13.2 Internal Investigations and Post-Employment Records

13.2 Internal Investigations and Post-Employment Records

The rest of competency IV.B is what happens when monitoring, a complaint, or a performance file turns into an investigation, and then what happens when the employment relationship ends. The exam skill is sequencing: collect only what the investigation needs, know when a third party triggers the Fair Credit Reporting Act (FCRA), balance three sets of people, and close the file without over-retaining medical or investigative material.

Collecting and handling investigation data

Start with a written scope: what is alleged, which systems and dates are in play, who is the accused, who is the complainant, and who are the witnesses. Pull the company mailbox, badge logs, CCTV, and device images that the written monitoring policy already covers. Do not expand into personal webmail, personal-cloud photos, or off-duty location history unless a separate legal basis exists. Mark the file confidential, limit the viewer list, and keep it out of the ordinary personnel file. An investigation file that is copied into every manager’s desk drawer is how a defamation or retaliation claim is built.

Interview notes should separate facts from conclusions. Do not record an interview in an all-party-consent state without the required consent. Do not promise a complainant absolute confidentiality that the employer cannot keep if a government charge, a union proceeding, or a lawsuit requires disclosure.

When a third party is a CRA — FACTA’s investigation exception

Sections 12.3 and 9.1 taught the employment consumer-report sequence: stand-alone disclosure, written authorization, a pre-adverse copy of the report plus the Summary of Rights, then an adverse-action notice. In 1999 the Federal Trade Commission’s Vail Letter applied that sequence to a third-party investigation of workplace misconduct. Employers said the advance notice would tip off the subject.

Congress answered in the Fair and Accurate Credit Transactions Act of 2003 (FACTA). The investigation exclusion is now 15 U.S.C. § 1681a(y) (FACTA enacted it as subsection (x); the Dodd-Frank Act redesignated it when it inserted Bureau definitions). A communication that would otherwise be a consumer report is excluded if all of the following are true:

Subsequent disclosure still exists. After taking any adverse action based in whole or in part on that communication, the employer shall disclose to the consumer a summary containing the nature and substance of the communication. Sources of information acquired solely for what would have been an investigative consumer report need not be disclosed. 15 U.S.C. § 1681a(y)(2). That is the residual notice duty. It is not the pre-investigation authorization packet, and it is not “no FCRA duties at all.”

If the employer’s own HR or legal staff runs the investigation and no consumer reporting agency (CRA) is used, the FCRA is not in the picture. Using outside counsel as a legal advisor is not automatically a CRA engagement; regularly assembling consumer information for third parties is what makes a CRA under 15 U.S.C. § 1681a(f).

Worked scenario. A bank hires a licensed investigations firm that regularly prepares workplace-misconduct reports. The allegation is expense-account fraud, not a credit score. The firm interviews coworkers and reviews ledgers and emails. No stand-alone FCRA hiring disclosure is required before the interviews. The bank fires the employee based on the report. The bank must then give a summary of the nature and substance of the report. It may withhold the names of coworkers who spoke solely for that investigation. If the same bank had pulled a credit report to decide a promotion, § 1681a(y) would not apply.

Documenting performance, and balancing three sets of rights

Performance documentation is not an FCRA event. It is an employment-file event. Date the observation, stick to job-related facts, and give the employee a chance to respond when policy or a contract requires it. A file that only starts the week someone complains looks retaliatory.

The accused has an interest in a fair, reasonably prompt inquiry and, in a union or public-sector shop, in whatever Weingarten or civil-service process applies. The complainant has a right to be free of retaliation (Title VII, and many state laws) and to a workplace that the employer actually remediates. Witnesses have a right not to be punished for concerted activity (National Labor Relations Act (NLRA) § 7) and not to have their statements sprayed across the department. An employer confidentiality instruction that would reasonably chill Section 7 activity is the National Labor Relations Board problem; a tailored instruction that protects the integrity of a discrete harassment investigation is the other pole. Do not write a blanket “tell no one or you will be fired” rule and call it privacy compliance.

Termination, transition, and what to collect at the door

On the last day, collect what the employer owns and only the work slice of what the employee owns.

Continuing confidentiality and trade-secret agreements survive termination if they are reasonable in scope. The Defend Trade Secrets Act of 2016 (DTSA), 18 U.S.C. §§ 1836–1839, is the federal civil trade-secret statute. Confidentiality agreements should include the DTSA whistleblower-immunity notice if the employer wants exemplary damages and attorney’s fees. A noncompete is a state-contract problem, not a privacy statute; do not use “privacy” to invent a federal noncompete.

References, service letters, and defamation

A prospective employer’s reference call is a disclosure of employment information. A truthful, good-faith statement of job title, dates, and a documented reason for separation is generally protected by a qualified privilege. A false statement of fact published to a third party is defamation. “I would not rehire” is usually opinion; “she stole $40,000” is a fact that must be true.

Some states impose a service-letter statute. Missouri Revised Statutes § 290.140 is the usual CIPP example: on written request, a corporation that has employed the person for at least ninety days must issue a letter stating the nature and duration of the employment and the true reason employment ended. Failure is a statutory wrong, separate from defamation. Do not invent a federal service-letter duty. Do not refuse a required service letter because the investigation file was confidential; state the true reason without dumping witness names into a letter that the employee will show to the next employer.

Do not over-retain medical or investigation files

The ADA’s medical-confidentiality rule, 29 C.F.R. § 1630.14, continues after the last day. Medical information stays in a separate medical file, on a need-to-know list (supervisors get work restrictions, not diagnoses; first-aid and government investigators get what the regulation allows). Do not staple the occupational-health report into the personnel file “because we closed the case.”

EEOC recordkeeping, 29 C.F.R. § 1602.14, generally requires personnel or employment records to be kept one year from the making of the record or the personnel action, whichever is later, and if a charge is filed, until final disposition. That is a floor, not a reason to keep a harassment investigation, a fitness-for-duty report, or a wellness questionnaire forever. Investigation files should have their own retention trigger (close of investigation plus the limitations period, or the charge-disposition rule) and a destruction step. Over-retention turns a closed inquiry into a standing source of unauthorized internal access, a broader discovery production, and a state-law medical-privacy problem.

OSHA’s access rule, 29 C.F.R. § 1910.1020, is the exception that looks like over-retention but is not: employee exposure records are generally kept 30 years, and occupational medical records for the duration of employment plus 30 years. That is a safety-records rule from section 12.2, not permission to leave an HR investigation in the same drawer.

Exam traps

• FACTA’s § 1681a(y) exception is not “the FCRA never applies to investigations.” It is “no advance hiring-style notices if the conditions are met; a post-adverse summary is still required.”
• Credit-purpose reports never enter § 1681a(y).
• A private employer’s investigation is not a Fourth Amendment search.
• Truthful references and service letters can coexist with a confidential investigation file; dumping the file is the miss.
• BYOD collection is container collection, not a full personal-device seizure.
• Medical and investigation files do not merge into the personnel file at termination.