DHS/USCIS/PIA-016 USCIS Computer Linked Application Information Management System (CLAIMS 3) and Associated Systems

Status: Original and derived artifacts are available for this document.

Download: pdf

Privacy Impact Assessment Update
DHS/USCIS/PIA-016(d) CLAIMS 3 and Associated Systems
Page 0

Privacy Impact Assessment
for the

Computer Linked Application Management System
and Associated Systems (CLAIMS 3)
DHS Reference No. DHS/USCIS/PIA-016(d)
June 30, 2020

Privacy Impact Assessment Update
DHS/USCIS/PIA-016(d) CLAIMS 3 and Associated Systems
Page 1

Abstract
U.S. Citizenship and Immigration Services (USCIS) oversees lawful immigration to the
United States and is responsible for processing petitions, applications, and other requests for
immigration benefits and requests. Executive Order 13780, “Protecting the Nation from Foreign
Terrorist Entry into the United States” requires the Department of Homeland Security (DHS) to
collect standard data on immigration forms and in case management systems. USCIS is now
updating this Privacy Impact Assessment (PIA) to provide notice of USCIS updating certain
immigration forms and associated systems, such as the Computer Linked Application Information
Management System (CLAIMS 3), in support of the Executive Order 13780. Upon publication of
this PIA, USCIS will collect additional biographic and social media data elements necessary for
identity verification, vetting, public safety, and national security screening. USCIS is updating this
PIA to evaluate the privacy risks and mitigations associated with these changes including the
collection, use, and maintenance of additional personally identifiable information (PII).

Overview
USCIS is the component within DHS that oversees lawful immigration to the United States.
USCIS receives immigration requests from individuals seeking immigration and non-immigration
benefits. Once a benefit request form is submitted to USCIS, a series of processing and
adjudication actions occur, such as case receipt and intake, generating biometric collection
appointments, case specific processing and management, automated background checks,
scheduling interview appointments, rendering final decisions, and producing proof of benefit. One
of the case management systems used to track and adjudicate certain immigration requests forms
filed with USCIS is CLAIMS 3.
USCIS uses CLAIMS 3 to process immigration requests with the exception of
naturalization, intercountry adoption, and certain requests for asylum and refugee status.1
CLAIMS 3 is the case management system that supports the maintenance and tracking of officer
casework documentation for many immigration related requests. CLAIMS 3 functionalities
include tracking the adjudication performed by USCIS personnel, archiving, card production, case
history, case transfer, on-demand reports, electronic file tracking, image capture, production
statistics, and status updates. This PIA update is focused on collecting standard biographic and
social media data elements on immigration forms processed within CLAIMS 3 for identity
verification, vetting, public safety, and national security screening and inspection conducted by
The “certain requests” for refugee and asylum benefits include the “follow to join” petition (Form I-730). “Follow
to join” is an option offered to family members of the principal beneficiaries of approved asylum and refugee status.
Immediate family members (spouses and children under the age of 21) may qualify for derivative status. An
individual who entered the United States and was granted asylum/refugee status within the past two years may
petition to have his or her spouse and/or unmarried children “follow-to-join” him or her in the United Sates and
obtain derivative status. The derivatives may be in the United States or outside the United States.
1

Privacy Impact Assessment Update
DHS/USCIS/PIA-016(d) CLAIMS 3 and Associated Systems
Page 2

DHS.

Reason for the PIA Update
Executive Order 13780, “Protecting the Nation from Foreign Terrorist Entry into the
United States,” requires the implementation of uniform vetting standards and the proper collection
of all information necessary for a rigorous evaluation of all grounds of inadmissibility or basis for
the denial of immigration-related benefits.2 The Executive Order requires DHS, specifically
USCIS and U.S. Customs and Border Protection (CBP), and the Department of State (DOS), to
collect standard data elements on immigration and foreign traveler forms and/or through
information collection systems. This data will be collected from certain populations on
applications for entrance into the United States or immigration-related benefits and is necessary
for identity verification, vetting, public safety, national security screening, and inspection
conducted by DHS.
In coordination with DHS, USCIS updated applications and petitions (collectively referred
to as immigration request forms) to collect the standard biographic and social media data elements
from individuals on the following immigration benefit requests:
•
•
•
•
•
•
•
•
•

