Pta

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 1 of 9

PRIVACY THRESHOLD ANALYSIS (PTA)
This form is used to determine whether
a Privacy Impact Assessment is required.

Please use the attached form to determine whether a Privacy Impact Assessment (PIA) is required under
the E-Government Act of 2002 and the Homeland Security Act of 2002.
Please complete this form and send it to your component Privacy Office. If you do not have a component
Privacy Office, please send the PTA to the DHS Privacy Office:
Senior Director, Privacy Compliance
The Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
Tel: 202-343-1717
[email protected]

Upon receipt from your component Privacy Office, the DHS Privacy Office will review this form. If a
PIA is required, the DHS Privacy Office will send you a copy of the Official Privacy Impact Assessment
Guide and accompanying Template to complete and return.
A copy of the Guide and Template is available on the DHS Privacy Office website,
www.dhs.gov/privacy, on DHSConnect and directly from the DHS Privacy Office via email:
[email protected], phone: 202-343-1717.

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 2 of 9

PRIVACY THRESHOLD ANALYSIS (PTA)
SUMMARY INFORMATION
Project or
Program Name:

Form I-9 “Employment Eligibility Verification” (renewal)

Component:

U.S. Citizenship and
Immigration Services (USCIS)

Office or
Program:

Verification

Xacta FISMA
Name (if
applicable):

Not applicable

Xacta FISMA
Number (if
applicable):

Not applicable

Type of Project or
Program:

Form or other Information
Collection

Project or
program status:

Update

Date first
developed:
Date of last PTA
update

November 1, 1986

Pilot launch
date:

Click here to enter a date.

March 26, 2012

Pilot end date:

Click here to enter a date.

ATO Status (if
applicable)

Choose an item.

ATO
expiration date
(if applicable):

Click here to enter a date.

PROJECT OR PROGRAM MANAGER
Name:
Office:

Karen Powers
Verification

Title:

Management and Program Analyst

Phone:

202-443-0244

Email:

[email protected]

INFORMATION SYSTEM SECURITY OFFICER (ISSO) (IF APPLICABLE)
Name:

Paul Stanard/Daniel McCarthy

Phone:

202-272-9062/202-272-8253

Email:

[email protected]/
[email protected]

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 3 of 9

SPECIFIC PTA QUESTIONS
1. Reason for submitting the PTA: Renewal PTA
Please provide a general description of the project and its purpose in a way a non-technical person could
understand. If this is an updated PTA, please describe what changes and/or upgrades that are triggering
the update to this PTA. If this is a renewal please state whether or not there were any changes to the
project, program, or system since the last version.
Background
In 1986, Congress mandated that employers verify that all new employees hired after November 6, 1986,
are authorized to work in the United States. In response to this mandate, Form I-9, “Employment
Eligibility Verification,” was created and is now issued by the U.S. Citizenship and Immigration Services
(USCIS). All U.S. employers must complete and retain a Form I-9 for each individual they hire for
employment in the United States. This requirement applies to both U.S. Citizens and non-citizens. The
employer must examine Form I-9 and the documentation (e.g., driver’s license, passport, birth certificate)
an employee presents to determine whether the documentation reasonably appears to be genuine. The
employer records the documentation information on Form I-9.
USCIS does not collect information directly from employees via this process; rather, employers collect
this information directly from their employees. Employers that participate in the E-Verify program submit
information from Form I-9 to the E-Verify system, which uses various federal government databases to
determine employment eligibility. After undergoing the Paperwork Reduction Act (PRA) process in
2012-2013, USCIS published a revised Form I-9 in March 2013 that among other things included new
data fields for employees to provide their e-mail address and telephone number. These changes were
documented in a PTA, and prompted updates to the Form I-9 PIA and E-Verify SORN, completed on
June 21, 2013, and July 22, 2013, respectively.
This PTA replaces the expired 2012 I-9 PTA. There are no substantive changes to the form, and no new
collection of PII. The form is covered by existing privacy compliance documentation.

2. Does this system employ any of the
following technologies:
If you are using any of these technologies and
want coverage under the respective PIA for that
technology please stop here and contact the DHS
Privacy Office for further guidance.

Closed Circuit Television (CCTV)
Social Media
Web portal1 (e.g., SharePoint)
Contact Lists
None of these

1

Informational and collaboration-based portals in operation at DHS and its components that collect, use, maintain, and share
limited personally identifiable information (PII) about individuals who are “members” of the portal or “potential members” who
seek to gain access to the portal.

