Pia

Privacy Impact Assessment Update
for the

Verification Information System
November 20, 2008
Contact Point
Claire Stapleton
Privacy Branch Chief
Verification Division
United States Citizenship and Immigration Services (USCIS)

Reviewing Officials
Donald Hawkins
Chief Privacy Officer
USCIS
(202) 272-8000
Hugo Teufel III
Chief Privacy Officer
Department of Homeland Security
(703) 235-0780

Privacy Impact Assessment Update 
USCIS, Verification Information System (VIS) 
Page 2 

Abstract
The Verification Division of the U.S. Citizenship and Immigration Services (USCIS)
operates the Verification Information System (VIS). VIS is a composite information system that
provides immigration status verification for government agencies and verification of employment
authorization for employers participating in the E-Verify program. USCIS is conducting this
Privacy Impact Assessment (PIA) to: 1) cover the expansion of VIS to collect and verify
information from United States Passports and Passport Cards from E-Verify users, 2) describe the
expansion of the scope of SAVE to include verification of citizenship and immigration status for
any DHS lawful purpose, not just for government benefit granting purposes as described in
previous PIAs, and 3) describe the expansion of the scope of E-Verify to indicate that it is no
longer solely voluntary in some cases and no longer solely for new employees in certain cases.

Introduction
The Verification Information System (VIS) is the technical infrastructure that enables USCIS
to operate SAVE and E-Verify. VIS is a nationally accessible database of selected immigration status
information containing more than 100 million records about individuals. Government agencies
use SAVE information to verify citizenship and immigration status for individuals as provided by
law. Typically, this includes determining whether a non-citizen is eligible for any public benefit,
license, or credential and determining immigration status for purposes of legally mandated
background investigations. These legally mandated background investigations might be
conducted by the Office of Personnel Management (OPM) or other government entities where
determination of immigration status is relevant to the reason for conducting the investigation in
the first place. Private and government employers use E-Verify information to determine whether
an employee is authorized to work in the United States.
VIS is being iteratively developed and deployed and as changes are made to the system, an
update to the PIA will be published to reflect these changes. The most recent PIA updates were
published April 1, 2007, September 5, 2007, and February 28, 2008. These may be found on the
DHS Privacy website, www.dhs.gov/privacy.
USCIS is conducting this Privacy Impact Assessment (PIA) to describe expansions to the
scope of VIS from recent and upcoming changes in the SAVE and E-Verify user population and to
describe enhancements to the information sources that VIS will access in order to improve the
ability of USCIS to verify citizenship and immigration status. Specifically, this PIA is published to:
1) cover the expansion of VIS to collect and verify information from United States Passports and
Passport Cards from E-Verify users, 2) describe the expansion of the scope of SAVE to include
verification of citizenship and immigration status for any DHS lawful purpose, not just for
government benefit granting purposes as described in previous PIAs, and 3) describe the

Privacy Impact Assessment Update 
USCIS, Verification Information System (VIS) 
Page 3 

expansion of the scope of E-Verify to indicate that it is no longer solely voluntary in some cases
and no longer solely for new employees in certain cases.
Expansion of VIS to Collect and Verify United State Passports and Passport Cards
E-Verify is used to determine whether an individual is authorized to work in the U.S. An
employer who participates in E-Verify uses the information that they have previously collected for
the Form I-9 process. Thus a U.S. citizen may present a Passport or Passport Card for purposes of
proof of employment authorization for the Form I-9. The Passport Card is a new identity
document issued by Department of State (DOS) that will act as a passport in limited circumstances
and will be acceptable for use in place of a U.S. passport for Form I-9 and E-Verify purposes. The
information contained on the Passport Card is the same information in the passport other than the
document identification number. It is possible to have a U.S. Passport and a Passport Card. The
numbers on the two documents would not be the same. The U.S. Passport and the Passport Card
can both be used to establish identity and work authorization for Form I-9 purposes, Currently, an
E-Verify employer captures the passport information (if presented as a List A document) from an
employee; however, prior to this update the VIS system neither captured nor confirmed the
passport number against government held data.
Regardless of the identity document presented to the employer for the Form I-9, the VIS
system requires an employee’s Social Security Number (SSN) to verify employment eligibility.
With this update, if an employee presents a U.S. Passport or Passport Card, VIS will initially check
the employee’s identity information, including Name, Date of Birth, and SSN, against the Social
Security Administration (SSA) database; however, if SSA cannot verify the employee’s citizenship
status information then VIS will verify the employee’s Passport or Passport Card data against DOS
data using an existing interface with Customs and Border Protection’s (CBP) Treasury Enforcement
Communications System (TECS). It may not be possible to determine an employee’s work
authorization solely through a query to the SSA database, for example, because SSA may not have
been informed that an immigrant has become a U.S. citizen. Previously, such an inability to verify
would have resulted in requiring the employee to visit an SSA Field Office and clarify citizenship
status with the SSA.
If the SSN is verified, VIS will verify the Passport number or Passport Card number so that
an employer can have the capability to visually compare the photograph that appears on a Passport
or Passport Card with the photograph that DOS has on file. E-Verify provides access to this
information through the Photo Screening Tool which is described in the PIA published September
4, 2007. VIS will not retain a copy of the photograph as provided from the DOS data, merely a
link that can be followed to retrieve the photograph in TECS should it need to be validated later.
However, VIS may retain a hard copy of the photograph when an initial verification cannot be
done by the employer and a secondary verification has to be done by the Verification Division

