44 F.4th 716
7th Cir.2022Background
- Alight Solutions provides recordkeeping and cybersecurity services for employer-sponsored health and retirement plans, including ERISA plans, and handled sensitive participant data for millions of participants.
- The DOL opened an investigation after alleged cybersecurity breaches led to unauthorized distributions from ERISA plan accounts; DOL issued an administrative subpoena duces tecum seeking documents from Jan 1, 2015 through production.
- Alight produced some materials but redacted client-identifying information, objected to many requests (challenging DOL authority, scope, burden, and confidentiality), and provided a two-month sampling that it said implied thousands of hours to comply.
- The district court enforced the subpoena as narrowed by the DOL, found the requests reasonably relevant and not indefinite, rejected Alight’s burden claims, and denied a protective order because FOIA and 18 U.S.C. §1905 protect disclosure to the public.
- The court instructed Alight to produce documents in its possession (noting it need not produce records from before its formation) and refused redaction that prevented the DOL from assessing ERISA violations.
- On appeal, the Seventh Circuit affirmed, holding DOL had authority, the subpoena was sufficiently definite and relevant, burdensomeness claims failed, and denial of protective relief was not an abuse of discretion.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| DOL authority to issue subpoena (to non-fiduciary) | Alight: DOL may not investigate non-fiduciaries; Alight is only an administrative service provider. | DOL: §1134(a)(1) authorizes investigations of any person when information may relate to ERISA violations. | Court: DOL authority extends to non-fiduciaries; subpoena lawful. |
| DOL authority to investigate cybersecurity (raised on appeal) | Alight (for first time on appeal): DOL lacks authority to probe cybersecurity generally. | DOL: cybersecurity and adequacy of protections are relevant to ERISA fiduciary duties. | Forfeited on appeal; merits alternative: cybersecurity is relevant to ERISA. |
| Subpoena indefiniteness and breadth | Alight: Requests are indefinite, amorphous, and overbroad (would require production of virtually all ERISA-related documents). | DOL: Requests (as narrowed) are clear and reasonably relevant to investigation. | Court: Terms are not too indefinite; breadth weighed under relevancy/burden and found acceptable. |
| Undue burden of compliance | Alight: Sample shows thousands of hours and extensive redaction work; compliance would be excessively burdensome. | DOL: Production burden speculative and unexplained; relevance justifies enforcement; redactions increased Alight’s burden. | Court: Alight’s burden allegations are conclusory and insufficient; subpoena not unduly burdensome. |
| Protective order for confidential information | Alight: Participant PII, settlement agreements, and client-identifying info require protection or redaction. | DOL: Information is necessary to identify potential ERISA violations; FOIA and §1905 protect against public disclosure. | Court: Alight failed to show good cause; denial of protective order not an abuse of discretion. |
Key Cases Cited
- EEOC v. Aerotek, Inc., 815 F.3d 328 (7th Cir. 2016) (standard for enforcing administrative subpoenas; relevance, definiteness, and agency authority)
- McLane Co., Inc. v. EEOC, 137 S. Ct. 1159 (2017) (administrative subpoenas must not be for illegitimate purpose; relevance and burden are fact-intensive)
- Chao v. Loc. 743, Int'l Bhd. of Teamsters, 467 F.3d 1014 (7th Cir. 2006) (agency subpoenas may be issued on suspicion of violation)
- United States v. Morton Salt Co., 338 U.S. 632 (1950) (agencies may investigate on mere suspicion to assure compliance)
- EEOC v. United Air Lines, Inc., 287 F.3d 643 (7th Cir. 2002) (presumption in favor of enforcing subpoenas; burden must be shown to threaten normal business)
- Dow Chem. Co. v. Allen, 672 F.2d 1262 (7th Cir. 1982) (administrative subpoena enforcement: agency authority, definiteness, and relevance)
- EEOC v. Quad/Graphics, Inc., 63 F.3d 642 (7th Cir. 1995) (court rejected substantially inflated burden estimates in subpoena disputes)