It should be old hat by now: Employers who use a third party to conduct a background check on an applicant or employee for employment purposes must comply with the Fair Credit Reporting Act (FCRA). But what many employers do not know, or may have forgotten, is that the Fair and Accurate Credit Transactions Act (FACTA) also imposes upon them some obligations when conducting a background investigation. (A background of the FCRA’s general requirements for employers is necessary to understand the FACTA’s implications, which we have outlined for you here.)

So what is the FACTA? As of December 4, 2013, the FACTA is a 10-year-old law enacted by Congress to combat identity theft. But that is not all it did. Pub. L. 108-159, 117 Stat. 1952 (amending the FCRA). When passed in 2003, it was hot news. But now, 10 years later, many employers have forgotten about it, or were not around when it was passed to even know about it. This blog post will discuss the history of FACTA, define what it requires, what impact it has had on employers in the last 10 years, and how it impacts employers now.

The FACTA amended the FCRA in a number of ways. Most relevant to employers, it fixed a problem that required employers who retain a third party to investigate workplace misconduct to comply with the FCRA’s four-step process — the disclosure, authorization, pre-adverse notice and adverse notice procedures. The problem arose when the Federal Trade Commission (FTC) (the administrative agency that had jurisdiction over the FCRA until jurisdiction was transferred to the Consumer Fraud Protection Bureau (CFPB)) issued the controversial 1999 Vail Letter that concluded that an investigation conducted by an employer’s outside legal counsel fell within the scope of the FCRA protections. In other words, before the FACTA, the FTC took the position that in order to comply with FCRA, employers using a third party to investigate employee misconduct had to obtain that employee’s written consent prior to obtaining a report and then provide a full copy of the report to the employee once the investigation was concluded.

This is where the FACTA stepped in with its common sense exception to the FCRA by amending the FCRA to exempt from the definitions of a consumer report and investigative consumer report any report that otherwise would fall within that definition if:

  • The communication is made to an employer in connection with an investigation that concerns either: (1) suspected misconduct relating to employment, or (2) compliance with federal, state or local laws and regulations, the rules of a self-regulatory organization (defined in section 78c(a)(26) of the law and any entity established under Title I of the Sarbanes-Oxley Act of 2002), or any preexisting written policies of the employer;
  • The communication is not made for the purpose of investigating a person’s creditworthiness, credit standing, or credit capacity; and
  • The communication is not provided to any person except: (1) the employer or an agent of the employer; (2) any federal or state officer, agency or department, or any officer, agency or department of a unit of general local government; (3) any self-regulatory organization with regulatory authority over the activities of the employer or employee; (4) as otherwise required by law; or, (5) pursuant to Section 1681f of the FCRA, which allows a consumer reporting agency to disclose personal identification information to a government agency.

15 U.S.C.1681a(y)(1).

So, what does this mean for employers? Employers who engage a third party to investigate workplace misconduct no longer have to provide advance notice to the employees under investigation, obtain their prior consent, or disclose the contents of the investigator’s report prior to taking adverse action based on the report.

However, employers still have some obligations to employees when they have an outside person or agency do an investigation under the FACTA. They must provide some summary information, but they do not have to provide even this information unless and until they take an adverse action. The law provides:

After taking any adverse action based in whole or in part on a communication described in paragraph (1), the employer shall disclose to the consumer a summary containing the nature and substance of the communication upon which the adverse action is based, except that the sources of information acquired solely for use in preparing what would be but for subsection (d)(2)(D) of this section an investigative consumer report need not be disclosed.

15 U.S.C.1681a(y)(2).

The key things for employers to remember are: (1) third party investigators do not have to list the names of the people they interviewed or attribute corroboration of facts to certain individuals, but they must include a summary of the nature and substance of the communication that the adverse action is based upon; (2) this information must be provided to the employee, but this disclosure does not need to be made until after adverse action has been taken; and (3) the employer does not have to provide the employee a copy of an investigative report, just the summary.

What seems to have plagued some employers since the FACTA’s enactment is the fact that the FACTA has too many undefined terms. For example,

  • The FACTA applies to communications that concern “any preexisting written policies of the employer,” but what preexisting policies are sufficient? Does this include an employee handbook statement that provides language to the effect, “ABC Company will investigate allegations of discrimination, harassment and other employee misconduct,” or is something more required?
  • Does the FACTA cover any inquiry by a third party into employee misconduct, or is a higher level of review required before the actions of a third party become covered “investigations” under the FACTA?
  • What type of “investigations” are covered under FACTA? Does this include investigations into just on-duty conduct, or is off-duty conduct also included?
  • While employers have to disclose the nature and substance of a report if the employer uses it in whole or in part to take an adverse employment action, does this summary report have to take a certain form? Can it be oral?
  • While the FACTA restricts distribution of the summary report to “the employer or an agent of the employer,” the FACTA does not define who is an “agent.”

