DOL Whistleblower Rule Will Have Far-Reaching Effects

Portfolio Media. Inc. 860 Broadway, 6th Floor New York, NY 10003 www.law360.com Phone: +1 646 783 7100 Fax: +1 646 783 7161 customerservice@law360.com DOL Whistleblower Rule Will Have Far-Reaching Effects Law360, New York (May 05, 2014, 12:05 PM ET) -- On April 4, 2014, the U.S. Department of Labor issued an interim final rule establishing procedures concerning the manner in which the U.S. Occupational Safety and Health Administration will address employee whistleblower complaints under the Consumer Financial Protection Act.[1] Although the interim final rule is effective immediately, the DOL will accept comments on the rule until June 2, 2014. The DOL based the OSHA CFPA whistleblower rule on existing OSHA procedures. The DOL s commentary to the rule relies frequently on guidance from other whistleblower provisions that OSHA administers, such as the whistleblower protections in the Sarbanes- Oxley Act.[2] Familiarity with the complaint procedures, however, is unlikely to provide comfort to the banks, nonbanks and service providers that have had to deal with Consumer Financial Protection Bureau supervisory examinations and investigations for more than two years now. Rather, the rule adds another regulatory layer that will continue to keep compliance officers and attorneys busy with the rule s wide scope of covered employees and protected activities. Since the CFPB became fully operational in 2012, its power to enforce the CFPA is extremely broad. The CFPB has exercised jurisdiction over any person or entity that: (1) may have violated a law that the bureau enforces or (2) may provide evidence of a violation of a law that the bureau enforces. It will be interesting to see whether OSHA interprets and enforces the rule with the same vigor that the CFPB has been interpreting and enforcing the federal laws that it enforces. What Employees are Covered by the Interim Final Rule? The interim final rule applies to all covered employees. [3] The term covered employees is broadly defined to include any individual performing tasks related to the offering or provision of a consumer financial product or service. [4] Further expanding the rule s coverage, a covered employee includes current, former and prospective employees.[5] Finally, a covered employee also includes any person whose employment could be affected by a covered person [under the CFPA] or service provider where

such an individual was performing tasks related to the offering or provision of a consumer financial product or service at the time the individual engaged in protected activity under the CFPA. [6] Thus, unlike SOX's whistleblower provisions, the CFPA s whistleblower rule applies to both public and private companies that fall within the CFPA s definition of covered person or service provider. [7] The broad scope of the term covered employee is not surprising given that the CFPA provides the CFPB with the broad authority to investigate, and initiate enforcement actions against, people and companies that allegedly violate one of the 18 federal consumer financial protection laws that the CFPB enforces.[8] The scope of the term covered employees also likely includes employees of businesses that are, in most cases, statutorily exempt from the CFPB s jurisdiction, such as employees of attorneys.[9] It appears that, like the CFPB, OSHA will be allowed to exercise jurisdiction over these employees if these employees are whistleblowers with respect to any of the laws that the CFPB enforces. The potential inclusion of otherwise exempt categories of employees is not unexpected because the CFPB has filed enforcement actions against persons and entities like attorneys and insurers arising out of alleged violations of one of the laws that the CFPB enforces.[10] The term covered employee is far-reaching in other ways. For example, the CFPB has been investigating and executing consent orders with banks arising out of alleged Equal Credit Opportunity Act violations with respect to indirect auto lending.[11] The CFPB, however, has yet to execute a consent order or file a public enforcement action against an auto dealer for allegedly engaging in supposed ECOA violations. Although the CFPB s indirect auto lending enforcement actions have focused on the lender s alleged wrongdoing,[12] it is likely that a covered employee under the DOL s CFPA-related whistleblower rule would include an employee of an auto dealer who claims to have suffered adverse employment action after raising issues to an employer that may concern equal credit opportunities for buyers. The examples of the potentially far-reaching scope of the rule do not stop there. An employee of a service provider that solicits customers to purchase credit card add-on products on behalf of a large bank would also likely fall within the definition of a covered employee if he or she incurs adverse employment action for reporting the violation of a law that the CFPB enforces. However, the CFPB has so far executed consent orders only with the banks issuing the credit cards, not with the service providers soliciting the add-on products.[13] What Acts Fall Within the Scope of Protected Whistleblower Activity? A covered employee may file a complaint with OSHA if the employee believes that an employer retaliated against the employee for any of the following reasons: Reporting violations of any law that the CFPB enforces to his or her employer or to a government agency; Reporting what the employee reasonably believes to be a violation of a law that the CFPB enforces to his or her employer or to a government agency; Participating in an investigation of potential violations of a law that the CFPB enforces; or

