Note to reader: This is Chapter 6 of Personal Privacy in an Information Society: The Report of the Privacy Protection Study Commission transmitted to President Jimmy Carter on July 12, 1977. The full Table of Contents is listed below.
A comprehensive study of the effects of record keeping on personal privacy must include records generated in the context of the relationship between employer and employee. The employment relationship affects most people over the greater part of their adult lives, and is basic to the economic and social well-being of our society. Loss of work is for most people a considerable hardship. Its consequences for an individual and for his family can be disastrous.
When an individual applies for work today, it is not unusual for the employer to ask him to divulge a considerable amount of information about himself, and to allow the employer to verify and supplement it. In addition, the individual may be examined by the company physician, given a battery of psychological tests, interviewed extensively, and subjected to a background investigation. After hiring, the records the employer keeps about him will again expand to accommodate attendance and payroll data, records concerning various types of benefits, performance evaluations, and much other information. All of this creates a broad base of recorded information about the employee which various entities unrelated to the employee-employer relationship will view as a valuable resource.
It is the creation, maintenance, use, and disclosure of these employee records which concern the Commission. At what point do inquiries about applicants and employees become unduly intrusive? What does fairness demand with respect to the uses and disclosures of records that support an employment decision? What expectation of confidentiality can an individual legitimately have with respect to the records his employer makes and keeps about him?
The Commission's examination of these questions has concentrated on the record-keeping practices of large private corporations. The Commission considered examining public-sector practices as well, but was dissuaded by time, budget, and the substantial amount of work already completed or in progress on personnel record keeping in the public sector. Several recent studies by Congressional committees and government agencies have examined public-sector employment practices, information collection techniques, and personal-data record systems.1 The Commission's study of how the Privacy Act of 1974 affects record keeping in the Federal government has illuminated the strengths and weaknesses of those privacy protection rules and procedures in the context of the Federal employment relationship. And the Project on Personnel Practices, Computers, and Citizens' Rights being carried out for the National Bureau of Standards by Professor Alan F. Westin, with partial Commission funding, has analyzed personnel record-keeping policy and practice in several agencies of Federal, State, and local government.
Within the private sector, the Commission also had to choose between looking at the record-keeping practices of a cross section of employers or confining its inquiry to the practices of sizeable organizations. The Commission concluded that concentrating on the employment-related record-keeping practices of larger organizations had some strong advantages. Although they constitute less than one percent of the many millions of businesses in the country, firms with over 1,000 employees account for more than 40 percent of total business employment. 2 Records also tend to matter more in large organizations. Because management can deal on the basis of personal knowledge or acquaintance with only a limited number of employees, records play an important role in employment decision making. Larger firms also tend to provide a wider range of benefits and frequently administer their benefit programs themselves. Thus, their records about applicants and employees contain more information than those of smaller employers. Of great importance to the Commission, moreover, was the fact that large private corporations lead in applying new information processing technologies to personal-data record keeping and thus have had to deal with privacy protection concerns earlier and more aggressively than most other organizations.
For these reasons, the analysis and recommendations that follow have focused on records generated in relationships between individuals and large, private-sector employers. The Commission does, however, believe that the limited amount of work it was able to do on the personnel record-keeping practices of small organizations warrants more general application of the principles underlying its recommendations.
THE EMPLOYEE-EMPLOYER RELATIONSHIP
The record-keeping policies and practices of private-sector employers are best understood by viewing them in the context of the employee-employer relationship. The legal framework of that relationship is contractual. That is, in theory, the employer and employee make a contract on mutually agreed terms, with termination equally available to both parties. The law of employment is based on the principles of employment at will and mutuality of obligation. Accordingly, the contract can be summarily terminated by either party.
In the public sector, these principles have been modified by civil service rules, which stipulate that government employees can be discharged only for just cause established through due process. In the private sector, they have been modified by collective bargaining. Union-management contracts have established just cause criteria for discipline and dismissal which, along with the institutionalization of arbitration, provide due process protections for some employees. Over three-quarters of all private-sector employees, however, do not have such protections.3
A private employer today may demand that applicants and employees supply detailed information about any aspect of their lives, submit to tests and examinations, and authorize the employer to acquire whatever records it wants about them from other organizations. Further, courts in some instances have upheld an employer's right to fire employees for exercising basic civil rights and privileges, e.g., for refusing to give perjured testimony, or for serving on a jury.4 . Thus, absent collective bargaining, there is no general framework in the private sector which could accommodate disputes about recorded information.5 Federal employees had such a framework before the Privacy Act of 1974 was conceived, but employees in the private sector do not.
RECORDS THE RELATIONSHIP GENERATES
In a small organization the various items of information maintainedabout an employee are frequently mingled in one file, and the custodian ofthe file may perform a number of loosely related record-keeping functions.In a large organization, on the other hand, the need to deal in a consistentway with large numbers of employees, and to match applicant abilities withjob requirements, calls for specialized functions and records. Over the years,personnel departments have expanded to handle not only recruitment,selection, and job placement but also, in many cases, industrial relations,benefit programs, occupational medicine and safety, and compliance withvarious Federal and State government requirements. All of these functionshave record-keeping consequences for the individual applicant or employee.Employee records are of necessity individually identifiable. Electronicdata processing has streamlined personnel record keeping, but even largecorporations still keep some of their employment records, particularly thoseinvolving subjective evaluations and those on applicants for jobs, in manualsystems. Some of these records relate directly to employment, such aspayroll records, grade and skill classifications, leave records, performance evaluations, and promotion tables. Others, such as pension records, life and health insurance records, medical records, counseling records, and home-loan records, are tangentially related. The need to keep well organized, readily accessible records is all the more imperative because of skill specialization in the workplace, increasingly complicated bookkeeping requirements, and Federal and State government record-keeping and reporting requirements, especially those which require that the basis of an employment decision be carefully documented.
Some corporations establish specific guidelines for personnel record keeping and inspect all record-keeping units periodically. In others, however, subordinate managers control the records their units maintain and use, so that while central management may set general policy, it cannot vouch for compliance with it.
THE USE OF RECORDS IN EMPLOYMENT DECISION MAKING
To the Commission's knowledge, no systematic analysis of how employee records affect employment decisions has ever been made. After an extensive survey of the literature, one writer characterized employment decision making as a "black box" problem: an individual can find out what information was available, and can know the outcome, but he may not know what decision processes produced the outcome.6 Nevertheless, a few general observations can be made.
In the first place, there are certain key decision-making points in the employment cycle: selection, placement, transfer, promotion, demotion, training, discipline, and separation. Second, there are great differences in how employee records are used in different industries. Different categories of employees, such as unionized and nonunionized workers, are affected differently by the records an employer keeps about them. For example, industries which recruit unskilled workers and train them to perform technologically advanced functions are likely to rely heavily on testing. Management and scientific and technical employees in any company are more likely than unskilled workers to be hired or promoted on the basis of colleagues' evaluations. Where there is a union contract, its terms frequently set criteria for making economically significant decisions about employees and, in such cases, reliance on records, both to make and to justify decisions, is common.
Unlike decisions based on insurance, credit, or medical records, however, the crucial employment decisions do not flow as a matter of course from recorded information, and thus it is virtually impossible to say for sure that an adverse decision was based on a record. In some cases, the records of several people are compared in arriving at decisions about applicants or employees, so that an employee's record standing alone cannot show why certain decisions were made about him. Moreover, there are occasions when the possibility of having to make a particular decision generates the keeping of a record, as when an employee's aberrant behavior is documented in order to justify an adverse decision about him. 7
FORCES FOR CHANGE
External forces can impinge heavily on employment-related record keeping. Government action, technological change, evolving managerial viewpoints and techniques, perspectives and goals of business firms and labor unions, market forces, and change in the composition and character of the work force can all have an effect. Yet because policy must be future-oriented, it is important to try to identify significant trends.
GOVERNMENTAL ACTION
The blurring of boundaries between public and private institutions that has shaped the nation's economic life over the last three decades is not likely to be reversed. More frequent and extended interaction with government inspectors, auditors, and contract monitors makes it likely that records will be required to support a larger range of decisions, including personnel decisions. This is likely to make managers more careful about what goes into records.
The main focus of legislative and regulatory intervention affecting the employment relationship appears to be in the area of general welfare of employees rather than labor-management relations per se. The Equal Employment Opportunity Act [42 U.S.C. 2000 et seq. (1972)] and the Occupational Safety and Health Act (OSHA) [29 U.S.C. 651 et seq. (1970)] suggest the path this trend may take. The perception that an individual's rights and liberties need more protection in his relationships with private-sector institutions is becoming widespread. Fair information practice legislation, such as the Fair Credit Reporting Act [15 U.S.C. 1681 et seq. (1971)] and the California law that permits employees to have access to their personal records [California Labor Code Sec. 1198.5] reflects this disposition.
In addition, some protective labor legislation, such as the Employee Retirement Income Security Act (ERISA), [P.L. 93-406, 88 Stat. 829 (1974)] underscores the increasing importance of the employer's role as provider of social and economic benefits. Yet neither the actual requirements imposed by such legislation, nor the regulations issued by government agencies to implement it, account for its overall impact on the collection, use, and disclosure of information about employees. For example, the Equal Employment Opportunity Commission has not required employers to create or maintain any specific records on individuals, 8 and yet its actions in pursuit of its statutorily defined obj ctives have forced employers to create records in order to demonstrate compliance. If an affirmative action program is required, as under the Rehabilitation Act [29 U.S.C. 701 etseq. (1973)] or the Age Discrimination in Employment Act [29 U.S.C. 621 et seq. (1967)], or is voluntarily undertaken out of a sense of corporate responsibility, records are essential. State laws have also had an impact upon the collection of information about employees and, most particularly, about applicants.
The long-term impact of some of this legislation is still not clear, however. Currently, the Occupational Safety and Health Act (OSHA) appears to be one of the laws most likely to raise significant fair information practice concerns. It provides in part that where standards have been promulgated with reference to specific health hazards:
where appropriate, any such standard shall prescribe the type and frequency of medical examinations or other tests which shall be made available, by the employer at his cost, to employees exposed to such hazards in order to most effectively determine whether the health of such employees is adversely affected by such exposure. [15 U.S.C. 636(b)(7)]
Results of these examinations or tests must be furnished to the employee's physician at the employee's request. They can also be made available to a prospective employer pursuant to authorization by the employee. This raises the prospect that an employee's r cedical records might follow him from job to job.9 Some workers have already declined to take the physicals employers are required to make available, and it has been suggested that one reason for their refusal is their fear of the consequences of having a known disability dccumented in their records. While a full discussion of this potentially serious problem is beyond the scope of this chapter, it seems clear that using information about previous exposure to health hazards in making determinations about an individual's suitability for employment or promotion is not consistent with the protective intent of the OSHA statute.
The Commission foresees that government involvement in selected aspects of the private-sector employment relationship will increase. The impact on employment record-keeping practices will be mixed, but the overall effect will probably be continuous reinforcement of the incentive to make, keep, and use records about employees. Barring a fundamental reconceptualization of governmental policy affecting the private-sector employment relationship, the likelihood is that incremental changes will perpetuate existing trends. Thus, for the future as in the present, the important task is to eliminate and guard against dangers inherent in existing policy and practice.
GROWTH OF FRINGE BENEFITS
Further increase in the benefits and services provided by employers is likely to contribute to further government involvement in the employment relationship. Fringe benefits have become a significant part of employee compensation in American industry. Beyond paid vacations and recreational programs, they now include pension plans, family health and medical benefits, and extended or supplementary unemployment insurance. For example, as of three years ago, the employers of some 65 percent of all private-sector, nonfarm workers offered pension plans.l0; This expansion increases the dependence of employees upon their jobs, and quite possibly their reluctance to change jobs, while, at the same time, adding to the amount and variety of information an employer maintains about employees.
Medical services and health and accident insurance are increasingly provided to employees and their families.11 As elsewhere, limitations on the kind of information gathered in these contexts are few because almost any personal information may be related to an individual's health, and because the expected confidentiality of the patient-physician relationship serves to legitimate probing inquiries. In the employment context, however, the provision of medical services and the processing of medical insurance claims raise acute privacy protection problems.
In practice, corporate and professional ethics tend to discourage abuse. Yet, so long as there are no absolute barriers to an employer's use of its employee medical and insurance claims records, and as long as employers are in some cases required to use such records, a privacy problem of potentially major proportions exists. For example, Department of Defense Industrial Security regulations require employers to report any information that would reflect on the reliability of employees who work on classified projects.12 Information on employees and their dependents in medical treatment or insurance claims files is not excluded from this requirement.
MANAGEMENT AND PERSONNEL MANAGEMENT
In large organizations with highly specialized divisions of labor andwell-established standards and procedures governing performance in theworkplace, personnel management strives for rational ways of makingselection, assignment, and promotion decisions. Fair and equal treatmenthas been a major objective of personnel offices throughout the country.It has been widely suggested, however, that this tendency is counter-productive for organizations in rapidly changing environments with highlyskilled and educated workers, and with tasks that require constantdevelopment of new systems and products. The role of personnel management in such "post-bureaucratic" organizations is changing. Setting uptemporary project-type organizations-firms within a firm-is a way ofoperating whose popularity is growing. Staffing is crucial in this type oforganization, and standard personnel department placement techniques are often irrelevant in such situations. Thus, authority for personnel decisions may be increasingly transferred to the project manager whose principal concern is fitting the individual with the necessary skills into the work team.
