may be different in the context of public employment. If the employer is a government entity or agency, then the employer's actions are "government action," and the employee may argue that the employer had violated the employee's constitutional "free speech" rights. See. e.g., Richarson v. Beckon, 2008 U.S. Dist. LEXIS 29346 (W.D. Wash, 2008)(involving a teacher who was disciplined after blogging about what it was like "on the inside" in a school district).

Polygraph Tests. The use of polygraph tests for employees is governed by th federal Employee Polygraph Protection Act, 29 U.S.C. §§ 2001 et seq. ("EPPA"), which applies to most private employers. Enacted in 1988, the EPPA generally prohibits most private employers from using polygraph tests, either for pre-employment screening or during the course of employment, for most purposes. Employers may not request or demand that an employee or applicant take a polygraph test, nor may they discipline or discriminate against an employee for refusing to take one.

There are limited exceptions which would permit a prospective employer to require submission to a polygraph, such as employers in security services (such as an armored car driver or a guard) or employers involved in pharmaceutical manufacture or distributing, but even then there are restrictions on the use of the tests. In addition, with some express restrictions, an employer may require submission to a polygraph test for employees suspected or certain workplace incidents (such as theft or embezzlement) which has resulted in loss by the employer, so long as there is "reasonable suspicion," but in those cases, there are strict requirements for how the tests must be conducted. In addition, the regulations define "reasonable suspicion" as "an observable, articulable basis in fact which indicates that a particular employee was involved in, or responsible for, an economic loss." The "reasonable suspicion must involve something more than the mere fact that the employee had the potential opportunity to cause the loss.

Violations of the EPPA can result in civil lawsuits by the employee or applicant for damages, or civil monetary penalties of up to $10,000 per violation may be assessed by the Wage & Hour Division of the Department of Labor.

Workplace Searches. There may be various reasons an employee may wish to search an employee, or an employee's purse, locker, or workspace. These include suspicion of theft, suspicion of drugs, or suspicion of weapons. The "workplace" which is subject to search generally includes those areas within the employer's control, such as desks, lockers, etc. However, sometimes an employer may find itself in need to search the employee's personal items, including purses, briefcases, or automobiles. When can this be done?

The "best defense" for the employer is to remove the employee's expectations of privacy. This can be accomplished by adopting policies and explaining to employees in advance that the employer reserves the right to search all areas of the employer's own property and items of personal property which the employee may bring to the workplace. A search policy actually fits in with the employer's other policies concerning violence, drug use, and theft. Even if such policies are adopted, however, they should be used judiciously and with great care.

However, great caution should be used in implementing any search policy. Any search conducted with any degree of force or over strong objections of the employee could give rise to claims including assault, battery, and invasion of privacy. An employer should never apply or threaten physical force in order to conduct any search, and an employer should never restrain an employee from leaving, in order to avoid liability for false imprisonment. If any suspected illegal substances are found, the employer should not remove or take custody of the substance, but should contact law enforcement authorities.

In an extreme example, the court permitted an employee to maintain claims against an employer for assault, battery, and negligent infliction of emotional distress when she was strip-searched by an employer because of suspicion of theft. Hykes v. Hughes, 835 A.2d 382 (Pa. Super. 2003).

Hidden Cameras. Surveillance cameras are becoming commonplace, including at the workplace. Generally speaking, employers are permitted to monitor by surveillance camera in "public" areas. When the cameras are hidden, however, and when the surveillance is surreptitious, then the employer may open itself to a different analysis.

In fact, as one California court has held (yes, another California case. California is a "whole different world" in many employment law matters, but the reasoning of this court should not be dismissed out of hand), an employee may sue for the "intrusion upon seclusion" type of invasion of privacy where the employer has caused "hidden" cameras to be placed in an area where the employee can claim a reasonable expectation of privacy, even if there is no proof that the employer actually used the cameras and observed the employee. See Hernandez v. Hillsides, Inc., 142 Cal. App. 4th 1377 (2006). While Tennessee has not specifically adopted the "intrusion into seclusion" type of claim for invasion or privacy, the Tennessee Supreme Court seems to have implicitly conceded that such a claim may be cognizable in this State. See Givens v. Mulliken, 75 S.W.3d 383 (Tenn. 2002).