Refusing to participate in acts that the employee believes to be violations of a law that the CFPB enforces.[14] The CFPA s list of protected whistlebower activities has the potential to be incredibly broad. Covered employees are protected for reporting alleged violations not only of the 18 federal consumer protection laws that were transferred, in whole or in part, to the CFPB,[15] but also for violation[s] of any law... subject to the jurisdiction of, or enforceable by, the [CFPB]. [16] This would therefore include the CFPB s wide-ranging catchall authority to regulate unfair, deceptive, or abusive acts or practices ("UDAAP") related to the provision of consumer financial products or services.[17] Because a UDAAP violation can potentially include virtually any act or omission that does not pass the CFPB s smell test, the scope of protected activities is potentially broad. The CFPB s UDAAP-related enforcement actions and public statements concerning the broad scope of UDAAP provide a roadmap that OSHA may follow.[18] When Must an Employee File a Whistleblower Complaint and What Happens After the Filing? A covered employee must file a complaint with OSHA within 180 days of the adverse action giving rise to the complaint.[19] The CFPB investigates potential violations of the 18 consumer protection laws that it enforces despite whether the limitations period for the underlying alleged violation has expired.[20] Therefore, employers should not be shocked if OSHA deems a whistleblower complaint to be timely if it is filed within this 180-day period, even if a CFPB enforcement action for the alleged underlying CFPA violation is time barred. Once a covered employee files a timely complaint, the interim final rule establishes a low threshold for OSHA to proceed with a CFPA whistleblower investigation; the employee need only make a prima facie showing that he or she was retaliated against in violation of the CFPA.[21] The interim final rule, however, presents employers with two opportunities to dismiss a CFPA whistleblower complaint early in the complaint process. OSHA must dismiss a CFPA whistleblower complaint if: (1) the employee fails to make the required prima facie showing; or (2) the employer rebuts that showing by clear and convincing evidence that it would have taken the same adverse action absent the protected [whistleblowing] activity. [22] If OSHA does not dismiss the whistleblower complaint after the initial stage, OSHA must determine whether there is reasonable cause to believe that protected activity was a contributing factor in the alleged adverse action. [23] Providing some degree of predictability, in its commentary to the interim final rule, the DOL indicated that OSHA will interpret the term contributing factor the same way that it interprets the term in the other whistleblower protection statutes that OSHA administers. Thus, a contributing factor is any factor which, alone or in connection with other factors, tends to affect in any way the outcome of the decision. [24] Even if OSHA determines that there is reasonable cause that the alleged protected activity was a contributing factor in the adverse action, OSHA may not order relief if the employer demonstrates by clear and convincing evidence that it would have taken the same action in the absence of the protected activity. [25] Following its investigation, OSHA must issue findings on whether there is reasonable cause to believe that the complaint has merit within 60 days of the filing of the whistleblower complaint.[26] OSHA must also order appropriate relief, if any, within this 60-day period.[27] The relief may include preliminary reinstatement, or salary and benefits without returning to work in appropriate

circumstances, affirmative action to abate the violation, back pay with interest and compensatory damages. [28] Other than the foregoing relief, as well as attorneys fees and other costs, the interim final rule does not provide for any other monetary relief for an employee, such as a cash reward independent of salary and benefits. This stands in contrast to SOX's whistleblower rules, under which a whistleblower may receive a bounty for his or her tip. OSHA s findings will be final unless either party files objections. If a party objects, there will be a hearing before an administrative law judge, after which either party may seek appellate relief. Either party may appeal the administrative law judge's decision to the DOL s Administrative Review Board and, after that, to the appropriate federal court of appeals.[29] However, this is not the only avenue for judicial review. Placing an emphasis on quickly resolving whistleblower disputes, the CFPA provides that if there has been no final decision... within 210 days after the date of the filing of the complaint, or within 90 days after the receipt of a written determination following OSHA s investigation, the employee may file a de novo action in a federal district court.[30] Employers must keep in mind that the dismissal of a whistleblower complaint does not necessarily mean that the regulators will disappear. The CFPB will investigate whether the claim underlying the adverse action against the employee has merit. Despite the rule s coexistence with OSHA s established procedural rules, the broad definition of the term covered employees and the scope of the rule s protected activities create uncertainty that will have a significant impact on all persons and entities that engage in acts that may violate any law that the CFPB enforces. By Keith J. Barnett and Charles M. Kruly, Sutherland Asbill & Brennan LLP Keith Barnett is a partner in Sutherland Asbill & Brennan's Atlanta office. Charles Kruly was previously an associate in Sutherland Asbill & Brennan s Washington, D.C., office. The opinions expressed are those of the author(s) and do not necessarily reflect the views of the firm, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice. [1] Procedures for Handling Retaliation Complaints Under the Employee Protection Provision of the Consumer Financial Protection Act of 2010, 79 Fed. Reg. 18,630 (April 3, 2014) (to be codified at 29 C.F.R. pt. 1985). [2] See, e.g., id. at 18,633. [3] Id. [4] 12 U.S.C. 5567(b) (emphasis added). [5] 79 Fed. Reg. at 18,633. [6] Id. [7] Id. [8] See Consumer Financial Protection Act of 2010, 1002(12) (listing the consumer protection laws