There is a strong trend in management away from formal, rule-bound relationships and toward the encouragement of openness and the development of commitment. The implications of this trend for the protection of personal privacy are, however, unclear. While a focus on commitment, teamwork, and adaptability tends to create a consultant market for behavioral scientists, this does not mean that the pressures on management to justify its past and present decisions on the basis of detailed records will cease to grow. On the one hand, the so-called "behavioral approaches" to management tend to stress "the importance of collecting accurate, timely data about aspects of the organization not normally closely monitored evidence as to employee job satisfaction, the accumulation of specialized knowledge and skills, signs of interdepartmental conflict, and the like."13 Yet, on the other hand, their net effect may be to focus decisions concerning employees more sharply than at present on work-related matters.
TECHNOLOGICAL DEVELOPMENTS
Recent years hale brought a tremendous increase in the capabilities of computer-based personnel systems. Use of these systems varies widely. The private organizations reporting to the Commission differed considerably in the extent to which they hale automated their personnel files. To date, technological innovations in information storage, transfer, and display hale not generally increased the amount of information about individual employees that is collected, maintained, or disclosed. Indeed, the Commission's inquiry indicates that adaptation to automated systems usually means that the information to be maintained in the data base is carefully screened for cost effectiveness. Furthermore, the emphasis on accuracy and timeliness of information associated with automated systems, and the practice of providing a print-out of the record for verification by the employee, hale been positive factors from a privacy protection viewpoint.
While cost will always be a consideration, computer technology promises to remove many limitations on record-system development in the near future. Improved computer capabilities, micrographics, and new duplication and transmission techniques promise to make the capture, transmission, and retrieval of information more and more economical in comparison with manual processes, and more readily available in highly selective formats to geographically separated users. Although these technical capabilities will not in themselves present privacy protection problems, trends and developments associated with them may pose problems that do not exist today. The types of records maintained in easily retrievable form will expand, and it seems likely that behavioral science data concerning employee attitudes and values will have an enhanced role in personnel decision making.
Instantaneous availability of information on employees at many locations may centralize some decisions now made locally; it certainly will raise the significance of need-to-know criteria in any policy governing disclosure of records within a firm. Centralization of files also increases the capability of organizations to respond to external requests for information about their employees. While the Commission's hearing record documents the reluctance of firms to disclose information about employees or former employees, easy retrieval may intensify pressures to make information available for purposes other than those for which they were originally collected.
In sum, the Commission subscribes to the view that information abuse does not flow automatically from advanced information technologies, and that better protections for personal privacy have often resulted from computerization.14 Yet, it also has reason to believe that ready access to large amounts of recorded information tends to create incentives to use that information for purposes that are inconsistent with the purposes for which it was originally collected. Thus, capabilities of information-processing technologies to be available in the 1980's make it imperative that responsible policies and practices governing the use of information generated in the employee-employer relationship be developed promptly.
GENERAL RECOMMENDATIONS
As elsewhere, the Commission has formulated its recommendations on records generated by the employment relationship in the light of three broad public-policy objectives: (1) to minimize intrusiveness; (2) to maximize fairness; and (3) to create a legitimate, enforceable expectation of confidentiality. In contrast to other areas, however, the Commission envisages adoption of most of its employment-related recommendations by voluntary action. The exceptions are all instances in which statutory or regulatory action appears to be both necessary and feasible. For example, the Commission recommends a statutory prohibition against the use of some exceptionally intrusive techniques for collecting information about applicants and employees, such as truth verification devices and pretext interviews. It also recommends amendment of the Fair Credit Reporting Act to regulate further the conduct of background investigations on applicants and employees, and proposes legislative or administrative action to constrain some practices of Federal agencies which impinge on the private-sector employment relationship. In other recommendations, however, the implementation strategy the Commission recommends is by and large a voluntary one.
Private-sector employers maintain many different kinds of information about their employees in individually identifiable form. The use of that information in decision making about employees is, however, difficult for an outsider to describe, particularly since employment decisions frequently are not solely based, on recorded information. Both the scope of records and the elusiveness of Their use distinguish employment record keeping from most other areas the Commission has studied.
Further, as stressed earlier, the absence of a general framework of rights and obligations that could accommodate disputes about recorded information places severe limitations on the extent to which rules governing the creation, use, and disclosure of employee records can be enforced. The Commission believes that flexibility in decisions about which job an employee is best suited to perform is essential to good management and should be constrained by public policy only to the extent that employers show themselves unable or unwilling to respond to concerns about the protection of employee privacy. Nonetheless, the enforcement- problem is the primary reason why the Commission does not believe that many of the privacy protection issues the private-sector employee-employer relationship raises can be resolved by legislated record-keeping requirements.
One can conceive of approaches to enforcing rules the Commission recommends for voluntary adoption by means which do not involve the creation of new labor laws, but all of the ones the Commission considered, it found wanting. One might give an employee a right to sue for failure to produce records on request, for example, but such a right would hardly be effective where records are difficult to identify with any reasonable degree of specificity; where it is difficult to link adverse decisions to records; and where it is often difficult to determine even that a particular decision was adverse. Given this situation and the possibility of reprisals, it seems reasonable to expect that most employees would be unwilling to sue an employer for access to records, or for correction of erroneous records. Furthermore, without specific protections, record-keeping personnel might find themselves in an awkward bind, if, for example, persons with more status in the organization pressured them to divulge information they were required by law to keep confidential. If they complied, they would violate the law; if they refused, they might lose their jobs.
In many other areas the Commission has studied, there are either Federal or State bodies responsible for monitoring the operations and performance of particular industries, such as insurance and banking. In the employment area, however, enforcement through government monitoring of employment record keeping, or even through a system whereby an employee could complain to a government agency about his employer's failure to comply with privacy protection requirements, would require creation of a new government program. Given the great number of records that would be eligible for oversight under the Commission's recommendations, and the fact that the collection and use of records varies considerably among employers, it would be a massive task for any government agency to oversee effectively the internal record-keeping practices of private employers. Such intervention by government, moreover, could markedly change the character of the employee-employer relationship in directions the Commission has not considered itself competent to evaluate.
The Commission does, of course, recognize that a voluntary approach may not be effective. Indeed, a minority of the members of the Commission are convinced that it will not be. They do not agree that to give an individual a statutory right to see, copy, and correct a record an employer maintains about him must be, of necessity, to give him a right without a remedy. The entity the Commission recommends in Chapter 1 might give further consideration to this matter.
It should be noted that there are no legal barriers or conflicts with other laws that would prevent companies from voluntarily complying with the Commission's recommendations. In addition, the experience of companies that have complied voluntarily will no doubt guide future determinations as to the need for, and practicality of, legislative action. Thus, the Commission as a whole hopes that the analysis and recommendations in this chapter will move the society toward a better understanding of the issues involved, the remedies that might be possible, and the balances that need to be struck.
REVIEW OF RECORD-KEEPING PRACTICES
Although private-sector employers are increasingly aware of the need to control the collection, maintenance, use, and disclosure of information about employees, employer practices vary widely, as do their methods of conforming practice to policy. The Commission's hearing record illustrates this variety.
Some large corporations have developed comprehensive fair information practice policies that they have systematically communicated to their employees.15 Others have developed practices to deal with some privacy protection concerns, but not others.16 Most employers, however, have not undertaken any sort of systematic review of their employment record-keeping policies and practices with privacy protection in mind. If such studies are done, it is usually because of Equal Employment Opportunity Act requirements or because the firm wants to automate some of its employment-related record keeping.17 Only rarely has the employee's perspective motivated reform of record-keeping practices, and in only a very few instances has an employer invited active participation by employees in revising its policies and practices.18
Several employers testified that they had created privacy protection review committees to study and report on employment-related record-keeping practices. In some instances, these bodies have been given permanent advisory responsibilities. 19 Such high-level committees, however, are rare. Some corporations have issued statements of policy or principle which inform employees and the public of their concern about the employment records they maintain. Others, without making any formal statements, have instituted record-keeping procedures that take account of privacy protection concerns.20 One major corporation testified that it had had a policy of allowing employees to have access to their records for years, but in reviewing its practices, discovered that its employees were unaware of the policy.21 Nothing in the Commission's record suggests that such a finding is unusual.
Among organizations that have adopted policies or practices to regulate the handling of records about employees, few have any way of checking to see if they are being carried out uniformly.22 Moreover, action taken at the corporate level is not always communicated to field offices, and few employers testified that they penalize record-keeping personnel for failure to comply with administrative instructions about the handling of employee records.23
The first step for employers who want to develop and execute privacy protection safeguards along the lines recommended by the Commission is to examine their current record-keeping policies and practices. The Commission also believes that employees should be represented on any group that undertakes such an examination.
Any review of current policy and practice should look carefully at the number and type of records held on applicants, employees, and former employees, and the items of information in each record. It should examine the uses made of employee records, their flow both within and outside of the employing organization, and how long they are maintained. Compliance with established policies and procedures should also be reviewed, particularly when a corporation has offices and plants in different States or in foreign countries. Finally, the review should determine whether, or in what situations, an employer systematically informs individuals of the uses and disclosures that are made of employment records about them. The Commission, in sum, recommends:
Recommendation (1):
That an employer periodically and systematically examine its employment and personnel record-keeping practices, including a review of:
(a) the number and types of records it maintains on individual employees, former employees, and applicants;
(b) the items of information contained in each type of employment record it maintains;
(c) the uses made of the items of information in each type of record; (d) the uses made of such records within the employing organization;
(e) the disclosures made of such records to parties outside the employing organization; and
(f) the extent to which individual employees, former employees, and applicants are both aware and systematically informed of the uses and disclosures that are made of information in the records kept about them.
Once having initiated such a program, an employer should be in a position to improve, articulate, and communicate to its employees both its privacy protection policies and its internal arrangements for assuring that these policies are consistently observed.
ADHERENCE TO FAIR INFORMATION PRACTICE POLICY
Although consenting to the divulgence of information about oneself can have little meaning for an individual who needs a job, an employer's adherence to a fair information practice policy can alleviate an applicant or employee's sense of uncontrolled exposure to intrusion on his personal privacy. The preliminary health questionnaire used by the IBM Corporation, for example, includes a detailed explanation of its purpose.24 The Cummins Engine Company's employee profile form, a copy of which is routinely sent to all employees, lists all possible users within the corporation, tells which information on the form goes to which users, and invites employees to address questions to the record system manager or the personnel office.25 Other employers follow similar procedures.26
If, however, a category of employment records is not shared with applicants and employees as a matter of policy, prevailing practice appears to be for employers not even to inform employees that such a category of records exists. Some employers indicated to the Commission that employees, in their opinion, have no legitimate interest in knowing of the existence of certain records, such as evaluations of employee "potential" used for management planning or records associated with security investigations.27 This position is hard to defend, since it argues for record-keeping systems whose very existence may be concealed, a posture with respect to minimum standards of fairness in personal-data record keeping that even the investigative agencies of the Federal government have not vigorously put forward. Nonetheless, there are many who will still try to defend it.
In the Commission's view, an employer's fair information practice policy must recognize eight basic obligations:
(1) to limit the employer's collection of information about applicants and employees to matters that are relevant to the particular decisions to be made and to avoid items of information that tend to stigmatize an individual unfairly. This can be a difficult judgment to make as there is little agreement on the characteristics that suit an individual to a particular job. The J.C. Penney Company has recently made an interesting attempt to limit its information collection to relevant items, and as a result, the firm's new employment application no longer asks about such things as leisure activities, military history, convictions (except for specific offenses), physical or mental condition, or alien status.28
(2) to inform all applicants, employees, and former employees with whom it maintains a continuing relationship (such as retirees) of all uses that may be made of the records the employer keeps on them. This makes it possible for individuals to understand the record-keeping aspects of their employment relationships and thus, as indicated earlier, to alleviate any sense tip--.. may leave of uncontrolled intrusion on their personal privacy.
(3) to not' employees of each type of record that may be maintained on them, including records that are not available to them for review and correction, so that employees need riot fear that hidden sources of information are contributing to decisions about them
(4) to institute and publicize procedures for assuring that individually identifiable employment record, are (a) created, used, and disclosed according to consistently followed procedures; (b) kept as accurate, timely, and complete o., necessary to assure that they are not the cause of unfairness in decisions made on the basis of them; and (c) disclosed within and outside of the employing organization only according to stated policy;
(5) to institute and publicize a broadly applicable policy of letting employees see, copy, correct, or amend, and if necessary, dispute individually identifiable information about themselves in the employer's records;
(6) to monitor the internal flow of individually identifiable employee record information, so that information is available only as actually needed according to clearly defined criteria;
(7) to regulate external disclosures of individually identifiable employee-record information in accordance with an established policy of which employees are made aware, including specific routine disclosures such as disclosures of payroll tax information to the Internal Revenue Service and disclosures made without the employee's authorization in response to specific inquiries or requests to verify information about him; and
(8) to assess its employee record-keeping policies and practices, at regular intervals, with a view to possibilities for improving them.
In sum, as an overall framework for addressing fair information practice concerns in the employment relationship, the Commission recommends:
Recommendation (2):
That an employer articulate, communicate, and implement fair information practice policies for employment records which should include:
(a) limiting the collection of information on individual employees, former employees, and applicants to that which is relevant to specific decisions;
(b) informing employees, applicants, and former employees who maintain a continuing relationship with the employer of the uses to be made of such information;
(c) informing employees as to the types of records that are being maintained on them;
(d) adopting reasonable procedures to assure the accuracy, timeliness, and completeness of information collected, maintained, used, or disclosed about individual employees, former employees, and applicants;
(e) permitting individual employees, former employees, and applicants to see, copy, correct, or amend the records maintained about them;
(f) limiting the internal use of records maintained on individual employees, former employees, and applicants;
(g) limiting external disclosures of information in records kept on individual employees, former employees, and applicants, including disclosures made without the employee's authorization in response to specific inquiries or requests to verify information about him; and
(h)providing for regular review of compliance with articulated fair information practice policies.
