Forms I-9s used in the employment eligibility verification process contain employees’ personal data.
As noted in guidance recently provided by the American Immigration Lawyers Association to its members, Form I-9s should be properly safeguarded as information on the Form I-9 could be determined to be Personally Identifiable Information (PII) under either federal or state privacy provisions or both.
Since Form I-9s are required to be retained by employers for certain periods of time in accordance with USCIS regulations, best practices include:
- storing such Form I-9s in locations where access is limited or locked,
- storing Form I-9s separately from the employee’s personnel file, and
- purging and properly destroying Form I-9s that have passed the USCIS mandated retention period and that are not required to be retained by any other law.
Electronically stored From I-9s should be password protected and within a records program that ensures only authorized personnel have access, provides for backup and recovery of records to protect against information loss, ensures that employees are trained to minimize the risk of unauthorized or accidental alteration or erasure and ensures that whenever an individual creates completes, updates, modifies, alters, or corrects an electronic record, the system creates a secure and permanent record that reflects the date of access, the identity of the individual who accessed the electronic record and the particular action taken with regard to the record.
Given the possibility of misdirected email or a security intrusion, Form I-9s sent via email should have password protection and should be sent via encrypted email.
If a Form I-9 has been completed but is now lost or misplaced, a data privacy expert should be consulted to identify the steps that an employer must take with regard to any data breach disclosure requirements.
To best protect company and employee information, employers should have a policy in place that defines PII for the company and provides guidance on how such information must be secured. Lost or misplaced Form I-9s should be included in any incident response plans the company has for possible data security breaches.
USCIS addresses email scams regarding Form I-9
U.S. Citizenship and Immigration Services (USCIS) has learned that employers have received scam emails requesting Form I-9 information that appear to come from USCIS.
Employers are not required to submit Forms I-9 to USCIS.
Employers must have a Form I-9, Employment Eligibility Verification, for every person on their payroll who is required to complete Form I-9.
All of these forms must be retained for a certain period of time.
These scam emails come from a fraudulent email address: [email protected]. This is not a USCIS email address.
The body of the email may contain USCIS and Office of the Inspector General labels, your address and a fraudulent download button that links to a non-government web address (uscis-online.org). Do not respond to these emails or click the links in them.
If you believe that you received a scam email requesting Form I-9 information from USCIS, report it to the Federal Trade Commission.
If you are not sure if it is a scam, forward the suspicious email to the USCIS webmaster at [email protected]. USCIS will review the emails received and share with law enforcement agencies as appropriate.
Please visit this USCIS webpage to read its notice regarding Form I-9 scams.
Yes! Please sign me up to receive email alerts from other Gunster practice areas.
This publication is for general information only. It is not legal advice, and legal counsel should be contacted before any action is taken that might be influenced by this publication.
About Gunster
Gunster, Florida’s law firm for business, provides full-service legal counsel to leading organizations and individuals from its 13 offices statewide. Established in 1925, the firm has expanded, diversified and evolved, but always with a singular focus: Florida and its clients’ stake in it. A magnet for business-savvy attorneys who embrace collaboration for the greatest advantage of clients, Gunster’s growth has not been at the expense of personalized service but because of it. The firm serves clients from its offices in Boca Raton, Fort Lauderdale, Jacksonville, Miami, Naples, Orlando, Palm Beach, Stuart, Tallahassee, Tampa Bayshore, Tampa Downtown, Vero Beach, and its headquarters in West Palm Beach. With more than 280 attorneys and consultants, and over 290 committed professional staff, Gunster is ranked among the National Law Journal’s list of the 500 largest law firms and has been recognized as one of the Top 100 Diverse Law Firms by Law360. More information about its practice areas, offices and insider’s view newsletters is available at www.gunster.com.
