Enforcement of E-Verify Regulation Postponed Once Again

Today is Data Privacy Day and we bring you a special post regarding E-Verify from guest contributors Lawrence Lorber, Malcolm Harkins, and James Segroves, of Proskauer's DC office, and David Grunblatt of Proskauer's Newark office.  Enforcement of a controversial federal regulation that raised significant privacy concerns has been postponed once again as the result of a legal challenge filed by Proskauer on behalf of the Chamber of Commerce of the United States of America and four other trade associations. See Chamber of Commerce of the U.S. v. Napolitano, Civil Action No. AW-08-3444 (D. Md.). The regulation in question would have required most government contractors and subcontractors to participate in E-Verify, an Internet-based system that allows employers to verify that individuals are eligible to work in the United States using an employee’s Social Security Number and other personal information. Pursuant to a January 27, 2009 agreement between the parties, enforcement of the regulation has been postponed until May 21, 2009, in order to give the recently inaugurated Administration of President Barack Obama an opportunity to review the regulation. A notice to this effect is scheduled to be published in the Federal Register on January 30, 2009.

By way of background, on June 6, 2008, then-President George W. Bush signed Executive Order 13,465, which instructs that “Executive departments and agencies that enter into contracts shall re-quire, as a condition of each contract, that the contractor agree to use an electronic employment eligibility verification system designated by the Secretary of Homeland Security to verify the employment eligibility of: (i) all persons hired during the contract term by the contractor to perform employment duties within the United States; and (ii) all persons assigned by the contractor to perform work within the United States on the Federal contract.” President Bush also commanded that the Federal Acquisition Regulation (“FAR”), which governs the acquisition of supplies and services by all federal agencies, be amended to incorporate the foregoing requirement. Three days later, then-Secretary of Homeland Security Michael Chertoff signed a notice designating E-Verify as the electronic employment eligibility verification system to be used by federal contractors and subcontractors.

On June 12, 2008, the agencies responsible for issuing the FAR published a proposed rule to implement Executive Order 13,465 and solicited comments on the proposed rule’s text. On November 14, 2008, a final rule was published in the Federal Register with an effective date of January 15, 2009.

In addition to responding to numerous comments attacking the legality of Executive Order 13,465 and the proposed rule, the final rule explained that “[s]everal commenters suggested that E-Verify has ongoing system security problems that jeopardize the privacy and security of individuals’ personal information.” The final rule also explained that “[m]any commenters stated a concern that E-Verify’s inability to prevent identity theft leaves employers that use E-Verify vulnerable to sanctions.” Ultimately, however, the final rule rejected these privacy-related concerns. For example, the final rule asserted that “security measures in place [to protect employees’ personal information transmitted though E-Verify] include among other things both strong and limited access controls, transmission encryption, and extensive audit logging.”

On December 23, 2008, the Chamber of Commerce of the United States of America—joined by the Associated Builders and Contractors, Inc.; the Society for Human Resource Management; the American Council on International Personnel; and the HR Policy Association—filed a Complaint for Declaratory and Injunctive Relief in the United States District Court for the District of Maryland. In addition to challenging the substance of the final rule, the plaintiffs contested the Executive Order, claiming it was unconstitutional and that it was an unlawful attempt to circumvent existing immigration laws. The plaintiffs also challenged the expansion of E-Verify to require the re-authorization of existing workers.

Shortly after the plaintiffs filed their complaint, the parties reached an agreement to delay implementation of the final rule until February 20, 2009, in order to allow expedited briefing on cross-motions for summary judgment. The plaintiffs’ motion for summary judgment was filed on January 14, 2009, the same day that a notice appeared in the Federal Register delaying the final rule’s enforcement until February 20, 2009.

On January 27, 2009—one day before the Federal Government’s deadline for responding to the plaintiffs’ motion for summary judgment—the parties reached an agreement delaying the applicability date of the final rule until May 21, 2009. A notice to this effect is scheduled to be published in the Federal Register on January 30, 2009. In addition, the Federal Government filed an emergency motion with the district court asking it to stay judicial proceedings for 90 days “in order to allow the newly-inaugurated Administration of President Barack Obama to review the [regulations] at issue in this case.” On January 28, 2009, the district court issued an order granting the Federal Government’s emergency motion.

Given the significant burdens the final rule would have imposed on federal contractors and subcontractors, this most recent delay in the final rule’s enforcement represents another intermediate victory for federal contractors and subcontractors throughout the United States. In addition, the Obama Administration’s pledge to review the final rule may mean that privacy concerns raised by commenters will be given greater weight.

New York Restricts Employer Use of Employee Social Security Numbers

New York now prohibits employers from publicly displaying employee Social Security Numbers (“SSNs”), printing employee SSNs on identification cards, and communicating to the general public employee SSNs or “personal identifying information.”   For more information, see this Client Alert from Proskauer's Employment Law Counseling and Training Practice Group.

CT's New SSN Law Is Third 0f Its Kind

A host of state laws require that companies take measures to protect the confidentiality of the Social Security Numbers that they possess regarding employees and consumers. But Connecticut’s new law, “AN ACT CONCERNING THE CONFIDENTIALITY OF SOCIAL SECURITY NUMBERS,” requires more. 

Connecticut is at least the third state to do so (after Michigan and Texas). In addition to the requirements that have become common among state laws (e.g., requirements to safeguard SSNs and to dispose of them in a secure fashion), Connecticut’s new law also requires that companies create, and publish to the public, a policy that protects the confidentiality of SSNs, prohibits their unlawful disclosure, and limits access to them. According to the Act, one way that the policy may be published is by posting it on an Internet Web page.

A company that intentionally violates Connecticut’s new law is subject to a civil penalty of $500 per violation, not to exceed $500,000 for any single event. In addition, if a company publishes a policy and then does not comply with it, the company could be subject to an action by the Federal Trade Commission, a state attorney general, or even an individual or class of individuals, for deceptive trade practices, consumer protection violations, and/or fraud.

Many states have Social Security Number protection laws that require companies to take measures to protect the Social Security Numbers that they possess in the course of their business. For example, many states prohibit companies from including full Social Security Numbers in mailings and from transmitting Social Security Numbers, unencrypted, over a public network (such as via unencrypted e-mail). Increasingly more states are adopting Social Security Number protection laws at a rapid pace. 

All companies should have Social Security Number protection policies that are designed to bring about compliance with these laws and the protection of Social Security Numbers from compromise. In the few states where these policies are required to be published, companies must do so, and should appreciate the additional legal exposure that goes along with publishing its policy to the world. In many cases (as in the case of Web site privacy policies), published policies are legally construed as enforceable commitments as to the company’s practices.

Connecticut’s Act becomes effective on October 1, 2008.