SPECIFIC RECOMMENDATIONS
With a few important exceptions, the Commission's specific recommendations on record keeping in the employee-employer relationship also embody a voluntary scheme for resolving questions of fairness in the collection, use, and dissemination of employee records. The reasons for not recommending statutory implementation of many of these recommendations should by now be clear. The Commission does, however, believe that employees, like other categories of individuals, should have certain prerogatives with respect to the records that are kept about them, and the recommendations below, if adopted, would serve to define those prerogatives as a matter of practice.
Intrusiveness
Some of the information an employer uses in making hiring and placement decisions is acquired from sources other than the individual applicant or employee. In addition to former employers and references named by the individual, such third-party sources may include physicians, creditors, teachers, neighbors, and law enforcement authorities.
One way to keep an employer's inquiries within reasonable bounds is to limit the outside sources it may contact without the individual's knowledge or authorization, as well as what the employer may seek from the individual himself. To do so, however, is to grapple with long and widely held societal views regarding the propriety of inquiries into an individual applicant or employee's background, medical history, credit worthiness, and reputation. As the Commission has agreed elsewhere in this report, the intrusions on personal privacy that seem to be taken for granted in many of the record-keeping relationships the Commission has studied usually begin with the criteria we, as a society, accept as proper ones for making decisions about people. Thus, while the Commission was struck by the extensiveness of the inquiries some employers make into matters such as medical history, it concluded that so long as society considers the line of inquiry legitimate, judgments about how extensive it should be must be largely aesthetic.
The same was not true, however, with regard to some of the techniques that are used to collect information about applicants and employees. There the Commission found a few it considers so intolerably intrusive as to justify banning them, irrespective of the relevance of the information they generate.
TRUTH VERIFICATION DEVICES
The polygraph examination, often called the lie-detector test, is one technique the Commission believes should be proscribed on intrusiveness grounds. The polygraph is used by employers to assess the honesty of job applicants and to gather evidence about employees suspected of illegal activity on the job. An estimated 300,000 individuals submitted to this procedure in 1974. 29
The main objections to the use of the polygraph in the employment context are: (1) that it deprives individuals of any control over divulging information about themselves; and (2) that it is unreliable. Although the latter is the focal point of much of the continuing debate about polygraph testing, the former is the paramount concern from a privacy protection viewpoint. During the 93rd Congress, the Senate Subcommittee on Constitutional Rights concluded that polygraph testing in the context of Federal employment raises intrusiveness issues of Constitutional proportions. 30 Similarly, the Committee on Government Operations of the House of Representatives emphasized the "inherent chilling effect upon individuals subjected to such examinations," and recommended that they no longer be used by Federal agencies for any purpose. 31
Advocates of banning the polygraph in employment describe it as humiliating and inherently coercive and suspect that some employers who use it do so more to frighten employees than to collect information from them. 32 Use of the polygraph has often been the subject of collective-bargaining negotiations and has even inspired employees to strike. The Retail Clerks Association, with more than 700,000 members, urges its locals to include anti-polygraph provisions in all contracts. 33
Other truth-verification devices now on the market, such as the Psychological Stress Evaluator (PSE), pose an even greater challenge to the notion that an individual should not be arbitrarily deprived of control over the divulgence of information about himself. Like the polygraph, the PSE electronically evaluates responses by measuring stress. Unlike the polygraph, the PSE uses voice inflections to measure stress and thus may be used without the individual knowing it is being used. 34 The use of such devices in the employment context, and the practices associated with their use, are, in the Commission's view, unreasonable invasions of personal privacy that should be summarily proscribed. The Commission, in effect, agrees with the conclusions of the two Congressional committees that have examined this issue as it arises in the Federal government and, therefore, recommends:
Recommendation (3):
That Federal law be enacted or amended to forbid an employer from using the polygraph or other truth-verification equipment to gather information from an applicant or employee.
The Commission further recommends that the Congress implement this recommendation by a statute which bans the manufacture and sale of these truth-verification devices and prohibits their use by employers engaged in interstate commerce. A clear, strong, Federal statute would preempt existing State laws with less stringent requirements and make it impossible for employers to subvert the spirit of the law by sending applicants and employees across State lines for polygraph examinations.
PRETEXT INTERVIEWS
The Commission also finds unreasonably intrusive the practices of investigators who misrepresent who they are, on whose behalf they are making an inquiry, or the purpose of the inquiry. (These so-called "pretext interviews" are discussed in some detail in Chapter 8.)
Because background checks in connection with the selection of an applicant or the promotion or reassignment of an employee are not criminal investigations, they do not justify undercover techniques. Nor, according to testimony before the Commission, are pretext interviews necessary to conduct adequate investigations in the employment context. Witnesses from private investigative firms repeatedly said that extensive information about an applicant can be developed without resorting to such ruses.35 Accordingly, in keeping with the posture it took on pretext interviews in connection with insurance underwriting and claims investigations, the Commission recommends:
Recommendation (4):
That the Federal Fair Credit Reporting Act be amended to provide that no employer or investigative firm conducting an investigation for an employer for the purpose of collecting information to assist the employer in making a decision to hire, promote, or reassign an individual may attempt to obtain information about the individual through pretext interviews or other false or misleading representations that seek to conceal the actual purpose(s) of the inquiry or investigation, or the identity or representative capacity of the employer or investigator.
Amending the Fair Credit Reporting Act in this way would be a reasonable extension of the Act's goal of assuring that subjects of investigations are treated fairly.
REASONABLE CARE IN THE USE OF SUPPORT ORGANIZATIONS
An employer should not be totally unaccountable for the activities of others who perform services for it. The Commission believes that an employer should have an affirmative obligation to check into the modus operandi of any investigative firm it uses or proposes to use, and that if an employer does not use reasonable care in selecting or using such an organization, it should not be wholly absolved of responsibility for the organization's actions. Currently, the responsibility of an employer for the acts of an investigative firm whose services it engages depends upon the degree of control the employer exercises over the firm. Most investigative reporting agencies are independent contractors who traditionally reserve the authority to determine and assure compliance with the terms of their contract. Thus, under the laws of agency, an employer may be absolved of any liability for the illegal acts of an investigative firm if those acts are not required by the terms of the contract.36 Accordingly, to establish the responsibility of an employer which uses others to gather information about applicants or employees for its own use, the Commission recommends:
Recommendation (5)
That the Federal Fair Credit Reporting Act be amended to provide that each employer and agent of an employer must exercise reasonable care in the selection and use of investigative organizations, so as to assure that the collection, maintenance, use, and disclosure practices of such organizations comply with the Commission's recommendations.
If Recommendation (5) were adopted, and it could be shown that an employer had hired or used an investigative firm with knowledge, either actual or constructive, that the organization was engaging in improper collection practices, such as pretext interviews, an individual or the Federal Trade Commission could initiate action against both the employer and the investigative firm and hold them jointly liable for the investigative firm's actions.
Fairness
Unfair practices can enter into employment record keeping in four main ways: (1) in the kinds of information collected for use in making decisions about individuals; (2) in the procedures used to gather such information; (3) in the procedures used to keep records about individuals accurate, timely, and complete; and (4) in the sharing of information across the variety of record-generating relationships that may be subsumed by the employment relationship.
FAIRNESS IN COLLECTION
When employers ask applicants and employees for more personal information than they need, unfairness may result. The process of selecting among applicants generally involves step-by-step disqualification of applicants on the basis of negative information. Where jobs require routine skills, or where many apply for a few vacancies, items of information that have little to do with job qualifications can become the basis for sifting among otherwise undifferentiated applicants. An arrest or conviction record remote in time or pertinence to the job being sought, or a less-than-honorable military discharge, are items of information that can be used in that way.
The cost of collecting information tends to limit what employers collect, but cost is not an effective deterrent when the item is easily obtained. Moreover, in employment, as well as in other areas in which records influence decisions about individuals, too much deference is often paid to records generated by other institutions. Unwarranted assumptions can be made about the validity and currency of information that other organizations record and disseminate. Questions are seldom asked about how the record came to be. As a result, records created by other institutions for their own decision-making purposes can unfairly stigmatize an individual. In the extreme case, they can set in motion a series of events which permanently exclude an individual from the economic mainstream, condemning him to marginal employment for a lifetime. Again, arrest, conviction, and military discharge records are principal culprits in this regard.
USE OF ARREST INFORMATION
Arrest information raises perplexing questions of fairness. Although the Commission's hearing testimony indicates that many employers no longer use arrest information in their employment decisions, a great many still do.37 The use of arrest information in making employment decisions is questionable for several reasons. An arrest record by itself indicates only that a law enforcement officer believed he had probable cause to arrest the individual for some offense; not that the person committed the offense. For instance, an individual may have been arrested for breaking and entering a building, while further investigation revealed that he had the owner's permission to be in the building. Constitutional standards specify that convictions, not arrests, establish guilt. Thus, denial of employment because of an unproved charge, a charge that has been dismissed, or one for which there has been an adjudication of innocence, is fundamentally unfair.
There is a balance to be struck between society's presumption of innocence until proven guilty and its concern for security. When it has been forced to strike that balance in the past, laws have been enacted declaring that arrests for certain offenses must be considered in choosing among applicants for certain kinds of employment.38 While such action is clearly the obverse of a ban on the use of arrest information in employment decision making, it can be treated as a limit on the collection and use of such information. Accordingly, the Commission recommends:
Recommendation (6):
That except as specifically required by Federal or State statute or regulation, or by municipal ordinance or regulation, an employer should not seek or use a record of arrest pertaining to an individual applicant or employee.
In addition, to give this recommendation force, the Commission further recommends:
Recommendation (7):
That existing Federal and State statutes and regulations, and municipal ordinances and regulations, which require an employer to seek or use an arrest record pertaining to an individual applicant or employee be amended so as not to require that an arrest record be sought or used if it is more than one year old and has not resulted in a disposition; and that all subsequently enacted statutes, regulations, and ordinances incorporate this same limitation.
Where an indictment is outstanding, Recommendations (6) and (7) would allow an employer to use it, even if a year had passed without disposition of the charge. Without the limitation Recommendation (7) would impose, however, the use of an arrest record is doubly unfair in that the information is untimely as well as incomplete. Because of rules requiring that cases be dropped if there is not a speedy trial and because the prosecution frequently drops cases where it does not have sufficient evidence to bring them to trial, the record of such cases may remain without disposition, and therefore be incomplete.
OCCUPATIONAL LICENSING
Many jurisdictions have occupational licensing laws that require an applicant to be of good moral character, the definition of good moral character being left to administrative boards or the courts to determine.39 Commonly, these bodies define an arrest record as pertinent to assessing moral character. The Commission obviously believes that an arrest record per se is an uncertain indicator of character; that if arrest records are to be sought, the language of the statute or regulation should specifically state both the type of occupation for which such information is necessary and the type of offense that is relevant to the required assessment of moral fitness. To do otherwise, in the Commission's view, is to invite unfair discrimination. Accordingly, the Commission recommends:
Recommendation (8):
That legislative bodies review their licensing requirements and amend any statutes, regulations, or ordinances to assure that unless arrest records for designated offenses are specifically required by statute, regulation, or ordinance, they will not be collected by administrative bodies which decide on an individual's qualifications for occupational licensing.
THE LAW ENFORCEMENT ASSISTANCE ADMINISTRATION ROLE
The Commission believes that it will be difficult to stop the inappropriate use of arrest information in employment decision making unless the dissemination of such information by law enforcement agencies and criminal justice information systems is restricted. Although no national policy or Federal legislation deals comprehensively with the collection, storage, and dissemination of criminal justice information by law enforcement authorities, some State laws do, and a start in the direction of formulating a national policy has been made. The Omnibus Crime Control and Safe Streets Act of 1968, as amended in 1973, contains some loose protections against unfair uses of records in State criminal justice information systems. It specifies that if arrest information is maintained, disposition information should also be maintained where feasible; that there should be reasonable procedures for assuring the accuracy of the information maintained and disseminated; that the subject of the information should be allowed to review it and challenge its accuracy; and that the information should only be used for lawful purposes. [42 U.S. C. 3771(b)] Even with this statute, however, and the Law Enforcement Assistance Administration regulations implementing it [28 C.F.R. 20.21], criminal histories are still too readily available to employers. Criminal justice information systems at State and local levels frequently do not have the capacity to disseminate only conviction information or records of arrest for specific offenses. Few are able to update arrest and disposition information promptly. The systems as they have developed often are incapable of making fine-grained distinctions between an arrest with pending disposition and one which has been recently dismissed. Thus, while it is feasible to correct information in a system after a year or so, the status of an arrest may be inaccurately recorded during the intervening period.
The Commission has not found a solution to this problem, but believes that the Law Enforcement Assistance Administration can and should do so. Accordingly, the Commission recommends:
Recommendation (9):
That the Law Enforcement Assistance Administration study or, by its grant or contract authority, designate others to study, alternative approaches to establishing within State and local criminal justice information systems the capacity to limit disclosures of arrest information to employers to that which they are lawfully required to obtain, and to improve the system's capacity to maintain accurate and timely information regarding the status of arrests and dispositions.
RETENTION OF ARREST INFORMATION
Because of the stigma attached to having an arrest record, and because arrest information is primarily used in hiring, the Commission believes that no employer should keep an arrest record on an individual after he is hired, unless there is an outstanding indictment or conviction. Accordingly, the Commission recommends:
Recommendation (10):
That when an arrest record is lawfully sought or used by an employer to make a specific decision about an applicant or employee, the employer should not maintain the record for a period longer than specifically required by law, if any, or unless there is an outstanding indictment.
