CIPP/US Study Guide
Chapter 12: Workplace Privacy

Investigating Employee Misconduct: Vail Letter and FACTA Fix

Investigations should be fair, documented, and compliant with CBAs. The FTC's Vail Letter made third-party investigators CRAs, requiring notice and consent that destroyed undercover investigations. FACTA fixed this: if three conditions are met, employers need not notify the employee of an investigative report, though a summary is required if adverse action is taken.

When misconduct is alleged, employers should take it seriously, treat the employee fairly, follow laws and policies (especially collective bargaining agreements), document the investigation, and consider others' rights (e.g., retaliation risk).

Under the Vail Letter, hiring an outside investigator made that firm a CRA and its report an investigative consumer report - requiring FCRA notice and consent that destroyed the undercover aspect of investigations.

FACTA's three-part fix

FACTA excluded employee-investigation communications from the 'consumer report' definition if: (1) made to the employer to investigate suspected misconduct or legal/policy compliance; (2) not for assessing creditworthiness; and (3) shared only with limited specified recipients. If adverse action is taken, the employer must give the employee a summary of the report - issued after the investigation, preserving its secrecy.

Key terms - quick answers

What is “Vail Letter”?
An FTC advisory opinion holding that an outside firm investigating employee misconduct was a CRA and its report an investigative consumer report, triggering FCRA notice/consent that defeated undercover investigations.