On a related note, a Florida jury trial in 2005 resulted in a $1 Million verdict in favor of two employees after a co-worker his a camera under their desk, then posted the photographs on a pornographic web-site. The jury found the employer liable on account of invasion of privacy and because of its negligence in retaining and supervising the employee who his the camera. The case was Kidder v. Ocwen Financial Corp. (no appellate reporter citation available).

4. Privacy Issues in Formal Complaint Procedures and Litigation

(This topic is subsumed in the discussion to follow).

B. HOW TO LAWFULLY CONDUCT AN INTERNAL INVESTIGATION

1. Employer Obligations re: Privacy, Confidentiality and Privilege

When an employer is aware of wrongful, discriminatory or harassing conduct by an employee, why should the employer care? Why should the employer investigate? Why should the employer do anything at all?

In the case of an employee suspected of engaging in theft, property destruction, and the like, the answer is obvious – the employer will want to put an end to the suspected behavior. In the case of suspected harassment or discrimination, the employer should care, and the employer should act, in order th avoid or limit liability. After all, in such cases the employer may face two distinct types of liability – either vicarious liability imposed because of the actions of its employee-agents, or direct liability for its own acts or omissions in failing to prevent or mitigate the harassing or discriminatory acts. (It is beyond the scope of this article to discuss the intricacies of harassment liability under the Faragher and Ellerth doctrines).

Consider Pollard v. E.I. DuPont De Nemours, Inc., 2005 U.S. App. LEXIS 11949 (6th Cir. 2005), which involved an employee's wrongful discharge claims, which also included claims for intentional infliction of emotional distress, under Tennessee law. The employee was awarded a judgment for $2.2 Million in compensatory damages and $2.5 Million in punitive damages, and the Court of Appeals affirmed the award. The basis for the punitive damages award under Tennessee law was the employer's recklessness, i.e., its conscious disregard for the substantial ans unjustifiable risk of harm to the employee. The company knew what was happening to the employee (i.e., serious harassment), but the company did almost nothing to stop the conduct, and it barely investigated the employee's complaints. The company was not held vicariously liable for the actions of its employees; it was held directly liable for its own failure to act.

Is an Investigation Warranted? Not all employee complaints require a full-fledged investigation. Many times a complaint can be resolved by explaining the company policy, correcting incorrect information, or simply by listening. The key in deciding whether a full-fledged investigation is necessary is to determine whether the employer needs to know more facts than the complaining employee can provide before reaching a conclusion.

On the other hand, an employer should not simply decide not to investigate due to inconvenience, time, trouble or expense considerations. The employer should consider whether obtaining facts or different sources (such as witness interviews, reviewing documents, etc.) would be helpful. Does the complaining employee indicate that other employees are involved? Would a review of documents, such as internal company e-mails, help resolve inconsistencies or provide context?

In the context of sexual harassment investigations and the Faragher and Ellerth defenses, an employer may be required to reasonably and prudently investigate certain types of claims, and then to take appropriate remedial actions, in order to gain the benefit of a possible affirmative defense.

The Basics of the Investigation. The basic considerations for the employer who investigates include:

Be prompt. Do not unduly delay undertaking the investigation.
Carefully document. Keep careful notes identifying who, what, where, when and why each step of the investigation was undertaken.
Have one person in charge of the investigation and responsible for coming up with the results or conclusion.
Early in the process, identify all persons with relevant information.
Act to preserve all documentary evidence.
It is highly suggested to work with legal counsel from the beginning. This may protect some of the investigative materials from automatic discovery by the complaining employee or counsel (although, if the employer intends to rely upon the fact that it conducted a prompt investigation as a partial defense, these materials might have to be shared).
Remember "Rule No. 1" for investigations: the investigator's first obligation is to get the facts straight, not to build a defense.