CONVICTION RECORDS
The problems conviction records present in employment decision making are different from those presented by arrest information. A conviction is a societal judgment on the actions of an individual. Unlike arrest information, a conviction record is not incomplete.
Federal and State laws sometimes require employers to check the conviction records of applicants for jobs in particular industries. Banks, for example, are required by the Federal Deposit Insurance Corporation to have the FBI check every job applicant for conviction of crimes involving dishonesty or breach of trust. [17 C.F.R. 240.17 f -21 Similarly, the Department of Transportation requires the trucking industry to find out whether a would-be driver has been convicted of reckless driving. [49 C.F.R. 391.271 The Bureau of Narcotics and Dangerous Drugs requires drug manufacturers to check the conviction records of all job applicants. [21 C.F.R. 1301.90, 1301.93]
Nevertheless, uneasiness among employers about the relevance of conviction records to employment decisions is growing. Some employers have stopped collecting them;40 others have reworded their application forms to inquire only about convictions relevant to the position for which an individual is applying. For example, the J.C. Penney Company now asks an applicant to list only convictions for crimes involving a breach of trust.41 Other employers specify felonies only or exclude traffic offenses, and some ask applicants to list only felonies committed during the past five years.42
Thus, to encourage employers to take steps voluntarily to protect individuals against unfair uses of conviction records in employment decision making, the Commission recommends:
Recommendation (11):
That unless otherwise required by law, an employer should seek or use a conviction record pertaining to an individual applicant or employee only when the record is directly relevant to a specific employment decision affecting the individual.
RETENTION OF CONVICTION RECORDS
Once conviction information has been collected and used in making a particular decision, retaining it raises still another fairness issue. The Commission has recommended that arrest-record information be destroyed after use, but the need for conviction information may recur, as when an employee is being considered for bonding or a position of trust. For the employer to have to seek the same information again and again would inconvenience both employee and employer.
Two witnesses before the Commission, IBM and General Electric, testified that they request conviction information on a perforated section of the application form. The personnel department tears off this segment and either seals it or maintains it separately from the individual's personnel file before circulating the form to potential supervisors.43 Thus, conviction information is not available in making decisions except when it is specifically required. The Commission believes this practice is a sound one, and thus, recommends:
Recommendation (12):
That where conviction information is collected, it should be maintained separately from other individually identifiable employment records so that it will not be available to persons who have no need for it.
MILITARY-RECORD INFORMATION
SPN Codes. The use some employers make of military discharge records, and of the administrative codes found on the Department of Defense (DOD) form known as the "DD-214," raises still another set of fairness issues. Of particular concern is the use of the separation program number (SPN) codes that the DOD assigned to all dischargees beginning in 1953. These codes may indicate many things, including an individual's sexual proclivities, psychiatric disorders, discharge to accept public office, or status as sole surviving child. The DOD uses them in preparing administrative and statistical reports and in considering whether an individual should be permitted to re-enlist. The Veterans Administration uses them to determine eligibility for benefits. Employers, however, also use them, and in the employment context they can do a great deal of harm.
SPN codes are frequently assigned on the basis of subjective judgments which are difficult for the dischargee to challenge. Until recently, the codes had different meanings in each branch of service, and they have been changed several times, leaving them prone to misinterpretation by employers not possessing the proper key. (Although employers are not supposed to know what the SPN codes mean, many have found out as a result of leaks from the agencies authorized to have them.) 44
In 1974, the DOD tried to stop unfair use of SPN codes by leaving them off its forms and offering anyone discharged prior to 1974 an opportunity to get a new form DD-214 without a SPN code. This solution has several defects. For one thing, not all pre-1974 dischargees know of the reissuance program. For another, a pre-1974 DD-214 without a SPN code may raise a canny employer's suspicion that the applicant had the SPN code removed because he has something to hide.
Inasmuch as this problem still seems to be a significant one, the Commission believes that the DOD should reassess its SPN code policy. The Department might consider issuing new DD-214 forms to all dischargees whose forms presently include SPN codes. Although such a blanket reissuance could be costly, without it employers will continue to draw negative inferences from the fact that an individual has exercised his option to have the SPN code removed. In any case, SPN code keys should stay strictly within the DOD and the Veterans Administration.
Issuing new DD-214s and tightening code key disclosure practices, however, will not resolve the problem if employers can continue to require that dischargees applying for jobs authorize the release of the narrative descriptions in their DOD records. The most effective control over this information would be a flat prohibition on its disclosure to employers, even when the request is authorized by the applicant. This would have to be done in such a way as not to preclude individuals from requesting narrative descriptions from the DOD for their own purposes, since they are entitled to do so under the Privacy Act.45
Military Discharge Records. The military discharge system, as it works today, still influences employment opportunities. There are five types of discharges: honorable, general, other than honorable, bad conduct, and dishonorable. General and other than honorable discharges are products of an administrative process which usually includes the right to a hearing before a board and a subsequent right of administrative appeal. Bad conduct and dishonorable discharges, on the other hand, are only given after a full court-martial.
In practice, it appears that employers tend to disregard the distinction between the administrative discharge and discharges resulting from courts-martial.46 Thus, any discharge except an honorable one can be the ticket to a lifetime of rejected job applications. Nor is that accidental. The DOD has intentionally linked discharge status to future employment as an incentive to good behavior while in the service.47
It can be argued that military service is just another kind of employment, and that discharge information is no different from information about any other past employment which applicants routinely release to prospective employers. Military service and civilian employment are not, however, comparable, since few civilian jobs involve supervision of almost every aspect of an employee's life.
On March 28, 1977, the Secretary of Defense announced a program for reviewing Viet Nam era discharges. It applies to two categories of individuals: (1) former servicemen who were discharged during the period August 4. 1964 to March 28, 1973, and who, if enlisted, received an undesirable or general discharge, or if an officer received a general or other than honorable discharge; and (2) servicemen in administrative desertion status whose period of desertion commenced between August 4, 1964 and March 28, 1973, and who meet certain other criteria. The discharge review portion of this program gives eligible veterans six months to apply for possible upgrading if positive service or extenuating personal circumstances appear to warrant it. The program aims at adjusting inequities that occurred during a particularly troubled period in our nation's history. It does not, however, address all the problems mentioned above. It does not extend to veterans with honorable discharges that carry possibly stigmatizing SPN codes. Nor does it apply to anyone separated from service with a general or undesirable discharge after March 28, 1973, although the normal channels for administrative review of such discharges are open to such individuals.
Thus, despite this welcome initiative, the Commission recommends:
Recommendation (13):
That Congress direct the Department of Defense to reassess the extent to which the current military discharge system and the administrative codes on military discharge records have needless discriminatory consequences for the individual in civilian employment and should, therefore, be modified. The reassessment should pay particular attention to the separation program number (SPN) codes administratively assigned to dischargees so as to determine how better to limit their use and dissemination, and should include a determination as to the feasibility of:
(a) issuing new DD-214 forms to all dischargees whose forms currently include SPN numbers;
(b) restricting the use of SPN codes to the Department of Defense and the Veterans Administration, for designated purposes only; and
(c) prohibiting the disclosure of codes and the narrative descriptions supporting them to an employer, even where such disclosure is authorized by the dischargee.
NOTICE REGARDING COLLECTION FROM THIRD PARTIES
The background check is the most common means of verifying or supplementing information an employer collects directly from an applicant or employee. Some employers have their own background investigators,48 but many hire an outside firm. The practices of private investigative firms are discussed in detail in Chapter 8. The discussion here focuses on the employer's responsibility when it conducts such an investigation itself, or hires a firm to do so in its behalf.
A background check may do no more than verify information provided by an applicant. It may, however, seek out additional information on previous employment, criminal history, life style, and personal reputation. The scope of such a background check depends on what the employer asks for, how much it is willing to pay, and the character of the firm hired to conduct the investigation. The Fair Credit Reporting Act (FCRA) protects the subject of certain types of pre-employment investigations by providing ways for him to keep track of what is going on and contribute to the investigative process. The Act's protections, however, do not extend to many applicants and employees, and the FCRA pre-notification requirement and the right of access the Act affords an individual to investigative reports are both too limited.
The FCRA requires that an individual be given prior notice of an employment investigation, but only if the investigation relates to a job for which he has formally applied and only if the employer retains outside help for the investigation. It does not require that an individual be told the name of the investigating firm, the types of information that will be gathered, the techniques and sources that will be used, or to whom information about him may be disclosed without his authorization. Furthermore, there is no requirement that the individual be notified if the information is or may be retained by the investigative agency and perhaps used by it in whole or in part during subsequent investigations it conducts for other employers or other users. Nor does the Act, as a practical matter, give an individual an opportunity to prevent the investigation, to suggest alternative sources, or to contradict the investigative agency's interpretation of what it discovers about him. The Act does require that an applicant be told when an adverse decision has been based on information in an investigative report and that he be given a chance to learn the nature and substance of the report, but these requirements only apply in situations where prior notice of the investigation is also required. [15 U.S.C. 1681d, g] That is, an individual need not be told anything if he has not applied for the job or promotion that has prompted the investigation, or if the investigation was conducted by the employer rather than by an outside firm. Thus, to strengthen the notice requirements of the FCRA as they protect individuals being investigated it connection with employment decisions, the Commission recommends:
Recommendation (14):
That the Federal Fair Credit Reporting Act be amended to provide that an employer, prior to collecting, or hiring others to collect, from sources outside of the employing organization the type of information generally collected in making a consumer report or consumer-investigative report (as defined by the Fair Credit Reporting Act) about an applicant, employee, or other individual in connection with an employment decision, notify the applicant, employee, or other individual as to:
(a) the types of information expected to be collected about him from third parties that are not collected on an application, and, as to information regarding character, general reputation, and mode of living, each area of inquiry;
(b) the techniques that may be used to collect such types of information;
(c) the types of sources that are expected to be asked to provide each type of information;
(d) the types of parties to whom and circumstances under which information about the individual may be disclosed without his authorization, and the types of information that may be disclosed;
(e) the procedures established by statute by which the individual may gain access to any resulting record about himself;
(f) the procedures whereby the individual may correct, amend, or dispute any resulting record about himself; and
(g) the fact that information in any report prepared by a consumer-reporting agency (as defined by the Fair Credit Reporting Act) may be retained by that organization and subsequently disclosed by it to others.
If Recommendation (14) were adopted, the current FCRA enforcement mechanisms would apply to employers who do their own investigations, as well as to investigative agencies. Employers argue that not letting a candidate for a job or promotion know he is being investigated protects him from disappointment. In the Commission's view, that argument is overridden by considerations of fairness to the individual. The purpose of requiring a notice of investigation is to alert an individual before information about him is collected. The purpose of requiring specific items in the notice is to apprise the individual of the extent of the intrusion. The purpose of the notice regarding access, correction, and amendment procedures is to assure that applicants and employees know that these rights exist and how to exercise them.
NOTICE As COLLECTION LIMITATION
The anticipated benefits of Recommendation (14) for the individual would be negated if an employer deviated from its notification. Moreover, many employers depend on investigative-reporting agencies whose collection practices could go considerably beyond what is stated in such a notice. Thus, to guard against these possibilities, the Commission recommends:
Recommendation (15):
That the Fair Credit Reporting Act be amended to provide that an employer limit:
(a) its own information collection and disclosure practices to those specified in the notice called for in Recommendation (14); and
(b) its request to any organization it asks to collect information on its behalf to information, techniques, and sources specified in the notice called for in Recommendation (14).
Like the notice recommendation itself, the existing Fair Credit Reporting Act enforcement mechanisms would be available to individuals when the limitations on notice have been exceeded either by employers or investigative firms. Consequently, an applicant or employee would be able to pursue Fair Credit Reporting Act remedies when an employer or investigative firm collected information from third parties or used techniques of collection other than as stated in the notice. Also, if an individual finds that the consumer investigative report has information beyond that specified in the notice, he should be able to have it deleted from his record.
AUTHORIZATION STATEMENTS
In many instances an employer must have an applicant or employee's permission before it can get personal information about him from other persons or institutions. In general, physicians and hospitals do not disclose individually identifiable information about a patient without the patient's specific written authorization. As a consequence of the Family Educational Rights and Privacy Act of 1974 (see Chapter 10), educational institutions no longer respond to an employer's inquiries about a current or former student without the individual's consent. Testimony before the Commission indicates that employers themselves are becoming reluctant to disclose information about their former employees to other employers. 49
Nonetheless, many employers' job application forms still include a release which the applicant must sign, authorizing the employer to acquire information from organizations or individuals that have a confidential relationship with the applicant. 50 Or, as noted in Chapter 8, an investigative firm may require that the employer get releases from employees to facilitate its inquiries on the employer's behalf. As in the insurance area, these authorizations are usually broad; and few warn that the information collected could be retained and reported to subsequent clients of the investigative firm.
When any authorization or waiver of confidentiality is sought from an applicant or employee, fairness demands that it be limited both in scope and period of validity. It should bear the date of signature and expire no more than one year from that date. It should be worded so that the individual who is asked to sign it can understand it, and should specify the persons and institutions to whom it will be presented and the information that each will be asked for, together with the reasons for seeking the information.
