Worker surveillance must comply with credit reporting rules