Promises of Confidentiality. The investigator should be considerate of the rights and interests of the accuser and the accused. This is somewhat of a balancing act – the investigator should assure the complaining party that the matter will be handled with proper discretion, but avoid promising absolute confidentiality. This is because, if the employer has deemed that an investigation is warranted, then the employer will have a corresponding obligation to take reasonable, prompt and effective actions following the results of the investigation. This may require making certain disclosures. In addition, it may be necessary for the employer to disclose certain information to the accused, or to other witnesses, simply in order to permit a complete response.

On a related note, sometimes an employee whose complaint prompts an investigation will ask that the employer "drop everything" and take no action. This is not uncommon at the conclusion of the initial interview, once the complaining employee gets everything off his or her chest and realizes that certain wheels have been set in motion. As with requests for privacy and confidentiality, the employers obligations are to conduct a fair and accurate investigation, and if the results warrant some sort of action by the employer, then that action should be taken. It may help comfort the complaining employee to explain that the company will not permit retaliation for making the complaint.

A Basic Investigation Protocol. Although each investigation should be tailored according to the unique facts and needs, the following is a generic, basic investigation protocol (which is geared toward a sexual harassment investigation):

(1) before the interviews begin:

keep in mind: how will the results of the investigation (including documents, decisions, and witnesses) look two years from now if we are involved in a trial?
take a preliminary look at documents, including

personnel file of the accuser
personnel file of the accused
organizational chart (chain of command)
any EEOC or similar charges involving:

similar alleged conduct
the same accused harasser
the same accuser
documents reflecting the accuser's attendance, transfer requests, etc.

prepare a preliminary list of all employees who would be in a position to know, if the allegations are true

(2) interviews:

keep separate documents/pages for each interview
at the top, put the date, who was present, where it was conducted
if appropriate, ask for permission to tape record; however, this is not always advisable because it can intimidate witnesses or make him or her hesitant
have a second employer representative present
do not put assumptions, interpretations, beliefs, etc. on the interview notes themselves
pin the witness down to facts regarding specific events
distinguish between personal knowledge and second-hand information
generally try to use open-ended questions
try to save "unfriendly" or embarrassing questions until the end
do not be afraid to ask the difficult question

(3) interview the accuser first, and promptly:

assure the accuser that there will be no retaliation for making the complaint
tell the accuser that accuracy is critical and honesty will be expected
instruct the accuser not to talk about the ongoing investigation with others
tell the accuser that the employer is investigating the complaint, and if it inappropriate conduct is found to have taken place, the employer will take prompt, immediate corrective action
prepare a written account of the complaints, ask the accuser to review it, change or add to it as necessary, and sign it (note: the accuser cannot be compelled to sign)
get all documents the accuser has which support the charges
ask the accuser to name all persons who would know about the alleged conduct including everyone with whom the accuser has talked
go over the accuser's understanding of company policy regarding harassment, including the complaint procedure
confirm with the accuser when, how and who was told about the conduct on behalf of the company
ask what action the accuser wants the company to take
follow up with the accuser from time to time, both to get additional information, and to advise him or her of the general status of the investigation

(4) interview the alleged wrongdoer:

he or she may be named individually in a lawsuit, so he or she could have a claim to have independent counsel present
explain that an allegation has been made, and that the company is duly investigating it
explain that in order to permit his or her response, it will be necessary to disclose who made the allegation, but the company takes very seriously the complainant's right to be free from reprisal or retaliation of any type
explain that every effort will be made to protect his or her rights, as well
instruct the alleged wrongdoer not to talk with others about the investigation
first generally ask him or her to describe the interactions between the accuser and the alleged wrongdoer including:

have gifts, cards or notes been exchanged?
has there been a dating, social or sexual relationship?
has the accuser initiated or participated in any sexual discussions, jokes, gestures, etc.?
has the accuser ever expressed displeasure with anything the alleged wrongdoer has done or said?

