+-------------+--------------------------------------------------------+
| ![](m       |                                                        |
| edia/image1 |                                                        |
| .png){width |                                                        |
| ="7.1743055 |                                                        |
| 55555556in" |                                                        |
| height="    |                                                        |
| 1.124305555 |                                                        |
| 5555554in"} |                                                        |
+-------------+--------------------------------------------------------+
| ![](m       | > **FARM SERVICE AGENCY**                              |
| edia/image2 |                                                        |
| .png){width | **Privacy Impact Analysis (PIA)**                      |
| ="1.3125in" |                                                        |
| heig        | **for**                                                |
| ht="8.5in"} |                                                        |
|             | **Farm Loan Program Information and Delivery System**  |
|             |                                                        |
|             | **(FLPIDS)**                                           |
|             |                                                        |
|             | -   AgCredit                                           |
|             |                                                        |
|             | -   Appraisal System (Appraisal )                      |
|             |                                                        |
|             | -   Debt & Loan Restructuring System (DALR\$)          |
|             |                                                        |
|             | -   Emergency Loan Delivery Spreadsheet (ELDS)         |
|             |                                                        |
|             |     -   Direct Loan Systems (DLS) in development       |
|             |                                                        |
|             |     -   Electronic Debt & Loan Restructuring System    |
|             |         (eDALR\$) in analysis phase                    |
|             |                                                        |
|             | -   Farm Business Plan (FBP)                           |
|             |                                                        |
|             | -   Farm Loan Program Risk Assessment (FLPRA)          |
|             |                                                        |
|             | ```{=html}                                             |
|             | <!-- -->                                               |
|             | ```                                                    |
|             | -   Management of Ag Credit (MAC)                      |
|             |                                                        |
|             | **Update Date: June 9, 2006**                          |
|             |                                                        |
|             | ![](media/image3.png){width="0.7791666666666667in"     |
|             | height="0.8229166666666666in"}                         |
|             |                                                        |
|             | **Farm Service Agency**                                |
|             |                                                        |
|             | **ITSD/FCAO/FLPDG**                                    |
|             |                                                        |
|             | **6501 Beacon Drive**                                  |
|             |                                                        |
|             | **Kansas City, MO 64133**                              |
+-------------+--------------------------------------------------------+

![](media/image4.wmf)

**Document Control**

![](media/image4.wmf)

  ------------ ------------ ------------ ----------------------------------
  **Date**     **Source**   **Author**   **Description of Changes**

  06/08/06     EDS          D Stanley    Consolidation to accommodate new
                            PBeagle      systems

                                         

                                         

                                         

                                         

                                         

                                         

                                         

                                         

                                         

                                         

                                         
  ------------ ------------ ------------ ----------------------------------

![](media/image5.png){width="1.1666666666666667in"
height="0.6680555555555555in"}

Prepared for:

Certification & Accreditation Phase 1

Farm Service Agency

United States Department of Agriculture

6501 Beacon Dr.

Kansas City, MO 64133

Table of Contents

[1 Purpose of Document 3](#purpose-of-document)

[2 Applicability 3](#applicability)

[2.1 Applicability of System 3](#applicability-of-system)

[2.2 System Overview 3](#system-overview)

[USDA PRIVACY IMPACT ASSESSMENT 3](#__RefHeading___Toc137546308)

Table of Tables

[Table 1: System Applicability 3](#__RefHeading___Toc137546309)

[Table 2: Data In The System 3](#__RefHeading___Toc137546310)

[Table 3: Access To The Data 3](#__RefHeading___Toc137546311)

[Table 4: Attributes Of The Data 3](#__RefHeading___Toc137546312)

[Table 5: Maintenance Of Administrative Controls
3](#__RefHeading___Toc137546313)

# Purpose of Document

USDA DM 3515-002 states: "Agencies are responsible for initiating the
PIA in the early stages of the development of a system and to ensure
that the PIA is completed as part of the required System Life Cycle
(SLC) reviews. Systems include data from applications housed on
mainframes, personal computers, and applications developed for the Web
and agency databases. Privacy must be considered when requirements are
being analyzed and decisions are being made about data usage and system
design. This applies to all of the development methodologies and system
life cycles used in USDA.

