**Foreign Agricultural Service**

**USDA**

**Privacy Impact Assessment**

**For**

**International Passport and Travel Tracking System**

**(IPATTS)**

**January 2007**

![](media/image1.wmf)

**Name of Project: International Passport and Travel Tracking System
(IPATTS)**

**Program Office: Office of Foreign Service Operations (OFSO)**

**Project's Unique ID: 005-68-01-51-02-0081-00-401-119**

> **A. [CONTACT INFORMATION:]{.underline}**

1.  **Who is the person completing this document?**

> Brenda Lawson
>
> FAS/OAO/ITD/ADB/Branch Chief
>
> 1400 Independence Ave., SW, Rm. 6526-S
>
> Washington, DC
>
> 202.720.1369
>
> <Brenda.lawson@usda.gov>

2.  **Who is the system owner?**

William Hawkins, Director

USDA/FAS/OAO/PM

1400 Independence Ave., SW, Rm. 4077-S

Washington, DC

202.720.3241

<William.hawkins@usda.gov>

3.  **Who is the system manager for this system or application?**

> Brenda Lawson
>
> FAS/OAO/ITD/ADB/Branch Chief
>
> 1400 Independence Ave., SW, Rm. 6526-S
>
> Washington, DC
>
> 202.720.1369
>
> <Brenda.lawson@usda.gov>

4.  **Who is the IT Security Manager who reviewed this document?**

> Carol Remmers
>
> Information Systems Security Program Manager (ISSPM)
>
> 1400 Independence Ave., SW, Rm. 6078-S
>
> Washington, DC
>
> 202.720.2369
>
> <carol.remmers@usda.gov>

5.  **Did the Chief FOI/PA review this document?**

Sally Klusaritz

FOI/PA, Deputy Director

USDA/FAS/OA/LPA

1400 Independence Ave., SW, Rm. 5074-S

Washington, DC

202.720.3448

<Sally.klusaritz@usda.gov>

6.  **Did the Agency's Senior Office for Privacy review this document?**

William Hawkins, Director

USDA/FAS/OAO/PM

1400 Independence Ave., SW, Rm. 4077-S

Washington, DC

202.720.3241

<William.hawkins@usda.gov>

7.  **Who is the Reviewing Official?**

> Eva Ripollone, CIO
>
> Office of the Director
>
> 1400 Independence Ave., SW,
>
> Washington, DC
>
> 202.690.2936
>
> <Eva.ripollone@usda.gov>
>
> **B. [SYSTEM APPLICATION/GENERAL INFORMATION:]{.underline}**
>
> **1. Does this system contain any information about individuals?**
>
> **Yes**

(a) **Is this information identifiable to the individual?**

> **Yes**

(If there is **NO** information collected, maintained, or used that is
identifiable to

> the individual in the system, [the remainder of the Privacy Impact
> Assessment]{.underline}
>
> [does not have to be completed past this section.]{.underline}
> **Note:** [Clearance sheet must be]{.underline}
>
> [signed and copies to IT Security and Chief FOI/PA must be
> provided]{.underline}).

(b) **Is the information about individual members of the public?**

> **No**

(If YES, a PIA must be submitted with the OMB Exhibit 300, and with the
IT

Security C&A documentation).

(c) **Is the information about employees?**

> **Yes**

(If yes and there is no information about members of the public, the PIA
is required for the USDA IT Security C&A process, but is not required to
be

submitted with the OMB Exhibit 300 documentation).

