**USDA PRIVACY IMPACT ASSESSMENT FORM**

**Agency: Associate Chief Financial Officer for Financial Systems
(ACFO-FS)**

**     **

**System Name: Online Payment and Collection Tracking and Reconciliation
System (OTRS)**

**     **

**System Type:** **Major Application**

**General Support System**

**Non-major Application**

**System Categorization (per FIPS 199):** **High**

**Moderate**

**Low**

**Description of the System:** OTRS is used to monitor the processing of
all Intra-governmental Payments and Collections (IPAC) bills charged to
the USDA agencies' Agency Location Codes (ALC). OTRS provides a
consolidated record and means to monitor unprocessed IPAC bills. OTRS
online screens allow users to determine the location of a bill, the
status of its processing, and any charge-backs that may have been issued
on the bill.

**     **

**Who owns this system?**

**     **

Associate Chief Financial Officer for Financial Systems

      **     **

**Who is the security contact for this system?      **

**     **

Associate Chief Financial Officer for Financial Systems

**Who completed this document?      **

**     **

**     ** Associate Chief Financial Officer for Financial Systems

**     **

**          **

### DOES THE SYSTEM CONTAIN INFORMATION ABOUT INDIVIDUALS IN AN IDENTIFIABLE FORM?

Indicate whether the following types of personal data are present in the
system

+------------------------------------------------------+------+-------+
| **QUESTION 1**                                       | Citi | Empl  |
|                                                      | zens | oyees |
| Does the system contain any of the following type of |      |       |
| data as it relates to individual:                    |      |       |
+------------------------------------------------------+------+-------+
| > Name                                               | #    | ## No |
|                                                      | # No |       |
+------------------------------------------------------+------+-------+
| > Social Security Number                             | **   | **    |
|                                                      | No** | Yes** |
+------------------------------------------------------+------+-------+
| > Telephone Number                                   | **   | *     |
|                                                      | No** | *No** |
+------------------------------------------------------+------+-------+
| > Email address                                      | **   | *     |
|                                                      | No** | *No** |
+------------------------------------------------------+------+-------+
| > Street address                                     | **   | *     |
|                                                      | No** | *No** |
+------------------------------------------------------+------+-------+
| > Financial data                                     | **   | *     |
|                                                      | No** | *No** |
+------------------------------------------------------+------+-------+
| > Health data                                        | **   | *     |
|                                                      | No** | *No** |
+------------------------------------------------------+------+-------+
| > Biometric data                                     | **   | *     |
|                                                      | No** | *No** |
+------------------------------------------------------+------+-------+
| **QUESTION 2**                                       | *    | **    |
|                                                      | *    |    ** |
| Can individuals be uniquely identified using         |   ** |       |
| personal information such as a combination of        |      |       |
| gender, race, birth date, geographic indicator,      |      |       |
| biometric data, etc.?                                |      |       |
|                                                      |      |       |
| NOTE: 87% of the US population can be uniquely       |      |       |
| identified with a combination of gender, birth date  |      |       |
| and five digit zip code[^1]                          |      |       |
+------------------------------------------------------+------+-------+
| Are social security numbers embedded in any field?   | **   | **    |
|                                                      | No** | Yes** |
+------------------------------------------------------+------+-------+
| Is any portion of a social security numbers used?    | **   | **    |
|                                                      | No** | Yes** |
+------------------------------------------------------+------+-------+
| Are social security numbers extracted from any other | **   | **    |
| source (i.e. system, paper, etc.)?                   | No** | Yes** |
+------------------------------------------------------+------+-------+

**If all of the answers in Questions 1 and 2 are
NO,**![](media/image1.wmf){width="0.40555555555555556in"
height="0.38055555555555554in"}

You do not need to complete a Privacy Impact Assessment for this system
and the answer to OMB A-11, Planning, Budgeting, Acquisition and
Management of Capital Assets,

Part 7, Section E, Question 8c is:

**3. No, because the system does not contain, process, or transmit
personal identifying information.**

If any answer in Questions 1 and 2 is YES, provide complete answers to
all questions below.

### DATA COLLECTION

3.  Generally describe the data to be used in the system.

     

> The data is billing information related to Intra-governmental Payments
> and Collections.

     

     

4.  Is the use of the data both relevant and necessary to the purpose
    for which the system is being used? In other words, the data is
    absolutely needed and has significant and demonstrable bearing on
    the system's purpose.

Yes

No

1.  Explain

> The data is required to process billing transactions necessary to keep
> USDA agencies from becoming anti-deficient.

5.  Sources of the data in the system.

    1.  What data is being collected from the citizens and/or employees?

     

None.

     

2.  What USDA agencies are providing data for use in the system?

     

None.

     

3.  What state and local agencies are providing data for use in the
    system?

     

County and state-based agencies associated with NRCS, RD and FSA.

     

4.  From what other third party sources is data being collected?

     

None.