Both the system owners and system developers must work together to
complete the PIA. System owners must address what data are used, how the
data are used, and who will use the data. System owners also need to
address the privacy implications that result from the use of new
technologies (e.g., caller identification). The system developers must
address whether the implementation of the owner's requirements presents
any threats to privacy."

The Privacy Impact Assessment (PIA) document contains information on how
the FLPIDS affects the privacy of its users and the information stored
within. This assessment is in accordance with NIST SP 800-37 *Guide for
the Security Certification and Accreditation of Federal Information
Systems.*

# Applicability

## Applicability of System

The information in this document is applicable to the system and its
subsystems as listed below.

[]{#__RefHeading___Toc137546309 .anchor}Table 1: System Applicability

+----------------------------+-----------------------------------------+
| **System**                 | **Subsystem**                           |
+============================+=========================================+
| Farm Loan Program          | -   AgCredit                            |
| Information and Delivery   |                                         |
| System (FLPIDS)            | -   Appraisal System (Appraisal )       |
|                            |                                         |
|                            | -   Debt & Loan Restructuring System    |
|                            |     (DALR\$)                            |
|                            |                                         |
|                            | -   Emergency Loan Delivery Spreadsheet |
|                            |     (ELDS)                              |
|                            |                                         |
|                            |     -   Direct Loan Making Systems      |
|                            |         (DLMS) in development           |
|                            |                                         |
|                            |     -   Electronic Debt & Loan          |
|                            |         Restructuring System (eDALR\$)  |
|                            |         in development                  |
|                            |                                         |
|                            | -   Farm Business Plan (FBP)            |
|                            |                                         |
|                            | -   Farm Loan Program Risk Assessment   |
|                            |     (FLPRA)                             |
|                            |                                         |
|                            | ```{=html}                              |
|                            | <!-- -->                                |
|                            | ```                                     |
|                            | -   Management of Ag Credit (MAC)       |
+----------------------------+-----------------------------------------+

## System Overview

**FLPIDS** -

-   **DALR\$** - The Farm Service Agency's (FSA) Debt and Loan
    Restructuring System (DALR\$) is an automated system used for
    restructuring loans. Through the use of DALR\$, the borrower is
    presented with various debt restructuring options, and a plan of
    action is completed that is mutually favorable to the government and
    the borrower.

-   **eDARL \$ -** Web based version of DALR\$ and is in development and
    will be operational in 2007.

-   **ELDS** - The FSA's Emergency Loan Program provides loans to assist
    farmers who have experienced crop and livestock losses due to
    natural disaster or quarantine. The Emergency Loan Delivery
    Spreadsheet is used to calculate disaster losses to crop and
    livestock production. Calculations provided by the Emergency Loan
    Delivery Spreadsheet assist in determining applicant eligibility for
    FSA Emergency and Disaster Loans.

-   **MAC** - The Management of Agricultural Credit (MAC) system
    performs various functions for the Farm Service Agency's (FSA) Farm
    Loan Programs. MAC is used to process loan applications and serves
    as a loan making, tracking, and reporting system. The system is also
    used to service FSA Direct Loans.

-   **Appraisal** - The Farm Service Agency (FSA) offers various types
    of loans to producers through its Farm Loan Program. To qualify for
    certain loans, the borrower is required to secure the loan by
    pledging sufficient collateral. Appraisals of farm property used as
    collateral to secure these loans are completed through the use of
    the Appraisal System COTS Software package.

-   **DLMS** - The Direct Loan Making System (DLMS) is a web-based
    application which will provide field offices with the ability to
    process loan applications, service loans, and allow producers access
    to their Farm Loan Program account information. This will interface
    through the ADPS subsystem in the Program Loan Accounting System
    (PLAS) on the mainframe to process the financial aspects of
    creating, obligating, and maintaining Direct Loans to farmers.

-   **FPB-WEM** - The Farm Business Plan -- Web Equity Manager
    **(FBP-WEM)** system provides financial data, collateral info,
    livestock, equipment, real estate, balance sheet, and classification
    of the borrower for determination of eligibility. It empowers SCO
    staff to better assess each producer's financial situation and their
    goals for the future. The resulting formal business plan, outlining
    the details of the producer, is required to begin their loan
    eligibility decisions and processing. The FBP-WEM continues the
    mission of its predecessor system called Farm Home Plan (FHP) and
    provides new capabilities for improved management and customer
    service.

