**USDA PRIVACY IMPACT ASSESSMENT FORM**

**Agency: Associate Chief Financial Officer for Financial Systems
(ACFO-FS)**

**     **

**System Name: Travel System (TRVL)**

> **includes Name and Address Subsystem (NAME)**

**     **

**System Type:** **Major Application**

**General Support System**

**Non-major Application**

**System Categorization (per FIPS 199):** **High**

**Moderate**

**Low**

**Description of the System:**

> TRVL provides USDA agencies the capability for processing travel
> authorizations, travel advances, and travel vouchers for temporary
> duty and relocation travel. The NAME subsystem supports TRVL for
> validating employee information. TRVL is customized software USDA
> developed in-house. The system is accessed using either 3270 terminal
> emulators for online entry or a PC-based batch system called PC TRVL.
> The TRVL system is administered through a front-end system that is
> co-located with the mainframe.
>
> As a sub-system of the TRVL System, the NAME System incorporates and
> is incorporated into the same security controls and measures of the
> TRVL System. NAME is an NFC system used to inquire, add, update and
> delete name and address records for several administrative payment
> systems. NAME is a legacy system and resides on NFC mainframe
> environment.

**Who owns this system?**

Associate Chief Financial Officer for Financial Systems

**Who is the security contact for this system?**

**     **

Associate Chief Financial Officer for Financial Systems

**Who completed this document?      **

**     **

Associate Chief Financial Officer for Financial Systems

**     **

### DOES THE SYSTEM CONTAIN INFORMATION ABOUT INDIVIDUALS IN AN IDENTIFIABLE FORM?

Indicate whether the following types of personal data are present in the
system

+------------------------------------------------------+------+-------+
| **QUESTION 1**                                       | Citi | Empl  |
|                                                      | zens | oyees |
| Does the system contain any of the following type of |      |       |
| data as it relates to individual:                    |      |       |
+------------------------------------------------------+------+-------+
| > Name                                               | **Y  | **    |
|                                                      | es** | Yes** |
+------------------------------------------------------+------+-------+
| > Social Security Number/Vendor Identification       | **Y  | **    |
| > Number                                             | es** | Yes** |
+------------------------------------------------------+------+-------+
| > Telephone Number                                   | **Y  | **    |
|                                                      | es** | Yes** |
+------------------------------------------------------+------+-------+
| > Email address                                      | **   | *     |
|                                                      | No** | *No** |
+------------------------------------------------------+------+-------+
| > Street address                                     | **Y  | **    |
|                                                      | es** | Yes** |
+------------------------------------------------------+------+-------+
| > Financial data                                     | **Y  | **    |
|                                                      | es** | Yes** |
+------------------------------------------------------+------+-------+
| > Health data                                        | **   | *     |
|                                                      | No** | *No** |
+------------------------------------------------------+------+-------+
| > Biometric data                                     | **   | *     |
|                                                      | No** | *No** |
+------------------------------------------------------+------+-------+
| **QUESTION 2**                                       | **   | *     |
|                                                      | No** | *No** |
| Can individuals be uniquely identified using         |      |       |
| personal information such as a combination of        |      |       |
| gender, race, birth date, geographic indicator,      |      |       |
| biometric data, etc.?                                |      |       |
|                                                      |      |       |
| NOTE: 87% of the US population can be uniquely       |      |       |
| identified with a combination of gender, birth date  |      |       |
| and five digit zip code[^1]                          |      |       |
+------------------------------------------------------+------+-------+
| Are social security numbers embedded in any field?   | **Y  | **    |
|                                                      | es** | Yes** |
+------------------------------------------------------+------+-------+
| Is any portion of a social security numbers used?    | **Y  | **    |
|                                                      | es** | Yes** |
+------------------------------------------------------+------+-------+
| Are social security numbers extracted from any other | **Y  | **    |
| source (i.e. system, paper, etc.)?                   | es** | Yes** |
+------------------------------------------------------+------+-------+

**If all of the answers in Questions 1 and 2 are
NO,**![](media/image1.wmf){width="0.40555555555555556in"
height="0.38055555555555554in"}

You do not need to complete a Privacy Impact Assessment for this system
and the answer to OMB A-11, Planning, Budgeting, Acquisition and
Management of Capital Assets,

Part 7, Section E, Question 8c is:

**3. No, because the system does not contain, process, or transmit
personal identifying information.**

If any answer in Questions 1 and 2 is YES, provide complete answers to
all questions below.

