Privacy Impact Assessment

Privacy Impact Assessment Update
for the

E-Verify Program: Use of Commercial Data for
Employer Verification
June 2, 2010
Contact Point
Claire Stapleton
Privacy Branch Chief
Verification Division
United States Citizenship and Immigration Services
703-603-2663
Reviewing Official
Mary Ellen Callahan
Chief Privacy Officer
Department of Homeland Security
(703) 235-0780

Privacy Impact Assessment Update
USCIS Verification Division, E-Verify Program
Page 2

Abstract
The Verification Division of the U.S. Citizenship and Immigration Services (USCIS) operates the EVerify Program, which provides verification of employment authorization for employers participating in
the E-Verify program. The E-Verify Program will collect additional employer business information from
both registering employers and a commercial data provider, Dun and Bradstreet (D&B), to enhance the
employer registration process, manage customer relationships, and improve reporting capabilities and
operational effectiveness. This expanded information collection pertains to registered employers
participating in the E-Verify Program.

Introduction
The E-Verify Program is a free and voluntary Department of Homeland Security (DHS) program
implemented by the USCIS Verification Division and operated in collaboration with the Social Security
Administration (SSA). It compares information provided by employees on the Employment Eligibility
Verification, Form I-9, against information in SSA and DHS databases in order to verify an employee's
employment eligibility. The Illegal Immigration Reform and Immigrant Responsibility Act of 1996
(IIRIRA) provides the statutory authority for E-Verify. On May 4, 2010, E-Verify published a PIA to
describe the program.1 This PIA update describes the expanded collection of business information from
both new registering employers and a commercial data provider, D&B, in order to ensure that registering
companies are genuine businesses. The commercial data consists of employer business information that EVerify will use to enhance the registration process, manage customer relationships, and improve reporting
capabilities and operational effectiveness. The information obtained from D&B is business information and
will include business contact information.
The E-Verify employer registration process requires that all employers (1) sign a Memorandum of
Understanding (MOU), which explains terms and conditions of using E-Verify, (2) complete a mandatory
tutorial and, (3) submit employer business information. Commencing on the date of publication of this
update, E-Verify will attempt to verify the submitted employer business information using commercial data
provided by D&B. E-Verify may be used by any type of employer from large corporations who verify staff
throughout the country all the way to individual employers who might want to verify the employment
eligibility of their domestic employees such as a nanny. Most employers however, will have established
themselves as corporate entities and thus will have created a corporate profile, therefore commercial data
about these employers will be publicly available to confirm their existence. Commercial data will assist EVerify in improving the quality of information collected during the online registration process by
providing additional verification of employer business information and using any discrepancies as an
opportunity to correct errors and eliminate duplicate employer registrations.

1

See http://www.dhs.gov/privacy.

Privacy Impact Assessment Update
USCIS Verification Division, E-Verify Program
Page 3

The registering employer previously provided E-Verify with their business name, business address,
mailing address, phone number and other information which is compared to information already in EVerify to eliminate duplicate registrations, as described in the E-Verify Privacy Impact Assessment. E-Verify
will now request the following new information to register: doing business as (DBA) name (if applicable),
the DUNS number (the Dun and Bradstreet identifier) (if applicable), the Administrator name, the Parent
Organization (if applicable), and the marketing channel (where the employer heard about E-Verify.)
Providing information on the marketing channel is optional. After checking for duplicate registrations EVerify will automatically send the company name and address to D&B where it will be compared against
the commercial database. D&B will assign each query a match grade and a confidence code which detail
what information matched and how well they matched and return this information to E-Verify.
If D&B issues a high confidence score (i.e., a very close or exact match), E-Verify will allow the
company to automatically register. If D&B returns a match with a low confidence score or a no match, EVerify automatically sends another request to the D&B database with any alternate addresses or business
names that the company may have provided during the application process to determine if a match can be
found. If D&B still cannot match on this information, E-Verify personnel review and assess whether the
online registration should be completed.
This manual assessment involves three steps, (1) again review whether there is an existing
duplicate or similar registration for the commercial entity in E-Verify. This will ensure that E-Verify
information is accurate and relevant (2) validate whether the records actually match and the company can
be registered without additional information, and (3) attempt to contact the employer by phone or email
to verify the information provided by the employer. E-Verify will reject an online employer registration
when: it is a duplicate of an existing registration, or when it is unable to confirm the registration
information directly with the employer. D&B will not have information on certain types of employers such
as new businesses or individuals who are employers. For example, if an individual is hiring a domestic
employee and they wanted to use E-Verify, D&B would likely have no information on that individual
employer. In this case D&B will return a no match and E-Verify will contact the individual employer and
confirm that they are in fact seeking to verify employment eligibility for an employee.
E-Verify’s use of commercial data for registering employers participating in the program provides a
number of programmatic, operational, and customer service-oriented benefits. First, it helps to ensure that
only valid companies enroll in E-Verify thereby establishing a level of identity assurance of the employer
and thus minimizing the chances of fraudulent companies from using E-Verify to confirm personal
information for illegal purposes. It will also enable the Verification Division to identify duplicate
registrations. In addition, use of commercial data will simultaneously improve the program’s operational
effectiveness and customer relationships with registered employers by enabling real-time validation of
registration information and facilitating communication between employers and the E-Verify Program.
Finally, E-Verify will use D&B information to generate new reports that will enable the program to measure
the effectiveness of the online employer enrollment process as well as plan for growth projections should EVerify requirements mandate participation by a broader population.

