Six Techniques and One Client: The Delta Logistics Cargo Theft File

1. Consumer report on Calvin. An employer has a permissible purpose only with proper certification and, for an existing employee, the report must flow through the FCRA's employment provisions: pre-adverse-action disclosure with a copy of the report and the summary of rights, then an adverse-action notice after the decision. A misconduct investigation conducted by a third party can instead fall outside the definition of "consumer report" under 15 U.S.C. §1681a(y) if the conditions below are met. Ordering a standard report and using it to decide discipline without notices is a violation.

2. DMV records on forty drivers. The Driver's Privacy Protection Act, 18 U.S.C. §§2721–2725, permits use by an employer or its agent to verify information on a commercial driver's license, and use by a licensed investigator for a permitted purpose. Pulling records for CDL holders to verify license status is defensible; blanket pulls on forty people, including personal-vehicle records, with no documented permissible use, is not. DPPA carries statutory damages and criminal penalties.

3. The bank pretext. Unlawful. Obtaining customer information of a financial institution by false pretenses violates 18 U.S.C. §1039 and constitutes fraud under Louisiana law. This is a career-ending act, not a gray area.

4. The ex-wife's login. Unlawful. Accessing stored communications without authorization from the account holder violates the Stored Communications Act, 18 U.S.C. §2701, with criminal exposure and a civil action under §2707. The ex-wife's consent does not authorize access to an account she does not control.

5. GPS on the personal truck. If the truck were employer-owned and notice given, tracking would be defensible. On a personal vehicle, including off-duty weekends, it supports trespass to chattels, intrusion upon seclusion under La. C.C. art. 2315, and possibly a stalking allegation if the subject becomes aware and claims fear. Public surveillance is the safer substitute.

6. Polygraph. The Employee Polygraph Protection Act, 29 U.S.C. §2001 et seq., bars most private-employer polygraph demands. An ongoing-investigation exemption exists for economic loss, but it requires a written statement to the examinee identifying the specific incident and the basis for reasonable suspicion, reasonable access to the employer, and cannot rest on the test alone.

The exclusion. Under 15 U.S.C. §1681a(y), a communication is not a "consumer report" when it is furnished to an employer in connection with an investigation of suspected misconduct by an employee, provided that: the communication is not used for creditworthiness, credit standing, credit capacity, or eligibility for credit or insurance, and is not used for employment purposes other than the investigation; and it is not communicated to any person other than the employer, the employer's agents, or a government agency. If the employer takes adverse action based in whole or in part on the communication, the employer must give the employee a summary of the nature and substance of the communication - but not the sources.

Structuring. Put the scope in writing: the engagement is an investigation of a specific, documented loss, for the client's internal use in deciding how to respond, and not a consumer report for employment eligibility. Deliver the report only to named HR and counsel recipients, with a cover page stating the restriction. Route any request for credit or background history away from the file entirely, and do not use the report to evaluate Calvin for promotion or credit.

If the client wants a credit report anyway, the firm is not the right channel. The employer must go to a CRA, certify permissible purpose, and run the pre-adverse-action and adverse-action sequence. Mixing the two - a misconduct report plus a credit pull, delivered as one package - destroys the exclusion for the whole package.

Adverse-action summary. Tell the client in writing that if it terminates Calvin based on the report, it owes him the summary; the firm should prepare a sanitized version that describes what was found without exposing confidential sources, so the client does not improvise one under pressure.

Stop and contain. End the pretext calls and email access immediately; no further logins. Preserve the account's access logs, because they will show who logged in and when, and the firm needs to know the true scope before it says anything.

Segregate. Quarantine everything derived from the bank call and the email account. It cannot go in the client report, it cannot be relied on for the termination decision, and it should be turned over to counsel. Do not delete it - destruction after the fact converts a bad act into an obstruction problem.

Notify. Notify the firm's E&O and cyber carriers, retain outside counsel the same day, and give the client a factual, minimal disclosure sufficient to let Delta protect itself. The client needs to know its termination decision may be tainted and that its HR file should not reference the tainted material.

Assess the board question. A licensee whose employee violated federal criminal statutes faces board discipline for conduct involving dishonesty and violation of law. Counsel should decide whether self-reporting to the Louisiana State Board of Private Security Examiners is required or advisable; either way, document the decision.

Fix the process. Suspend the junior investigator from field work pending review; audit active files for similar techniques; adopt a written source-approval matrix listing permitted databases, prohibited pretexting, and who may authorize an approach; and require that every new technique get supervisory sign-off in writing. The engagement letter should be amended to state the lawful methods the firm will and will not use - which protects the firm the next time a client says "move fast."