Privacy Impact Assessment Update 
USCIS, Verification Information System (VIS) 
Page 4 

Status Verifiers. This is the same procedure followed for other documents where the initial
verification cannot be done by the employer.
Expansion of SAVE for Verification of Citizenship and Immigration Status
SAVE has previously been characterized as being limited to immigration and citizenship
status verification for purposes of eligibility for any public benefit, license or credential—the
benefit or “entitlement” is referred to in the name of the program Systematic Alien Verification for
Entitlements (SAVE). However, Section 642(c) of the Illegal Immigration Reform and Immigrant
Responsibility Act of 1996 (IIRIRA) obligates USCIS to respond to inquiries “by a Federal, State, or
local government agency, seeking to verify or ascertain the citizenship or immigration status of
any individual within the jurisdiction of the agency for any purpose authorized by law.”
Accordingly, to the extent that a federal, state, or local government entity has the legal
authority to verify citizenship or immigration status, SAVE, as an access method to USCIS systems,
is authorized to respond to the request. Specifically, in addition to the verifications for purposes
of granting government benefits, this includes verification for purposes of legally mandated
background investigations. These legally mandated background investigations might be
conducted by the OPM or other government entities where determination of immigration status is
relevant to the reason for conducting the investigation, such as for Federal personnel security
clearances or staff in sensitive critical infrastructure facilities in the private sector. For certain
security clearances OPM may verify not only the individual who is the subject of the background
investigation, but also their family members and cohabitants (associated individuals) based on
information the subject provides OPM. The associated individuals who are being verified through
SAVE will only have notice of the verification by means of this SORN and accompanying PIA.
Change in the Scope of E-Verify
E-Verify, including its original iteration as Basic Pilot, has operated to date as a program for
employers to verify employment eligibility of their new employees. Employers have not been
permitted to verify the employment eligibility of existing employees. Recently, several state and
Federal laws have required employer participation in the program for new hires in various
circumstances. These laws range from some states requiring that all employers in that state
participate in E-Verify, to other states requiring the state contractor workforce or government
employers to participate. In addition, the Federal government requires that all newly-hired
Federal employees be verified through E-Verify, and has adopted a federal procurement policy of
contracting only with employers that agree to use E-Verify to verify the work authorization of
their new employees as well as all employees assigned to work on federal contracts. As a result,
the population of E-Verify users has expanded, and will continue to expand. E-Verify will also
begin to be used for some employers’ existing workforce in addition to newly hired employees.