Form N-400, Application for Naturalization
Form I-131, Application for Travel Document
Form I-192, Application for Advance Permission to Enter as a Nonimmigrant
Form I-485, Application to Register Permanent Residence or Adjust Status
Form I-589, Application for Asylum and for Withholding of Removal
Form I-590, Registration for Classification as a Refugee
Form I-730, Refugee/Asylee Relative Petition
Form I-751, Petition to Remove Conditions on Residence
Form I-829, Petition by Entrepreneur to Remove Conditions on Permanent Resident Status

The standardized collection of information is necessary to comply with Section 5 of the Executive
Order to establish screening and vetting standards and procedures to enable USCIS to assess an
individual’s eligibility to receive an immigration-related request from USCIS. This data collection
is also used to validate an individual’s identity, identify law enforcement or national security risks
to the United States, and ultimately to determine whether to grant the immigration request.
USCIS is updating the PIAs associated with the case management systems responsible for
processing the forms listed above. Of the listed forms, CLAIMS 3 is responsible for supporting
the adjudicative actions for Forms I-131, I-192, I-485, I-730, I-751, and I-829.

2

See 82 FR 13209 (March 9, 2017).

Privacy Impact Assessment Update
DHS/USCIS/PIA-016(d) CLAIMS 3 and Associated Systems
Page 3

Standard Information Collection Update
DHS published two public notices for the collection of biographic and social media
information. The first notice covered approximately 15 biographical data elements deemed “high
value” and critical for enhanced vetting, thereby creating a new baseline of uniform data collection.
The second notice covered the collection of social media identifiers (e.g., handles; user names)
and associated public social media platforms (e.g., websites) that applicants have used in the past
five years.
Biographic Information
The Executive Order establishes a common set of key biographic data elements to be
consistently collected across traveler screening and immigration-benefit forms. These data
elements are: Name; Sex/Gender; Date of Birth; Place of Birth; Country(ies) of Citizenship;
Country of Residence; Passport/Travel Document or National ID; Telephone Number(s); Email
address(es); U.S. Residence or Destination City and State; Foreign Address City and State; and
U.S. Point of Contact Name and Telephone Number (if applicant is located outside of the United
States). The majority of these data elements are commonly collected on USCIS immigration forms.
To standardize collection of data in support of comprehensive and systematic vetting of
immigration requestors, USCIS updated its forms to collect information not previously collected,
to include city/region of birth, Passport/Travel Document or National ID (Country of issuance;
Issue date; Expiration date), foreign Address, and U.S. Point of Contact name and telephone
number (if the individual is located outside of the United States).
Social Media Information
The Executive Order also establishes the collection of publicly available social media
information to assist with identity verification. Social media may help distinguish individuals of
concern from applicants whose information substantiates their eligibility for an immigration
benefit. Social media can provide positive, confirmatory information to verify identity and support
a benefit requestor’s immigration request. It can also be used to identify potential deception, fraud,
or previously unidentified national security or law enforcement concerns.
USCIS updated its immigration forms to collect social media identifiers (also known as
usernames, identifiers, or “handles”) and associated social media platforms used by an
immigration requestor during the past five years for identity verification and national security
screening and vetting purposes.3 USCIS will not collect social media passwords. USCIS personnel
review publicly available information on social media platforms in a manner consistent with the
3

Vetting, for purposes of immigration enforcement and border security, involves the review and evaluation of
information associated to an individual to validate identity, identify potential threats, and identify issues related to
fraud, misrepresentation, national security, border security, homeland security, public safety, or law enforcement
interests of the United States.

Privacy Impact Assessment Update
DHS/USCIS/PIA-016(d) CLAIMS 3 and Associated Systems
Page 4

privacy settings the applicant has chosen to adopt for those platforms. Only the information that
the account holder has allowed to be shared publicly will be viewable by USCIS.

Privacy Impact Analysis
Authorities and Other Requirements
The legal authority to collect and use information, including Social Security number (SSN),
does not change with this update. Section 103 of the Immigration and Nationality Act (INA)
provides the legal authority for the administration and adjudication of immigration and nonimmigration benefits.4
The collection, use, maintenance, and dissemination of information are covered under the
following system of records notices (SORN):
•

DHS/USCIS/ICE/CBP-001 Alien File, Index, and National File Tracking System of
Records,5 which covers the collection, use, and maintenance of applications and
supplemental evidence, in addition to other information related to the individual as he or
she passes through the immigration process;

•

DHS/USCIS-018 Immigration Biometric and Background Check,6 which covers
background checks and their results; and

•

DHS/USCIS-007 Benefits Information System,7 which covers the collection and use of
immigrant and non-immigrant benefit applications, decisional data, and associated fees for
adjudication.