As you can see just from this small list of examples, the FACTA left open a lot of unanswered questions. While the cases in this area are severely limited, it appears that the federal district courts are inclined to read the FACTA exceptions broadly. Here’s how the federal district courts have weighed in.

An “Investigation” Into “Employee Misconduct” May Extend to “Off-Duty” Conduct and to Conduct Even After the Employee Has Been Terminated.

In Millard v Miller, No. 05-C-103-S, 2005 U.S. Dist. LEXIS 16809 (W.D. Wis. Aug. 9, 2005) the court interpreted “investigation” extremely broadly and found that an employer’s investigation into an employee’s off-duty activity to determine if plaintiff made false misrepresentations regarding her workers’ compensation claim even after the employee had been terminated from employment was subject to the FACTA’s exclusion.

In Millard, Plaintiff advised her supervisor that she had injured her back at work and was unable to work one day after receiving a negative performance review. Plaintiff filed a workers’ compensation claim, which was denied. Plaintiff was eventually terminated because she had exhausted her available leave time. During the course of her workers’ compensation claims proceedings, plaintiff delayed her independent medical examination based on her representation that she was traveling to visit relatives at the time of the examination. Suspecting that plaintiff lied to obtain the delay so she instead could go shopping, the defendants sought plaintiff’s credit report to determine plaintiff’s credit card issuers so they could subpoena their records. Defendants did not seek plaintiff’s permission to obtain the report or disclose that they were obtaining a report for employment purposes. Nevertheless, defendants obtained a copy of plaintiff’s credit report and provided it to the workers’ compensation insurer, which was used to argue that workers’ compensation benefits should be denied.

Plaintiff brought suit claiming defendants obtained a consumer report on her without complying with the FCRA. Defendants sought to exclude their procurement of the report under the FACTA’s “suspected employment misconduct” exception. Plaintiff countered arguing that the exception was inapplicable because the report was not obtained to investigate “employment misconduct” because it occurred long after her employment was terminated and did not relate to “compliance with Federal, State, or local laws and regulations.” The court did not find either argument viable and specifically noted that the FACTA is not limited to “employment misconduct” but is drafted more broadly to include any misconduct “related to employment.” Any reasonable interpretation of this broader phrase includes conduct occurring in the workers’ compensation context because a workers’ compensation claim by definition relates to employment. As a result, misconduct in the making or prosecuting of the claim must relate to employment. In addition, defendants believed and intended to prove that plaintiff made misrepresentations in violation of the workers’ compensation statute and administrative procedures and hoped to use the information to deny or limit plaintiff’s workers’ compensation claims because, under applicable state law, workers’ compensation recovery can be limited for a claimant who obstructs a medical examination. Since the investigation was targeted at demonstrating obstruction, it fell within the parameters of FACTA.

The plaintiff also argued that defendants’ conduct in providing the report to the workers’ compensation insurer was outside the protection of the FACTA because the insurer was not “an agent of the employer.” The court did not bite on this argument either and found that the insurer was representing the employer’s interest as well as its own in seeking to avoid workers’ compensation liability. Because defendants were not obligated to comply with the permission and notice requirements of the FCRA by virtue of the FACTA exclusion, the court awarded summary judgment in defendants’ favor.

Suspected Employee Misconduct Is Not Required to Trigger the FACTA Exception

In Martin v. First Advantage Background Services Corp, 877 F.Supp.2d 754 (D.Minn. July 13, 2012) the court held that a consumer background report obtained on a re-employed employee that revealed a negative item and disqualified the employee from continued employment was covered under the exception because, even though the report was not ordered to address allegations of suspected employee misconduct, the report was used in connection with an investigation as to the employer’s compliance with laws, regulations, or preexisting written internal policies and was sufficient to trigger the exemption.

In Martin, the plaintiff had previously worked for and later been re-employed by the employer. The employer ran a background check three months after plaintiff’s re-hire which revealed that the plaintiff had been charged with impersonating an officer. Defendant terminated plaintiff, who sued under the FCRA arguing non-compliance. Defendant countered, arguing that the FACTA exception applied and, therefore, it did not have to comply with all of the FCRA’s requirements. Plaintiff objected and argued that the background report was not obtained in connection with suspected employee misconduct meaning the FACTA exception was not triggered.

The district court read the FACTA broadly and found that the background check was part of an investigation looking into the employee’s compliance with federal laws and regulations concerning those working for financial institutions and to ascertain plaintiff’s compliance with the defendant’s handbook policies requiring termination of employees who do not meet background screening requirements or those of the Financial Institutions Reform, Recovery and Enforcement Act. With that, the court rejected plaintiff’s position that the FACTA exemption applied only to investigations of employee misconduct because the statute also expressly includes an exemption relating to compliance with laws, regulations, and internal policies. Thus, the court concluded that a report received and used in connection with an investigation into the employer’s compliance with laws, regulations, or preexisting written internal policies is sufficient to trigger the FACTA exemption.

