![](media/image1.jpeg){width="1.7395833333333333in"
height="1.1875in"}Privacy Impact Assessment (PIA)

TRAVEL Application

Revision: 2.1

USDA FOREST SERVICE

Prepared By: FINANCIAL MANAGEMENT STAFF

Date: August, 2007

# Revision and History Page

  ------------ ------------ -------------------------- ----------- -------- --------------
  **Document   **Revision   **Description of Change**  **Section   **Page   **Initials**
  Version \#** Date**                                  #/          \#**     
                                                       Paragraph            
                                                       \#**                 

  2.1          8/15/2007    Included SORN details      1.2.4       8        HF

                                                                            

                                                                            

                                                                            

                                                                            

                                                                            
  ------------ ------------ -------------------------- ----------- -------- --------------

# Review Page

The following signatures represent the review and acceptance of the
Privacy Impact Assessment (PIA) for the Forest Service (FS) Travel
Application (TRAVEL).

  -- -------------- -- ------------------------------- -- ---------------------- --
                                                                                 

     **Date**          **IRM C&A Project Manager**        **Signature**          

                                                                                 

     **Comment:**                                                                

                                                                                 

                                                                                 

                                                                                 

                                                                                 

                                                                                 

     **Date**          **IRM C&A System Project           **Signature**          
                       Manager**                                                 

                                                                                 

     **Comment:**                                                                

                                                                                 

                                                                                 

                                                                                 

                                                                                 

                                                                                 

     **Date**          **Information System Security      **Signature**          
                       Officer**                                                 

                                                                                 

     **Comment:**                                                                

                                                                                 

                                                                                 

                                                                                 

                                                                                 

                                                                                 

     **Date**          **System Owner**                   **Signature**          

                                                                                 

     **Comment:**                                                                

                                                                                 

                                                                                 

                                                                                 
  -- -------------- -- ------------------------------- -- ---------------------- --

# Table of Contents

[Revision and History Page i](#revision-and-history-page)

[Review Page ii](#review-page)

[Table of Contents iii](#table-of-contents)

[1 Privacy Impact Assessment 1](#privacy-impact-assessment)

[1.1 Introduction 1](#introduction)

[1.2 Summary of Results of the Privacy Impact Assessment
1](#summary-of-results-of-the-privacy-impact-assessment)

[1.2.1 DATA IN THE SYSTEM 4](#data-in-the-system)

[1.2.2 ACCESS TO THE DATA 5](#access-to-the-data)

[1.2.3 ATTRIBUTES OF THE DATA 6](#attributes-of-the-data)

[1.2.4 MAINTENANCE OF ADMINISTRATIVE CONTROLS
8](#maintenance-of-administrative-controls)

# Privacy Impact Assessment

## Introduction

The objective of the PIA is to assist USDA FS employees in identifying
information privacy when planning, developing, implementing, and
operating agency owned applications. The PIA will help USDA FS employees
consider and evaluate whether existing statutory requirements are being
applied to systems that contain personal information. These requirements
are drawn from the Privacy Act of 1993, Children's Online Privacy
Protection Act of 1998, Freedom of Information Act, Paperwork Reduction
Act of 1995, Office of Management and Budget Memoranda M-99-18 dated
June 2, 1998 and M-00-13 dated June 22, 2000 and OCIO memorandum, Use of
Cookies on Web Pages, DR 3410-1, Information Collection Activities, and
DR 3080-1, Records Disposition

The PIA is a Government requirement that helps to ensure that system
owners and developers consider and evaluate existing statutory
information management requirements that must be applied to new or
modified applications that contain personal information. The goals
accomplished in completing this PIA include:

-   Providing USDA FS management with the tools to make informed policy
    and system design decisions.

-   Ensuring accountability for privacy issues.

-   Ensuring a consistent format and structured process for analyzing
    both technical and legal compliance of the application.

-   Providing basic documentation on the flow of personal information
    within the application.

## Summary of Results of the Privacy Impact Assessment

A review of the application, as installed by USDA FS, indicates that
TRAVEL maintains identifiable form of information on individual
employees. The system stores and tracks all tactical, logistical, and
support resources that are mobilized by the incident dispatch community.
A completed USDA Privacy Impact Assessment Form is provided as
Attachment A.

## USDA PRIVACY IMPACT ASSESSMENT FORM

**Agency: Forest Service**

**System Name: Travel Application**

**System Type:** **Major Application**

**System Categorization (per FIPS 199):** Moderate

**Description of the System:**

The Travel application is an interlinked system of Lotus Notes databases
and client software that provides USDA FS travelers nationwide the
ability to create travel vouchers, submit them for approval, make
changes if necessary, resubmit them and track them internally until
payment.