> **2. What is the purpose of the system/application?**
>
> **IPATTS** consists of both web-based and client-server systems:
>
> **IPATTS Web** is a web form written in ASP code. FAS users use this
> form to submit official travel and passport requests.
>
> **IPATTS client-server** application is an update program written in
> PowerBuilder.
>
> Only ISS administration staff members have access to the system to
> create/update data. IPATTS data resides in Sybase Server called FAA
> Database.
>
> **IPATTS** is a web-based system that enables FAS employees, who are
> anticipating travel for official job duties, to quickly determine the
> visa requirements for their destination country or countries. Using
> this system, USDA employees can apply for "official" passports over
> the web. The system will track who has what passports and will keep
> passports until they are needed.
>
> **3. What legal authority authorizes the purchase or development of
> this**
>
> **system/application?**
>
> **FAS/OAO/ITD/ADB**

C.  **[DATA in the SYSTEM:]{.underline}**

> **1. Generally describe the type of information to be used in the
> system and what**
>
> **categories of individuals are covered in the system?**
>
> **Employee:** Used by ITS to track on the preparations made for
> international travel. IPATTS is also used to generate reports, visa
> forms, USDA letters, and State Department letters.
>
> **2. What are the sources of the information in the system?**
>
> **AD-202, AD-121, DS-11** and **DS-82** and forms submitted by the
> Agency Travel Coordinator
>
> **(a) Is the source of the information from the individual or is it
> taken from**
>
> **another source? If not directly from the individual, then what
> other**
>
> **source?**
>
> **From Individuals**
>
> **(b) What Federal agencies are providing data for use in the
> system?**
>
> **USDA**
>
> **(c) What State and local agencies are providing data for use in the
> system?**
>
> **None**
>
> **(d) From what other third party sources will data be collected?**
>
> **None**
>
> **(e) What information will be collected from the employee and the
> public?**
>
> **Personal data (SSN, address), dependent information, photo**
>
> **3. Accuracy, Timeliness, and Reliability**
>
> **(a) How will data collected from sources other than USDA records be
> verified for accuracy?**
>
> **N/A**
>
> **(b) How will data be checked for completeness?**
>
> Data entered is validated before saving it to the database. Required
> fields have to be completed before saving to the database.
>
> **(c) Is the data current?** What steps or procedures are taken to
> ensure the data is
>
> current and not out-of-date? Name the document (e.g., data models).
>
> Data is routinely updated by ITS and travel coordinators.
>
> **(d) Are the data elements described in detail and documented?** If
> yes, what is

the name of the document?

D.  **[ATTRIBUTES OF THE DATA:]{.underline}**

> **1. Is the use of the data both relevant and necessary to the purpose
> for which the**
>
> **system is being designed?**
>
> **Yes**
>
> **2. Will the system derive new data or create previously unavailable
> data about an**
>
> **individual through aggregation from the information collected, and
> how will**
>
> **this be maintained and filed?**
>
> **No**
>
> **3. Will the new data be placed in the individual's record?**
>
> **Yes**
>
> **4. Can the system make determinations about employees/public that
> would not be**
>
> **possible without the new data?**
>
> **Yes**
>
> **5. How will the new data be verified for relevance and accuracy?**
>
> **Validation rules are built into the system.**
>
> **6. If the data is being consolidated, what controls are in place to
> protect the data**
>
> **from unauthorized access or use?**
>
> Only authorized users belonging to the database and to the specific
> database group can access the system. Access is determined by database
> login and password.
>
> **7. If processes are being consolidated, are the proper controls
> remaining in place to**
>
> **protect the data and prevent unauthorized access?** Explain.
>
> **N/A,** there are no processes being consolidated.
>
> **8. How will the data be retrieved?** Does a personal identifier
> retrieve the data? If
>
> yes, explain and list the identifiers that will be used to retrieve
> information on the
>
> individual.
>
> **Identifiers** for each personal record are generated by the system.
> (Identifier consist of the last 4 digits of the SSN, but user must
> login first.)
>
> **9. What kinds of reports can be produced on individuals?** **What
> will be the use of**
>
> **these reports? Who will have access to them?**
>
> **Reports** listing location/expiration of passport, used to alert TTS
> staff about expiring Passports. Reports are only available to TTS
> staff.

