Dhs/uscis/pia-056

Privacy Impact Assessment Update
DHS/USCIS/PIA-056(c) USCIS ELIS
Page 0

Privacy Impact Assessment
for the

USCIS Electronic Information System
(USCIS ELIS)
DHS Reference No. DHS/USCIS/PIA-056(c)
June 30, 2020

Privacy Impact Assessment Update
DHS/USCIS/PIA-056(c) USCIS ELIS
Page 1

Abstract
U.S. Citizenship and Immigration Services (USCIS) oversees lawful immigration to the
United States and is responsible for processing petitions, applications, and other requests for
immigration benefits and requests. Executive Order 13780, “Protecting the Nation from Foreign
Terrorist Entry into the United States” requires the Department of Homeland Security (DHS) to
collect standard data on immigration forms and in case management systems. USCIS is now
updating this Privacy Impact Assessment (PIA) to provide notice of USCIS updating certain
immigration forms and associated systems, such as the USCIS Electronic Information System
(USCIS ELIS), in support of the Executive Order 13780. Upon publication of this PIA, USCIS
will collect additional biographic and social media data elements necessary for identity
verification, vetting, public safety, and national security screening. USCIS is updating this PIA to
evaluate the privacy risks and mitigations associated with these updates including the collection,
use, and maintenance of additional personally identifiable information (PII).

Overview
USCIS is the component within DHS that oversees lawful immigration to the United States.
USCIS receives immigration requests from individuals seeking immigration and non-immigration
benefits. Once a benefit request form is submitted to USCIS, a series of processing and
adjudication actions occur, such as case receipt and intake, biometric collection appointment
generation, case specific processing and management, automated background checks, interview
appointment scheduling, final decision rendering, and production of the proof of benefit. One of
the case management systems used to track and adjudicate certain immigration requests forms
filed with USCIS is USCIS ELIS.1 USCIS ELIS is an internal case management system composed
of microservices to assist with performing complex adjudicative and processing tasks.2 This PIA
update is focused on collecting standard biographic and social media data on immigration forms
processed within USCIS ELIS for identity verification, vetting, public safety, national security
screening, and inspection conducted by DHS.

Reason for the PIA Update
Executive Order 13780, “Protecting the Nation from Foreign Terrorist Entry into the
United States,” requires the implementation of uniform vetting standards and the proper collection
of all information necessary for a rigorous evaluation of all grounds of inadmissibility or basis for

1

Please see Appendix B of the DHS/USCIS-056 USCIS ELIS to view the immigration forms processed in USCIS
ELIS, available at https://www.dhs.gov/uscis-pias-and-sorns.
2
A microservice is an approach to application development in which a large application is built as a suite of
modular services. Each module supports a specific business goal and uses a simple, well-defined interface to
communicate with other sets of services.

Privacy Impact Assessment Update
DHS/USCIS/PIA-056(c) USCIS ELIS
Page 2

the denial of immigration-related benefits.3 The Executive Order requires DHS, specifically
USCIS and U.S. Customs and Border Protection (CBP), and the Department of State (DOS), to
collect standard data elements on immigration and foreign traveler forms and/or through
information collection systems. This data will be collected from certain populations on
applications for entrance into the United States or immigration-related benefits and is necessary
for identity verification, vetting, public safety, national security screening, and inspection
conducted by DHS.
In coordination with DHS, USCIS updated application and petitions (collectively referred
to as immigration request forms) to collect standard biographic and social media data elements
from individuals on the following immigration benefit requests:
•
•
•
•
•
•
•
•
•

Form N-400, Application for Naturalization
Form I-131, Application for Travel Document
Form I-192, Application for Advance Permission to Enter as a Nonimmigrant
Form I-485, Application to Register Permanent Residence or Adjust Status
Form I-589, Application for Asylum and for Withholding of Removal
Form I-590, Registration for Classification as a Refugee
Form I-730, Refugee/Asylee Relative Petition
Form I-751, Petition to Remove Conditions on Residence
Form I-829, Petition by Entrepreneur to Remove Conditions on Permanent Resident Status