Requiring this degree of specificity in authorizations should not unduly hamper legitimate investigations and will go far to improve the quality of the personal information held not only by investigative firms and employers, but by other keepers of individually identiftable information as well. Accordingly, the Commission recommends:
Recommendation (16):
That no employer or consumer-reporting agency (as defined by the Fair Credit Reporting Act) acting on behalf of an employer ask, require, or otherwise induce an applicant or employee to sign any statement authorizing any individual or institution to disclose information about him, or about any other individual, unless the statement is:
(a) in plain language;
(b) dated;
(c) specific as to the individuals and institutions he is authorizing to disclose information about him who are known at the time the authorization is signed, and general as to others whose specific identity is not known at the time the authorization is signed;
(d) specific as to the nature of the information he is authorizing to be disclosed;
(e) specific as to the individuals or institutions to whom he is authorizing information to be disclosed;
(f) specific as to the purpose(s) for which the information may be used by any of the parties named in (e) at the time of the disclosure; and
(g) specific as to its expiration date which should be for a reasonable period of time not to exceed one year.
It should be noted that the necessary generality permitted by parts of Recommendation (16) need not apply to an employer that obtains an authorization from an applicant, employee, or former employee permitting it to release confidential information to others. In that case, the authorization form can and should be specific as to what information may be disclosed, to whom, and for what purpose.
FAIRNESS IN USE
ACCESS TO RECORDS
Fairness demands that an applicant or employee be permitted to see and copy records an employer maintains about him. Allowing an employee to see and copy his records can be as advantageous to the employer as to the employee. As discussed earlier, employment records in the private sector are generally regarded as the property of management.51 Except where limited by State statute, as in Maine52 and California,53 or where controlled by collective-bargaining agreements, all the rights of ownership in employment records vest in the employer. Although many firms permit, and some even encourage, employees to review at least some of the records kept about them, there is no generally accepted rule.54 Where records are factual, e.g., benefit and payroll records, or where they are the sole basis for making a decision about an individual, such as in a seniority system, the advantages of employee access to assure accuracy are rarely disputed. However, many employers do not give their employees access to promotion tables, salary schedules, and test scores. Some employers believe that employee access to information may weaken their position when they are potentially in an adversary relationship with an employee, e.g., in a dispute regarding a claim for benefits. Most employers do not want employees to have access to information they believe requires professional interpretation, such as medical records and psychological tests. In addition, employers are reluctant to give employees access to information supplied by sources requesting an assurance of confidentiality. While testimony before the Commission suggests that this last problem is diminishing as reliance on references diminishes,55 in the academic community, where candidates for tenure are traditionally evaluated by unidentified peers, concern about access to letters of references is great.56
Although union contracts rarely address the access issue, where formal grievances are filed, the records supporting management's decisions must, by law, be shared with the union and with the grievant. Also, certain information, such as seniority, salary, and leave, must be posted.57 Unions have won access to particular records in specific circumstances by arbitration, and even where there is no union some employers have grievance and arbitration procedures. Without a union, however, employees who complain of violations of an internal policy on employee access to records have little protection from reprisals and no right of appeal if their complaints are ignored.
Furthermore, a right to see, copy, and request correction or amendment of an employment record is of little value, so long as an employer is free to designate which records will be accessible and to determine the merits of any dispute over accessibility or record content. Nonetheless, a well-considered access policy, consistently carried out, is strong evidence of an employer's commitment to fair practice protections for personal privacy. Such a policy gives an employee a way to know what is in records kept about him, to assure that they are factually accurate, and to make reasoned decisions about authorizing their disclosure outside the employing organization.
While recognizing that periodic evaluations of employee performance contain subjective information developed by the employer for its own use, the Commission believes that employees should have a right of access to those records also. Many employers do, in fact, share performance evaluations with their employees, as guidance on how to improve performance is generally regarded as one of the more important functions of these evaluations.58 The employee's interest in these records is obvious, since negative evaluations can deny an employee opportunities for promotion or placement. They may also disqualify him from entering the pool of employees from which such selections are made. Furthermore, records pertaining to employee performance are usually maintained in individually identifiable form and could be disclosed in that form to outside requestors.
When it comes to evaluations of an employee's potential, however, the testimony suggests that the resulting records frequently are not shared with employees.59 The Commission finds it difficult to justify the difference in treatment. Performance evaluations and evaluations of potential are intimately related. Moreover, where an employee does not have access to both, supervisors can evaluate an employee one way to his face and another way behind his back, so to speak, making it impossible for him to assess his standing.
The Commission recognizes a valid difference between performance and potential evaluations when a separate set of records pertains to employees thought to have a high potential for advancement. Since such records are mainly a long-range planning tool of management, employees should not necessarily have a right to see and copy them, whether or not they are maintained in individually identiftable form. The mere existence of such records, however, should not be kept secret from employees.
Another type of evaluation record an employer might justifiably withhold from an employee is the security record concerning an ongoing or concluded investigation into suspected employee misconduct. Although employees have a right to know that their employer maintains security records, a general right to see, copy, and request correction of such records would seriously handicap security investigations. Nonetheless, as the Commission contends later in this chapter, access should be allowed to any information from a security record that is transferred to an individual's personnel file.
The Commission strongly believes that employees should be able to see and copy most employment records. If an individual cannot conveniently do this in person, he should be able to arrange to do so by mail or telephone, provided the employer takes reasonable care to assure itself of the identity of the requestor. Nonetheless, as the Commission has already emphasized, to legislate a right of access to records without a more general scheme of rights to protect the employee who exercises it could be futile. When the employee-employer relationship is defined by collective bargaining, access to records is an obvious topic for contract negotiation and the resulting provisions would then be binding on the parties. When, however, employee access rights are not defined by contract, or enforceable by a government agency with rule-making powers, individual employees are in a poor position to resist their employer's refusal to honor their access and correction rights. As indicated earlier, there were differences within the Commission as to whether such a right need be a right without a remedy, and thus a right that should not be legislated. Recognizing that employers have discretion to determine which records they will make available to their employees, the Commission believes that employers should develop and promulgate access and correction policies voluntarily. Accordingly, the Commission recommends:
Recommendation (17):
That as a matter of policy an employer should
(a) designate clearly:
(i) those records about an employee, former employee, or applicant for employment (including any individual who is being considered for employment but who has not formally applied) which the employer will allow such employee, former employee, or applicant to see and copy on request; and(ii) those records about an employee, former employee, or applicant which the employer will not make available to the employee, former employee, or applicant,
except that an employer should not designate as an unavailable record any recorded evaluation it makes of an individual's employment performance, any medical record or insurance record it keeps about an individual, or any record about an individual that it obtains from a consumer-reporting agency (as defined by the Fair Credit Reporting Act), or otherwise creates about an individual in the course of an investigation related to an employment decision not involving suspicion of wrongdoing;
(b) assure that its employees are informed as to which records are included in categories (a)(i) and (ii) above; and
(c) upon request by an individual applicant, employee, or former employee:
(i) inform the individual, after verifying his identity, whether it has any recorded information pertaining to him that is designated as records he may see and copy; and(ii) permit the individual to see and copy any such record(s), either in person or by mail; or
(iii) apprise the individual of the nature and substance of any such record(s) by telephone; and
(iv) permit the individual to use one or the other of the methods of access provided in (c)(ii) and (iii), or both if he prefers,
except that the employer could refuse to permit the individual to see and copy any record it has designated as an unavailable record pursuant to (a)(ii), above.
ACCESS TO INVESTIGATIVE REPORTS
The Fair Credit Reporting Act requirement that an employer notify an individual when information in an investigative report was the basis for an adverse employment decision about him is inadequate. That an individual, so notified, can go to the investigative-reporting agency that made the report and demand to know what information is in it gives him some protection. [15 U.S.C. 1681h] The Commission believes, however, that in employment, as in insurance, the subject of an investigative report should have an affirmative right to see and copy it, and to correct, amend, or dispute its contents. When corrections, amendments, or dispute statements are entered into a report by an employer, it should so inform the investigative-reporting agency so that its records may also be altered. Finally, it is important for an individual to be notified in advance of his right to see, copy, correct, amend, or dispute a proposed report, and of the procedures for so doing.
The Commission's recommendations in Chapter 5 on the insurance relationship specify that the subject of an investigation has a right to see and copy, in two places, the report prepared by a support organization in connection with an underwriting investigation: at the office of the insurer that ordered it, and at the office of the firm that prepared it. Hence, the Commission does not recommend that the insurer or investigative agency routinely provide the individual with a copy of the report, either before or after using it to make a decision about him. To do so would be costly because of the volume of reports insurers order, many of which do not result in adverse decisions, and because Insurance Recommendation (13) on adverse underwriting decisions, would immediately expose a report that did result in such a decision.
In the employment context, however, several considerations urge a different approach. First, all the evidence available to the Commission indicates that there are far fewer investigative reports prepared on job applicants and employees than on insurance applicants.60 Second, the Commission's recommendations on employment records provide no guarantee that an employee will be able to see and copy an investigative report on himself that remains in an employer's files after he is hired, even though the report could become the basis for an adverse action in the future. Third, while the Commission considered tying a see-and-copy right to the making of an adverse employment decision, it rejected the proposal because the relationship between items of information and employment decisions is not always clear enough to make such a right meaningful. Fourth, it seemed to the Commission that for a rejected applicant to exercise a see-and-copy right would be awkward at best.
Hence, to balance an employer's legitimate need to collect information on applicants and employees through background checks against the procedural protections needed to insure fairness to the individual in making such investigations and using the information so acquired, the Commission recommends:
Recommendation (18):
That the Fair Credit Reporting Act be amended to provide:
(a) that an applicant or employee shall have a right to:
(i) see and copy information in an investigative report maintained either by a consumer-reporting agency (as defined by the Fair Credit Reporting Act) or by the employer that requested it; and(ii) correct, amend (including supplement), or dispute in writing, any information in an investigative report maintained either by a consumer-reporting agency (as defined by the Fair Credit Reporting Act) or by the employer that requested it;
(b) that an employer must automatically inform a consumer-reporting agency (as defined by the Fair Credit Reporting Act) of any correction or amendment of information made in an investigative report at the request of the individual, or any other dispute statement made in writing by the individual; and
(c) that an employer must provide an applicant or employee on whom an investigative report is made with a copy of that report at the time it is made by or given to the employer.
ACCESS TO MEDICAL RECORDS
The medical records an employer maintains differ significantly in character and use from the other records created in the employee-employer relationship. Responsibility for giving physical examinations to determine possible work restrictions and for serving as primary medical-care providers is falling ever more heavily on employers, giving them increasingly extensive medical files on their employees. These records, and opinions based on them, may enter into employment decisions, as well as into other types of non-medical decisions about applicants and employees. Hence, the Commission believes that access to them should be provided in accordance with the Commission's recommendations on medical records and medical-record information in Chapter 7. That is, when an employer's relationship to an applicant, employee, or former employee is that of a medical-care provider,61 the Commission recommends:
Recommendation (19):
That, upon request, an individual who is the subject of a medical record maintained by an employer, or another responsible person designated by the individual, be allowed to have access to that medical record, including an opportunity to see and copy it. The employer should be able to charge a reasonable fee (not to exceed the amount charged to third parties) for preparing and copying the record.
However, when the employer's relationship to an applicant, employee, or former employee is not that of a medical-care provider, the Commission recommends:
Recommendation (20):
That, upon request, an individual who is the subject of medical-record information maintained by an employer be allowed to have access to that information either directly or through a licensed medical professional designated by the individual.
In Chapter 7, where the rationale for these recommendations is presented in detail, "medical-record information" is defined as:
Information relating to an individual's medical history, diagnosis, condition, treatment, or evaluation obtained from a medical-care provider or from the individual himself or from his spouse, parent, or guardian, for the purpose of making a non-medical decision about the individual.
As to Recommendation (19), the Commission would urge that if a State enacts a statute creating individual rights of access to medical records pursuant to Recommendation (2) in Chapter 7, it encompass within the statute medical records maintained by an employer whose relationship to applicants, employees, or former employees is that of a medical-care provider.
ACCESS TO INSURANCE RECORDS
In their role as providers or administrators of insurance plans, employers maintain insurance records on employees and former employees and their dependents. Since the considerations governing access to these records are largely the same as when the records are maintained by an insurance company, the Commission believes that employer policy on access to them by the individuals to whom they pertain should be consistent with the recommendation on access in Chapter 5. Accordingly, the Commission recommends:
Recommendation (21):
That an employer that acts as a provider or administrator of an insurance plan, upon request by an applicant, employee, or former employee should:
(a) inform the individual, after verifying his identity, whether it has any recorded information about him that pertains to the employee's insurance relationship with him;
(b) permit the individual to see and copy any such recorded information, either in person or by mail; or
(c) apprise the individual of the nature and substance of any such recorded information by telephone; and
(d) permit the individual to use whichever of the methods of access provided in (b) and (c) he prefers.
The employer should be able to charge a reasonable copying fee for any copies provided to the individual. Any such recorded information should be made available to the individual, but need not contain the name or other identifying particulars of any source (other than an institutional source) of information in the record who has provided such information on the condition that his or her identity not be revealed, and need not reveal a confidential numerical code.
It should be noted that this recommends ion as it would apply to insurance institutions (see Chapter 5) would not apply to any record about an individual compiled in reasonable anticipation, of a civil or criminal action, or for use in settling a claim while the claim remains unsettled. After the claim is settled, the recommendation would not apply to any record compiled in relation to a a third-party claimant (i.e., a claimant who is not an insured, policy owner, or principal insured), except as to any portion of such a record which is disseminated or used for a purpose unrelated to processing the claim.
Inasmuch as this recommendation and Recommendation (25)below, are proposed for voluntary adoption by employers, it should be noted that there is a gap in the Commission's recommendations regarding records generated in the insurance relationship (Chapter 5) and that it may affect a substantial number of individuals, given the proportion of the workforce currently insured under employer-provided or employer-administered group plans. Thus, while the Commission hopes that employers will voluntarily adopt Recommendation (21) and (25), it also hopes that because their adoption must be voluntary, employers will not seize on self-administered insurance plans as a way of avoiding the statutory access and correction requirements recommended for insurance records in Chapter 5.