**10. What opportunities do individuals have to decline to provide
information (i.e.,**

> **where providing information is voluntary) or to consent to
> particular uses of**
>
> **the information (other than required or authorized uses and how
> individuals**
>
> **can grant consent.)**
>
> **Only required/authorized data is collected.**

E.  **[MAINTENANCE AND ADMINISTRATIVE CONTROLS:]{.underline}**

> **1. If the system is operated in more than one site, how will
> consistent use of the**
>
> **system and data be maintained in all sites?**
>
> **N/A**
>
> **2. What are the retention periods of data in this system?**
>
> **15+ Years**
>
> **3. What are the procedures for disposition of the data at the end of
> the retention**
>
> **period? How long will the reports produced be kept? Where are the
> procedures**
>
> ** documented?**
>
> Trip and passport data older than 15 years after expiration and
> destroyed can be deleted.

**4. Is the system using technologies in ways that the USDA has not
previously**

**employed (e.g., monitoring software, Smart Cards, Caller-ID)?**

**No**

> **5. How does the use of this technology affect public/employee
> privacy?**
>
> **N/A**
>
> **6. Will this system provide the capability to identify, locate, and
> monitor**
>
> **individuals? If yes, explain.**
>
> Yes, it should be able to indicate when an individual has a
> passport/visa for overseas and in what country.
>
> **7. What kinds of information are collected as a function of the
> monitoring of**
>
> **individuals?**
>
> **Location and addresses of individuals**
>
> **8. What controls will be used to prevent unauthorized monitoring?**
>
> **N/A**
>
> **9. Under which Privacy Act systems of records notice does the system
> operate?**
>
> **Provide number and name.**
>
> **USDA/FAS-7**

**10. If the system is being modified, will the Privacy Act system of
records notice**

> **require amendment or revision? Explain.**
>
> **Undetermined**

**F. [ACCESS TO DATA:]{.underline}**

**1. Who will have access to the data in the system?** (E.g.,
contractors, users, managers,

system administrators, developers, tribes, other)

**Users**

> **2. How is access to the data by a user determined?** Are criteria,
> procedures, controls,
>
> and responsibilities regarding access documented?
>
> Only users belonging to the database and to the specific database
> group can access the system. Access is determined by the database
> login and password.
>
> **3. Will users have access to all data on the system or will the
> user's access be**
>
> **restricted? Explain.**
>
> **Yes.** Users have access to all data on the system.
>
> **4. What controls are in place to prevent the misuse (e.g.,
> unauthorized browsing) of**
>
> **data by those having access?** (Please list processes and training
> materials)
>
> **Security Training**
>
> **5. Are contractors involved with the design and development of the
> system and will**
>
> **they be involved with the maintenance of the system**?
>
> If yes, are Privacy Act contract clauses inserted in their contracts
> and other regulatory measures addressed?
>
> **Yes.**
>
> **Yes.**
>
> **6. Do other systems share data or have access to the data in the
> system? If yes,**
>
> **explain.**
>
> The web interface IPATTS Web System.
>
> **7. Who will be responsible for protecting the privacy rights of the
> public and**
>
> **employees affected by the interface?**
>
> **ITS** is responsible
>
> **8. Will other agencies share data or have access to the data in this
> system (Federal,**
>
> **State, Local, Other)?**
>
> **No**
>
> **9. How will the data be used by the other agency?**
>
> The data is used for tracking, reporting, and preparing letters and
> visa forms.

10. **Who is responsible for assuring proper use of the data?**

**ITS** is responsible.

**APPENDIX A**

**DECLARATION OF PRIVACY PRINCIPLES**

The privacy principles set forth in this declaration are based on the
ethical and legal obligations of the United States Department of
Agriculture to the public and are the responsibility of all USDA
employees to recognize and treat their office as a public trust.

The obligation to protect client and partner privacy and to safeguard
the information clients and partners entrust to us is a fundamental part
of the USDA's mission to administer the law fairly and efficiently.
Clients and partners have the right to expect that the information they
provide will be safeguarded and used only in accordance with law. In
recognition of these obligations, policies and procedures must clearly
state who should have access to what information and for what purposes.
In addition, appropriate limitations must be placed on the collection,
use and dissemination of clients and partners' personal and financial
information and sufficient technological and administrative measures
must be implemented to ensure the security of USDA data systems,
processes and facilities.

