In Walsh v. Alight Solutions, LLC, — F.4th —, 2022 WL 3334450 (7th Cir. Aug. 12, 2022), the Seventh Circuit affirmed a district court order requiring Alight Solutions to produce documents in response to a Department of Labor (“DOL”) subpoena, confirming that the DOL has broad authority to issue subpoenas to investigate possible ERISA violations, even against non-fiduciaries.

Alight provides recordkeeping services for employers who sponsor ERISA-governed health and welfare and retirement plans. In 2019, the DOL began investigating Alight on the basis of alleged cybersecurity breaches that resulted in unauthorized distributions of plan benefits from plans for which Alight provides recordkeeping services. The DOL served Alight with an administrative subpoena duces tecum requesting 32 categories of documents dating back to 2015.

Alight argued that the subpoena was unenforceable because the DOL lacks authority to investigate non-fiduciaries like Alight; the subpoena was too indefinite and too burdensome; and the subpoena sought confidential information of Alight’s clients. The district court disagreed and ordered Alight to comply with the subpoena.

On appeal to the Seventh Circuit, Alight raised all of the same arguments, plus one more: that the DOL lacks authority to investigate cybersecurity issues in the first place. The Seventh Circuit rejected them all, holding that the DOL has broad authority to investigate whether “any person” has violated “any provision” of ERISA, and its subpoena authority is not limited to fiduciaries. The Seventh Circuit also held that investigating cybersecurity issues fell within the DOL’s authority to investigate potential breaches of fiduciary duty under ERISA. Finally, as to Alight’s undue burden and confidentiality arguments, the Seventh Circuit held that Alight had failed to substantiate them with evidence of the burden that compliance would impose on Alight or harm that it or its clients would suffer from disclosure of confidential information to the DOL.

The Seventh Circuit’s opinion is a good reminder of the breadth of the DOL’s subpoena authority and the steps companies should take to respond to DOL subpoenas. Recipients of DOL subpoenas should object in writing to each request they find objectionable and be able to clearly articulate the burden compliance would impose in terms of “the number of documents implicated, the cost to produce those documents, the hours production would require, or how compliance would threaten the normal operation of” the recipient’s business.