It’s a well-known problem for many HR and hiring managers in the US: those pesky I-9 employment eligibility forms have a tendency to slip away from their intended binders or cabinets and seek refuge in desk drawers and personnel-related folders where they have no business hanging out. One of my most memorable attorney audits involved a company which had a seemingly endless supply of hidden I-9s, which gradually resurfaced with a predictable and yet amusing exclamation – (“Look, I found another one!”)
That was several years ago. Today, we all know this is really not that funny of a situation when you consider that Immigration and Customs Enforcement (ICE) can demand these forms within a very short 72-hour time period and assess penalties for any substantive or uncorrected technical paperwork violations. We now also know (or perhaps more keenly understand) that an I-9 form is a highly sensitive document, containing enough personally identifiable information to ruin your employee’s credit history, should the form fall into the wrong hands.
Fortunately, there is a solution (which does not involve repeated checking of desk drawers): adopt and utilize an electronic I-9 system. As we’ve discussed on this blog in the past, a well-designed electronic I-9 system will enable employers to securely generate and store I-9s in electronic form, which can be protected with strong encryption, user-based access privileges, and frequent backups. But what happens if you start using an electronic I-9 system and find later that you cannot get to this information when you need it most? Well, as we learned this week, you do what every other business would do – you go to court.
LexisNexis Sues USVerify over access to electronic I-9 data
Last week, LexisNexis, a well-known provider of online research information and other services, filed a breach of contract suit requesting injunctive relief against another company, USVerify, which had been providing LexisNexis clients an electronic I-9 and E-Verify product under a 5-year reseller agreement. LexisNexis notified USVerify that it would not be renewing its Reseller Agreement upon its expiration at the end of this month and requested the return of its customers’ I-9 information in a format that would be suitable to LexisNexis’ new reseller partner.
So far, so good, right? Well, here’s where it gets interesting. In response, USVerify argued that they are not obligated under the terms of the Reseller Agreement to perform this work without additional compensation. In addition, USVerify “informed LexisNexis that it intended to contact LexisNexis’ customers and inform them of the need to make arrangements for ‘replacement services’ after the expiration of the agreement,” according to the complaint. LexisNexis argues that USVerify is barred (under the terms of the reseller agreement) from directly selling its I-9 and E-Verify product to LexisNexis customers and claims that USVerify has caused approximately $600,000 in damages by allegedly doing so with at least one customer.
Time for the lawyers. Specifically, LexisNexis is requesting that the court grant an injunction requiring USVerify to (1) immediately return all customer information to LexisNexis; (2) immediately produce all I-9 information in a usable and readily accessible format that complies with the regulations; (3) maintain and directly provide the government with any necessary I-9 information in the event of an I-9 audit during the transition period; and (4) permanently cease and desist from using any information about LexisNexis customers. The complaint also requests an award of damages and reasonable attorneys’ fees and costs.
Electronic I-9 Regulations
In addition to the breach of contract issue, there is also the matter of the electronic I-9 regulations. As we have discussed in the past, the regulations (finalized last year) specify a variety of recordkeeping, access, and security standards which must be followed in any system which generates or stores I-9 records. While the regulations are most often implicated when evaluating audit trails and electronic signatures, they also dictate the level of access that must be afforded to ICE or a similar agency.
Specifically, the regulations state that “[a]n electronic generation or storage system must not be subject, in whole or in part, to any agreement (such as a contract or license) that would limit or restrict access to and use of the electronic generation or storage system by an agency of the United States, on the premises of the employer, recruiter or referrer for a fee (or at any other place where the electronic generation or storage system is maintained), including personnel, hardware, software, files, indexes, and software documentation.”
This provision will undoubtedly cause major concern to employers if their chosen vendor is unable or unwilling to provide requested information in a timely fashion.
Lessons for Employers Using or Considering Electronic I-9 Systems
Needless to say, this is a very messy situation, and the employer (end user) seems to be caught right in the middle. We have a potential breach of contract, a possible violation of the electronic I-9 regulations, and a severe nightmare if ICE happens to request those I-9 records while this whole mess is being sorted out. What are the lessons learned for employers using (or considering using) an electronic I-9 product?
1. Always get your immigration/employment counsel involved before signing up to use an electronic I-9 and E-Verify system.
I’ve mentioned the role of counsel many times on this blog, but I think it cannot be emphasized enough when you consider the potential legal ramifications and headaches if you choose a system which is not fully compliant with the regulations. Experienced immigration and employment law counsel will be able to spot potential compliance issues and guide you through the “must-haves” in your system – proper audit trails, electronic signature capabilities, E-Verify features, and the myriad of other requirements.
2. Know who your I-9 and E-Verify provider really is
When using a background screening provider, applicant tracking system, or all-in-one solution, employers must still perform their due diligence on the company that is actually providing the electronic I-9 and E-Verify services. Does the vendor specialize in compliance software? Does the vendor have the necessary technical and legal resources to ensure a compliant and secure system? Is the vendor financially viable – and what will happen if they discontinue the service? Ultimately, your organization will need to learn the answers to these questions in order to make an informed decision.
3. Make sure the contract specifies who owns the data and how it will be returned
Most employers think it’s obvious that they own the electronic I-9 and E-Verify data (in the same way they own the paper files), but it’s always important to read the fine print! In the case at hand, it appears this point was not clearly defined, leading to a potentially messy and disastrous situation for some employers. To avoid this potential landmine, always make sure to study the license agreement closely and demand a provision which sets out the unambiguous data ownership by the employer.
4. Data Backups are essential, when everything is electronic
Even if you’re confident that you own the data, you’ll want to make sure that you can have easy access to it in the event of an ICE or DHS audit or because you’ve decided to switch to a different platform. Look for a vendor that will provide you with a complete back up of all your data in an industry standard format that includes I-9s, E-Verify letters and results and other supporting documents. Also, it’s wise to ask how frequently these backups can be made available to you as part of the vendor’s standard service.
While it’s too early to tell how this particular case will unfold, the message to employers remains clear: with I-9 enforcement at an all-time high, it’s now a question of “when” rather than “if” your organization will be audited. . If you’re using or considering using an electronic I-9 system to ease the pain and get your house in order, remember to consult your immigration counsel, perform your security and legal due diligence, and look for a trusted vendor who can assure you. that your I-9s will be safe and secure, no matter what time of the day it is!