-   **FLPRA** - To assist the Reviewer-In-Charge (RIC) with the review
    activities, FLPRA will produce reports to assist in the evaluation
    process by providing FSA with a clear, concise, objective evaluation
    of the overall condition and performance of the state FLP programs.
    FLPRA reports and review work performed will establish the basis for
    actions taken by FSA to ensure state FLP programs are effective and
    comply with regulations.

[]{#__RefHeading___Toc137546308 .anchor}**USDA PRIVACY IMPACT
ASSESSMENT**

[]{#__RefHeading___Toc137546310 .anchor}Table 2: Data In The System

+------------------------------+---------------------------------------+
| **DATA IN THE SYSTEM**       |                                       |
+==============================+=======================================+
| > 1\. Generally describe the | Customer-Name, Social Security        |
| > information to be used in  | Number, Financial Information, loan   |
| > the system in each of the  | information, Farm production          |
| > following categories:      | information, Liabilities, assets      |
| > Customer, Employee, and    | owned, tax id, employees name         |
| > Other.                     |                                       |
+------------------------------+---------------------------------------+
| 2a. What are the sources of  | Customer Tax records, credit reports, |
| the information in the       | SCIMS, creditors, banks, GLS,         |
| system?                      | customer case file, IRS, RMA, DPH     |
|                              | Database, yield records, crop         |
|                              | insurance company records, USDA       |
|                              | statistics. Public records, MAC, FBP, |
|                              | GLS, MRT, PLAS, ADPS.                 |
+------------------------------+---------------------------------------+
| 2b. What USDA files and      | SCIMS, WebEquity, FBP, ADPS, MAC, RD  |
| databases are used? What is  | status information, OIP- employee     |
| the source agency?           | access, NASS, GIS, Internal FLPIDS    |
|                              | databases owned by FCAO and Master    |
|                              | References Tables owned by EDMSO.     |
|                              | FSA,                                  |
+------------------------------+---------------------------------------+
| 2c. What Federal Agencies    | FSA, NRCS,IRS, Geological Survey,     |
| are providing data for use   | NASS and Commerce, RD,                |
| in the system?               |                                       |
+------------------------------+---------------------------------------+
| 2d. What State and Local     | County offices, Tax records,          |
| Agencies are providing data  | Courthouse Records (UCC filings),     |
| for use in the system?       | Deed Recorder                         |
+------------------------------+---------------------------------------+
| 2e. From what other third    | Other lenders, credit reporting       |
| party sources will data be   | agencies, private appraisers, Crop    |
| collected?                   | insurance companies, multi list data, |
|                              | Farm Credit System, sales data. Ag    |
|                              | Lenders, business owners              |
+------------------------------+---------------------------------------+
| 2f. What information will be | Service Center employee (employees    |
| collected from the           | name or id is collected as part of    |
| customer/employee?           | the process) enters the information   |
|                              | given to them from the customer,      |
|                              | credit info, other financial data,    |
|                              | assets, production info, historical   |
|                              | business info, SSN, Tax ID, Property  |
|                              | info, community info, farm tract      |
|                              | info, livestock/crop info,            |
+------------------------------+---------------------------------------+
| 3a. How will data collected  | Data is verified manually, Use 3 FLP, |
| from sources other than the  | verify employment, lenders, tax       |
| USDA records and the         | records(IRS)                          |
| customer be verified for     |                                       |
| accuracy?                    |                                       |
+------------------------------+---------------------------------------+
| 3b. How will data be checked | Depend on accuracy of the information |
| for completeness?            | given from the sources, summary data  |
|                              | is calculated, employees manually     |
|                              | check for completeness.               |
+------------------------------+---------------------------------------+

[]{#__RefHeading___Toc137546311 .anchor}Table 3: Access To The Data

  -----------------------------------------------------------------------
  **ACCESS TO THE DATA**          
  ------------------------------- ---------------------------------------
  1\. Who will have access to the FSA employees, Users, managers and
  data in the system (Users,      system administrators, developers, loan
  Managers, System                employees, State, County, National
  Administrators, Developers,     offices, will have access to system
  Other)?                         data.