This update does not change the Authority to Operate (ATO) for CLAIMS 3. USCIS issued the
ATO for CLAIMS 3 on September 3, 2015, and this system is part of an Ongoing Authorization
program. As such, CLAIMS 3 will have an ongoing ATO with no expiration date as long as
CLAIMS 3 continues to operate in compliance with security and privacy requirements.
The associated records schedule does not change with this update. USCIS continues to
retain data within CLAIMS 3 for 50 years from the date of the last completed action in accordance
with National Archives and Records Administration (NARA) Disposition Authority Number
DAA-0566-2016-0013.
4

8 U.S.C. § 1103(a).
DHS/USCIS/ICE/CBP-001 Alien File, Index, and National File Tracking System of Records, 82 FR 43556
(October 18, 2017), available at https://www.dhs.gov/system-records-notices-sorns.
6
DHS/USCIS-018 Immigration Biometric and Background Check (IBBC) System of Records, 83 FR 36950 (July
31, 2018), available at https://www.dhs.gov/system-records-notices-sorns. This SORN replaces the DHS/USCIS002 Background Check Service, which previously provided coverage for the background check results stored in
CLAIMS 3.
7
DHS/USCIS-007 Benefits Information System, 84 FR 54622 (October 10, 2019), available at
https://www.dhs.gov/system-records-notices-sors.
5

Privacy Impact Assessment Update
DHS/USCIS/PIA-016(d) CLAIMS 3 and Associated Systems
Page 5

This update impacts the Paperwork Reduction Act (PRA) requirements for CLAIMS 3.
The information stored within CLAIMS 3 is subject to the PRA and the burden is accounted for
under the DHS PRA information collection efforts. The CLAIMS 3 impacted forms include:
•
•
•
•
•
•

Form I-131, Application for Travel Document (OMB No. 1615-0013)
Form I-192, Application for Advance Permission to Enter as a Nonimmigrant (OMB No.
1615-0017)
Form I-485, Application to Register Permanent Residence or Adjust Status (OMB No.
1615-0023)
Form I-730, Refugee/Asylee Relative Petition (OMB No. 1615-0037)
Form I-751, Petition to Remove Conditions on Residence (OMB No. 1615-0038)
Form I-829, Petition by Entrepreneur to Remove Conditions on Permanent Resident Status
(OMB No. 1615-0045)
Characterization of the Information

USCIS continues to collect and maintain the information previously outlined in Section 2.0
of DHS/USCIS/PIA-016(a) CLAIMS 3 and Associated Systems and subsequent updates.8
Consistent with the requirements for uniform vetting standards described in Executive Order
13780, USCIS collects the following standard biographic and social media information from
immigration request forms and ingests the data into CLAIMS 3 and associated systems:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
8

Name
Sex/Gender
Date of Birth
City/Region and Country of Birth
Country/Countries of Citizenship
Country of Residence
Passport/Travel Document or National ID (e.g., Country of issuance, issue date, expiration
date)
Telephone Number(s)
Email address(es)
U.S. Address: Residence or Destination city
U.S. Address: Residence or Destination state
Foreign Address city
Foreign Address state
U.S. Point of Contact Name, if applicant is located outside of the United States

See DHS/USCIS/PIA-016(a) CLAIMS 3 and Associated Systems, available at https://www.dhs.gov/uscis-piasand-sorns.

Privacy Impact Assessment Update
DHS/USCIS/PIA-016(d) CLAIMS 3 and Associated Systems
Page 6

•
•

U.S. Point of Contact Telephone Number, if applicant is located outside of the United
States
Social media user identifications (also known as usernames, identifiers, or “handles”) and
associated social media platforms

