The Fair Credit Reporting Act (“FCRA”) requires an organization requesting a consumer report to notify the target of the organization’s intent to obtain the report. Some internal auditors have expressed concern that compliance with the FCRA requirements gives targeted individuals the opportunity to alter or destroy evidence.
The FCRA defines “consumer report” to include background investigations reports, personnel and human resources data collection, witness statements, and any other report or collection of data pertaining to an individual. And, under the FCRA no individual or organization may obtain a consumer report without first receiving the subject’s authorization before proceeding.
Internal auditors may not like alerting targeted individuals by seeking their authorization to investigate, but FCRA compliance does not mean disaster. FTC opinions make it clear that organizations can obtain blanket authorization from their employees, provided that such authorization is specific, separate, and includes a list of the employee’s rights.
Employers concerned with running effective internal investigations can meet authorization requirements by having all new employees sign an investigative authorization form upon hiring, indicating that the employee agrees to the company conducting background checks, credit checks, and similar reports containing personal information at various points throughout their employment. This authorization should be distinct from the authorization to conduct a criminal background check as part of the hiring process.
The authorization form should also include an explanation of the employee’s right to review and respond to any such report, and explain their appeal rights. If a company intends to take any adverse action premised on the report, it should disclose the report to the employee along with the name of the reporting agency. The investigator’s report is also potentially discoverable by the employee, so the company must be sure its reporting procedures are current, and that its reports are factual, accurate, complete, and balanced.
A well organized company with internal procedures that mirror current best practices can comply with the FCRA and still complete thorough, effective internal investigations.