### DATA COLLECTION

3.  Generally describe the data to be used in the system.

> Travel authorizations, travel advances, and travel vouchers for
> temporary duty and relocation travel for official government.

4.  Is the use of the data both relevant and necessary to the purpose
    for which the system is being designed? In other words, the data is
    absolutely needed and has significant and demonstrable bearing on
    the system's purpose.

Yes

No

1.  Explain

> TRVL provides USDA agencies the capability for processing travel
> authorizations, travel advances, and travel vouchers for temporary
> duty and relocation travel.

5.  Sources of the data in the system.

    1.  What data is being collected from the citizens and/or employees?

> There is no data collected from the citizens and/or employees, it is
> entered by administrative assistants responsible for entering
> authorizations and vouchers.

2.  What USDA agencies are providing data for use in the system?

> All USDA agencies provide data to TRVL.
>
>      

3.  What state and local agencies are providing data for use in the
    system?

> County and state based agencies associated with FSA, NRCS and RD

4.  From what other third party sources is data being collected?

> Invitational travelers

6.  Will data be collected from sources outside your agency? For
    example, citizens and employees, USDA sources (i.e., NFC, RD, etc.)
    or Non-USDA sources.

Yes

No. If NO, go to question 7

1.  How will the data collected from citizens and employees be verified
    for accuracy, relevance, timeliness, and completeness?

> TRVL supports screen edits for entry of employee and invitational
> traveler data including required fields for approval of authorizations
> and vouchers.

2.  How will the data collected from USDA sources be verified for
    accuracy, relevance, timeliness, and completeness?

> TRVL contains edits for the entry of authorizations and vouchers that
> include required fields and accuracy checks.

3.  How will the data collected from non-USDA sources be verified for
    accuracy, relevance, timeliness, and completeness?

> It is the responsibility of the sponsoring agency to validate the
> invitational traveler information.

### DATA USE

7.  Individuals must be informed in writing of the principal purpose of
    the information being collected from them. What is the principal
    purpose of the data being collected?

> TRVL provides USDA agencies the capability for processing travel
> authorizations, travel advances, and travel vouchers for temporary
> duty and relocation travel.

     

8.  Will the data be used for any other purpose?

Yes

No. If NO, go to question 9

1.  What are the other purposes?

     

9.  Is the use of the data both relevant and necessary to the purpose
    for which the system is being designed? In other words, the data is
    absolutely needed and has significant and demonstrable bearing on
    the system's purpose.

Yes

No

1.  Explain

> TRVL provides USDA agencies the capability for processing travel
> authorizations, travel advances, and travel vouchers for temporary
> duty and relocation travel.

10. Will the system derive new data or create previously unavailable
    data about an individual through aggregation from the information
    collected (i.e. aggregating farm loans by zip codes in which only
    one farm exists.)?

Yes

No. If NO, go to question 11

1.  Will the new data be placed in the individual's record (customer or
    employee)?

Yes

No

2.  Can the system make determinations about customers or employees that
    would not be possible without the new data?

Yes

No

3.  How will the new data be verified for relevance and accuracy?

     

11. Individuals must be informed in writing of the routine uses of the
    information being collected from them. What are the intended
    [routine]{.underline} uses of the data being collected?

> TRVL provides USDA agencies the capability for processing travel
> authorizations, travel advances, and travel vouchers for temporary
> duty and relocation travel.
>
>      

12. Will the data be used for any other uses (other than indicated in
    question 11)?

Yes

No. If NO, go to question 13

1.  What are the other uses?

     

13. Automation of systems can lead to the consolidation of data --
    bringing data from multiple sources into one central location/system
    -- and consolidation of administrative controls. When administrative
    controls are consolidated, they should be evaluated so that all
    necessary privacy controls remain in place to the degree necessary
    to continue to control access to and use of the data. Is data being
    consolidated?

Yes

No. If NO, go to question 14

1.  What controls are in place to protect the data and prevent
    unauthorized access?

     

14. Are processes being consolidated?

Yes

No. If NO, go to question 15

1.  What controls are in place to protect the data and prevent
    unauthorized access?

     

### DATA RETENTION

15. Is the data periodically purged from the system?

Yes

No. If NO, go to question 16

1.  How long is the data retained whether it is on paper,
    electronically, in the system or in a backup?

> Temporary Duty travel records are purged every three years. Relocation
> travel records are purged every six years. The NAME subsystem is not
> purged.

2.  What are the procedures for purging the data at the end of the
    retention period?

     

> Two months prior to the next fiscal year a database sweep is performed
> to purge selected records. The fiscal year of the authorization record
> number is used to determine when a record should be purged.