  2\. How is access to the data   Access if determined by user ID and
  by a user determined? Are       password, following standard agency
  criteria, procedures, controls, procedures. Role based access is built
  and responsibilities regarding  in.
  access documented?              

  3\. Will users have access to   Access is determined by roles. Some
  all data on the system or will  systems allow state/county access only,
  the user's access be            some have database passwords, National
  restricted? Explain.            users may have unrestricted access.

  4\. What controls are in place  Electronic signature of who made
  to prevent the misuse (e.g.     changes, Essential data is locked down,
  browsing, unauthorized use) of  eAuth and web system does not allow
  data by those having access?    browsing, Password protection of
                                  database, security
                                  training/policies/procedures and
                                  handbooks on proper use.

  5a. Do other systems share data Only systems within FCAO share data.
  or have access to data in this  
  system? If yes, explain.        

  5b. Who will be responsible for Agency Users.
  protecting the privacy rights   
  of the customers and employees  
  affected by the interface.      

  6a. Will other agencies share   NO
  data or have access to data in  
  this system (International,     
  Federal, State, Local, Other)?  

  6b. How will the data be used   N/A
  by the agency?                  

  6c. Who is responsible for      N/A
  assuring proper use of the      
  data?                           
  -----------------------------------------------------------------------

[]{#__RefHeading___Toc137546312 .anchor}Table 4: Attributes Of The Data

+------------------------------+---------------------------------------+
| **ATTRIBUTES OF THE DATA**   |                                       |
+==============================+=======================================+
| 1\. Is the use of the data   | Yes                                   |
| both relevant and necessary  |                                       |
| to the purpose for which the |                                       |
| system is being designed?    |                                       |
+------------------------------+---------------------------------------+
| 2a. Will the system derive   | Yes                                   |
| new data or create           |                                       |
| previously unavailable data  |                                       |
| about an individual through  |                                       |
| aggregation from the         |                                       |
| information collected?       |                                       |
+------------------------------+---------------------------------------+
| 2b. Will the new data be     | Yes,                                  |
| placed in the individual's   |                                       |
| record (customer or          |                                       |
| employee)?                   |                                       |
+------------------------------+---------------------------------------+
| 2c. Can the system make      | Yes, improved analysis,               |
| determinations about         |                                       |
| customers or employees that  |                                       |
| would not be possible        |                                       |
| without the new data?        |                                       |
+------------------------------+---------------------------------------+
| 2d. How will the new data be | Spot check, audits, manual            |
| verified for relevance and   | verification, system tested           |
| accuracy?                    | calculations.                         |
+------------------------------+---------------------------------------+
| 3a. If data is being         | User ID and Password. Through eAuth   |
| consolidated, what controls  | and EAS or within the system.         |
| are in place to protect the  |                                       |
| data from unauthorized       |                                       |
| access or use?               |                                       |
+------------------------------+---------------------------------------+
| 3b. If processes are being   | User ID and Password. eAuth and EAS   |
| consolidated, are the proper | or within the system.                 |
| controls remaining in place  |                                       |
| to protect the data and      |                                       |
| prevent unauthorized access? |                                       |
| Explain.                     |                                       |
+------------------------------+---------------------------------------+
| 4a. How will the data be     | Data will be retrieved by User ID and |
| retrieved? Can it be         | Password. Customer data once in the   |
| retrieved by personal        | application could be retrieved by     |
| identifier? If yes, explain. | SS#, Tax ID, customer number, system  |
|                              | assigned identifiers.                 |
+------------------------------+---------------------------------------+
| 4b. What are the potential   | Name, address, tax id could be        |
| effects on the due process   | wrongly used.                         |
| rights of customers and      |                                       |
| employees of:                |                                       |
|                              |                                       |
| -   consolidation and        |                                       |
|     linkage of files and     |                                       |
|     systems;                 |                                       |
|                              |                                       |
| -   derivation of data       |                                       |
|                              |                                       |
| -   accelerated information  |                                       |
|     processing and decision  |                                       |
|     making;                  |                                       |
|                              |                                       |
| -   use of new technologies. |                                       |
+------------------------------+---------------------------------------+
| 4c. How are the effects to   | FSA Security Procedures in place      |
| be mitigated?                | would take affect.                    |
+------------------------------+---------------------------------------+