As to medical-record information maintained by an employer as a consequence of its insurance relationship with an individual employee or former employee, the Commission's intention is that Recommendation (20) apply.
CORRECTION OF RECORDS
Any employee who has reason to question the accuracy, timeliness, or completeness of records his employer keeps about him should be able to correct or amend those records. Furthermore, the procedures for correcting or amending employment records should conform to those recommended in other chapters of this report. For example, when an individual requests correction or amendment of a record, the employer should notify persons or organizations to whom the erroneous, obsolete, or incomplete information has been disclosed within the previous two years, if the individual so requests. When the information came from a consumer-reporting agency (as defined by the Fair Credit Reporting Act), any corrections should routinely be passed on to that agency so that its records on an applicant or employee will also be accurate. When the employer rejects the requested correction or amendment, fairness demands that the employer incorporate the employee's statement of dispute into the record and pass it along to those to whom the employer subsequently discloses the disputed information, as well as to those who need to know the information is disputed in order to protect the individual from unfair decisions being made on the basis of it. Moreover, if an employer attempts to verify allegedly erroneous, obsolete, or incomplete information in a record, it should limit its investigation to the particular items in dispute.
The Commission does not intend that the correction or amendment procedures alter any existing retention periods for records or require employers to keep an accounting of every disclosure made to a third party. However, when an employer does keep an accounting of disclosures to third parties, for whatever purpose, it should let an employee use it in deciding to whom corrections, amendments, or dispute statements should be forwarded. Accordingly, the Commission recommends:
Recommendation (22):
That, except for a medical record or an insurance record, or any record designated by an employer as an unavailable record, an employer should voluntarily permit an individual employee, former employee, or applicant to request correction or amendment of a record pertaining to him; and
(a) within a reasonable period of time correct or amend (including supplement) any portion thereof which the individual reasonably believes is not accurate, timely, or complete; and
(b) furnish the correction or amendment to any person or organization specifically designated by the individual who may have, within two years prior thereto, received any such information; and, automatically to any consumer-reporting agency (as defined by the Fair Credit Reporting Act) that furnished theinformation corrected or amended; or
(c) inform the individual of its refusal to correct or amend the record in accordance with his request and of the reason(s) forthe refusal; and
(i) permit an individual who disagrees with the refusal to correct or amend the record to have placed on or with the record a concise statement setting forth the reasons for his disagreement;(ii) in any subsequent disclosure outside the employing organization containing information about which the individual has filed a statement of dispute, clearly note any portion of the record which is disputed, and provide a >copy of the statement along with the information being disclosed; and
(iii) furnish the statement to any person or organization specifically designated by the individual who may have, within two years prior thereto, received any such information; and, automatically, to any consumer-reporting agency (as defined by the Fair Credit Reporting Act) that furnished the disputed information; and
(d) limit its reinvestigation of disputed information to those record items in dispute.
The procedures for correcting and amending insurance and medical records which the Commission recommends in Chapters 5 and 7 should be voluntarily adopted by employers who maintain such records. Thus, with respect to a medical record maintained by an employer whose relationship to an employee is that of a medical-care provider, the Commission recommends:
Recommendation (23):
That an employer establish a procedure whereby an individual who is the subject of a medical record maintained by the e' plover can request correction or amendment of the record. When the individual requests correction or amendment, the employer should, within a reasonable period of time, either:
(a) make the correction or amendment requested, or
(b) inform the individual of its refusal to do so, the reason for the refusal, and of the procedure, if any, for further review of the refusal.
In addition, if the employer decides that it will not correct or amend a record in accordance with the individual's request, the employer should permit the individual to file a concise statement of the reasons for the disagreement, and in any subsequent disclosure of the disputed information include a notation that the information is disputed and the statement of disagreement. In any such disclosure, the employer may also include a statement of the reasons for not making the requested correction or amendment.
Finally, when an employer corrects or amends a record pursuant to an individual's request, or accepts a notation of dispute and statement of disagreement, it should furnish the correction, amendment, or statement of disagreement to any person specifically designated by the individual to whom the employer has previously disclosed the inaccurate, incomplete, or disputed information.
As with Recommendation (19), the Commission would urge that if a State enacts a statute creating individual rights regarding the correction of medical records pursuant to Recommendation (2) in Chapter 7, it encompass within the statute medical records maintained by an employer whose relationship to applicants, employees, or former employees is that of a medical-care provider.
In addition, when an employer maintains medical-record information about an individual applicant, employee, or former employee, the Commission recommends:
Recommendation (24):
That notwithstanding Recommendation (22), when an individual who is the subject of medical-record information maintained by an employer requests correction or amendment of such information, the employer should:
(a) disclose to the individual, or to a medical professional designated by him, the identity of the medical-care provider who was the source of the medical-record information;
(b) make the correction or amendment requested within a reasonable period of time, if the medical-care provider who was the source of the information agrees that it is inaccurate or incomplete; and
(c) establish a procedure whereby an individual who is the subject of medical-record information maintained by an employer, and who believes that the information is incorrect or incomplete, would be provided an opportunity to present supplemental information of a limited nature for inclusion in the medical-record information maintained by the employer, provided that the source of the supplemental information is also included.
Although Recommendations (22), (23) and (24) appear complex, they contain only two key requirements:
Finally, with respect to the correction or amendment of insurance records maintained by an employer, the Commission recommends:
Recommendation (25):
That when an employer acts as a provider or administrator of an insurance plan, the employer should:
(a) permit an individual to request correction or amendment of a record pertaining to him;
(b) within a reasonable period of time, correct or amend (including supplement) any portion thereof which the individual reasonably believes is not accurate, timely, or complete;
(c) furnish the correction or amendment to any person or organization specifically designated by the individual who may have, within two years prior thereto, received any such information; and, automatically, to any insurance-support organization whose primary source of information on individuals is insurance institutions when the support organization has systematically received any such information from the employer within the preceding seven years, unless the support organization no longer maintains the information, in which case, furnishing the correction or amendment would not be necessary; and, auto-matically, to any insurance-support organization that furnished the information corrected or amended; or
(d) inform the individual of its refusal to correct or amend the record in accordance with his request and of the reason(s) for the refusal; and
(i) permit an individual who disagrees with the refusal to correct or amend the record to have placed on or with the record a concise statement setting forth the reasons for his disagreement;(ii) in any subsequent disclosure outside the employing organization containing information about which the individual has filed a statement of dispute, clearly note any portion of the record which is disputed and provide a copy of the statement along with the information being disclosed; and
(iii) furnish the statement to any person or organization specifically designated by the individual who may have, within two years prior thereto, received any such information; and, automatically to an insurance-support organization whose primary source of information on individuals is insurance institutions when the support organization has received any such information from the employer within the preceding seven years, unless the support organization no longer maintains the information, in which case, furnishing the statement would not be necessary; and, automatically, to any insurance-support organization that furnished the disputed information; and
(e) limit its reinvestigation of disputed information to those record items in dispute.
FAIRNESS IN INTERNAL DISCLOSURES ACROSS RELATIONSHIPS
Just as fairness must be a concern of employers when gathering information from external sources, they have a duty to see that information generated within the several discrete relationships subsumed under the broad employee-employer relationship is not shared within the employing organization in ways that are unfair to the individual employee.
As a rule, employers large enough to have separate functional units for personnel, security, insurance, and medical-care operations have voluntarily taken steps to assure that the records each of these units generates are maintained separately and not used improperly. The biggest problems are in small organizations that cannot realistically segregate record-keeping functions. Another potential problem is the impact of technology which could make retrieval of information stored in a common data base by unauthorized persons easier than is currently the case.
PERSONNEL AND PAYROLL RECORDS
As personnel planning and management systems have become more elaborate, so have the personnel files and payroll records an employer keeps on its employees. This is not to say that all employees expect personnel and payroll records to be held in confidence within the employing organization. Some may not; but out of consideration for those who do, the Commission believes that an employer should limit the use of personnel and payroll record information to whatever is necessary to fulfill particular functions. Therefore, the Commission recommends:
Recommendation (26):
That an employer assure that the personnel and payroll records it maintains are available internally only to authorized users and on a need-to-know basis.
SECURITY RECORDS
Security records differ from personnel records in that they frequently must be created without the employee's knowledge. Sometimes the information in them is inconclusive; sometimes the problem that precipitated the security record is not quickly resolved. Nonetheless, an employer may have to keep security records in order to safeguard the workplace or corporate assets. As a rule, employers document any action resulting from security investigations in the individual's personnel file, but do not include the details leading up to the action.62
Security departments usually work with personnel departments in the course of investigating incidents involving employees 63When the security function is separate from the personnel department, however, security records are generally not available to management and are frequently, though not always, filed by incident rather than by name, at least until the case is resolved.64 Since security records maintained apart from personnel records can have little impact on personnel decisions about an employee, and since employee access to security records could substantially hamper legitimate security investigations, allowing the employee to see and copy them while they are being maintained as security records seems hard to justify. If, however, information in the security record of an employee is to be used for other purposes, such as discipline, termination, promotion, or evaluation, fairness demands that the employee have direct access to it. Thus, the Commission, again taking the voluntary approach, recommends:
Recommendation (27):
That an employer:
(a) maintain security records apart from other records; and
(b) inform an employee whenever information from a security record is transferred to his personnel record.
MEDICAL RECORDS AND MEDICAL-RECORD INFORMATION
As indicated earlier, an employer may maintain both medical-record information and medical records: the former as a consequence of requiring it as a condition of employment, placement, or certification to return to work; the latter as a consequence of providing various forms of medical care, including routine physicals. However collected, there is a case for requiring employers to restrict the circulation of medical records and medical-record information outside the medical department. Corporate physicians are sincerely concerned about possible misuses of the records they maintain. No matter how hard they may strive to be independent of the employing organization their allegiance is ultimately to the employer.
Many large employers have procedures that guarantee the confidentiality of medical-record information in all but the most extreme circumstances; and many corporate medical departments only make recommendations for work restrictions, carefully refraining from passing on any diagnosis or treatment details in all but the most extreme circumstances.65 Nevertheless, it is the duty of the corporate physician to tell his employer when he finds in an individual a condition that could negatively affect the interests of the employer or other employees.66 Furthermore, employers rely on corporate physicians for evaluation of an applicant or employee's health in making hiring and placement decisions. A further complication arises if, as often happens, the corporate physician also provides regular medical care for employees outside of the employment context, perhaps functioning as the family doctor.
An employee availing himself of medical services offered by his employer does so at some risk to the traditional confidential relationship between physician and patient, unless great care is taken to insulate that relationship from the usual work-related responsibilities of the medical department. Thus, when a medical department provides voluntary physicals or routine medical care for employees, the resulting records should be maintained separately from the records generated by work-related contacts and should never be used to make work-related decisions. This is a difficult policy to enforce and can work only where management understands and respects the need to separate the compulsory and voluntary functions of the medical department. Thus, the Commission recommends:
Recommendation (28):
That an employer that maintains an employment-related medical record about an individual assure that no diagnostic or treatment information in any such record is made available for use in any employment decision; and
Recommendation (29):
That an employer that provides a voluntary health-care program for its employees assure that any medical record generated by the program is maintained apart from any employment-related medical record and not used by any physician in advising on any employment-related decision or in making any employment-related decision without the express authorization of the individual to whom the record pertains.
INSURANCE RECORDS
Insurance claims records often contain information about medical diagnosis and treatment. This information is given to the employer to meet a need of the employee; that is, to protect the employee against loss of pay due to illness or to arrange for medical bills to be paid. Where an employer either self-insures or self-administers a health-insurance plan, it necessarily maintains a significant amount of information about employees and their families. Some of this information can be useful in making personnel decisions, especially if it gives details of the diagnosis or treatment of a mental condition, a terminal illness, or an illness which drains the emotions of an employee. Testimony before the Commission indicates that many employers guard claims information carefully, apparently understanding how unfair it is to make an employee choose between filing a legitimate insurance claim and jeopardizing future employment.67 Some physicians say, however, that this kind of information is available for use in personnel decision making,68 and there is evidence of its unauthorized use in making decisions unrelated to claims payment.69
In its consideration of insurance institutions and the records they maintain, the Commission saw how important a confidentiality policy is to insureds. It believes that such a policy is no less important when the insurance plan is administered by an employer. Although it may be difficult to segregate insurance claims records completely, fairness demands that the claims process be walled off from other internal functions of the employing organization.
Employment-related insurance, such as disability or sick pay, usually involves the corporate physician in claims processing, as it is his function to evaluate the medical evidence on which the claim is based. Thus, corporate physicians must have access to information about these claims. They do not, however, have to use information thus obtained in making decisions that are unrelated to the claim. If asked for an opinion of a candidate for transfer to a job at a new location, for example, the physician can determine a person's physical capacity by examination without delving into claims records for clues to potential medical problems. Nor should these records influence other employment decisions, such as determinations of tenure, promotion, or termination. Accordingly, the Commission recommends:
Recommendation (30):
That an employer that provides life or health insurance as a service to its employees assure that individually identifiable insurance records are maintained separately from other records and not available for use in making employment decisions; and further
Recommendation (31):
That an employer that provides work-related insurance for employees, such as worker's compensation, voluntary sick pay, or short- or long-term disability insurance, assure that individually identifiable records pertaining to such insurance are available internally only to authorized recipients and on a need-to-know basis.
