# Presentation: 716747

## DOI UniversityOverview of Government Privacy Requirements

- Module 1:  The Privacy Act Overview
- Module 2:  E-Government Act of 2002 			    Privacy Requirements
- Module 3:  Roles and Responsibilities
- Module 4:  Where Can I Go for More 			    Information

## Course Objectives

- 	This course is meant to help you become familiar with:
- The general requirements of the Privacy Act,
- E-Government Act of 2002 privacy requirements, and
- Your part in protecting personal information

## Slide 3

## Course Overview    Why do I need Privacy Act Training?

- 	One reason is that the Privacy Act requires it:  “Persons who are involved in the design, development, operation, or maintenance of a system of records, or in maintaining any record must be instructed in the rules and requirements of the Privacy Act (see _[5 USC 552a(e)(9)](http://www.usdoj.gov/foia/privstat.htm)__).” _
- 	(See also 383 DM 9)

## Course OverviewWhy Do I Need Privacy Training?

- 	The Office of Management and Budget (OMB) also requires:   A review of training practices “to ensure that all agency personnel are familiar with the requirements of the Act, with the agency's implementing regulation, and  with any special requirements of their specific jobs.” (OMB A-130, Appendix I)

## Course OverviewWhy Do I Need Privacy Training?

-  Make you aware of your part in being stewards of the information entrusted to you from the public and other employees, and
- Make you aware of you own privacy rights.

## Module 1:  Overview of the Privacy Act

- Topic 1:  Why do I need Privacy Act Training?
- Topic 2:  Why a Privacy Act?
- Topic 3:  What Does it Apply to?
- Topic 4:  What are the Types of Privacy Act 	      	      Systems of Records?
- Topic 5:  What is the Definition of a Privacy Act 	      Record?
- Topic 6:  What are the Civil and Criminal 	  	      Penalties
- Topic 7:  Collecting Information from Individuals

## Module 1:  Overview of the Privacy Act

- Topic 8:   Notifying the Public
- Topic 9:   Rights of the Subject of the File
- Topic 10: Restrictions on Disclosing Privacy Act 	       Records
- Topic 11: The FOIA and Privacy Act Interface
- Topic 12: Assuring the Integrity of Records
- Topic 13: Safeguarding Your Information
- Topic 14: Privacy Act Records Management  		       Requirements

## Module 1:  Overview of the Privacy ActTopic 1:  What is the Privacy Act?

- 	**The Privacy Act of 1974   (5 U.S.C. 552a) establishes safeguards for the protection of records the Executive Branch of the federal Government collects and maintains on individuals who are United States citizens or lawfully admitted permanent residents.**

## Module 1:  Overview of the Privacy ActTopic 1:  What is the Privacy Act?

**You may be surprised by the diverse scope of the Privacy Act.  For example, were you aware that it includes requirements for:**
-   Limiting the collection of personal information from 	individuals,
-   Publishing notices about information collected,
-   Restricting the use and disclosure of personal   	information,
-   Providing certain rights to the subject of the    	record, and
-   Safeguarding the information?

## Module 1:  Overview of the Privacy ActTopic 1:  What is the Privacy Act?

**	****Privacy Act requirements are found in each phase of the life cycle of an information system**

**      ****Collection**

**      ****Maintenance**

-                 **Use**

-         **Disposition**

## Module 1:  Overview of the Privacy ActTopic 2:  Why a Privacy Act?

**The purpose of the Privacy Act**
- Balance the Government’s need to maintain information about individuals with the rights of the individuals to be protected against unwarranted invasions of their privacy
- Prevent potential abuses presented by the Government’s increasing use of computers to store and retrieve personal data about individuals

## Module 1:  Overview of the Privacy ActTopic 3:  What Does it Apply to?

**The Act Applies to Individuals **
- 	(I.e., United States citizens, and 	lawfully admitted permanent residents)
- 	It does not apply to information about: 	-  Businesses, and
- Organizations (including persons representing them), and
- Statistical information not linked to the person

## Module 1:  Overview of the Privacy ActTopic 3:  What Does it Apply to?

**	****The Act applies to information that is maintained:**
**	****-  ****	****By the Executive Branch ****	****of the federal Government ****	****and**
**	****-  ****	****In a “**_**system of records**_**”**
**	**

## Module 1:  Overview of the Privacy ActTopic 3:  What Does it Apply to?

- 	A “system of records” is any group of any records from which information is retrieved by the name of an individual or by some other identifying piece of information that can link the information to an individual.
**How is the information in                                         your record system retrieved?**

## Module 1:  Overview of the Privacy ActTopic 3:  What Does it Apply to?

- 	Information in                 Privacy Act systems       cover a portion of the information on individuals in Departmental records systems.
- 	Other information on individuals may be covered by the Freedom of Information Act.