**Who owns this system? (Name, agency, contact information)**

USDA Forest Service

Attn: Financial Management Staff

1601 N. Kent Street

Arlington, VA 22209

**Who is the security contact for this system? (Name, agency, contact
information)**

Name: Daniel Cha

Title: IT Specialist

Agency: USDA Forest Service

Address: Washington Office

Telephone Number: 703-605-4680

E-mail: <dcha@fs.fed.us>

**Who completed this document? (Name, agency, contact information)**

Forest Service Information Resource Management (FS IRM)

DOES THE SYSTEM CONTAIN INFORMATION ABOUT INDIVIDUALS IN AN IDENTIFIABLE
FORM?

Indicate whether the following types of personal data are present in the
system.

+---------------------------------------------------+-------+---------+
| **QUESTION 1**                                    | Cit   | Em      |
|                                                   | izens | ployees |
| Does the system contain any of the following type |       |         |
| of data as it relates to individual:              |       |         |
+---------------------------------------------------+-------+---------+
| Name                                              | Yes   | Yes     |
+---------------------------------------------------+-------+---------+
| Social Security Number                            | Yes   | Yes     |
+---------------------------------------------------+-------+---------+
| Telephone Number                                  | Yes   | Yes     |
+---------------------------------------------------+-------+---------+
| Email address                                     | No    | No      |
+---------------------------------------------------+-------+---------+
| Street address                                    | Yes   | Yes     |
+---------------------------------------------------+-------+---------+
| Financial data                                    | Yes   | Yes     |
+---------------------------------------------------+-------+---------+
| Health data                                       | No    | No      |
+---------------------------------------------------+-------+---------+
| Biometric data                                    | No    | No      |
+---------------------------------------------------+-------+---------+
| **QUESTION 2**                                    | Yes   | Yes     |
|                                                   |       |         |
| Can individuals be uniquely identified using      |       |         |
| personal information such as a combination of     |       |         |
| gender, race, birth date, geographic indicator,   |       |         |
| biometric data, etc.?                             |       |         |
|                                                   |       |         |
| NOTE: 87% of the US population can be uniquely    |       |         |
| identified with a combination of gender, birth    |       |         |
| date and five digit zip code[^1]                  |       |         |
+---------------------------------------------------+-------+---------+
| Are social security numbers embedded in any       | Yes   | Yes     |
| field?                                            |       |         |
+---------------------------------------------------+-------+---------+
| Is any portion of a social security numbers used? | No    | No      |
+---------------------------------------------------+-------+---------+
| Are social security numbers extracted from any    | No    | No      |
| other source (i.e. system, paper, etc.)?          |       |         |
+---------------------------------------------------+-------+---------+

**If all of the answers in Questions 1 and 2 are
NO**,![](media/image3.wmf){width="0.40555555555555556in"
height="0.38055555555555554in"}

You do not need to complete a Privacy Impact Assessment for this system
and the answer to OMB A-11, Planning, Budgeting, Acquisition and
Management of Capital Assets,

Part 7, Section E, Question 8c is:

**3. No, because the system does not contain, process, or transmit
personal identifying information.**

If any answer in Questions 1 and 2 is YES, provide complete answers to
all questions below.

### DATA IN THE SYSTEM

+---------------------------+------------------------------------------+
| 1\. Generally describe    | Customer Data: N/A                       |
| the information to be     |                                          |
| used in the system in     | [Employee Data]{.underline}: Travel      |
| each of the following     | voucher information                      |
| categories: Customer,     |                                          |
| Employee, and Other.      | [Other Data (EERAs):]{.underline}        |
|                           |                                          |
|                           | [Other Data (modules in the Travel       |
|                           | application): supporting validation      |
|                           | tables, Lotus Notes data bases to house  |
|                           | travel vouchers]{.underline}             |
+---------------------------+------------------------------------------+
| 2a. What are the sources  | [The travelers trip details]{.underline} |
| of the information in the |                                          |
| system?                   |                                          |
+---------------------------+------------------------------------------+
| 2b. What USDA files and   | [Travel voucher documents are stored in  |
| databases are used? What  | Lotus Notes data bases. The source is    |
| is the source agency?     | Forest Service employees completing      |
|                           | travel vouchers for                      |
|                           | reimbursement.]{.underline}              |
+---------------------------+------------------------------------------+
| 2c. What Federal Agencies | USDA Forest Service                      |
| are providing data for    |                                          |
| use in the system?        |                                          |
+---------------------------+------------------------------------------+
| 2d. What State and Local  | None                                     |
| Agencies are providing    |                                          |
| data for use in the       |                                          |
| system?                   |                                          |
+---------------------------+------------------------------------------+
| 2e. From what other third | None                                     |
| party sources will data   |                                          |
| be collected?             |                                          |
+---------------------------+------------------------------------------+
| 2f. What information will | The Forest Service employee enters the   |
| be collected from the     | detail information related to an         |
| customer/employee?        | authorized trip to another location for  |
|                           | official business. He/she is requesting  |
|                           | reimbursement for expended personal      |
|                           | funds.                                   |
+---------------------------+------------------------------------------+
| 3a. How will data         | N/A                                      |
| collected from sources    |                                          |
| other than the USDA FS    |                                          |
| records and the customer  |                                          |
| be verified for accuracy? |                                          |
+---------------------------+------------------------------------------+
| 3b. How will data be      | The Travel data entry application has    |
| checked for completeness? | validations that require mandatory       |
|                           | fields be filled in. Validations are     |
|                           | done against master tables to assure     |
|                           | accuracy.                                |
+---------------------------+------------------------------------------+