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 4 of 9

3. From whom does the Project or
Program collect, maintain, use, or
disseminate information?
Please check all that apply.

This program does not collect any personally
identifiable information2
Members of the public
DHS employees/contractors (list components):
Contractors working on behalf of DHS
Employees of other federal agencies

4. What specific information about individuals is collected, generated or retained?
Please provide a specific description of information that is collected, generated, or retained (such as
names, addresses, emails, etc.) for each category of individuals.
USCIS does not collect information via this process. Information is collected by employers only,
directly from their employees. Employers only collect those data fields contained on the Form I-9.
The data fields that could potentially be collected are as follows:
Employee (All employees, unless indicated otherwise)
 Name (Last, First, Middle Initial, Other Names Used)
 Address
 Date of Birth
 Social Security Number (optional, unless the employer participates in E-Verify)
 Claimed Citizenship or Immigration Status (U.S. Citizen (USC)), Noncitizen National, Lawful
Permanent Resident, or Alien Authorized to Work in the United States)
 A-Number or I-94 Number (Non-USCs)
 Signature
 Date of Signature
 Phone Number (optional)
 Email Address (optional)
 Foreign Passport Number and Country of Issuance (required only if employee attests to being
an “Alien Authorized to Work,” does not have an Alien Registration Number, did not receive
an I-94 from USCIS and entered the U.S. using a foreign passport)
Preparer/Translator (if appropriate)
 Name
DHS defines personal information as “Personally Identifiable Information” or PII, which is any information that permits the
identity of an individual to be directly or indirectly inferred, including any information that is linked or linkable to that individual,
regardless of whether the individual is a U.S. citizen, lawful permanent resident, visitor to the U.S., or employee or contractor to
the Department. “Sensitive PII” is PII, which if lost, compromised, or disclosed without authorization, could result in substantial
harm, embarrassment, inconvenience, or unfairness to an individual. For the purposes of this PTA, SPII and PII are treated the
same.
2

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 5 of 9




Address
Signature
Date of Signature

Document(s) as set forth in Lists A, B or C
 Title
 Issuing Authority
 Number (e.g., driver’s license number)
 Expiration Date (if any)
Employer (or Employer’s Authorized Representative)
 Name
 Title
 Signature
 Date of Signature
 Business or Organization Name and Address
Reverification and Rehires (if applicable, to be completed by employer)
 New Name (if applicable)
 Date of Rehire (month/day/year)(if applicable)
 If the employee’s previous grant of employment authorization has expired, new information
from the document that establishes current employment authorization, including: document
title, document number and expiration date (if any)
 Signature of Employer’s or Authorized Representative
 Date of Employer’s or Authorized Representative’s Signature

The information on Form I-9 comes from:





Employees who provide basic information about themselves and attest to their own
immigration status;
The preparers/translators, if applicable, who provide information about themselves;
Document(s) provided by the employee
Employers or their authorized representative who enter the date of hire and attest to having
reviewed the documents, to determining that they reasonably appear to be genuine and relate
to the individual presenting it, and believing the employee to be authorized to work in the
United States.

4(a) Does the project, program, or system
retrieve information by personal identifier?

No. Please continue to next question.
Yes. If yes, please list all personal identifiers
used:

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 6 of 9

4(b) Does the project, program, or system
use Social Security Numbers (SSN)?

No.
Yes.

4(c) If yes, please provide the specific legal
basis and purpose for the collection of
SSNs:

The SSN is an optional field on the Form I-9, unless
the employer participates in the E-Verify Program.
The legal authority to collect SSNs is provided by
Immigration Reform and Control Act of 1986,
codified at 8 USC 1324a.

4(d) If yes, please describe the uses of the
SSNs within the project, program, or
system:

E-Verify employers enter an employee’s SSN into
the E-Verify system, which verifies the employee’s
employment eligibility against the Social Security
Administration database. The SSN is used to for the
purpose of verifying an employee's employment
eligibility.

4(e) If this project, program, or system is
an information technology/system, does it
relate solely to infrastructure?

No. Please continue to next question.
Yes. If a log kept of communication traffic,
please answer the following question.

For example, is the system a Local Area Network
(LAN) or Wide Area Network (WAN)?
4(f) If header or payload data3 is stored in the communication traffic log, please detail the data
elements stored.
Click here to enter text.

5. Does this project, program, or system
connect, receive, or share PII with any
other DHS programs or systems4?

No.
Yes. If yes, please list:
Click here to enter text.