Reason for the PIA Update
E-Verify will be collecting additional information from registering employers and comparing it
against data provided bya commercial data provider. The use of commercial data will, among other things,

Privacy Impact Assessment Update
USCIS Verification Division, E-Verify Program
Page 4

be used to reduce the potential for fraudulent participation in E-Verify, thus protecting employees’
personally identifiable information (PII).

Privacy Impact Analysis
The System and the Information Collected and Stored within the System
The use of commercial data by E-Verify to verify employers positively impacts privacy because it
provides a greater level of confidence that employer registrants are valid employers seeking to verify that
their employees are employment authorized. E-Verify will compare the employer-provided registration
information against D&B information. The comparison will help to authenticate the employers using the EVerify system.
In addition to the information currently provided and described in the E-Verify PIA, registering
companies will now provide the following new information:
Doing Business As (DBA), if available;
DUNS number – Dun & Bradstreet Identifier, if available. Not all employers will
have a DUNS number, and other information such as address and phone number
will be used to differentiate similar employees;
Administrator Name – Links a company to its corporate administrator. This is the
new name of the field formerly known as “Corporate Administrator”;
Estimated Hiring Projections;
Marketing Channel Inquiry – The registering entity will be asked to identify how
they heard about E-Verify by selecting an option from a “drop down” menu.
Providing this information is optional. The answer to “how did you hear about EVerify?” will allow the Outreach branch to assess the usefulness of marketing
efforts and fine tune the existing marketing strategy;
D&B will provide the following new information, which will be used to determine whether a company
registering to use E-Verify is a valid company and for segmentation (e.g., by industry or geographic
location) of enrolled companies for reporting purposes. These fields which will be retained as part of the
E-Verify information on the companies are:
Confidence Code – D&B generated and used to identify the confidence of a match between
the registration record and the D&B record
Address Source - An indicator passed back from D&B that identifies whether the employer
submitted address was matched to the business address or an alternative address
Line of Business – Description of Business activity used to categorize the business for
reporting and customer management purposes

Privacy Impact Assessment Update
USCIS Verification Division, E-Verify Program
Page 5

Local Business ID –D&B name for the Employer Identification Number (EIN) used to
confirm self reported EIN
Mailing Address – Used to confirm self-reported information
Match Grade – Used to show closeness of match for each element “matched” on
NAICS Code - North American Industry Code System, used to confirm self reported
information
Physical Address – If different then mailing address used to confirm self reported
information
Small Business Indicator – Indicates that the business is a small business as defined by the
Small Business Administration (SBA) used to categorize the business for reporting and
customer management purposes
Source System – What name is matched on from the D&B database. This is an indicator
passed back from D&B that indicates which name was matched on – either the business
name or alternative name (DBA).
United States-based parent company name and DUNS Number – Used to associate
companies with related companies for E-Verify registration purposes
Year Started - Year the business started operating, used to categorize the business for
reporting and customer management purposes
Bankruptcy Indicator –Used to determine whether a company is in operation
Criminal Activity Indicator – Used to determine whether additional scrutiny is needed
during registration
Employee Here, Employee Here Code, and Employee Percent Growth – Number of
employees at a particular location used to manage E-Verify based on growth projections
Employee Total and Employee Total Code – Number of employees at all business locations
used to manage E-Verify based on growth projections
Foreign-based Parent Company and Foreign-based Parent Company Country Code – Used
to associate companies with related companies for E-Verify registration purposes
Government Contractor – Indicates the presence of at least one federal contract award to
this company used to categorize the business for reporting and customer management
purposes
Out of Business Flag – Indicates whether the company may be out of business used to
determine whether additional scrutiny is needed during registration
Parent HQ Name and DUNS number, Legal business name and DUNS number of the
Parent/HQ – used to associate companies with related companies for E-Verify registration
purposes

Privacy Impact Assessment Update
USCIS Verification Division, E-Verify Program
Page 6