     

6.  Will data be collected from sources outside your agency? For
    example, citizens and employees, USDA sources (i.e. NFC, RD, etc.)
    or Non-USDA sources.

Yes

No. If NO, go to question 7

1.  How will the data collected from citizens and employees be verified
    for accuracy, relevance, timeliness, and completeness?

     

N/A

     

2.  How will the data collected from USDA sources be verified for
    accuracy, relevance, timeliness, and completeness?

     

Through edits in the system.

     

3.  How will the data collected from non-USDA sources be verified for
    accuracy, relevance, timeliness, and completeness?

     

N/A

     

### DATA USE

7.  Individuals must be informed in writing of the principal purpose of
    the information being collected from them. What is the principal
    purpose of the data being collected?

     

> The data is required to process billing transactions necessary to keep
> USDA agencies from becoming anti-deficient.

     

8.  Will the data be used for any other purpose?

Yes

No. If NO, go to question 9

1.  What are the other purposes?

     

          

9.  Is the use of the data both relevant and necessary to the purpose
    for which the system is being designed? In other words, the data is
    absolutely needed and has significant and demonstrable bearing on
    the system's purpose.

Yes

No

1.  Explain

> The data is required to process billing transactions necessary to keep
> USDA agencies from becoming anti-deficient.

10. Will the system derive new data or create previously unavailable
    data about an individual through aggregation from the information
    collected (i.e. aggregating farm loans by zip codes in which only
    one farm exists.)?

Yes

No. If NO, go to question 11

1.  Will the new data be placed in the individual's record (customer or
    employee)?

Yes

No

2.  Can the system make determinations about customers or employees that
    would not be possible without the new data?

Yes

No

3.  How will the new data be verified for relevance and accuracy?

     

     

     

11. Individuals must be informed in writing of the routine uses of the
    information being collected from them. What are the intended
    [routine]{.underline} uses of the data being collected?

     

> The data is required to process billing transactions necessary to keep
> USDA agencies from becoming anti-deficient.

     

12. Will the data be used for any other uses (other than indicated in
    question 11 )?

Yes

No. If NO, go to question 13

1.  What are the other uses?

     

     

     

13. Automation of systems can lead to the consolidation of data --
    bringing data from multiple sources into one central location/system
    -- and consolidation of administrative controls. When administrative
    controls are consolidated, they should be evaluated so that all
    necessary privacy controls remain in place to the degree necessary
    to continue to control access to and use of the data. Is data being
    consolidated?

Yes

No. If NO, go to question 14

1.  What controls are in place to protect the data and prevent
    unauthorized access?

     

     

     

14. Are processes being consolidated?

Yes

No. If NO, go to question 15

1.  What controls are in place to protect the data and prevent
    unauthorized access?

     

     

     

### DATA RETENTION

15. Is the data periodically purged from the system?

Yes

No. If NO, go to question 16

1.  How long is the data retained whether it is on paper,
    electronically, in the system or in a backup?

     

     

     

2.  What are the procedures for purging the data at the end of the
    retention period?

     

     

     

3.  Where are these procedures documented?

     

     

     

16. While the data is retained in the system, what are the requirements
    for determining if the data is still sufficiently accurate,
    relevant, timely, and complete to ensure fairness in making
    determinations?

     

     Once data is entered it becomes static with no updates or changes.

     

17. Is the data retained in the system the minimum necessary for the
    proper performance of a documented agency function?

Yes

No

### DATA SHARING

18. Will other agencies share data or have access to data in this system
    (i.e. international, federal, state, local, other, etc.)?

Yes

No. If NO, go to question 19

1.  How will the data be used by the other agency?

     

The data is used to review Intra-governmental transactions.

     

2.  Who is responsible for assuring the other agency properly uses of
    the data?

     

The data is used by the Controller Operations Division only.

     

19. Is the data transmitted to another agency or an independent site?

Yes

No. If NO, go to question 20

1.  Is there the appropriate agreement in place to document the
    interconnection and that the PII and/or Privacy Act data is
    appropriately protected?

2.  Where are those documents located?

     

     

     

20. Is the system operated in more than one site?

Yes

No. If NO, go to question 21

1.  How will consistent use of the system and data be maintained in all
    sites?

     

> The second site is the Disaster Recovery site for NFC-based
> applications. Back-up procedures and off-site storage ensure
> consistent availability of data.     

     

### DATA ACCESS

21. Who will have access to the data in the system (i.e. users,
    managers, system administrators, developers, etc.)?

     

> The Controller Operations Division, Intra-governmental Payments and
> Collections Reconciliation Branch.

     

22. How will user access to the data be determined?

     

     Determination is based on job function.

     

1.  Are criteria, procedures, controls, and responsibilities regarding
    user access documented?

Yes

No

23. How will user access to the data be restricted?

     

     Based on job function.