All USDA employees are required to exhibit individual performance that
reflects a commitment to dealing with every client and partner fairly
and honestly and to respect the clients and partners' right to feel
secure that their personal information is protected. To promote and
maintain clients and partners' confidence in the privacy,
confidentiality and security protections provided by the USDA, the USDA
will be guided by the following Privacy Principles:

  ----------- ------------------------------------------------------------
  Principle   Protecting citizen, client and partner privacy and
  1:          safeguarding confidential citizen, client and partner
              information is a public trust.

  Principle   No information will be collected or used with respect to
  2:          citizens, clients and partners that is not necessary and
              relevant for legally mandated or authorized purposes.

  Principle   Information will be collected, to the greatest extent
  3:          practicable, directly from the citizen, client or partner to
              whom it relates.

  Principle   Information about citizens, clients and partners collected
  4:          from third parties will be verified to the greatest extent
              practicable with the citizens, clients and partners
              themselves before action is taken against them.

  Principle   Personally identifiable citizen, client or partner
  5:          information will be used only for the purpose for which it
              was collected, unless other uses are specifically authorized
              or mandated by law.

  Principle   Personally identifiable citizen, client or partner
  6:          information will be disposed of at the end of the retention
              period required by law or regulation.

  Principle   Citizen, client or partner information will be kept
  7:          confidential and will not be discussed with, nor disclosed
              to, any person within or outside the USDA other than as
              authorized by law and in the performance of official duties.

  Principle   Browsing, or any unauthorized access of citizen, client or
  8:          partner information by any USDA employee, constitutes a
              serious breach of the confidentiality of that information
              and will not be tolerated.

  Principle   Requirements governing the accuracy, reliability,
  9:          completeness, and timeliness of citizen, client or partner
              information will be such as to ensure fair treatment of all
              clients and partners.

  Principle   The privacy rights of citizens, clients and partners will be
  10:         respected at all times and every citizen, client and partner
              will be treated honestly, fairly, and respectfully.
  ----------- ------------------------------------------------------------

The Declaration does not, in itself, create any legal rights for clients
and partners, but it is intended to express the full and sincere
commitment of the USDA and its employees to the laws which protect
client and partner privacy rights and which provide redress for
violations of those rights.

**APPENDIX B**

**POLICY STATEMENT ON CITIZEN, CLIENT AND PARTNER PRIVACY RIGHTS**

The USDA is fully committed to protecting the privacy rights of all
citizens, clients and partners. Many of these rights are stated in law.
However, the USDA recognizes that compliance with legal requirements
alone is not enough. The USDA also recognizes its social responsibility
which is implicit in the ethical relationship between the USDA and the
citizen, client or partner. The components of this ethical relationship
are honesty, integrity, fairness, and respect.

Among the most basic of a citizens, clients, or partners' privacy rights
is an expectation that the USDA will keep personal and financial
information confidential. Citizens, clients and partners also have the
right to expect that the USDA will collect, maintain, use, and
disseminate personally identifiable information and data only as
authorized by law and as necessary to carry out agency responsibilities.

The USDA will safeguard the integrity and availability of citizens,
clients and partners' personal and financial data and maintain fair
information and record keeping practices to ensure equitable treatment
of all citizens, clients and partners. USDA employees will perform their
duties in a manner that will recognize and enhance individuals' rights
of privacy and will ensure that their activities are consistent with
law, regulations, and good administrative practice. In our record
keeping practices, the USDA will respect the individual's exercise of
his/her First Amendment rights in accordance with law.

As an advocate for privacy rights, the USDA takes very seriously its
social responsibility to citizens, clients and partners to limit and
control information usage as well as to protect public and official
access. In light of this responsibility, the USDA is equally concerned
with the ethical treatment of citizens, clients and partners as well as
their legal and administrative rights.