### ACCESS TO THE DATA 

+---------------------------+------------------------------------------+
| 1\. Who will have access  | Travelers and approvers have access to   |
| to the data in the system | their associated vouchers. The System    |
| (Users, Managers, System  | Administrators have full access to all   |
| Administrators,           | vouchers.                                |
| Developers, Other)?       |                                          |
+---------------------------+------------------------------------------+
| 2\. How is access to the  | Access to data is authorized through     |
| data by a user            | Lotus Notes USERID. Current roles in the |
| determined? Are criteria, | system are:                              |
| procedures, controls, and |                                          |
| responsibilities          | -   Read Only                            |
| regarding access          |                                          |
| documented?               | -   Read and update                      |
|                           |                                          |
|                           | -   Read, update, delete                 |
+---------------------------+------------------------------------------+
| 3\. Will users have       | User's access is restricted. The ability |
| access to all data on the | to read, update or write to a voucher is |
| system or will the user's | based on your Notes ID. If you are not   |
| access be restricted?     | the owner/creator or designated approver |
| Explain.                  | of a travel voucher, you have no access  |
|                           | to it.                                   |
+---------------------------+------------------------------------------+
| 4\. What controls are in  | By system design, no one is authorized   |
| place to prevent the      | to have more access to voucher           |
| misuse (e.g. browsing,    | information than they need. Security     |
| unauthorized use) of data | awareness training is required on an     |
| by those having access?   | annual basis for system administrators.  |
+---------------------------+------------------------------------------+
| 5a. Do other systems      | Yes. The data is passed to the NFC TRVL  |
| share data or have access | system for reimbursement processing.     |
| to data in this system?   |                                          |
| If yes, explain.          |                                          |
+---------------------------+------------------------------------------+
| 5b. Who will be           | The Travel application masks privacy     |
| responsible for           | information when hard copy vouchers are  |
| protecting the privacy    | printed.                                 |
| rights of the customers   |                                          |
| and employees affected by |                                          |
| the interface.            |                                          |
+---------------------------+------------------------------------------+
| 6a. Will other agencies   | No.                                      |
| share data or have access |                                          |
| to data in this system    |                                          |
| (International, Federal,  |                                          |
| State, Local, Other)?     |                                          |
+---------------------------+------------------------------------------+
| 6b. How will the data be  | To process payment for official travel.  |
| used by the agency?       |                                          |
+---------------------------+------------------------------------------+
| 6c. Who is responsible    | Proper use of the system and associated  |
| for assuring proper use   | data is the responsibility of the system |
| of the data?              | owner.                                   |
+---------------------------+------------------------------------------+

### ATTRIBUTES OF THE DATA

+---------------------------+------------------------------------------+
| 1\. Is the use of the     | Yes                                      |
| data both relevant and    |                                          |
| necessary to the purpose  |                                          |
| for which the system is   |                                          |
| being designed?           |                                          |
+---------------------------+------------------------------------------+
| 2a. Will the system       | No                                       |
| derive new data or create |                                          |
| previously unavailable    |                                          |
| data about an individual  |                                          |
| through aggregation from  |                                          |
| the information           |                                          |
| collected?                |                                          |
+---------------------------+------------------------------------------+
| 2b. Will the new data be  | N/A                                      |
| placed in the             |                                          |
| individual's record       |                                          |
| (customer or employee)?   |                                          |
+---------------------------+------------------------------------------+
| 2c. Can the system make   | N/A                                      |
| determinations about      |                                          |
| customers or employees    |                                          |
| that would not be         |                                          |
| possible without the new  |                                          |
| data?                     |                                          |
+---------------------------+------------------------------------------+
| 2d. How will the new data | N/A                                      |
| be verified for relevance |                                          |
| and accuracy?             |                                          |
+---------------------------+------------------------------------------+
| 3a. If data is being      | N/A                                      |
| consolidated, what        |                                          |
| controls are in place to  |                                          |
| protect the data from     |                                          |
| unauthorized access or    |                                          |
| use?                      |                                          |
+---------------------------+------------------------------------------+
| 3b. If processes are      | N/A                                      |
| being consolidated, are   |                                          |
| the proper controls       |                                          |
| remaining in place to     |                                          |
| protect the data and      |                                          |
| prevent unauthorized      |                                          |
| access? Explain.          |                                          |
+---------------------------+------------------------------------------+
| 4a. How will the data be  | N/A                                      |
| retrieved? Can it be      |                                          |
| retrieved by personal     |                                          |
| identifier? If yes,       |                                          |
| explain.                  |                                          |
+---------------------------+------------------------------------------+
| 4b. What are the          | N/A                                      |
| potential effects on the  |                                          |
| due process rights of     |                                          |
| customers and employees   |                                          |
| of:                       |                                          |
|                           |                                          |
| consolidation and linkage |                                          |
| of files and systems;     |                                          |
|                           |                                          |
| derivation of data        |                                          |
|                           |                                          |
| accelerated information   |                                          |
| processing and decision   |                                          |
| making;                   |                                          |
|                           |                                          |
| Use of new technologies.  |                                          |
+---------------------------+------------------------------------------+
| 4c. How are the effects   | N/A                                      |
| to be mitigated?          |                                          |
+---------------------------+------------------------------------------+