within the CFPB s jurisdiction); id. 1051-58 (granting the CFPB enforcement authority). [9] Id. 1027(e) (providing that, generally, the CFPB may not exercise any supervisory or enforcement authority with respect to an activity engaged in by an attorney as part of the practice of law ); id. 1027(i) (providing that [t]he CFPB shall have no authority to exercise any power to enforce [the CFPA] with respect to a person regulated by the [SEC] but requiring the CFPB and the SEC to consult and coordinate regarding SEC rules that might affect products or services regulated by the CFPB). [10] See, e.g., CFPB v. Chance Edward Gordon, 12-CV-06147, Complaint (C.D. Cal., July 18, 2012), available at http://files.consumerfinance.gov/f/201207_cfpb_enforcement-complaint-filed_gordonlaw.pdf (CFPB enforcement action against an attorney and entities controlled by the attorney for engag[ing] in an ongoing, unlawful mortgage relief scheme that prey[ed] on financially distressed homeowners nationwide by falsely promising a loan modification in exchange for an advance fee ). [11] See, e.g., In re Ally Financial, Inc., Consent Order, 2013-CFPB-0010 (CFPB Dec. 20, 2013), available at http://files.consumerfinance.gov/f/201312_cfpb_consent-order_ally.pdf. [12] See CFPB Bulletin 2013-02, Indirect Auto Lending and Compliance with the Equal Credit Opportunity Act, Mar. 21, 2013, available at http://files.consumerfinance.gov/f/201303_cfpb_march_-auto-finance- Bulletin.pdf. [13] See In re Bank of America, N.A. and FIA Card Services, N.A., Consent Order, 2014-CFPB-0004 (CFPB Apr. 9, 2014), available at http://files.consumerfinance.gov/f/201404_cfpb_bankofamerica_consentorder.pdf. [14] Id. [15] See Consumer Financial Protection Act of 2010, 1002(12) (listing the consumer protection laws within the CFPB s jurisdiction). [16] 79 Fed. Reg. at 18,633. [17] Consumer Financial Protection Act of 2010, 1031(b) (authorizing the CFPB to prohibit unfair, deceptive, or abusive acts or practices ). [18] See, e.g., CFPB v. Am. Debt Settlement Solutions, Inc., No. 9:13-cv-80548-DMM, Stipulated Final Judgment and Order (S.D. Fla. June 7, 2013), available at http://files.consumerfinance.gov/f/201306_cfpb_finalorder_adss_signed-judgment.pdf (stipulated order finding that debt relief services were abusive ); CFPB Bulletin 2013-07, Prohibition of Unfair, Deceptive, or Abusive Acts or Practices in the Collection of Consumer Debts, July 10, 2013, available at http://files.consumerfinance.gov/f/201307_cfpb_bulletin_unfair-deceptive-abusive-practices.pdf. [19] 79 Fed. Reg. at 18,633. [20] See In re PHH Corp., Decision and Order on Petition to Modify or Set Aside Civil Investigative Demand, 2012-MISC-PHH Corp-0001 at 7 (Sept. 20, 2012), available at http://files.consumerfinance.gov/f/201209_cfpb_setaside_phhcorp_0001.pdf (requiring a firm to produce documents and information outside the applicable limitations period because the issue... is

not whether all such information is itself actionable; rather the issue is whether such information is relevant to conduct for which liability can be lawfully imposed ). [21] Id. at 18,633-634. [22] Id. at 18,634. [23] Id. (emphasis added). [24] Id. (quoting Marano v. Dep t of Justice, 2 F.3d 1137, 1140 (Fed. Cir. 1993). [25] Id. (quoting 12 U.S.C. 5567(c)(3)(C)) (emphasis added). [26] Id. [27] Id. [28] Id. at 18,636-37. [29] Id. at 18,636-637. [30] 12 U.S.C. 5567(c)(4)(D). All Content 2003-2014, Portfolio Media, Inc.