disclose the specific alleged incidents in detail, to permit him or her a full opportunity to verify, refute, or explain them
ask who else may have corroborating facts
explore possible reasons the accuser may have to falsify or fabricate
give an opportunity to provide alibis or mitigating information
request all relevant documents

(5) interview other witnesses:

particularly if they are also alleged to be victims of harassment or a hostile work environment
first explain generally the basis for the investigation
explain that the witness has the right to be free from retaliation for participating in the investigation
explain the importance of confidentiality of the information discussed
explain that names will not be discussed unless the witness is supposed to have specific knowledge of specific events
instruct the witness not to discuss the investigations with others
ask more in generalities, rather than specifics, if possible

(6) special problems:

even if the accuser fails or refuses to fully cooperate, the burden remains with the employer to fully investigate
"he said, she said" issues

often credibility is a key to the investigation
if necessary, return to witness interviews to discuss discrepancies, obtain corroboration of disputed facts

(7) reach a conclusion and prepare a report outlining the results of the investigation

(8) make a recommendation

(9) act to implement the final decision

2. Electronic Surveillance and E-Mail Files

(Please refer to the section above pertaining to surveillance and electronic monitoring).

3. The Effect of the Fair Credit Reporting Act

The federal Fair Credit Reporting Act ("FCRA"), as amended, 15 U.S.C. §1681 et seq., directly affects a company's ability to obtain background information on applicants and current employees through contracts with consumer reporting agencies. The FCRA was actually enacted in 1970 to promote the accuracy, fairness and privacy of information obtained by credit reporting agencies, particularly with respect to consumer credit information. However, the Act was interpreted to apply to employers who use consumer reporting agencies in (1) conducting pre-employment background checks, (2) investigating claims of harassment, discrimination or wrongdoing, and (3) investigating suspected workers' compensation abuse or fraud.

Even in these situations, however, employers should bear in mind that the FCRA only applies when outside, third parties ("consumer reporting agencies") are used to collect the information, and it does not apply to investigations conducted solely by the employer, using the employer's personnel and resources. "Consumer reporting agencies" include almost any third party, business or agency hired by the employer to help obtain information about the employee or applicant.

In 1999, the Federal Trade Commission issued the "Vail Letter," which was an interpretation of the FCRA in the context of an employer's investigation of harassment complaints. The "Vail Letter" concluded that such reports would be "investigative consumer reports," which meant that the employer would be obligated to (1) provide the target employee notice of the investigation, (2) request the target employee's permission if any part of the investigation was to be conducted by an outside third party, and (3) provide the target employee an unedited copy of the investigative report and an opportunity to refute the investigator's findings before taking any adverse employment action. This proved to be not only a burden for the employer, but it also tended to compromise the integrity of the investigations.

In December, 2003, Congress amended the FCRA by passing the "Fair and Accurate Credit Transactions Act" ("FACT"), which addressed the FTC's interpretation in the "Vail Letter" and clarified the impact of the FCRA upon workplace investigations. With the passage of FACT, the FCRA now specifically excludes from the definition of consumer report "communications made to employers in connection with an investigation of: (I) suspected misconduct relating to employment, and (ii) compliance with federal, state, or local laws and regulations, the rules of a self-regulating organization, or any preexisting written policies of the employer."

Although with the passage of FACT, employers have more leeway in the conduct of investigations, employers are required to take steps to protect the employee's privacy. For example, a workplace investigation report may not be disclosed to anyone except the employer (or its agent), state and federal agencies, officers, or as otherwise required by law. In addition, FACT includes a " disposal rule" which mandates how consumer information gathered for a business purpose must be maintained and then disposed of.

In addition, while the employer is no longer obligated to give the employee who was the subject of an investigation an unedited copy of the report before taking adverse employment action, the employer is required to give the employee a summary of the report, if adverse employment action is taken based in part upon the results.

Penalties for non-compliance with the FCRA, as amended, can be substantial. Willful noncompliance can subject the violating party to actual damages up to $1,000, punitive damages, and attorney's fees. Negligent violations can result in an award of the employee's actual damages and attorney's fees.

View all articles by Bob E. Lype