### MAINTENANCE OF ADMINISTRATIVE CONTROLS

+---------------------------+------------------------------------------+
| 1a. Explain how the       | N/A                                      |
| system and its use will   |                                          |
| ensure equitable          |                                          |
| treatment of customers    |                                          |
| and employees.            |                                          |
+---------------------------+------------------------------------------+
| 2a. If the system is      | Each traveler retrieves the same data    |
| operated in more than one | entry application and loads it on their  |
| site, how will consistent | PC. The national sweep controller is     |
| use of the system and     | only run in Ft. Collins by the           |
| data be maintained in all | administrators.                          |
| sites?                    |                                          |
+---------------------------+------------------------------------------+
| 2b. Explain any           | N/A                                      |
| possibility of disparate  |                                          |
| treatment of individuals  |                                          |
| or groups.                |                                          |
+---------------------------+------------------------------------------+
| 2c. What are the          | 30 day retention of travel vouchers.     |
| retention periods of data |                                          |
| in this system?           |                                          |
+---------------------------+------------------------------------------+
| 2d. What are the          | The Lotus Notes data bases automatically |
| procedures for            | purge documents based on the retention   |
| eliminating the data at   | set by the programmer.                   |
| the end of the retention  |                                          |
| period? Where are the     | Documentation about vouchers is in the   |
| procedures documented?    | Travel Admin Guide.                      |
+---------------------------+------------------------------------------+
| 2e. While the data is     | N/A                                      |
| retained in the system,   |                                          |
| what are the requirements |                                          |
| for determining if the    |                                          |
| data is still             |                                          |
| sufficiently accurate,    |                                          |
| relevant, timely, and     |                                          |
| complete to ensure        |                                          |
| fairness in making        |                                          |
| determinations?           |                                          |
+---------------------------+------------------------------------------+
| 3a. Is the system using   | No                                       |
| technologies in ways that |                                          |
| the USDA has not          |                                          |
| previously employed (e.g. |                                          |
| Caller-ID)?               |                                          |
+---------------------------+------------------------------------------+
| 3b. How does the use of   | N/A                                      |
| this technology affect    |                                          |
| customer/employee         |                                          |
| privacy?                  |                                          |
+---------------------------+------------------------------------------+
| 4a. Will this system      | No                                       |
| provide the capability to |                                          |
| identify, locate, and     |                                          |
| monitor                   |                                          |
| [                         |                                          |
| individuals]{.underline}? |                                          |
| If yes, explain.          |                                          |
+---------------------------+------------------------------------------+
| 4b. Will this system      | No                                       |
| provide the capability to |                                          |
| identify, locate, and     |                                          |
| monitor [groups of        |                                          |
| people]{.underline}? If   |                                          |
| yes, explain.             |                                          |
+---------------------------+------------------------------------------+
| 4c. What controls will be | Access controls                          |
| used to prevent           |                                          |
| unauthorized monitoring?  |                                          |
+---------------------------+------------------------------------------+
| 5a. Under which Systems   | USDA/OFM-4, Travel and Transportation    |
| of Record notice (SOR)    | System                                   |
| does the system operate?  |                                          |
| Provide number and name.  |                                          |
+---------------------------+------------------------------------------+
| 5b. If the system is      | No. No modifications to the system are   |
| being modified, will the  | planned.                                 |
| SOR require amendment or  |                                          |
| revision? Explain.        |                                          |
+---------------------------+------------------------------------------+

[^1]: Comments of Latanya Sweeney, Ph.D., Director, Laboratory for
    International Data Privacy Assistant Professor of Computer Science
    and of Public Policy Carnegie Mellon University To the Department of
    Health and Human Services On \"Standards of Privacy of Individually
    Identifiable Health Information\". 26 April 2002.