The standardized collection of information is necessary to comply with Section 5 of the Executive
Order to establish screening and vetting standards and procedures to enable USCIS to assess an
individual’s eligibility to receive an immigration-related request from USCIS. This data collection
is also used to validate an individual’s identity, identify law enforcement or national security risks
to the United States, and ultimately to determine whether to grant the immigration request.
USCIS is updating PIAs associated with the case management system responsible for
processing the forms listed above. Of the listed forms, USCIS ELIS is responsible for supporting
the adjudicative actions for Forms N-400 and I-131.
Standard Information Collection Update
DHS published two public notices for the collection of biographic and social media
information. The first notice covered approximately 15 biographical data elements deemed “high
value” and critical for enhanced vetting, thereby creating a new baseline of uniform data collection.
The second notice covered the collection of social media identifiers (e.g., handles; user names)
and associated public social media platforms that applicants have used in the past five years.

3

See 82 FR 13209 (March 9, 2017).

Privacy Impact Assessment Update
DHS/USCIS/PIA-056(c) USCIS ELIS
Page 3

Biographic Information
The Executive Order establishes a common set of key biographic data elements to be
consistently collected across traveler screening and immigration-benefit forms. These data
elements are: Name; Sex/Gender; Date of Birth; Place of Birth; Country(ies) of Citizenship;
Country of Residence; Passport/Travel Document or National ID; Telephone Number(s); Email
address(es); U.S. Residence or Destination City and State; Foreign Address City and State; and
U.S. Point of Contact Name and Telephone Number (if applicant is located outside of the United
States). The majority of these data elements are commonly collected on USCIS immigration forms.
To standardize collection of data in support of comprehensive and systematic vetting of
immigration requestors, USCIS updated its forms to collect information not previously collected
to include city/region of birth, Passport/Travel Document or National ID (Country of issuance;
Issue date; Expiration date), foreign Address, and U.S. Point of Contact name and telephone
number (if the individual is located outside of the United States).
Social Media Information
The Executive Order also mandates the collection of publicly available social media
information to assist with identity verification. Social media may help distinguish individuals of
concern from applicants whose information substantiates their eligibility for an immigration
benefit. Social media can provide positive, confirmatory information to verify identity and support
a benefit requestor’s immigration request. It can also be used to identify potential deception, fraud,
or previously unidentified national security or law enforcement concerns.
USCIS updated its immigration forms to collect social media identifiers (also known as
usernames, identifiers, or “handles”) and associated social media platforms used by an
immigration requestor during the past five years for identity verification and national security
screening and vetting purposes.4 USCIS will not collect social media passwords. USCIS personnel
review publicly available information on social media platforms in a manner consistent with the
privacy settings the applicant has chosen to adopt for those platforms. Only that information that
the account holder has allowed to be shared publicly will be viewable by USCIS.

Privacy Impact Analysis
Authorities and Other Requirements
The legal authority to collect and use information, including Social Security number (SSN),
does not change with this update. Section 103 of the Immigration and Nationality Act (INA)

4

Vetting, for purposes of immigration enforcement and border security, involves the review and evaluation of
information associated to an individual to validate identity, identify potential threats, and identify issues related to
fraud, misrepresentation, national security, border security, homeland security, public safety, or law enforcement
interests of the United States.

Privacy Impact Assessment Update
DHS/USCIS/PIA-056(c) USCIS ELIS
Page 4

provides the legal authority for the administration and adjudication of immigration and nonimmigration benefits.5
The following system of record notices (SORN) cover the collection, maintenance, and use
of the information contained in USCIS ELIS:
•

DHS/USCIS/ICE/CBP-001 Alien File, Index, and National File Tracking System of
Records,6 which covers individuals who petition for benefits under the INA, and includes
petitioners, preparers, and attorneys;

•

DHS/USCIS-007 Benefits Information System,7 which covers individuals who have filed
applications or petitions for immigration benefits under INA; and

•

DHS/USCIS-018 Immigration Biometric and Background Check System of Records,8
which covers the background checks that are performed.