     

1.  Are procedures in place to detect or deter browsing?

> Yes CA-Top Secret Security Software

No

2.  Are procedures in place to detect or deter unauthorized user access?

Yes CA-Top Secret Security Software

No

24. Does the system employ security controls to make information
    unusable to unauthorized individuals (i.e. encryption, strong
    authentication procedures, etc.)?

Yes CA-Top Secret Security Software

No

### CUSTOMER PROTECTION

25. Who will be responsible for protecting the privacy rights of the
    citizens and employees affected by the interface (i.e. office,
    person, departmental position, etc.)?

     

> The Controller Operations Division, Intra-governmental Payments and
> Collections Reconciliation Branch.

     

26. How can citizens and employees contact the office or person
    responsible for protecting their privacy rights?

     

     Agency Privacy Officer

     

27. A "breach" refers to a situation where data and/or information
    assets are unduly exposed. Is a breach notification policy in place
    for this system?

Yes. If YES, go to question 28 USCert

No

1.  If NO, please enter the POAM number with the estimated completion
    date:

     

     

     

28. Consider the following:

-   Consolidation and linkage of files and systems

-   Derivation of data

-   Accelerated information processing and decision making

-   Use of new technologies

Is there a potential to deprive a citizens and employees of fundamental
rules of fairness (those protections found in the Bill of Rights)?

Yes

No. If NO, go to question 29

1.  Explain how this will be mitigated?

     

     

     

29. How will the system and its use ensure equitable treatment of
    customers?

     

     Decisions are not made based on aggregated, correlated data.

     

30. Is there any possibility of treating customers or employees
    [differently and unfairly]{.underline} based upon their individual
    or group characteristics?

Yes

No. If NO, go to question 31

1.  Explain

     

     

     

### SYSTEM OF RECORD

31. Can the data be retrieved by a personal identifier? In other words,
    does the system actually retrieve data by the name of an individual
    or by some other unique number, symbol, or identifying attribute of
    the individual?

Yes

No. If NO, go to question 32

1.  How will the data be retrieved? In other words, what is the
    identifying attribute (i.e., employee number, social security
    number, etc.)?

     

      SSN and TIN may be embedded but not retrievable by the data field.

     

2.  Under which Systems of Record notice (SOR) does the system operate?
    Provide number, name and publication date. (SORs can be viewed at
    [www.access.GPO.gov](http://www.access.GPO.gov/))

          

> The system operates under the following SOR notices:
>
> USDA/OCFO -- 3, Billings and Collections Systems
>
> USDA/OFM -- 4, Travel and Transportation System
>
> USDA/OFM -- 7, SF-1099 Reporting System
>
> USDA/OP -- 1, Personnel and Payroll System for USDA Employees

3.  If the system is being modified, will the SOR require amendment or
    revision?

     

      In addition to the SOR notices above, an updated SOR is in review
for posting to include all ACFO-FS application systems.

     

     

     

### TECHNOLOGY

32. Is the system using technologies in ways not previously employed by
    the agency (e.g. Caller-ID)?

Yes

No. If NO, the questionnaire is complete.

1.  How does the use of this technology affect citizen and employee
    privacy?

     

     

     

Upon completion of this Privacy Impact Assessment for this system, the
answer to

OMB A-11, Planning, Budgeting, Acquisition and Management of Capital
Assets,

Part 7, Section E, Question 8c is:

**1. Yes.**

PLEASE SUBMIT A COPY TO

THE OFFICE OF THE ASSOCIATE CHIEF INFORMATION OFFICE/CYBER SECURITY

### Privacy Impact Assessment Authorization

### Memorandum

### 

### 

I have carefully assessed the Privacy Impact Assessment for the

[Online Tracking and Reconciliation System]{.underline}

This document has been completed in accordance with the requirements of
the EGovernment Act of 2002.

We fully accept the changes as needed improvements and authorize
initiation of work to proceed. Based on our authority and judgment, the
continued operation of this system is authorized.

[/s/]{.underline}\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
[\_June 26, 2007\_\_\_\_\_]{.underline}

Information Systems Security Program Manager Date

[/s/]{.underline}\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
[\_June 26, 2007\_\_\_\_\_]{.underline}

Agency Preparer Date

[/s/]{.underline}\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
[\_June 26, 2007\_\_\_\_\_]{.underline}

System Manager/Owner Date

OR Project Representative

OR Program/Office Head.

[/s/]{.underline}\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
[\_June 26, 2007\_\_\_\_\_]{.underline}

Agency's Chief FOIA officer Date

OR Senior Official for Privacy

OR Designated privacy person

[/s/]{.underline}\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
[\_June 26, 2007\_\_\_\_\_]{.underline}

Agency OCIO Date

[^1]: Comments of Latanya Sweeney, Ph.D., Director, Laboratory for
    International Data Privacy Assistant Professor of Computer Science
    and of Public Policy Carnegie Mellon University To the Department of
    Health and Human Services On \"Standards of Privacy of Individually
    Identifiable Health Information\". 26 April 2002.