Expectation of Confidentiality
Employers have regular access to more information about employees than do credit, depository, or insurance institutions; yet there are no legal controls on the disclosure of employment information. The confidentiality of these records is maintained today solely at the discretion of the employer and can be transgressed at any time with no obligation to the individual record subject.
Evidence before the Commission indicates that, although there is no legal requirement for them to do so, private-sector employers tend to protect information about employees against disclosure.70 In part, this is because answering requests for such information can be a substantial administrative burden with no compensating advantage to the employer. In part, it is because employers fear common law actions brought for defamation or invasion of privacy. Such restraints, however, are uneven at best; and there are circumstances under which almost any employer routinely discloses the information in its employee records, as, for example, in response to inquiries from law enforcement authorities.71
The question of how much confidentiality can be expected of employers for information in their employment records is significant. Because of the amount and nature of the information held, the pressures under which it is usually collected, and the diverse circumstances in which it could be used, the creation of an expectation of confidentiality is at least as important in the employee-employer relationship as in any other relationship the Commission studied. Furthermore, while there is generally no valid business-related reason to disclose this information, modem technology, as discussed earlier, is making the process of disclosure much easier than it has been. Thus, the employee needs protection against the disclosure of information outside of the employing organization.
Although employees, as a rule, recognize that employment information will be used within the employing organization for a variety of purposes, and that they cannot be notified of and asked to approve each use, they should be able to assume that this rather free flow will be contained within the boundaries of the employing organization. The expectation that the confidentiality of information about them will be respected as to outside requesters depends en certain assurances en the part of employers.
The Commission believes that an employer has an obligation to inform its employees as specifically as possible of the kinds of information about them that may be disclosed both during and after the employment relationship. This means that at the beginning of the relationship, the employer should tell the applicant or employee what information about him may be disclosed. This communication is essential to protect the individual's right to determine what information he will divulge in case disclosure in some particular quarter could embarrass or otherwise harm him.
NOTICE REGARDING EXTERNAL DISCLOSURES
An employer should notify each applicant and employee of its policies regarding the disclosure of directory information, that is, basic factual information freely given to all third parties. The applicant or employee should also be informed of disclosures that may be made pursuant to statute or collective-bargaining agreements, and of the procedures by which he will be notified of or asked to authorize any other disclosures. Because information may have to be released under subpoena or ether legal process, employees should be assured prior notice of subpoenas where possible in sufficient time to challenge their scope and legitimacy. Chapter 9 on government access to records about individuals examines this problem and recommends placing the notice burden en the party issuing the subpoena.
In sum, the Commission recommends:
Recommendation (32):
That an employer clearly inform all its applicants upon request, and all employees automatically, of the types of disclosures it may make of information in the records it maintains on them, including disclosures of directory information, and of its procedures for involving the individual in particular disclosures.
THE EMPLOYER'S DUTY OF CONFIDENTIALITY
As the first premise of a responsible confidentiality policy, disclosures to any outside entity without the employee's authorization should be prohibited. Exceptions can then be made for directory information, subpoenas, specific statutory requirements, and disclosures made pursuant to collective-bargaining agreements.
Directory Information. Although employers de not, as a rule, object to giving employees some control ever the disclosure of information in records the employer keeps on them, they fear that requiring consent in every instance will be unmanageably burdensome. To alleviate this fear, and in recognition of the fact that most external disclosures of information from employment records are made in the interest of the employee rather than of the employer, the Commission believes that disclosure by an employer of a limited category of factual data without employee authorization can be justified. This category, which the Commission has designated as "directory information," should include only information an employer considers reasonably necessary to satisfy the vast majority of third-party requests. That is, it might include the fact that an individual is or has been employed by the employer, the dates of employment, the individual's present job title or position, and perhaps wage or salary information. This is not to suggest, however, that every employer should freely disclose all of these items. The Commission commends employers whose disclosure policies are even more limiting.
Disclosures for Law Enforcement Purposes. Law enforcement authorities frequently ask employers for information about employees. In addition to the items designated as directory information, they often seek an individual's dates of attendance at work, home address, and, in some cases, personnel and payroll records. Reasonable as it may seem to some to give properly identified law enforcement authorities access to information in employee files, there can be no employee expectation of confidentiality without limits on such access. The Commission's hearing record suggests that most law enforcement requests for information can be met by disclosing directory information, the employee's home address, and specific dates of attendance at work.72 When law enforcement authorities need more extensive information than that, they can obtain it by means of a subpoena or other legal process; requiring them to do so would reinforce realistic expectations of confidentiality for employment records without unduly burdening either law enforcement authorities or employers. It would also allow an employer to give a consistent response to all law enforcement requests.
Conversely, the Commission believes that an employer should remain free to disclose information about an individual applicant, employee, or former employee to law enforcement authorities if it has reason to believe that actions of the individual threaten the employer's property or the safety or security of other employees, or if it suspects an employee of engaging in illegal activities, whether or not those activities relate to his employment. Such disclosures, in the Commission's view, should not be considered violations of an employee's reasonable expectation of confidentiality.
Other Disclosures. In addition to the types of disclosures discussed above, an employer must fulfill the obligations set by its collective-bargaining contracts. When an employer retains an outside agent or contractor to collect information about an employee or group of employees, the employer must be in a position to disclose enough information for the agent or contractor to perform its legitimate functions. The agent or contractor, however, should be prohibited from redisclosing such information, and the employee should be able to find out that it has been disclosed. In addition, when a physician in an employer's medical department, or one retained by the employer, discovers that an employee has a serious medical problem of which he may not be aware, the physician should be free to disclose that fact to the employee's personal physician.
In contrast to its duty of confidentiality recommendations with respect to credit, insurance, and medical-care record keeping, the Commission is not prepared to urge that the employer's duty of confidentiality be established by statute or regulation. The absence of legal barriers to voluntary implementation by an employer, coupled with the fact that the employee-employer relationship is not one in which the record keeper is performing a service for the individual, justifies, in the Commission's view, a voluntary approach. This is not to say that there should be no legislative or regulatory action at all. Chapter 9, on access to records by government agencies, calls for legislating constraints on access to records about individuals when the record keeper is not bound by a statutory duty of confidentiality. In addition, when an employer does perform services for employees or former employees, such as providing life and health-insurance coverage or medical care for employees or former employees who want it, the Commission's recommendations with respect to those types of record-keeping relationships could also be made applicable to employers. Earlier in this chapter, the Commission has suggested how the access and correction rights that would prevail in a normal insurance or medical-care relationship might be applied to an employer by extension. Likewise, the duty of confidentiality recommended for insurers and medical-care providers could be made applicable to employers to the extent that the relationship with an applicant, employee, or former employee mirrors those types of relationships. In the main, however, the Commission believes that the employer's duty of confidentiality, at least with respect to those records that are peculiarly the product of the employment relationship, can be implemented by voluntary compliance reinforced by mutual agreements, such as through collective-bargaining contracts. Accordingly, the Commission recommends:
Recommendation (33):
That each employer be considered to owe a duty of confidentiality to any individual employee, former employee, or applicant about whom it collects information; and that, therefore, no employer or consumer-reporting agency (as defined by the Fair Credit Reporting Act) which collects information about an applicant or employee on behalf of an employer should disclose, or be required to disclose, in individually identifiable form, any information about any individual applicant, employee, or former employee, without the explicit authorization of such individual, unless the disclosure would be:
(a) in response to a request to provide or verify information designated by the employer as directory information, which should not include more than:
(i) the fact of past or present employment;(ii) dates of employment;
(iii) title or position;
(iv) wage or salary; and
(v) location of job site;
(b) an individual's dates of attendance at work and home address in response to a request by a properly identified law enforcement authority;
(c) a voluntary disclosure to protect the legal interests of the employer when the employer believes the actions of the applicant, employee, or former employee violate the conditions of employment or otherwise threaten physical injury to the property of the employer or to the person of the employer or any of his employees;
(d) to a law enforcement authority when the employer reasonably believes that an applicant, employee, or former employee has been engaged in illegal activities;
(e) pursuant to a Federal, State, or local compulsory reporting statute or regulation;
(f) to a collective-bargaining unit pursuant to a collective-bargaining contract;
(g) to an agent or contractor of the employer, provided:
(i) that only such information is disclosed as is necessary for such agent or contractor to perform its function for the employer;(ii) that the agent or contractor is prohibited from redisclosing the information; and
(iii) that the individual is notified that such disclosure may be made and can find out if in fact it has been made;
(h) to a physician for the purpose of informing the individual of a medical problem of which he may not be aware; and
(i) in response to a lawfully issued administrative summons or judicial order, including a search warrant or subpoena.
DISCLOSURES OF OSHA RECORDS TO PROSPECTIVE EMPLOYERS
A confidentiality problem mentioned earlier in this chapter derives from the Occupational Safety and Health Act (OSHA), which mandates that an employer provide medical surveillance of employees known to have been exposed to certain hazardous environments or substances. This, of course, requires the employer to keep records of medical examinations and other tests made to find out if a worker's health has been adversely affected. The Commission's hearings showed that some employers have already established procedures for exchanging medical surveillance records of workers known to have had such exposures.73 A worker's former employer may disclose such a record to a prospective employer solely in the interest of continued protection of the worker's health, but the possibility remains that the prospective employer may discriminate against the worker because of its fear that previous hazardous exposure may lead in time to partial or complete disability.
The central problem with these disclosures from one employer to another is that the use of medical surveillance records as a measure of employability is not a use for which the information is collected and thus is inherently unfair. Accordingly, the Commission recommends:
Recommendation (34):
That Congress direct the Department of Labor to review the extent to which medical records made to protect individuals exposed to hazardous environments or substances in the workplace are or may come to be used to discriminate against them in employment. This review should include an examination of the feasibility of:
(a) restricting the availability of records generated by medical examinations and tests conducted in accordance with OSHA requirements for use in making employment decisions; and
(b) establishing mechanisms to protect employees whose health has been affected by exposure to hazardous environments or substances from the economic consequences of employers' decisions concerning their employability.
The Commission's recommendations assign employers an important task: to adopt policies and practices regarding the collection, use, and disclosure of information on applicants, employees, and former employees without being forced to do so by government. Unless each employer has a conscientious program on which applicants and employees can rely to safeguard the records the employer keeps about them, the voluntary approach recommended in this chapter will prove unsuccessful. Thus, a future commission or legislative bodies may have to consider compulsory measures, with all the disadvantages for the employee-employer relationship that would entail.
When asked how he thought industry would respond to guidelines for voluntary compliance in developing policies and procedures on employment record keeping, a witness representing the Ford Motor Company said:
Certainly it has the merit of allowing various corporations to develop guidelines that are appropriate to their situations . . . there is a wide diversity of situations and there are numerous ways by which the principles of privacy could be implemented . . . I would simply want to take a hold on determining whether at some later date legislation is necessary. The suggestion is that we start with the voluntary and determine to what extent the compulsory may be necessary based on experience.74
The Commission shares that view.
Finally, the Commission also believes that its recommendations with respect to the employment relationship, or at least the concepts on which they are based, apply equally to Federal, State, and local governments and their employees.75
1 The Use of Polygraphs and Similar Devices by Federal Agencies, Report of the Government Operations Committee, U.S. House of Representatives, 94th Congress, 2d Session, 1976, p. 61; Rights to Privacy of Federal Employees, Hearings before the Subcommittee on Retirement and Employee Benefits of the Committee on Pos1 Office and Civil Service, U.S. House of Representatives, 93d Congress, 1st and 2d Session, 1974, p. 378; and Government Dossiers: Survey of Information Contained in Government Files, Repor1 of 1he Subcommittee on Administrative Practice and Procedure of 1he Committee on the Judiciary, U.S. Senate, 90th Congress, 1st Session, 1967, p. 605.
2 U.S. Department of Commerce, 1967 Enterprise Statistics, (Part I, General Repor1 on Industrial Organization), 1967.
3 According to the Bureau of Labor Statistics, in 1974 employees who were members of unions or employee associations represented 29.1 percent of employees in non-agricultural establishments, and 24.5 percent of the total labor force. U.S. Department of Labor, Bureau of Labor Statistics, Directory of National Unions and Employee Associations, 1976.
4 Kenneth Walters, "Employee Freedom of Speech," Industrial Relations, Vol. 15, No. I (February, 1976), pp. 26-43.
5 Clyde W. Summers, "Individual Protection Against Unjust Dismissal, Time for a Statute," Virginia Law Review, Vol. 62, No. 3 (April, 1976), pp. 481-532.
6 Michael Baker, "The Use of Organization Records in Decisions About Job Applicants and Employees," Unpublished memorandum to the National Bureau of Standards' Project on Personnel Practices, Computers, and Citizens Rights, July 11, 1976.
7 See, for example, Testimony of the Manufacturers Hanover Trust Company, Employment and Personnel Records, Hearings before the privacy Protection Study Commission, December 16, 1976, pp. 693-695. (hereinafter cited as "Employment Records Hearings").
8 See, for example, Testimony of the Equal Employment Opportunity Commission, Employment Records Hearings, December 17, 1976, p. 972.
9 Letter from the Ford Motor Company to the Privacy Protection Study Comimssion, January 14, 1977.
10 Donald R. Beld, "Prevalence of Private Retiremen1 Plans," Monthly Labor Review, Vol. 98, No. 10 (October 1975), pp. 17-20.
11 Seymour Lusterman, Industry Roles in Health Care, (New York: The Conference Board, 1973).
12 Department of Defense Industrial Security Manual for Safeguarding Classified Information, (DOD 5220.22-M), par. 6b(1).
13 George Strauss, R. E. Miles, and C. C. Snow, "Implications for Industrial Relations," Organizational Behavior: Research and Issues, (Madison, Wisc: Industrial Relations Research Association, 1974), p. 198.