This update does not change the Authority to Operate (ATO) for USCIS ELIS. The USCIS ELIS
Security Plan was last updated on February 6, 2020. USCIS ELIS has been granted an ATO under
the USCIS Ongoing Authorization (OA) process. The OA requires USCIS ELIS to be reviewed
on a monthly basis and to maintain its security and privacy posture in order to retain its ATO.
USCIS is developing a retention schedule for the records stored in USCIS ELIS that is
subject to final approval by the National Archives and Records Administration (NARA). USCIS
is negotiating a proposed retention schedule that will allow USCIS to maintain records to support
the adjudication of the immigration request, any follow-up inquiries or requests related to the
application, including inquiries related to law enforcement, public safety, national security, and
Freedom of Information Act and Privacy Act (FOIA/PA) matters.
The collection of additional data elements triggers Paperwork Reduction Act (PRA)
requirements. The information stored within USCIS ELIS is subject to the PRA and the burden is
accounted for under the DHS PRA information collection efforts. The USCIS ELIS impacted
forms includes:
•
•

5

Form N-400, Application for Naturalization (OMB No. 1615-0052)
Form I-131, Application for Travel Document (OMB No. 1615-0013)

8 U.S.C. § 1103(a).
DHS/USCIS/ICE/CBP-001 Alien File, Index, and National File Tracking System of Records, 82 FR 43556
(September 18, 2017), available at https://www.dhs.gov/system-records-notices-sorns.
7
DHS/USCIS-007 Benefits Information System, 84 FR 54622 (October 10, 2019), available at
https://www.dhs.gov/system-records-notices-sorns.
8
DHS/USCIS-018 Immigration Biometric and Background Check, 83 FR 36950 (July 31, 2018), available at
https://www.dhs.gov/system-records-notices-sorns.
6

Privacy Impact Assessment Update
DHS/USCIS/PIA-056(c) USCIS ELIS
Page 5

Characterization of the Information
USCIS continues to collect and maintain the information previously outlined in Section 2.0
of the DHS/USCIS/PIA-056 USCIS ELIS and subsequent updates.9 Consistent with the
requirements for uniform vetting standards described in Executive Order 13780, USCIS collects
the following standard biographic and social media information from immigration request forms
and ingests the data into USCIS ELIS:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Name
Sex/Gender
Date of Birth
City/Region and Country of Birth
Country/Countries of Citizenship
Country of Residence
Passport/Travel Document or National ID (e.g., Country of issuance, issue date, expiration
date)
Telephone Number(s)
Email address(es)
U.S. Address: Residence or Destination city
U.S. Address: Residence or Destination state
Foreign Address city
Foreign Address state
U.S. Point of Contact Name, if applicant is located outside of the United States
U.S. Point of Contact Telephone Number, if applicant is located outside of the United
States
Social media user identifications (also known as usernames, identifiers, or “handles”) and
associated social media platforms

USCIS previously collected a vast majority of the data elements on USCIS immigration forms.
However, USCIS is updating this PIA to identify the biographic and social media elements not
previously collected on immigration forms or stored in USCIS ELIS and associated systems. The
new information collected on these forms include: social media platform, social media identifier(s)
used over the past five years, foreign address (city/state) and prior address history, Passport/Travel
Document or National ID (country of issuance, issuance date and expiration date), and U.S. Point
of Contact name and phone number (if the individual is located outside of the United States).

9

See DHS/USCIS-056 USCIS ELIS, available at https://www.dhs.gov/uscis-pias-and-sorns.

Privacy Impact Assessment Update
DHS/USCIS/PIA-056(c) USCIS ELIS
Page 6

This update does not impact the sources of information collected. USCIS continues to
collect information directly from the immigration requestor and/or legal representative, and
internal and external systems.
This update does not impact the use of information from commercial sources or publicly
available data contained in non-social media internet sites. USCIS plans to continue to use
information provided in the immigration request form to conduct general internet searches used as
part of the benefit adjudication process by adjudicators, and search publicly available social media
postings10 that are used by authorized Fraud Detection and National Security Directorate (FDNS)
personnel trained to conduct social media reviews of publicly available information.11
This update has no impact on the accuracy of information received from the immigration
requestor and/or legal representative. This collection of information is necessary to comply with
Section 5 of the Executive Order 13780 to establish screening and vetting standards and procedures
to enable USCIS to assess an individual’s eligibility to receive an immigration-related benefit from
USCIS. This data collection also is used to validate an individual’s identity and to determine
whether the individual poses a law enforcement or national security risk to the United States. This
information collection is done so in the same manner as all other information collected from the
immigration requestor and/or legal representative.
Privacy Risk: There is a risk that the information provided on the immigration form is
inaccurate.
Mitigation: This risk is mitigated. USCIS relies on the accuracy of the information
provided by the immigration requestor and/or legal representatives. Prior to submitting an
immigration request form, requestors must certify on the respective forms that the information
submitted is true and correct to the best of the immigration requestor’s knowledge and belief.
USCIS presumes the information submitted is accurate and verifies the information against
multiple sources during the review process.
USCIS also gives individuals opportunities during and after the completion of the
immigration request process to correct information they have provided or received and to respond
to information received from external sources, including social media. If the information could
lead to a denial of the immigration benefit and if it is information of which the benefit requestor is
unaware, it would be provided to the benefit requestor in a Notice of Intent to Deny during an