          

3.  Where are these procedures documented?

     

> A protected Source Library

     

16. While the data is retained in the system, what are the requirements
    for determining if the data is still sufficiently accurate,
    relevant, timely, and complete to ensure fairness in making
    determinations?

[]{.mark}

> The data retained in the system is secured to protect accuracy. The
> system runs an assurance job.

     

17. Is the data retained in the system the minimum necessary for the
    proper performance of a documented agency function?

Yes

No

### DATA SHARING

18. Will other agencies share data or have access to data in this system
    (i.e. international, federal, state, local, other, etc.)?

Yes

No. If NO, go to question 19

1.  How will the data be used by the other agency?

     

     

2.  Who is responsible for assuring the other agency properly uses of
    the data?

     

19. Is the data transmitted to another agency or an independent site?

Yes

No. If NO, go to question 20

1.  Is there the appropriate agreement in place to document the
    interconnection and that the PII and/or Privacy Act data is
    appropriately protected?

> 19.2 Where are those documents located?

     

20. Is the system operated in more than one site?

Yes

No. If NO, go to question 21

1.  How will consistent use of the system and data be maintained in all
    sites?

     

> The second site is the Disaster Recovery site for the National Finance
> Center (NFC) applications. Back-up procedures and off-site storage for
> tapes maintain the consistency of the data.

     

### DATA ACCESS

21. Who will have access to the data in the system (i.e. users,
    managers, system administrators, developers, etc.)?

> Users will have access to the data in the system based on job function
> and the need-to-know the information. They will be located throughout
> the agencies and the Office of the Associate Chief Financial Officer
> for Financial Systems (ACFO-FS). Security profiles are set up for
> users to ensure that internal controls and separation of duties are
> maintained. Sensitive information is restricted from users if there is
> no valid job-related need for the information to perform the duties of
> their position.
>
> Security Administrators manage the security tables within TRVL. It is
> their job function to manage the user's authority to update tables
> within TRVL, ensure the settings on the security tables reflect
> internal controls and monitor the system logs to check for
> unauthorized access, overrides and approvals.
>
> The system developers have access to maintain the system databases and
> files for TRVL. This requires that high-level access be given based on
> the job function. The systems developers also have appropriate access
> to view the data to ensure it is correct. Access is only granted after
> appropriate background investigations have been completed for this
> sensitive position.
>
> Access to TRVL is protected by authentication, encryption of
> passwords, and password aging. Security background investigations are
> required of all users and contractors. All users, including
> contractors, have had security briefings about system security rules
> and must sign a document confirming that they understand the rules.
>
> Access to other than USDA authorized resources is absolutely
> prohibited.

22. How will user access to the data be determined?

> Once a user has completed the background investigation required for
> Federal employment or being a contractor to the Federal Government,
> access is granted based on job function and the need-to-know
> principle. A user signs a document acknowledging that they have read
> and understand the system security rules before access is granted.
> This document is kept on file with an original signature. The Security
> Administrator assigns a profile to the user based on their job
> functions after the request is signed. These profiles have been set up
> to provide access to only the data necessary to perform job functions.
>
> The Security Administrators Handbook documents the TRVL security
> rules, criteria, procedures, controls and the responsibilities of the
> users, Security Administrators, Agency Financial Managers and the USDA
> Office of the Chief Financial Officer. The criteria is listed for
> adding and removing users within TRVL, changing passwords, changing
> user profiles on security tables, and changing or building new
> security models.
>
> The Security Administrator monitors the systems security audit trail
> logs and reports to management, any types of unauthorized access
> attempts, overrides or approvals.

1.  Are criteria, procedures, controls, and responsibilities regarding
    user access documented?

Yes

No

23. How will user access to the data be restricted?

> A user's access will be restricted based on job function within an
> agency. A profile based on the user ID within the system will
> determine what data the user can view in TRVL. It is the
> responsibility of the user's manager and the Security Administrator of
> each agency to ensure the proper paperwork is filled out and signed,
> and that the right profile is attached to the user.

1.  Are procedures in place to detect or deter browsing?

> Yes CA-Top Secret Security software

No

2.  Are procedures in place to detect or deter unauthorized user access?

Yes CA-Top Secret Security software

No

24. Does the system employ security controls to make information
    unusable to unauthorized individuals (i.e., encryption, strong
    authentication procedures, etc.)?

Yes CA-Top Secret Security software

No

### CUSTOMER PROTECTION

25. Who will be responsible for protecting the privacy rights of the
    citizens and employees affected by the interface (i.e., office,
    person, departmental position, etc.)?