Privacy Impact Assessment Update 
USCIS, Verification Information System (VIS) 
Page 5 

Privacy Impact Analysis
The System and the Information Collected and Stored within the System
With the publication of this PIA, VIS will collect and verify U.S. Passport and Passport Card
data, which when required for secondary verification purposes may include photographs, from
employees who present a U.S. Passport or Passport Card as a Form I-9 List A document to an EVerify participating employer. The Passport and Passport Card will be collected in the same
manner and using the same security controls as any of the other information collected and stored
within VIS, such as the employee’s name and date of birth. With this update, if an employee
presents a U.S. Passport or Passport Card,, VIS will initially check the SSN against the Social
Security Administration (SSA) database, and only if the SSA cannot verify the employee
employment status then VIS will verify the employee’s Passport, or Passport Card against DOS data
via the CBP TECS. When VIS conducts a verification of these DOS documents, it will also provide
employers the capability to visually compare the photograph that appears on a Passport or Passport
Card with the photograph on file through its Photo Screening Tool. As the result of this
verification, VIS will store a link to the photograph rather than a copy of the photograph, and will
store a record of the verification outcome as it does with all other verifications.
The Verification Division makes every effort to minimize the amount of data collected.
However, having access to this additional information will improve the ability of E-Verify to
accurately and rapidly verify an employee’s employment eligibility in cases where SSA may not
have current data on an individual. This will minimize the number of cases that will need to be
sent to secondary verification.
Use of the System and the Information
Individuals may present either the Passport or the Passport Card, for use with the Form I-9,
and the employer keeps a copy. E-Verify will collect and verify the Passport, or Passport Card data
and will verify the number from Passports or Passport Cards. The Passport and Passport Card will
be used in the event that the information submitted to SSA cannot be verified. This verification of
DOS documents will minimize the burden on an employee, who will be able to avoid a secondary
verification process if the Passport, or Passport Card can be used to confirm immigration status,
while also minimizing the use of the information.
In addition to verification of the Passport and Passport Card data, this update will provide
the employer with access to an electronic copy of the photograph that should correspond with the
document offered by the employee through the use of the E-Verify Photo Tool. When the
employer accepts the document from the employee when completing the Form I-9, the employer
must determine if the document photograph matches the employee presenting the card. When
using the Photo Tool, the employer must compare the photograph presented in the document

Privacy Impact Assessment Update 
USCIS, Verification Information System (VIS) 
Page 6 

with the photograph presented by the Photo Tool, for a one-to-one match. This will help to
ensure that the documents offered have not been tampered with. Because the photograph on the
document being presented should be an exact match to the document in the system that was used
to create the document, the employer should be able to quickly determine if the photographs are a
one-to-one match.
The expansion of SAVE from merely verifying immigration or citizenship status for
government benefit granting purposes, to verifying any individual for any legal purpose is a
significant change for the use of VIS which some might interpret as a departure from the
Verification Division’s core function. However, it must be noted that DHS is responsible for being
able to determine immigration and citizenship status, and if VIS were unavailable for this purpose,
DHS would be required to develop an entirely new system with the exact same capabilities as VIS
in order to comply with the statutory requirement in the INA that DHS respond to such requests.
Furthermore, because VIS is transaction–based, and each verification is handled as a separate
transaction, VIS does not query stored data that was previously collected by VIS, and the data that
was collected previously for purposes of SAVE when it had a narrower scope will not be used for
the broader purposes described in this PIA. That is, if an individual had been verified through
SAVE for a government benefit, any new verification for another purpose will be an entirely new
transaction that would not use any data submitted for the previous verification.
Retention
As noted in other PIAs, USCIS has submitted an amendment to the NARA schedule to
increase the time records are stored and retained in the VIS Repository from five (5) to ten (10)
years, based on the statute of limitations for most types of misuse or fraud possible using VIS
(under 18 U.S.C. § 3291, the statute of limitations for false statements or misuse regarding
passports, citizenship or naturalization documents), from the date of the completion of the
verification. Passport and Passport Card photographs are typically not retained although if
necessary for secondary verification purposes employees may provide hard copies of these
photographs to VIS verifiers. These hard copies will be retained for the minimal time necessary to
complete the secondary verification process.
Internal and External Sharing and Disclosure
With the publication of this PIA, VIS will have access to Passport and Passport Card records
through a connection to CBP’s TECS which holds copies of these records. VIS will not collect or
retain any information directly from these passport records, but rather will verify information that
was provided by an E-Verify employee. To perform this verification, VIS will search TECS for a
DOS record matching the employee’s Passport number or Passport Card number plus full name
and date of birth. TECS will not store this information except in its system audit logs, so the fact