6. Does this project, program, or system
connect, receive, or share PII with any
external (non-DHS) partners or
systems?
6(a) Is this external sharing pursuant to
new or existing information sharing

3

No.
Yes. If yes, please list:
Click here to enter text.
Choose an item.

When data is sent over the Internet, each unit transmitted includes both header information and the actual data being sent. The
header identifies the source and destination of the packet, while the actual data is referred to as the payload. Because header
information, or overhead data, is only used in the transmission process, it is stripped from the packet when it reaches its destination.
Therefore, the payload is the only data received by the destination system.
4
PII may be shared, received, or connected to other DHS systems directly, automatically, or by manual processes. Often, these
systems are listed as “interconnected systems” in Xacta.

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 7 of 9

access agreement (MOU, MOA, LOI,
etc.)?

Please describe applicable information sharing
governance in place:
N/A

7. Does the project, program, or system
provide role-based training for
personnel who have access in addition
to annual privacy training required of
all DHS personnel?

8. Per NIST SP 800-53 Rev. 4, Appendix
J, does the project, program, or system
maintain an accounting of disclosures
of PII to individuals who have
requested access to their PII?
9. Is there a FIPS 199 determination?4

No.
Yes. If yes, please list:

No. What steps will be taken to develop and
maintain the accounting: There are no requests for
disclosure of PII because the form is not routinely
collected by the government.
Yes. In what format is the accounting
maintained:
Unknown.
No.
Yes. Please indicate the determinations for each
of the following:
Confidentiality:
Low
Moderate

High

Undefined

Integrity:
Low

Moderate

High

Undefined

Availability:
Low
Moderate

High

Undefined

PRIVACY THRESHOLD REVIEW

4

FIPS 199 is the Federal Information Processing Standard Publication 199, Standards for Security Categorization of Federal
Information and Information Systems and is used to establish security categories of information systems.

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 8 of 9

(TO BE COMPLETED BY COMPONENT PRIVACY OFFICE)
Component Privacy Office Reviewer:

Kristy Sawyer/Sarita Rijhwani

Date submitted to Component Privacy
Office:

January 20, 2016

Date submitted to DHS Privacy Office:

January 21, 2016

Component Privacy Office Recommendation:
Please include recommendation below, including what new privacy compliance documentation is needed.
This PTA replaces the expired Form I-9 updated PTA (March 2, 2012).
We recommend this form be designated as “Privacy Sensitive” and covered by existing privacy
compliance documentation- (DHS/USCIS-011 E-Verify System of Records, August 11, 2014 and
DHS/USCIS/PIA-036(b) - Form I-9 Employment Eligibility Verification Update; DHS/USCIS/PIA-036
Employment Eligibility Verification Requirements Under the Form I-9 April 15, 2011; DHS/USCIS/PIA030(d) - E-Verify Program.

(TO BE COMPLETED BY THE DHS PRIVACY OFFICE)
DHS Privacy Office Reviewer:

Lindsay Lennon

PCTS Workflow Number:

1117860

Date approved by DHS Privacy Office:

January 21, 2016

PTA Expiration Date

January 21, 2019
DESIGNATION

Privacy Sensitive System:
Category of System:
Determination:

Yes

If “no” PTA adjudication is complete.

Form/Information Collection
If “other” is selected, please describe: Click here to enter text.
PTA sufficient at this time.
Privacy compliance documentation determination in progress.
New information sharing arrangement is required.
DHS Policy for Computer-Readable Extracts Containing Sensitive PII
applies.
Privacy Act Statement required.

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 9 of 9

Privacy Impact Assessment (PIA) required.
System of Records Notice (SORN) required.
Paperwork Reduction Act (PRA) Clearance may be required. Contact
your component PRA Officer.
A Records Schedule may be required. Contact your component Records
Officer.
System covered by existing PIA
PIA:

SORN:

If covered by existing PIA, please list: DHS/USCIS/PIA-036(b) - Form I-9 Employment
Eligibility Verification Update; DHS/USCIS/PIA-030(d) - E-Verify Program
System covered by existing SORN

If covered by existing SORN, please list: DHS/USCIS-011 - E-Verify Program August 11,
2014 79 FR 46852
DHS Privacy Office Comments:
Please describe rationale for privacy compliance determination above.
There have been no substantive changes to the form since the 2012 PTA, and no new collections of PII.
PRIV agrees with USCIS Privacy that the DHS/USCIS/PIA-036(b) continues to cover the form. When
USCIS collects information from the Form I-9, the employer enters the information into the E-Verify
system. Therefore, the E-Verify PIA and E-Verify SORN cover the collection of that information.