10

Select USCIS personnel who seek to access, process, store, receive, or transmit PII obtained through the
Operational Use of Social Media while conducting investigations or background checks are required to complete a
Rules of Behavior (ROB) for the Operational Use of Social Media. These ROBs ensure that users are accountable
for their actions on social media, are properly trained, and aware of the authorized use of social media sites.
11
See DHS/USCIS/PIA-013-01 FDNS Directorate, available at https://www.dhs.gov/uscis-pias-and-sorns.

Privacy Impact Assessment Update
DHS/USCIS/PIA-056(c) USCIS ELIS
Page 7

interview or in similar processes. The benefit requestor would have an opportunity to review and
respond.
Privacy Risk: There is a risk of over collection now that USCIS uniformly collects social
media information as part of its determination with an immigration request.
Mitigation: This risk is mitigated. In coordination with DHS, USCIS updated immigration
request forms to collect the standard biographic and social media data elements from individuals
on the appropriate immigration benefit requests in support of existing USCIS vetting and
adjudication programs. USCIS now collects social media user identifiers (also known as
usernames, identifiers, or “handles”) and associated social media platforms used by the
immigration requestor during the past five years on certain forms. USCIS is seeking this
information, covering the previous five-year period, to assist with identity verification and for
consistency with other federal entity data collections for certain immigration request forms. USCIS
personnel review publicly available information on social media platforms in a manner consistent
with the privacy settings the immigration requestor has chosen to adopt for those platforms. Only
that information which the account holder has allowed to be shared publicly will be viewable by
USCIS.
USCIS collection of social media information is not “mandatory” in the sense that a benefit
request form will be denied or rejected based solely on the lack of a response. USCIS continues to
adjudicate a form where social media data element information is not answered, but failure to
provide the requested data may delay the final determination an individual’s eligibility for the
requested benefit. USCIS requires the ability to consider that information as it may contradict or
substantiate information provided to USCIS in connection with the immigration request
Uses of the Information
The uses of information do not change as a result of this update as outlined in Section 3.0
of the DHS/USCIS/PIA-056 USCIS ELIS and its subsequent updates. USCIS continues to use
USCIS ELIS to support and manage the administration and adjudication of certain immigration
related requests. Specifically, USCIS uses the biographic and social media information for the
following purposes:
Identity Verification
USCIS uses name, gender, date of birth, city/region/country of birth, country of citizenship,
and social media information to confirm an individual’s identity as it relates to the submitted
immigration request form and to search DHS component historic records. These biographic
identifiers are also used internally by USCIS and screening partners to confirm or disprove an
association between an immigration requestor and information of interest and the strength of that
association in the context of the underlying information.

Privacy Impact Assessment Update
DHS/USCIS/PIA-056(c) USCIS ELIS
Page 8

Identity Resolution
The current passport/travel/national identity document information (country of issuance,
issue date, and expiration date) is a unique numeric identifier issued to a single individual that
USCIS uses to confirm a person’s identity and to search DHS records. It is also used by USCIS
and screening partners to find, confirm, or disprove an association between an applicant, to
determine the strength of that association, or to provide other information about the person that
may be important in the adjudication.
Contact Information
The following eight (8) data elements are used to provide official correspondence from
USCIS to an immigration requestor:
•
•
•
•
•
•
•
•

Telephone Number(s)
Email address(es)
U.S. Address: Residence or Destination city
U.S. Address: Residence or Destination state
Foreign Address city
Foreign Address state
U.S. Point of Contact Name, if applicant is located outside of the United States
U.S. Point of Contact Telephone Number, if applicant is located outside of the United
States