14 Alan F. Westin and Michael A. Baker, Databanks in a Free Society, (New York: Quadrangle/The New York Times Book Company, 1972).
15 See, for example, Submission of the Cummins Engine" Company, "Employee Profile," Employment Records Hearings, December 9, 1976, p. 7; Submission of the Equitable Life Assurance Society of the U.S., "Privacy Principles, General Operating Policy No. 29," March 19, 1976; and Submission of International Business Machines, "Four Principles of Privacy," Employment Records Hearings, December 10, 1976.
16 See, for example, Submission of the Proctor and Gamble Company, "Release of Information About Present or Former Employees," Employment Records Hearings, December 9, 10, 16, 17, 1976; and Submission of the Manufacturers Hanover Corporation, "The Standards We Live By," Employment Records Hearings, December 16, 1976.
17 See, for example, Testimony of the Inland Steel Company, Employment Records Hearings, December 10, 1976, p. 369; and Testimony of the Cummins Engine Company, Employment Records Hearings, December 9, 1976, p. 2.
18 See, for example, Testimony of the Cummins Engine Company, Employment Records Hearings, December 9, 1976, p. 13.
19 See, for example, Testimony of the Equitable Life Assurance Society, Employment Records Hearings, December 9, 1976, p. 107; Testimony of the General Electric Company, Employment Records Hearings, December 9, 1976, pp. 226, 227; Testimony of the Cummins Engine Company, Employment Records Hearings, December 9, 1976, p. 10; and Submission of the International Business Machines Corporation, "The Managing of Employee Personal Information and Employee Privacy," Employment Records Hearings, December 10, 1976, pp. 8-9.
20 See, for example, Testimony of the Inland Steel Company, Employment Records Hearings, December 10, 1976, pp. 332, 373.
21 Testimony of the Ford Motor Company, Employment Records Hearings, December 16, 1976, p. 517.
22 Alan Westin, "Trends in Computerization of Personnel Data," Part II, 1955-1976, Unpublished Report for the National Bureau of Standards' Project on Personnel Practices, Computers and Citizens Rights, p. 4; Testimony of the General Electric Company, Employ-ment Records Hearings, December 9, 1976, pp. 267-268; Testimony of the Equitable Life Assurance Society, Employment Records Hearings, December 9, 1976, p. 133; and Testimony of Rockwell International, Employment Records Hearings, December 17, 1976, pp. 922-924.
23 See, for example, Submission of General Electric, "Safeguarding Confidential Data," Unpublished memorandum to Major Appliance Group, June 21, 1976; and Testimony of the Inland Steel Company, Employment Records Hearings, December 10, 1976, p. 366.
24 Submission of International Business Machines, "Preliminary Health Questionnaire," Employment Records Hearings, December 10, 1976.
25 Submission of Cummins Engine Company, "Employee Profile," Employment Records Hearings, December 9, 1976.
26 See, for example, Submission of J. C. Penney, "Drug Screen Report," Employment Records Hearings, December 10, 1976; and Submission of General Electric Company, "Medical History," Employment Records Hearse s, December 9, 1976.
27 See, for example, Testimony of the Ford Motor Company, Employment Records Hearings, December 16, 1976, pp. 559, 560. " addition, every corporate witness testified that some of its employment records were unavailable to employees.
28 Submission of J. C. Penny, "Application Form," Employment Records Hearings, December 10, 1976.
29 Privacy, Polygraph, and Employment, Report of the Subcommittee on Constitutional Rights of the Committee on the Judiciary, U.S. Senate, 93d Congress, 2d Session, November 1974, p. 3.
30 Ibid, pp. 9-14.
31 Op. cit., House Committee on Government Operations, p. 46.
32 Ibid., p. 38.
33 Testimony of the Retail Clerks International Association, Employment Records Hearings, December 17, 1976, p. 1009.
34 Joseph F. Kubis, "Comparison of Voice Analysis and Polygraph as Lie Detection Procedures," (Report for U.S. Army Land Warfare Laboratory, August 1973) p. 6.
35 See, for example, Testimony of Pinkerton's Incorporated, Private Investigative Firms, Hearings before the Privacy Protection Study Commission, January 26. 1977, p. 156 (hereinafter cited as "Private Investigative Hearings"); and Testimony of Wackenhut Corporation, Private Investigative Hearings, January 26, 1977, pp. 53-54.
36 See, e.g., Milton v. Missouri Pacific Ry. Co., 193 Mo. 46, 91 S.W. 949 (1906); Inscoe Y. Globe Jewelry Co., 200 N.C. 580, 157 S.E. 794 (1931). However, recent decisions in a few jurisdictions indicate that under certain circumstances, one who employs a private investigator may not thereby insulate himself from liability for torts committed by the investigator by merely arguing that they were committed outside the scope of the employment. Ellenberg v. Pinkerton's, Inc., 125 Ga. App. 648, 188 S.E.2d 911 (1972); Noble v. Sears, Roebuck and Co., 33 Cal. App. 3d 654, 109 Cal. Rptr. 269, 73 A.L.R. 3d 1164 (1973).
37 Written statement of American Civil Liberties Union, Employment Records Hearings, December 9, 1976, p. 5; and testimony of Sorrell Wildhorn, Rand Corporation, Private Investigative Hearings, January 26, 1977, p. 237. See also the testimony of Charles S. Allen, Jr.., President, Armored Car Division, Contract Carrier Conference, American Trucking Association and Donald J. Jarvis, Vice President -Secretary and General Counsel, Bums International Security Service. Criminal History Records, Hearings before the Law Enforcement Assistance Administration, U.S. Department of Justice, December 11, 1975 (transcript on file at LEAA).
38 See, for example, California Labor Code Sec. 432.7(e)(1) and (2).
39 See, for example, Purdon's Pennsylvania Statutes Annotated: Professions and Occupations, Title 63, and Code of Laws of South Carolina 56-1305 ("Licensing of Pharmacists"), 1952.
40 Cummins Engine Company, interview with staff, November 4, 1976.
41 Submission of J. C. Penney Company, "Application Form," Employment Records Hearings, December 10, 1976.
42 See, for example, Submission of International Business Machines, "Application Form," Employment Records Hearings, December 10, 1976.
43 See, for example, Submission of International Business Machines, "Application Form," Employment Records Hearings, December 10, 1976; and Submission of General Electric Company, "Application Form," Employment Records Hearings, December 9, 1976.
44 Need for and Uses of Data Recorded on DD Form 214 Report of Separation from Active Duty, Report of the Subcommittee on Drug Abuse in Military Services of the Committee on Armed Services, U.S. Senate, January 23, 1975.
45 Letter from Walter W. Stender, Assistant Archivist for Federal Records Centers, General Services Administration National Archives and Records Service, to the Privacy Protection Study Commission, March 3, 1977; see also, General Services Administration "Release and Access Guide for Military and Personnel Records at the National Personnel Records Center," December 30, 1976.
46 See, for example, Testimony of the Ford Motor Company, Employment Records Hearings, December 16, 1976, p. 585.
47 Letter from D. 0. Cooke, Deputy Assistant Secretary of Defense, to the Privacy Protection Study Commission, January 18, 1977.
48 See, for example, Testimony of the Ford Motor Company, Employment Records Hearings, December 16, 1976, p. 531; and Testimony of Rockwell International, Employment Records Hearings, December 17, 1976, pp. 953, 955,957.
49 See, for example, Testimony of International Business Machines, Employment Records Hearings, December 10, 1976, p. 315; Testimony of Manufacturers Hanover Trust Company, Employment Records Hearings, December 16, 1976, pp. 678-679; and Testimony of Civil Service Commission, Employment Records Hearings, December 10, 1976, p. 414. Exception to this general practice may occur when an employee is terminated for cause, in which case this fact may be released. Testimony of Ford Motor Company, Employment Records Hearings, December 16, 1976, pp. 517-518, 599.
50 See, for example, Testimony of General Electric Company, Employment Records Hearings, December 9, 1976, p. 252.
51 Letter from the Association of Washington Business to the Privacy Protection Study Commission, November 22, 1976; and Letter from The Standard Oil Company to the Privacy Protection Study Commission, October 18, 1976.
52 Maine Rev. Stat. Ann. Tit. 5, Sec 638; Tit. 30, Sec. 64 and 2257.
53 California Labor Code, Sec. 1198.5.
54 See, for example, Testimony of General Electric Company, Employment Records Hearings, December 9, 1976, p. 235; Testimony of Cummins Engine Company, Employment Records Hearings, December 9, 1976, pp. 58-59; and Testimony of Inland Steel Company, Employment Records Hearings, December 10, 1976, pp. 370-373.
55 See, for example, Testimony of General Electric Company, Employment Records Hearings, December 9, 1976, pp. 279-280; and Testimony of Cummins Engine Company, Employment Records Hearings, December 9, 1976, p. 68.
56 See, for example, Testimony of Harvard University, Employment Records Hearings, December 17, 1976, pp. 864-902; Letter from Jean Mayer, President, Tufts University, to Roger W. Heyns, President, American Council on Education, August 9, 1976; and Sheldon Elliot Steinbach, "Employee Privacy, 1975: Concerns of College and University Administrators," Educational Record, Vol. 57, No. 1, 1976.
57 Labor Management Relations (Taft-Hartley) Act, 29 U.S.C. 141 et seq. (1947). For case citations, see Clyde W. Summers, op. cit.
58 See, for example, Testimony of Cummins Engine Company, Employment Records Hearings, December 9, 1976, pp. 46-47; Testimony of Equitable Life Assurance Society of the U.S., Employment Records Hearings, December 9, 1976, pp. 131-132; and Testimony of J. C. Penney Company, Employment Records Hearings, December 10, 1976, p. 464-465.
59 Testimony of Manufacturers Hanover Trust Company, Employment Records Hearings, December 16, 1976, p. 653.
60 See Chapter 8 of this report; See also, for example, Testimony of Equifax Services, Inc., Credit Reporting and Payment Authorization Services, Hearings before the Privacy Protection Study Commission, August 3, 1976, pp. 162-163; Testimony of Wackenhut Corporation, Private Investigative Hearings, January 26, 1977, p. 29; and Testimony of Inland Steel Company, Employment Records Hearings, December 10, 1976, p. 349.
61 The term "medical-care provider" includes both "medical-care professionals" and "medical-care institutions." A "medical-care professional" is defined as "any person licensed or certified to provide medical services to individuals, including, but not limited to, a physician, dentist, nurse, optometrist, physical or occupational therapist, psychiatric social worker, clinical dietitian or clinical psychologist." A "medical-care institution" is defined as "any facility or institution that is licensed to provide medical-care services to individuals, including, but not limited to, hospitals, skilled nursing facilities, home-health agencies, clinics, rehabilitation agencies, and public-health agencies or health-maintenance organizations (HMOs)."
62 See, for example, Testimony of Inland Steel Company, Employment Records Hearings, December 10, 1976, p. 388; Testimony of Ford Motor Company, Employment Records Hearings, December 16, 1976, p. 576; and Testimony of International Business Machines, Employment Records Hearings, December 10, 1976, p. 309.
63 See, for example, Testimony of Cummins Engine Company, Employment Records Hearings, December 9, 1976, p. 19; and Testimony of Ford Motor Company, Employment Records Hearings, December 16, 1976, p. 556.
64 See, for example, Testimony of Inland Steel Company, Employment Records Hearings, December 10, 1976, p. 388; and Testimony of Ford Motor Company, Employment Records Hearings, December 16, 1976, p. 576.
65 See, for example, Testimony of Dr. Bruce Karrh, Assistant Medical Director, du Pont de Nemours and Company, Employment Records Hearings, December 17, 1976, pp. 782-783; and Testimony of Dr. Norbert Roberts, Medical Director, Exxon Corporation, Employment Records Hearings, December 17, 1976, p. 785. This is also the policy of the Ford Motor Company and the Atlantic Richfield Company. See "Employee Records & Personal Privacy: Corporate Policies & Procedures," McCaffery, Seligman & von Simpson, Inc., November, 1976, pp. 105, 139.
66 See, for example, Testimony of Ford Motor Company, Employment Records Hearings, December 16, 1976, p. 587; and Testimony of Dr. Bruce Karrh, Assistant Medical Director, du Pont de Nemours and Company, Employment Records Hearings, December 17, 1976, pp. 781-783.
67 See, for example, Testimony of Inland Steel Company, Employment Records Hearings, December 10, 1976, p. 334; and Testimony of General Electric Company, Employment Records Hearings, December 9, 1976, pp. 248-250.
68 "Confidentiality and Third Parties," The American Psychiatric Association Task Force of June 1975, Appendix Vol. H, p. 53.
69 Ibid, p. 55.
70 All employers who testified to the Commission have policies limiting the disclosure of information about employees, although there is some variation from employer to employer regarding what information is disclosed.
71 See, for example, Testimony of the Equitable Life Assurance Society of the United States, Employment Records Hearings, December 9, 1976, p. 125; Testimony of Inland Steel Company, Employment Records Hearings, December 10, 1976, p. 390; and Testimony of Ford Motor Company, Employment Records Hearings, December 16, 1976, pp. 540-541.
72 See, for example, Testimony of Ford Motor Company, Employment Records Hearings, December 16, 1976, pp. 539, 592.
73 Letter from C. Hoyt Anderson, Director Personnel Relations and Research Office, Ford Motor Company, to the Privacy Protection Study Commission, January 14, 1977.
74 Employment Records Hearings, December 16, 1976, p. 528.
75 A more complete discussion of the topics of this chapter will be forthcoming in a separately published appendix volume.