Privacy Impact Assessment Update 
USCIS, Verification Information System (VIS) 
Page 7 

that this verification was performed will not be otherwise visible to TECS users. Upon
verification, VIS will return to the employer an indication that the DOS data was verified, plus
access to the photograph on file for the DOS document presented. VIS will retain a record of the
verification plus a link to where the photograph may be retrieved in TECS. The connection to the
CBP data will be over the secured DHS network. There is no other change to internal or external
sharing and disclosure of VIS information based on the publication of this PIA.
Notice and Consent
Although in the vast majority of cases notice is directly given to SAVE applicants, with the
expansion of SAVE there are instances when the only notice will be through the publication of this
PIA and an accompanying System of Records Notice (SORN). For example, one of the new uses of
SAVE will be for purposes of background investigations for security clearances and public trust
investigations. In some cases, OPM will determine immigration and citizenship through SAVE,
not only for the security clearance or public trust investigation subject who has been given notice
and provides consent based on agreeing to the background investigation, but also for cohabitants
of the security clearance and public trust investigation subject. OPM does not provide these
cohabitants and family members the opportunity to consent, and these people will receive
notification only through this PIA and accompanying SORN. This limited notification is justified
based on national security concerns associated with individuals who will be granted security
clearances or public trust positions.
There is no change to the means of notice given by E-Verify based on this update. Notice
is provided through USCIS issued posters which describe E-Verify and provide contact information
for getting additional information. Notice is also provided by means of SORNs and PIAs.
Keeping in mind that once an employer participates in E-Verify it must verify all new
employees, as E-Verify becomes mandatory, either for geographic areas, such as the state of
Arizona, or for certain careers or career paths, such as federal employees, the option to not consent
by selecting an employer that is not an E-Verify participant diminishes or is eliminated. The
ability to consent or not is no longer available to some employees. There is no ability to minimize
this privacy risk and this must be accepted as a realized privacy issue that the federal government is
willing to accept based on it being the inevitable result of passage of laws that make participation
in E-Verify mandatory.
Individual Access, Redress, and Correction
Access, redress and correction have not changed with this update. Therefore, the
procedures set forth within Section 7.0 of the April 1, 2007 VIS PIA remain in effect. The first
opportunity to correct data is built directly in the verification process when E-Verify issues a

Privacy Impact Assessment Update 
USCIS, Verification Information System (VIS) 
Page 8 

Tentative Non Confirmation (TNC). An individual has the opportunity to correct the data they
believe is incorrect. Because VIS uses data which is not owned by the Verification Division, the
Verification Division will refer an individual seeking correction to the actual data owner.
Similarly, if an individual does not take the opportunity during the TNC process to correct their
data, once a Final Non Confirmation (FNC) is issued, they would likewise be referred to the
agency that did not confirm the individual’s data. Individuals may request access to their
information by submitting a Privacy Act request to USCIS in writing clearly marked “Privacy Act
Request” to the following address:
National Records Center
FOIA/PA Office
P.O. Box 648010
Lee’s Summit, MO 64064-8010
Requestors are required to provide their Alien Registration Number and/or full name, date and
place of birth and return address.
Technical Access and Security
Technical Access and Security remains consistent with Section 8.0 of the April 1, 2007 VIS
PIA.

Privacy Impact Assessment Update 
USCIS, Verification Information System (VIS) 
Page 9 

Technology
Technology remains consistent with Section 9.0 of the April 1, 2007 VIS PIA. VIS has a
comprehensive audit trail tracking and maintenance function that stores information on who
submits the query, when the query was run, what the response was, who receives the response,
and when the response was received. The VIS Helpdesk periodically reviews user lists and disables
inactive accounts where necessary. Each Agency signs a Memorandum of Understanding with
DHS defining the use of VIS, the handling of account information, and security compliance
requirements. Failure to comply with security policies can result in loss of access to VIS, at the
discretion of DHS.
Additionally, the USCIS Verification Division has established an office to monitor
employers’ use of E-Verify and promote compliance with correct program procedures. External
users of VIS are provided an on-line tutorial that explains the SAVE Program or E-Verify, as
appropriate. The tutorial also covers the procedures associated with the use of VIS.

Responsible Official
Claire Stapleton, Privacy Branch Chief, Verification Division, USCIS
Department of Homeland Security

Approval Signature

Original signed and on file with the DHS Privacy Office

Hugo Teufel III
Chief Privacy Officer
Department of Homeland Security