These data elements are also used as secondary data elements to confirm a subject’s identity as it
relates to the submitted benefit request forms and to component historic records. These data
elements are also used internally by USCIS and screening partners to confirm or disprove an
association between a benefit requestor and information of interest and the strength of that
association in the context of the underlying information.
USCIS ELIS continues not to use technology to conduct electronic searches, queries, or
analyses to discover or locate a predictive pattern or anomaly.
USCIS continues to share information with DHS components. DHS Component access and
use does not change as a result of this update.
Notice
USCIS is providing general notice about the system changes through this PIA update.
USCIS also continues to provide notice through the associated SORNs and through the Privacy
Notices on the associated forms (both paper and electronic). Furthermore, DHS issued two notices
in the Federal Register titled, (1) “Agency Information Collection Activities: Generic Clearance

Privacy Impact Assessment Update
DHS/USCIS/PIA-056(c) USCIS ELIS
Page 9

for the Collection of Certain Information on Immigration and Foreign Travel Forms,”12 and (2)
“Agency Information Collection Activities: Generic Clearance for the Collection of Social Media
Information on Immigration and Foreign Travel Forms”13 to notify the public on USCIS’ intent to
update several immigration request forms to collect biographic and social media information,
respectively.
Data Retention by the Project
USCIS is developing a retention schedule for the records stored in USCIS ELIS that is
subject to final approval by NARA. USCIS is negotiating a proposed retention schedule that will
allow USCIS to maintain records to support the adjudication of the immigration request, any
follow-up inquiries or requests related to the application, including inquiries related to law
enforcement, public safety, national security, and FOIA/PA matters.
Privacy Risk: There is a risk that information may be retained longer than is needed.
Mitigation: This risk is not mitigated. USCIS is developing a retention schedule for USCIS
ELIS. The proposed NARA schedule will be consistent with the concept of retaining data only for
as long as necessary to support USCIS’s mission. Until USCIS completes a NARA-approved
retention schedule, USCIS will maintain all records indefinitely and will not delete records until a
retention schedule is approved by NARA in accordance with the Federal Records Act.
Information Sharing
This update does not impact internal and external information sharing as outlined in USCIS
ELIS. There are no new privacy risks associated with information sharing.
Redress
This update does not impact how access, redress, and correction may be sought through
USCIS. USCIS continues to provide individuals with access to their information through a Privacy
Act or FOIA request. Individuals not covered by the Privacy Act or Judicial Redress Act (JRA)
still may obtain access to records consistent with FOIA unless disclosure is prohibited by law or
if the agency reasonably foresees that disclosure would harm an interest protected by an
exemption. U.S. Citizens and Lawful Permanent Residents may also file a Privacy Act request to
access their information. If an individual would like to file a Privacy Act or FOIA request to view
his or her USCIS record, the request can be mailed to the following address:

12

https://www.federalregister.gov/documents/2020/02/10/2020-02613/agency-information-collection-activitiesgeneric-clearance-for-the-collection-of-certain-information.
13
https://www.federalregister.gov/documents/2019/09/04/2019-19021/agency-information-collection-activitiesgeneric-clearance-for-the-collection-of-social-media.

Privacy Impact Assessment Update
DHS/USCIS/PIA-056(c) USCIS ELIS
Page 10

National Records Center
Freedom of Information Act/Privacy Act Program
P.O. Box 648010
Lee’s Summit, MO 64064-8010
Persons not covered by the Privacy Act or JRA are not able to amend their records through FOIA.
Should a non-U.S. person find inaccurate information in his or her record received through FOIA,
he or she may visit a local USCIS Field Office to identify and amend inaccurate records with
evidence.
Auditing and Accountability
This update does not impact auditing and accountability by implementing technical and
security controls to limit access and mitigate privacy risks associated with unauthorized access and
disclosure.

Responsible Official
Donald K. Hawkins
Privacy Officer
U.S. Citizenship and Immigration Services
Department of Homeland Security
(202) 272-8030

Approval Signature
Original, signed copy on file at the DHS Privacy Office.
________________________________
Dena Kozanas
Chief Privacy Officer
Department of Homeland Security
(202) 343-1717