Illinois Amends Right to Privacy in the Workplace Act to Require Handling ID Discrepancy Notifications

Quick Hits

• Illinois SB2339 amended the Right to Privacy in the Workplace Act to prohibit employers from taking adverse action against an employee solely based on receipt of a discrepancy notification from a federal agency or outside vendor and must provide timely notice to the employee and the employee’s authorized representative within five business days.
• SB2339’s five-business-day notice requirement operates alongside existing E-Verify rules, and employers may want to harmonize these timelines to ensure compliance with both state and federal requirements.
• SB2339 introduces robust enforcement mechanisms, including private rights of action for employees and interested parties, with penalties ranging from $100 to $5,000 per violation and additional relief for violations resulting in denial or loss of employment.

SB2339 repealed prior statutory provisions specifically addressing E-Verify and replaced them with broader obligations tied to an employer’s receipt of written notifications from any federal agency or outside vendors—including but not limited to the Social Security Administration, the Internal Revenue Service, or insurance companies—regarding discrepancies in an employee’s individual taxpayer identification number (ITIN) or other identifying documents. SB2339 outlines specific actions (inspection, warrants, subpoena, etc.) permitted by the Illinois Department of Labor (IDOL) in investigating claims against an employer or prospective employer that can be brought by employees, potential employees, and interested parties (including nonprofits and labor unions). However, aggrieved parties do not need to file a complaint with the IDOL or otherwise exhaust alternative administrative remedies before filing a lawsuit. The new provisions authorize the attorney general to initiate or intervene in a civil action against employers if “reasonable cause” exists to believe a party has violated the Right to Privacy in the Workplace Act.

Key Employer Obligations. Employers are prohibited from taking adverse action (e.g., reducing hours, suspending, discharging) against an employee solely based on receipt of a discrepancy notification from a federal agency or outside vendor. This approach is consistent with established federal guidance on the same issue. Employers must also provide timely notice to the employee and the employee’s authorized representative, if any. Notice must be provided as soon as practicable but no later than five business days after the employer receives the notification or determines that the employee must respond to the notification in any manner, whichever is later, unless a shorter timeline applies under federal law or a collective bargaining agreement.

Interaction With E-Verify Timelines. SB2339’s five-business-day notice requirement operates alongside existing E-Verify rules applicable to those enrolled in that program. When E-Verify issues a mismatch result, federal requirements apply. Within ten federal government working days after E-Verify issues the mismatch result, the employer must notify the employee; the employee must decide whether to take action to resolve the mismatch and inform the employer of that decision; and if the employee does not respond by the tenth day, the employer may close the case in E-Verify. Employers may want to harmonize these timelines by ensuring SB2339’s five-day state notice requirement is met while also complying with E-Verify’s ten-day federal timeline.

Required Method of Employee Notification. Employers must notify the employee in person and by hand delivery, if possible. If hand delivery is not possible, the employer must notify the employee by mail and by email (if the employer has the employee’s email address). The employer must also notify the employee’s authorized representative, if any.

Enforcement and Private Rights of Action. SB2339 introduces robust enforcement mechanisms authorizing IDOL to conduct investigations of employer records at any time. Employees have a private right of action. “Interested parties”—defined to include not-for-profit corporations and labor organizations attentive to compliance with worker safety and privacy laws, wage and hour requirements, or other statutory requirements—may also bring actions for civil penalties. Interested parties may seek injunctive relief and are entitled to ten percent of any statutory penalties recovered plus attorneys’ fees; the remaining ninety percent is directed to Illinois to fund enforcement of the Child Labor Law of 2024. A three-year statute of limitations applies to causes of action under this section.

Penalties and Remedies. Employers or prospective employers in violation are subject to penalties, including:

• “a civil penalty of not less than $100 and not more than $1,000 for each violation found by a court” (note that subsequent violations within a three-year period are subject to increased penalties between $1,000 and $5,000 for each violation);
• if the employee was discharged or denied employment, “all relief necessary to make the employee whole, including, but not limited to:
  • reinstatement with the same seniority status”;
  • back pay and interest; and
  • “a civil penalty of $10,000”; and
• compensation for damages including litigation costs, expert witness fees, and reasonable attorney’s fees.

Safe Harbor. Employers may avoid civil penalties by demonstrating good faith reliance on guidance from IDOL or the U.S. Department of Homeland Security, or by showing a bona fide administrative error that did not affect the employee’s employment or pay. Employers are not subject to concurrent or duplicative enforcement action based on the same set of facts or alleged violations involving the same individual(s).

Next Steps

Practical Steps for Employers Now. Employers may want to immediately review and update policies and procedures to: ensure no adverse action is taken solely on receipt of discrepancy notifications from federal agencies and vendors; implement a workflow to meet the five-business-day notice requirement while maintaining compliance with E-Verify’s ten-day Tentative Nonconfirmation (TNC) process when applicable; establish the required notification methods with documentation; train HR and compliance personnel on the new standards, penalties, and safe harbor provisions; and maintain meticulous records for IDOL review.

Ogletree Deakins’ Chicago office and Immigration Practice Group will continue to monitor developments and will post updates on the Illinois and Immigration blogs as additional information becomes available.

In addition, the Ogletree Deakins Client Portal covers developments in E-Verify Requirements and Illinois employment laws, including the new Illinois E-Verify Requirements. Premium subscribers have access to details on Illinois laws, templates, and other requirements for new hires, such as onboarding notices. All client-users have access to updates. For more information on the Client Portal or a Client Portal subscription, please reach out to clientportal@ogletree.com.

Follow and Subscribe
LinkedIn | Instagram | Webinars | Podcasts