12.2 FTC, DOL, EEOC, NLRB, and OSHA

12.2 FTC, DOL, EEOC, NLRB, and OSHA

CIPP/US BoK 2.6.1 competency IV.A PI2 asks you to identify the federal agencies that share workplace privacy and to know which slice each one actually owns. The trap is treating every employee complaint as an FTC privacy case, or treating OSHA as a general privacy regulator because it uses the word "records." Route the fact pattern by subject matter, not by the word "privacy."

Federal Trade Commission

The Federal Trade Commission (FTC) enters the workplace through two doors.

Door one is the Fair Credit Reporting Act (FCRA). When an employer uses a consumer report from a consumer reporting agency (CRA) to hire, promote, reassign, or fire, the employer is an FCRA user. The FTC's employer guidance, Using Consumer Reports: What Employers Need to Know, is the exam's operational checklist: a stand-alone written disclosure that a report may be used for employment purposes (not buried in the application), written authorization, a pre-adverse-action packet (copy of the report plus A Summary of Your Rights Under the Fair Credit Reporting Act) before the decision becomes final, and an adverse-action notice after the decision. The Consumer Financial Protection Bureau (CFPB) now writes the Summary of Rights form and shares FCRA interpretation, but CIPP/US Domain IV still treats the FTC as the workplace-privacy agency for hiring-report notices. Domain II covers the rest of the FCRA; here you only need the employment-use path.

Door two is deception about monitoring. Section 5 of the FTC Act prohibits unfair or deceptive acts or practices. An employer that tells applicants or workers "we do not read email" or "this wellness app is anonymous" while doing the opposite has an FTC deception problem, even if no CRA is involved. The FTC is not the agency for polygraphs, disability inquiries, or union surveillance.

Department of Labor — Wage and Hour Division

The Department of Labor (DOL) Wage and Hour Division (WHD) enforces the Employee Polygraph Protection Act of 1988 (EPPA). WHD Fact Sheet #36 is the official short form. EPPA generally prohibits a private employer from requiring, requesting, suggesting, or causing an employee or applicant to take a lie-detector test, from using the results, and from retaliating against someone who refuses. A lie detector includes a polygraph, voice-stress analyzer, and similar devices. Employers must post the EPPA notice. Federal, state, and local governments are excluded. Narrow polygraph-only exceptions exist for certain security-service applicants, certain pharmaceutical applicants with direct access to controlled substances, and current employees reasonably suspected in an ongoing economic-loss investigation; those exceptions are taught in section 12.3. WHD brings injunctions and civil money penalties; the employee may also sue in court within three years.

DOL is a large department. WHD is the EPPA desk. The Occupational Safety and Health Administration (OSHA) is also inside DOL but is a different agency for exam purposes — do not send a polygraph complaint to OSHA, and do not send a lead-exposure records request to WHD.

Equal Employment Opportunity Commission

The Equal Employment Opportunity Commission (EEOC) owns the anti-discrimination workplace-privacy statutes:

A charge of discrimination is generally due within 180 days (often 300 days when a state or local fair-employment agency exists). If the fact pattern is "they asked about my disability on the application," "they ran a credit screen that knocks out a protected class," or "they used my mother's cancer history," the agency is the EEOC, not the FTC.

National Labor Relations Board — current 2025–2026 doctrine

The National Labor Relations Board (NLRB) enforces the National Labor Relations Act (NLRA). Section 7 protects the right of most private-sector employees to engage in concerted activity for mutual aid or protection — discussing wages, complaining together about scheduling, circulating a petition, or forming a union — with or without a union. Supervisors, most public employees, and true independent contractors are generally outside the NLRA.

Longstanding Board law, not a 2022 memo, is what you should teach in 2026:

• An employer may not spy on, photograph, or otherwise surveil employees engaged in protected concerted activity.
• Creating the impression of surveillance ("we know who posted on that wage channel") can be an unfair labor practice even if no one was actually watching.
• A social-media or electronic-communications rule that a reasonable employee would read as banning discussion of wages or working conditions can be unlawful. That is why a unionized — or organizing — workforce changes the social-media analysis even when the same policy would be only an AEP issue for a purely individual rant.

What you should not teach as current doctrine: former General Counsel Jennifer Abruzzo's GC Memorandum 23-02 (31 October 2022) urged a new framework under which intrusive electronic monitoring and algorithmic management would be presumptively unlawful if they would tend to interfere with Section 7 activity, with a disclosure remedy if the employer's business need won. That memorandum was prosecutorial guidance, not a Board decision. On 14 February 2025, Acting General Counsel William B. Cowen issued GC 25-05 and rescinded GC 23-02 (along with several other predecessor memos). As of August 2026, the exam-safe statement is: Section 7 and the traditional surveillance / impression-of-surveillance rules still apply; the 2022 presumptive-violation monitoring framework is not current General Counsel doctrine and was never a Board holding. Do not treat Stericycle, a named 2022–2024 GC advice memo, or GC 23-02 as the 2026 electronic-monitoring test.

Occupational Safety and Health Administration

OSHA is a workplace-safety regulator. It is not a general privacy agency. Its privacy-adjacent work is almost always about hazard monitoring and occupational records, not about email, social media, or hiring algorithms.

• OSHA standards can require exposure monitoring (air sampling, noise dosimetry, radiation badges) and medical surveillance for specific toxins.
• 29 C.F.R. § 1910.1020 gives employees and their designated representatives a right of access to relevant exposure and medical records. Occupational medical records are generally retained for the duration of employment plus 30 years. The employer must provide access at no cost, typically within 15 working days of a request.
• Exposure records include workplace monitoring of toxic substances or harmful physical agents. They do not include ordinary drug- or alcohol-test results used to assess employee substance use.
• When a clinician performs OSHA-required surveillance, the written opinion to the employer should not reveal diagnoses unrelated to occupational exposure.

Send OSHA a complaint about unmonitored silica or a refused exposure-file request. Do not send OSHA a complaint about a background check, a polygraph, or a social-media password demand.

Agency → typical complaint

Scenario. A fulfillment center uses indoor GPS badges, requires a pre-offer medical questionnaire, pulls CRA background reports, and disciplines two employees who started a group chat about heat-illness breaks. That is four agencies, not one "privacy" case: EEOC for the pre-offer medical questions (and for any Title VII impact in how badges are assigned), FTC for the FCRA user steps, NLRB for discipline aimed at concerted heat-safety talk, and OSHA if the underlying issue is heat or exposure records. The CIPP/US skill is to unbundle the file.