     

> USDA agencies that process authorizations and vouchers for their
> employees.

     

26. How can citizens and employees contact the office or person
    responsible for protecting their privacy rights?

[]{.mark}

Contact the Agency Privacy Officer.

     

27. A "breach" refers to a situation where data and/or information
    assets are unduly exposed. Is a breach notification policy in place
    for this system?

Yes. If YES, go to question 28

No

1.  If NO, please enter the POAM number with the estimated completion
    date.

```{=html}
<!-- -->
```
28. Consider the following:

-   Consolidation and linkage of files and systems

-   Derivation of data

-   Accelerated information processing and decision making

-   Use of new technologies

Is there a potential to deprive a customer of due process rights
(fundamental rules of fairness)?

Yes

No. If NO, go to question 29

1.  Explain how this will be mitigated?

     

     

29. How will the system and its use ensure equitable treatment of
    citizens and employees?

> Decisions are not made based on aggregated, correlated data.

30. Is there any possibility of treating customers or employees
    differently and unfairly based upon their individual or group
    characteristics?

Yes

No. If NO, go to question 31

1.  Explain

     

### SYSTEM OF RECORD

31. Can the data be retrieved by a personal identifier? In other words,
    does the system actually retrieve data by the name of an individual
    or by some other unique number, symbol, or identifying attribute of
    the individual?

Yes

No. If NO, go to question 32

1.  How will the data be retrieved? In other words, what is the
    identifying attribute (i.e. employee number, social security number,
    etc.)?

> []{.mark}
>
> The data is retrieved by social security number and employee name.

2.  Under which Systems of Record notice (SOR) does the system operate?
    Provide number, name and publication date. (SORs can be viewed at
    [www.access.GPO.gov](http://www.access.GPO.gov/))

> The system operates under the following SOR notices:
>
> USDA/OCFO -- 3, Billings and Collections Systems
>
> USDA/OFM -- 4, Travel and Transportation System
>
> USDA/OFM -- 7, SF-1099 Reporting System
>
> USDA/OP -- 1, Personnel and Payroll System for USDA Employees

3.  If the system is being modified, will the SOR require amendment or
    revision?

     

      In addition to the SOR notices above, an updated SOR is in review
for posting to include all Office of the Chief Financial Officer
application systems.

     

### TECHNOLOGY

32. Is the system using technologies in ways not previously employed by
    the agency (e.g. Caller-ID)?

Yes

No. If NO, the questionnaire is complete.

1.  How does the use of this technology affect citizen and employee
    privacy?

     

Upon completion of this Privacy Impact Assessment for this system, the
answer to

OMB A-11, Planning, Budgeting, Acquisition and Management of Capital
Assets,

Part 7, Section E, Question 8c is:

**1. Yes.**

PLEASE SUBMIT A COPY TO

THE OFFICE OF THE ASSOCIATE CHIEF INFORMATION OFFICE/CYBER SECURITY

### Privacy Impact Assessment Authorization

### Memorandum

### 

### 

I have carefully assessed the Privacy Impact Assessment for the

[Travel System including Name and Address Subsystem (NAME)]{.underline}

This document has been completed in accordance with the requirements of
the EGovernment Act of 2002.

We fully accept the changes as needed improvements and authorize
initiation of work to proceed. Based on our authority and judgment, the
continued operation of this system is authorized.

[/s/]{.underline}\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
[\_June 26, 2007\_\_\_\_\_]{.underline}

Information Systems Security Program Manager Date

[/s/]{.underline}\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
[\_June 26, 2007\_\_\_\_\_]{.underline}

Agency Preparer Date

[/s/]{.underline}\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
[\_June 26, 2007\_\_\_\_\_]{.underline}

System Manager/Owner Date

OR Project Representative

OR Program/Office Head.

[/s/]{.underline}\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
[\_June 26, 2007\_\_\_\_\_]{.underline}

Agency's Chief FOIA officer Date

OR Senior Official for Privacy

OR Designated privacy person

[/s/]{.underline}\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
[\_June 26, 2007\_\_\_\_\_]{.underline}

Agency OCIO Date

[^1]: Comments of Latanya Sweeney, Ph.D., Director, Laboratory for
    International Data Privacy Assistant Professor of Computer Science
    and of Public Policy Carnegie Mellon University To the Department of
    Health and Human Services On \"Standards of Privacy of Individually
    Identifiable Health Information\". 26 April 2002.