USCIS previously collected a vast majority of the data elements on USCIS immigration forms.
However, USCIS is updating this PIA to identify the biographic and social media elements not
previously collected on immigration forms or stored in CLAIMS 3 and associated systems. The
new information collected on these forms include: social media platform, social media identifier(s)
used over the past five years, foreign address (city/state) and prior address history, Passport/Travel
Document or National ID (country of issuance, issuance date and expiration date), and U.S. Point
of Contact name and phone number (if the individual is located outside of the United States).
This update does not impact the sources of information collected. USCIS continues to
collect information directly from the immigration requestor and/or legal representative, and
internal and external systems.
This update does not impact the use of information from commercial sources or publicly
available data contained in non-social media internet sites. USCIS plans to continue to use
information provided in the immigration request form to conduct general internet searches used as
part of the benefit adjudication process by adjudicators, and search publicly available social media
postings9 that are used by authorized Fraud Detection and National Security Directorate (FDNS)
personnel trained to conduct publicly available social media reviews.10
This update has no impact on the accuracy of information received from the immigration
requestor and/or legal representative. This collection of information is necessary to comply with
Section 5 of the Executive Order 13780 to establish screening and vetting standards and procedures
to enable USCIS to assess an individual’s eligibility to receive an immigration-related benefit from
USCIS. This data collection also is used to validate an individual’s identity and to determine
whether the individual poses a law enforcement or national security risk to the United States. This
information collection is done so in the same manner as all other information collected from the
immigration requestor and/or legal representative.
Privacy Risk: There is a risk that the information provided on the immigration form is
inaccurate.

9

Select USCIS personnel who seek to access, process, store, receive, or transmit PII obtained through the
Operational Use of Social Media while conducting investigations or background checks are required to complete a
Rules of Behavior (ROB) for the Operational Use of Social Media. These ROBs ensure that users are accountable
for their actions on social media, are properly trained, and aware of the authorized use of social media sites.
10
See DHS/USCIS/PIA-013-01 FDNS Directorate, available at https://www.dhs.gov/uscis-pias-and-sorns.

Privacy Impact Assessment Update
DHS/USCIS/PIA-016(d) CLAIMS 3 and Associated Systems
Page 7

Mitigation: This risk is mitigated. USCIS relies on the accuracy of the information
provided by the immigration requestor and/or legal representatives. Prior to submitting an
immigration request form, requestors must certify on the respective forms that the information
submitted is true and correct to the best of the immigration requestor’s knowledge and belief.
USCIS presumes the information submitted is accurate and verifies the information against
multiple sources during the review process.
USCIS also gives individuals opportunities during and after the completion of the
immigration request process to correct information they have provided or received and to respond
to information received from external sources, including social media. If the information could
lead to a denial of the immigration benefit and if it is information of which the benefit requestor is
unaware, it would be provided to the benefit requestor in a Notice of Intent to Deny during an
interview or in similar processes, and the benefit requestor would have an opportunity to review
and respond.
Privacy Risk: There is a risk of over collection now that USCIS uniformly collects social
media information as part of its determination with an immigration request.
Mitigation: This risk is mitigated. In coordination with DHS, USCIS updated immigration
request forms to collect the standard biographic and social media data elements from individuals
on the appropriate immigration benefit requests in support of existing USCIS vetting and
adjudication programs. USCIS now collects social media user identifications (also known as
usernames, identifiers, or “handles”) and associated social media platforms used by the
immigration requestor during the past five years on certain forms. USCIS is seeking this
information, covering the previous five-year period, to assist with identity verification and
consistency with other federal entity data collections for certain immigration request forms. USCIS
personnel review publicly available information on social media platforms in a manner consistent
with the privacy settings the immigration requestor has chosen to adopt for those platforms. Only
that information which the account holder has allowed to be shared publicly will be viewable by
USCIS.
USCIS collection of social media information is not “mandatory” in the sense that a benefit
request form will be denied or rejected based solely on the lack of a response. USCIS continues to
adjudicate a form where social media data element information is not answered, but failure to
provide the requested data may delay the final determination of an individual’s eligibility for the
requested benefit. USCIS requires the ability to consider that information as it may contradict or
substantiate information provided to USCIS in connection with the immigration request.
Uses of the Information
The uses of information do not change as a result of this update as outlined in Section 3.0
of the DHS/USCIS/PIA-016(a) CLAIMS 3 and associated systems and its subsequent updates.

Privacy Impact Assessment Update
DHS/USCIS/PIA-016(d) CLAIMS 3 and Associated Systems
Page 8

USCIS continues to use CLAIMS 3 and its associated systems to support and manage the
administration and adjudication of certain immigration related requests. Specifically, USCIS uses
the biographic and social media data element information for the following purposes:
Identity Verification
USCIS uses name, gender, date of birth, city/region/country of birth, country of citizenship,
and social media information to confirm an individual’s identity as it relates to the submitted
immigration request form and to search DHS component historic records. These biographic
identifiers are also used internally by USCIS and screening partners to confirm or disprove an
association between an immigration requestor and information of interest and the strength of that
association in the context of the underlying information.
Identity Resolution
The current passport/travel/national identity document information (country of issuance,
issue date, and expiration date) is a unique numeric identifier issued to a single individual that
USCIS uses to confirm a person’s identity and to search DHS records. It is also used by USCIS
and screening partners to find, confirm, or disprove an association between an applicant, and
determine the strength of that association, or to provide other information about the person that
may be important in the adjudication.
Contact Information
The following eight (8) data elements are used to provide official correspondence from
USCIS to an immigration requestor:
•
•
•
•
•
•
•
•

