State UI data disclosure for DOL evaluations

CLASSIFICATION
   EMPLOYMENT AND TRAINING ADMINISTRATION                  Unemployment Insurance
               ADVISORY SYSTEM                             CORRESPONDENCE SYMBOL
                                                           OUI/DL
          U.S. DEPARTMENT OF LABOR
                                                           DATE
             Washington, D.C. 20210                        June 25, 2012

ADVISORY:          UNEMPLOYMENT INSURANCE PROGRAM LETTER NO. 23-12

TO:                STATE WORKFORCE AGENCIES

FROM:              JANE OATES /s/
                   Assistant Secretary

SUBJECT:           Mandatory Disclosure of Unemployment Compensation Information for
                   Department of Labor Evaluations of Unemployment Compensation Programs

1. Purpose. To advise state workforce agencies of the Department of Labor’s (Department)
interpretation of Section 303(a)(6) of the Social Security Act (SSA) and 20 CFR 603.5(i) as
requiring states to disclose unemployment compensation (UC) information, including
confidential wage and claim information, needed for Office of Management and Budget (OMB)
approved evaluations of UC programs conducted by the U.S. Department of Labor.

2. References. Title III, Social Security Act (SSA; 42 USC 301 et seq.); and 20 CFR Part 603,
Confidentiality and Disclosure of State UC Information.

3. Background. Evaluations of UC programs help to ensure the accountability and efficiency of
crucial programs that assist unemployed workers while they seek new jobs. Rigorous program
evaluations are an essential component of oversight as they provide the Department with
valuable information about states’ effectiveness in executing core functions, approaches that
result in positive impacts on individuals who access the benefits and services of state UC
agencies, and approaches that are cost-beneficial to the government, taxpayers, and society.
Rigorous evaluations ensure that employer-paid unemployment taxes are invested strategically in
methods that work best.

When the Department conducts evaluations, samples of UC claimants are typically needed,
which often requires the participation of specific key states. Otherwise, the validity of the study
may be compromised. This guidance is issued to facilitate and expedite the process for obtaining
UC information, including confidential wage and claim information, necessary to conduct OMB-
approved Department evaluations of UC programs while maintaining the strictest data privacy
protections.

4. Interpretation. Section 303(a), SSA, provides:

       The Secretary of Labor shall make no certification for payment to any State unless he
       finds that the law of such State, approved by the Secretary of Labor under the Federal
       Unemployment Tax Act, includes provision for…

 RESCISSIONS                                              EXPIRATION DATE
   None                                                     Continuing

       (6) The making of such reports, in such form and containing such information, as the
       Secretary of Labor may from time to time require, and compliance with such provisions
       as the Secretary of Labor may from time to time find necessary to assure the correctness
       and verification of such reports ….

Given the importance of evaluations to the proper functioning of UC programs, this provision
authorizes the Secretary of Labor to require states to disclose UC information, including
confidential wage and claim information, necessary for OMB-approved evaluations of UC
programs conducted by the Department. This program letter interprets section 303(a)(6), SSA,
only for purposes of the disclosure of UC information needed for departmental evaluations of
UC programs. The Department reserves its authority to interpret this section for other purposes.

Federal regulations at 20 CFR Part 603 define confidential UC information, which includes
individual-level wage and claim information, describe the mandatory and permissible disclosures
of such information, and specify the safeguards and other requirements related to these
disclosures, such as requiring states to enter into an agreement before disclosures occur.

However, 20 CFR 603.5(i) provides that disclosure of confidential UC information to a “Federal
official for purposes of UC program oversight and audits,” is not subject to the confidentiality
requirements of the regulations at 20 CFR Part 603. As evaluations of UC programs are a part of
the Department’s oversight function, the Department is therefore not required to enter into an
agreement with a state UC agency for the state to disclose confidential UC information to the
Department.

When the Department has retained the services of evaluators under contract to conduct the actual
evaluations, states are to provide the data directly to the contractor without first sending the data
to the Department. The contractor must follow the same confidentiality and security
requirements as apply to the Department, as described in section 5 below.

Even though the regulations at 20 CFR Part 603 do not apply to disclosure of confidential UC
information for Departmental oversight and audits, the Department will continue to reimburse
the states for reasonable costs associated with disclosures for evaluation of UC programs. The
Department, however, reserves its right not to reimburse state costs for other disclosures it
requires under Section 303(a)(6), SSA.

5. Safeguarding Confidential UC Information. The Department requires its contractors to
maintain the security of confidential UC information consistent with at least the following:
OMB Circular A-130, Appendix III, Security of Federal Automated Information Resources;
National Institute of Standards and Technology (NIST) Federal Information Processing Standard
(FIPS) 200, Minimum Security Requirements for Federal Information and Information Systems;
NIST FIPS 199, Standards for Security Categorization of Federal Information and Information
Systems; NIST Special Publication (SP) 800-18, Revision 1, Guide for Developing Security Plans
for Federal Information Systems; NIST SP 800-53, Recommended Security Controls for Federal
Information Systems; and DOL, CM, NIST SP 800-53 Security Controls Implementation Plan.

These standards are more restrictive than the safeguard and security requirements at 20 CFR
603.9, which apply to the disclosure of confidential UC information subject to 20 CFR Part 603.
Thus, safeguards are in place to protect confidential UC information disclosed to the Department

and/or its contracted evaluators. In addition, the contracts between the Department and its
evaluators require additional safeguards similar to those in section 603.9 of the regulation.

6. Effective Date. This guidance is effective upon issuance. Most states will not need to amend
their laws to permit the disclosure of UC information, including confidential wage and claim
information, required by this guidance because states already provide data to the Department
under section 303(a)(6), SSA. However, to the extent states are required to amend their laws to
permit these disclosures, states have until the end of the first session of their state legislatures
following issuance of this guidance to meet the compliance requirements herein.

7. Action Required. When requested, administrators are required to provide UC information,
including confidential wage and claim information, to the Department or authorized contractors
of the Department for OMB-approved evaluations of UC programs.

8. Inquiries. Questions should be directed to the appropriate Regional Office.