Uses of the System and the Information
E-Verify will collect additional business information from two sources: registration information
from the employer and compare it against information provided by D&B. After doing an automatic deduplication process, E-Verify will send this information (business name, doing business as (DBA) name,
physical and mailing addresses, and MOU signatory telephone number) received during the registration
process to D&B where it will be compared against its database and assigned a match grade and a confidence
code and return this information to E-Verify. D&B data is a compilation of company information from
publicly available sources and from trade information that D&B receives from trade organizations with
which they have agreements. The confidence code indicates the level of confidence that D&B has that the
registering organization matches the organization that D&B has on record. The match grade details what
information elements provided by the registering organization matched and how well they matched. D&B
returns all matches to E-Verify.
If there is a high confidence match, E-Verify will allow the company to register automatically. If
D&B returns a low confidence code or no match could be found in the D&B database, E-Verify
automatically sends another request to the D&B database with an alternate address or business name, if
available, to determine if a match can be found.
If D&B cannot match on this information E-Verify assesses whether the registration should be
completed. This assessment involves three steps: (1) again review whether there is an existing duplicate
registration in E-Verify; (2) validate whether the records actually match and the company can be registered
without additional information; and (3) attempt to contact the employer by phone or email to verify the
information if there is no match. E-Verify will reject an online registration when it is a duplicate of an
existing registration, (e.g., originally registered under company name but now attempting register under a
DBA) or if an E-Verify representative is unable to confirm the registration information directly with the
employer. D&B will not have information on certain types of employers such as new businesses or
individuals who are employers. For example, if an individual is hiring a domestic employee and they
wanted to use E-Verify D&B would likely have no information on that individual employer. In this case
D&B will return a no match and E-Verify will contact the individual employer and confirm that they are in
fact seeking to verify employment eligibility for an employee.
The use of commercial data by E-Verify to verify employers positively impacts privacy because it
provides a greater level of confidence that employer registrants are legitimate employers seeking to verify
that their employees are employment authorized. It also provides programmatic and operational benefits
by for example, reducing duplicate registrations, enabling real-time registration validation and enhanced
reporting capabilities that will allow E-Verify to measure operational effectiveness.

Retention
The E-Verify program will retain the new information for ten (10) years from the date of the last
transaction. This is not a change from the current retention schedule for the existing records in E-Verify.
The retention schedule N1-566-08-7 has been approved by NARA as of June 5, 2008.

Internal Sharing and Disclosure
There is no change from the DHS internal sharing and disclosures as described in the previous EVerify PIA. When potential fraud or misuse is indicated by E-Verify information or the D&B information,

Privacy Impact Assessment Update
USCIS Verification Division, E-Verify Program
Page 7

this information may be shared, on a case-by-case basis, with DHS internal law enforcement organizations
such as the Immigration and Customs Enforcement (ICE). E-Verify will share only that information
required to pursue an investigation into the potential fraud or misuse of the E-Verify system.

External Sharing and Disclosure
The E-Verify program will be sharing business name, doing business as (DBA) name, physical and
mailing addresses, and MOU signatory telephone number with D&B for verification purposes. All other
sharing remains as described in the E-Verify PIA. There will only be minimal sharing, only information
required for verification of the registrant will be shared with D&B.

Notice
Notice is being provided by this PIA Update. Additionally, a banner notice of the new registration
process will be published on the E-Verify website in advance of this enhancement being put in place.
Additionally, when a company decides to register, a list of required information is provided in the
beginning of the registration process so that a company can assess up front what information it needs to
gather and whether or not it wants to register based on the information requirements.

Individual Access, Redress, and Correction
Once an employer has registered to use E-Verify, each program administrator has full access to the
company’s profile and can update the information they provided as needed. The information that is
provided by the registering entity can always be edited once the entity is fully registered. The information
provided by D&B will not be available to the employer through the company’s profile page. An employer
by may request this information through a Privacy Act or FOIA request.
E-Verify provides redress if the company receives a low confidence match score from D&B. If the
match score is below a certain threshold, the E-Verify customer contact center will attempt to contact the
company by email or phone. If E-Verify can confirm the registration information with the employer the
company will be allowed to continue registering. The initial mismatch has no effect on the future
relationship between the company and E-Verify as long as it is resolved. If registration is denied because
the E-Verify representative is unable to confirm the registration information with the company, the
company can always attempt the registration process again in the future. The company is not banned from
E-Verify but the information will have to be confirmed prior to the company’s registration being
completed.

Technical Access and Security
D&B has no access to the E-Verify program, however, there is a connection between E-Verify and
the commercial data provider via the Enterprise Service Bus (ESB), however this connection is strictly
limited to the transfer of the business information for the purposes described in this PIA Update. This
connection does not permit access to the E-Verify system and therefore has a minimal impact on privacy.

Technology
No change from the technology described in the E-Verify PIA.

Privacy Impact Assessment Update
USCIS Verification Division, E-Verify Program
Page 8

Responsible Official
Claire Stapleton, Chief
Privacy Branch, Verification Division
United State Citizenship and Immigration Services
Department of Homeland Security

Approval Signature

Original signed copy on file with the DHS Privacy Office
Mary Ellen Callahan
Chief Privacy Officer
Department of Homeland Security