SMHLLAW

In the last issue of our newsletter, we briefly explored how employers might use their own internal business records containing employees’ personal information in the context of investigating those employees for potential misconduct. In this issue, we wanted to expand upon that topic in light of the recent press over the board of directors investigations at Hewlett Packard.  While those situations involving investigations of board members may be relatively rare, a more common scenario would involve investigating employees for misconduct, ranging from trade secret violations to theft. Although all of the HP cases have not yet been resolved, there are several lessons companies can learn from the press coverage generated in response to this.

First, seek counsel prior undertaking any investigative activities. An attorney can help spot some of the potential issues, and provide more specific guidance on actions that are not permitted in the relevant jurisdiction. However, this advice is only possible if a company is forthcoming with all of the details of planned activities. Ignorance of the law is no defense, so there is no benefit to providing selective information to an attorney in advance of an investigation. It is especially important to seek counsel prior to hiring outside investigators, as this can implicate laws such as the Fair Credit Reporting Act. 

A company also needs good, clear policies so its employees know what to expect. These policies should be included in the terms of an employment contract signed upon initially hiring the employee, and also reinforced by the rules and regulations in the employee handbook. It is harder for an employee to argue they expect privacy when they are warned in advance that all internet use – including accessing personal email accounts at work or on company computers – is subject to monitoring. The same applies to use of company-provided cell phones.

Perhaps the most obvious lesson to learn is the power of negative attention, as the volume of articles written on the HP situation demonstrates. There may be unusually intense public interest in a company’s inspection of personal information if it is perceived as unjust. Imagine a scenario where a company, suspicious that an employee is talking to a competitor, sends an investigator to the employee’s house on garbage day to look for evidence of these communications. Although the company’s fears might be legitimate, in the court of public opinion, the ends might not justify the means.  In our modern society, cell phone video cameras are pervasive, and the impact of such an image could be significant. For many small and medium sized companies, a proper response to negative press can far exceed an allotted public relations budget. Even if the investigative activities are legal, the potential public relations impact should be considered even from the earliest stage of an investigation. 

It is possible for investigative activities to implicate unrelated individuals and entities. A company also should be aware of third parties that may be affected in the course of their investigation. In the HP case, investigators allegedly accessed the personal and work records of members of the press. In the garbage searching example above, this could involve delving into the personal information of family members, neighbors, or roommates. 

Finally, managers should understand that some suspected conduct is serious enough to warrant involvement of the proper authorities, rather than continuing an investigation on its own. An obvious example would be where there is evidence on a company computer of illegal activity, such as downloads of child pornography. 

Protection and control of personal information is something that is increasingly important to individuals. The HP investigation has introduced the public to yet another example of how personal information can be used or accessed by an interested third party. A company must be aware of the limitations and potential problems that can arise prior to launching an investigation that may implicate the personal information of their employees and others.