Telephone Number(s)
Email address(es)
U.S. Address: Residence or Destination city
U.S. Address: Residence or Destination state
Foreign Address city
Foreign Address state
U.S. Point of Contact Name, if applicant is located outside of the United States
U.S. Point of Contact Telephone Number, if applicant is located outside of the United
States

These data elements are also used as secondary data elements to confirm a subject’s identity as it
relates to the submitted benefit request forms and to component historic records. These data
elements are also used internally by USCIS and screening partners to confirm or disprove an
association between a benefit requestor and information of interest and the strength of that
association in the context of the underlying information.

Privacy Impact Assessment Update
DHS/USCIS/PIA-016(d) CLAIMS 3 and Associated Systems
Page 9

CLAIMS 3 continues not to use technology to conduct electronic searches, queries, or
analyses to discover or locate a predictive pattern or anomaly.
USCIS continues to share information with DHS components. DHS Component access and
use does not change as a result of this update.
Notice
USCIS is providing general notice about the system changes through this PIA update.
USCIS also continues to provide notice through the associated SORNs and through the Privacy
Notices on the associated forms (both paper and electronic). Furthermore, DHS issued two notices
in the Federal Register titled, (1) “Agency Information Collection Activities: Generic Clearance
for the Collection of Certain Information on Immigration and Foreign Travel Forms,”11 and (2)
“Agency Information Collection Activities: Generic Clearance for the Collection of Social Media
Information on Immigration and Foreign Travel Forms”12 to notify the public on USCIS’ intent to
update several immigration request forms to collect biographic and social media information,
respectively.
Data Retention by the Project
The records schedule does not change with this update. CLAIMS 3 continues to maintain
limited background check results and the records will be retained for 50 years from the date of the
last completed action in accordance with NARA Disposition Authority Number DAA-0566-20160013. There are no additional risks to the retention of information since CLAIMS 3 plans to
continue to adhere to the NARA approved schedule.
Information Sharing
This update does not impact internal and external information sharing as outlined in
CLAIMS 3 and Associated Systems. There are no new privacy risks associated with information
sharing.
Redress
This update does not impact how access, redress, and correction may be sought through
USCIS. USCIS continues to provide individuals with access to their information through a Privacy
Act or Freedom of Information Act (FOIA) request. Individuals not covered by the Privacy Act or
Judicial Redress Act (JRA) still may obtain access to records consistent with FOIA unless
disclosure is prohibited by law or if the agency reasonably foresees that disclosure would harm an
interest protected by an exemption. U.S. Citizens and Lawful Permanent Residents may also file a
11

See https://www.federalregister.gov/documents/2020/02/10/2020-02613/agency-information-collection-activitiesgeneric-clearance-for-the-collection-of-certain-information.
12
See https://www.federalregister.gov/documents/2019/09/04/2019-19021/agency-information-collection-activitiesgeneric-clearance-for-the-collection-of-social-media.

Privacy Impact Assessment Update
DHS/USCIS/PIA-016(d) CLAIMS 3 and Associated Systems
Page 10

Privacy Act request to access their information. If an individual would like to file a Privacy Act or
FOIA request to view his or her USCIS record, the request can be mailed to the following address:
National Records Center
Freedom of Information Act/Privacy Act Program
P.O. Box 648010
Lee’s Summit, MO 64064-8010
Persons not covered by the Privacy Act or JRA are not able to amend their records through FOIA.
Should a non-U.S. person find inaccurate information in his or her record received through FOIA,
he or she may visit a local USCIS Field Office to identify and amend inaccurate records with
evidence.
Auditing and Accountability
This update does not impact auditing and accountability by implementing technical and
security controls to limit access and mitigate privacy risks associated with unauthorized access and
disclosure.

Responsible Official
Donald K. Hawkins
Privacy Officer
U.S. Citizenship and Immigration Services
Department of Homeland Security
(202) 272-8030

Approval Signature
Original, signed copy on file at the DHS Privacy Office.
________________________________
Dena Kozanas
Chief Privacy Officer
Department of Homeland Security
(202) 343-1717