Martin demonstrates the value of ensuring that background-screening policies specify both the statutes and procedures that serve as the basis for the screening and gives employers a helpful tool when ordering and using background reports to comply with internal policies and with legal compliance obligations.

The FACTA Exception Can Be Triggered Even When the Employer’s Motive For Ordering a Background Report are Less Than Pure.

In Pearce v. Oral & Maxillofacial Assocs., LLC, No. CIV-10-0705-HE, 2010 U.S. Dist. LEXIS 133430 (W.D. Okla. Dec. 16, 2010) the plaintiff filed a discrimination charge against her employer. After obtaining a finding from the agency with which the plaintiff filed the complaint, the employer re-assigned her to menial duties. Plaintiff later filed a retaliation claim and the employer engaged a third party to investigate plaintiff’s allegations. Plaintiff claimed that the investigation was done to embarrass and intimidate her and that defendants failed to provide her with a copy of the report upon her request. Defendant moved to dismiss Plaintiff’s FCRA claims for failure to state a claim on the grounds that the investigative report was excluded under the FACTA.

The court found that the investigative report was not a consumer report and therefore all of Plaintiff’s FCRA claims were dismissed except for her claim against her employer for its failure to provide a summary of the report. The court reasoned that because the employer ordered the report to investigate the plaintiff’s allegations of misconduct it fell within the exemption and that the employer’s alleged ulterior motives for ordering the report did not affect the applicability of the exemption.

So, did the court really mean for this result? Well, it appears so. The court revisited the issue the next year in Pearce v. Oral and Maxillofacial Associates LLC, No. CIV-10-0705-HE, 2011 U.S. LEXIS 37631 (W.D. Okla. April, 6, 2011) and concluded in granting defendants’ motion to dismiss on a pre-emption issue:

Although the explicit legislative history is somewhat thin, it appears clear that Congress concluded the application of the various FCRA requirements to investigations of workplace misconduct would interfere with those investigations and, among other things, discourage the use of third-party organizations or individuals in conducting such investigations….Congress thus indicated a clear intention to protect employee investigations from the application of certain FCRA requirements. It did, however, attempt to strike a balance with the employee’s interest in knowing information about him or her that had been obtained or considered, by providing for limited disclosure to the employee. If a third-party investigation contributes to some adverse action being taken against the employee, then the “employer” must thereafter disclose to the “consumer” a “summary containing the nature and substance” of the information upon which the adverse action was based, but excluding certain source information. 15 U.S.C. § 1681a(x). In sum, the means Congress chose to “protect the investigation” included (1) eliminating any requirement of prior notice to or consent from the employee, (2) requiring disclosures to be made only if (and after) the involved information contributed to some adverse action against the employee, (3) providing that any disclosures would be limited (i.e. a “summary” and excluding certain source information), and (4) imposing the disclosure requirement only on the “employer.”


  • Remember the FACTA. While it Imposes Obligations on Employers, It Also Provides Helpful Exceptions.
    • The Obligations: The FACTA cleared up the mess the Vail letter created and made it clear that employee misconduct investigations that are conducted by a third party investigator are not subject to the FCRA’s disclosure and authorization requirements. If an employer takes an adverse action against an employee based in whole or in part on anything contained in a covered report, the employer must disclose to the employee a summary containing the nature and substance of the communication upon which an adverse action is based after taking the adverse action.
    • The Helpful Exceptions: As demonstrated by the cases discussed above, district courts thus far have interpreted the FACTA broadly and have allowed employers to argue that the FACTA exceptions apply in various circumstances, including to investigations of off-duty employee misconduct, to ensure the employer’s compliance with other laws/regulations and internal policy even in the absence of an allegation of employee misconduct. So, employers faced with a FACTA non-compliance lawsuit would be wise to at least review the FACTA and determine if it may apply. The district court cases cited herein are not binding on most courts, but can be used by employers as supporting authority.
  • Not so fast! Remember, the FACTA has nothing to do with routine background checks, and employers must still comply with the FCRA’s disclosure, authorization and notice requirements in regards to most background checks. The FACTA is the exception, not the rule. Given the increase in FCRA class lawsuits, employers that use background checks for employment purposes must ensure they are taking proper steps to ensure compliance with the applicable provisions of the FCRA.
  • Don’t forget individual state laws. The FCRA’s disclosure and authorization requirements still apply to these types of investigations. In states that have counterparts to the FCRA, employers must also comply with those state-specific obligations laws to the extent they impose different or more stringent requirements than the FCRA.