[]{#__RefHeading___Toc137546313 .anchor}Table 5: Maintenance Of
Administrative Controls

+------------------------------+---------------------------------------+
| **MAINTENANCE OF             |                                       |
| ADMINSTRATIVE CONTROLS**     |                                       |
+==============================+=======================================+
| 1a. Explain how the system   | FSA guidelines for fair and equitable |
| and its use will ensure      | treatment already exist. Automated    |
| equitable treatment of       | consideration or uniform calculations |
| customers and employees.     | of all available options.             |
+------------------------------+---------------------------------------+
| 2a. If the system is         | For web-based applications, patches   |
| operated in more than one    | or fixes are done to the main program |
| site, how will consistent    | so anyone accessing the site will see |
| use of the system and data   | the update. The web program and       |
| be maintained in all sites?  | database are in a central location so |
|                              | updates would affect all at the same  |
|                              | time.                                 |
|                              |                                       |
|                              | In reference to S36 applications.     |
|                              | Centrally managed distribution with   |
|                              | the same releases to all sites.       |
+------------------------------+---------------------------------------+
| 2b. Explain any possibility  | None as long as employee abide by the |
| of disparate treatment of    | rules of behavior. The exception      |
| individuals or groups.       | would be: User error.                 |
+------------------------------+---------------------------------------+
| 2c. What are the retention   | Data is stored indefinitely. Some     |
| periods of data in this      | exists until the user is deleted from |
| system?                      | the database. 5 Years on average for  |
|                              | some systems FSA 25-AS Handbook       |
+------------------------------+---------------------------------------+
| 2d. What are the procedures  | Follow procedures in FSA 25-AS        |
| for eliminating the data at  | Handbook                              |
| the end of the retention     |                                       |
| period? Where are the        |                                       |
| procedures documented?       |                                       |
+------------------------------+---------------------------------------+
| 2e. While the data is        | Data is locked down. Data in          |
| retained in the system, what | evaluated by user determination.      |
| are the requirements for     | Reports can be run as a check.        |
| determining if the data is   |                                       |
| still sufficiently accurate, |                                       |
| relevant, timely, and        |                                       |
| complete to ensure fairness  |                                       |
| in making determinations?    |                                       |
+------------------------------+---------------------------------------+
| 3a. Is the system using      | NO                                    |
| technologies in ways that    |                                       |
| the USDA has not previously  |                                       |
| employed (e.g. Caller-ID)?   |                                       |
+------------------------------+---------------------------------------+
| 3b. How does the use of this | N/A                                   |
| technology affect            |                                       |
| customer/employee privacy?   |                                       |
+------------------------------+---------------------------------------+
| 4a. Will this system provide | Address and loan information may      |
| the capability to identify,  | provide this capability.              |
| locate, and monitor          |                                       |
| [individuals]{.underline}?   |                                       |
| If yes, explain.             |                                       |
+------------------------------+---------------------------------------+
| 4b. Will this system provide | NO                                    |
| the capability to identify,  |                                       |
| locate, and monitor [groups  |                                       |
| of people]{.underline}? If   |                                       |
| yes, explain.                |                                       |
+------------------------------+---------------------------------------+
| 4c. What controls will be    | Security controls with in the Web     |
| used to prevent unauthorized | Farm.                                 |
| monitoring?                  |                                       |
+------------------------------+---------------------------------------+
| 5a. Under which Systems of   | FSA-2-Farm Records File Automated     |
| Record notice (SOR) does the |                                       |
| system operate? Provide      | FSA-14-Applicant/Borrower             |
| number and name.             |                                       |
+------------------------------+---------------------------------------+
| 5b. If the system is being   | NO                                    |
| modified, will the SOR       |                                       |
| require amendment or         |                                       |
| revision? Explain.           |                                       |
+------------------------------+---------------------------------------+