Employers Should Purge Old I-9s

​Employers often fail to shred old Forms I-9 that are beyond the retention requirement, even though this can lead to compliance liability.

"But remember that once an I-9 has been purged, it's gone forever, so it's best to have a system in place with appropriate checks and balances," said John Fay, an attorney and director of product strategy at Equifax Workforce Solutions in Phoenix.

"Many employers have, knowingly or not, adopted a laissez-faire attitude to I-9 purging by choosing to keep their I-9s beyond the retention period and to sort it all out in the event of an inspection by the government," Fay said. The problem with this approach is that U.S. Immigration and Customs Enforcement (ICE) typically gives employers only three business days to produce I-9s and associated documentation.

In the mad dash of responding to this notice of inspection (NOI), employers may not have the time or resources to remove or pull out those purgeable I-9s from the documents sent to ICE. In such cases, the agency may review and consider the old I-9s in assessing paperwork fines and penalties against the employer, Fay noted.

Errors on forms for terminated employees are difficult, if not impossible, to correct, said Sujata Ajmera, an attorney with Clark Hill in Austin, Texas. In the event of an ICE audit, such errors could create compliance violations that cannot be mitigated.

Further, she noted, the forms create a record of compliance practices within the organization. Implementing a good retention program will help the company eliminate any old and possibly problematic patterns of practice that could come up in a lawsuit, she explained.

"Timely purging is also a great general risk-mitigation strategy," Fay added, regardless of the possible I-9 compliance liability. This is especially true considering that a completed I-9 has much personally identifiable information, including an employee's name, Social Security number and address.

How Long Must I-9s Be Kept?

I-9s must be retained either one year after the date of termination or three years after the date of hire, whichever is later.

"Some employers have read that requirement and mistakenly interpreted it to mean that they could destroy I-9 forms of their current employees after a three-year period," Fay said. But the retention period for an I-9 comes into play only after the employment is terminated, he explained.

"Figuring out the Form I-9 retention period has long been a source of frustration for employers, primarily because the actual purge date varies based on how long the employee had been with the organization," he said.

The I-9 retention rule applies uniformly to all employees, but there may be occasions when an employer needs to preserve an I-9 due to litigation, Fay noted.

Some employers have third-party HR administrators who maintain the I-9 records on behalf of the company. In this circumstance, "the same retention rules apply and it is recommended that the employer proactively work with and engage their vendors and I-9 certifiers to ensure they have implemented a compliant retention policy," Ajmera said.

The employer should inquire about the vendor's retention program and receive written assurances that the documents are being kept and purged in accordance with all regulations, she said. "A quarterly or annual audit is a good way to ensure vendors are staying compliant with all rules." The responsibility is always on the employer to follow the I-9 requirements, she noted.

How Should Employers Get Rid of Old I-9s?

Given the amount of sensitive personally identifiable information on I-9s, employers should use a secure document destruction protocol to lessen the risk of unauthorized exposure, Fay said.

For example, the National Institute of Standards and Technology provides in-depth guidance and best practices for data destruction in its Guidelines for Media Sanitization, including recommendations for destroying paper files through the use of cross-cut shredders.

Similarly, I-9s stored in an electronic format should also be purged using a well-documented and secure data wipe process that prevents information from later being recovered or retrieved, Fay said. "This process generally works well when I-9s are electronically stored in a dedicated application or hosting environment, enabling the employer to securely initiate the purge process from an administrative control panel," he added.

What Are the Risks of Purging I-9s Prematurely?

Accidental or premature purging of I-9s can be disastrous, particularly when an employer receives an NOI from ICE demanding I-9s that no longer exist, Fay said. "In those instances, the employer will need to complete new I-9s as soon as possible, and even then, they still face potential liability for late-completed verifications," he noted.

Employers that purge I-9s too early and are found to be out of compliance can face penalties as high as approximately $2,300 per I-9 on average, said Jorge Lopez, an attorney with Littler in Miami. "This is normal for paperwork violations," he said. "There could be other aggravating circumstances, such as a situation where there is an intentional hire violation."

However, the bottom line is that the purge rule lets an employer remove an I-9 that is no longer required to be retained and therefore decreases the exposure to liability in the future, Lopez said.

"It will be prudent to make a purge process part of the I-9 compliance module," he noted.