**Covered by the FOIA**

**Covered by the Privacy Act**

**Info on Individuals**

- Retrieved by name or
- other identifier

## The Privacy Act and Privacy Policy Apply to Information in any Format:

**Paper Records**
**Databases**
**Intra and Inter-Agency Data Sharing **
**Data Matching**
**Websites**
**New Technology (e.g., GIS, Wireless)****	**

## Module 1:  Overview of the Privacy Act Topic 4:  Types of Systems of Records

- 	In order to make the proper decisions on Privacy Act records you must be aware that there are several types of systems of records.  They are:
- 	1.      Government-wide,
- 	2.      Central, and
- 	3.      Internal

**1.  Government-wide -**
- Certain agencies have government-wide responsibilities for these systems. The records may be located in other agencies such as the Department (DOI), but the authority and policy comes from the agency publishing the notice.
- (E.g., the Office of Personnel Management published a number of Government-wide systems of records relating to the operation of the Government's personnel program).

**Module 1: ****Overview of the Privacy Act**** ****Topic 4:  Types of Systems of Records**

## Module 1:  Overview of the Privacy Act Topic 4:  Types of Systems of Records

**	****2.  ****Central** –
- 	The records belong to the Office of Personnel Management (OPM) and OPM has full responsibility for the records.  (OPM makes decisions about access and disclosure for example)
- 	They are considered on loan to the Department (e.g. records created by background investigations and  provided to the Department by OPM such as OPM/Central-9:  Personnel Investigations Records).  These are OPM records and _**disclosure and handling is**_ _**decided on by OPM**_.

**     ****3.  Internal –**** **
**	**These records are owned and maintained by the DOI and its specific bureaus/offices.
- 	See the handout for lists of Privacy Act system of records notices that affect the Department.

**Module 1:  ****Overview of the Privacy Act**** ****Topic 4:  Three Types of Systems of Records**

## Module 1:  Overview of the Privacy ActTopic 5:  What is the Definition of a Privacy Act Record ?

- 	The term “record” according to the Privacy Act means any item, collection or grouping of information about an individual that is _maintained by the agency_, including but not limited to, his education, financial transactions, medical history, and criminal or employment history and _that contains his name_, or the identifying number, symbol, _or other identifying particular_ assigned to the individual, such as a finger or voice print or a photograph. (5 U.S.C. 552a (a)(4)).

## Module 1:  Overview of the Privacy ActTopic 5: What is the Definition of a Privacy Act Record ?

**	****The Privacy Act requirements do not apply to t****hose records about individuals which are:**
- 	(i)  	Created and maintained primarily for an      	employee’s convenience;
- 	(ii) 	Not subject to agency creation or retention 	requirements; and
- 	(iii) 	Not distributed to other agency employees for 	their official use.
- 	(Refer to DOI FOIA regulations - 43 CFR 2.3(c)).

## Module 1:  Overview of the Privacy ActTopic 5: What is the Definition of a Privacy Act Record ?

**	**

- Now that you know how to identify what information is covered by the Act, the following will make you aware of the unique requirements for handling and managing that information.

## Module 1: Overview of the Privacy Act Topic 6:  Civil and Criminal Penalties

- 	The Privacy Act provides legal remedies (both civil and criminal) that permit an individual to seek enforcement of the rights granted under the Act

## Module 1: Overview of the Privacy Act Topic 6:  Civil and Criminal Penalties

**The Civil Remedy**
- Applies to the Agency not the employee
- The Plaintiff must show that:
- There was a violation of the Privacy Act.
- They suffered an adverse effect as a result of the violation.
- The agency was a direct or proximate cause of the effect.
- The violation was intentional and willful.

## Module 1: Overview of the Privacy Act Topic 6:  Civil and Criminal Penalties

**Criminal Remedy**
- Applies to the individual employee
- Allows for fines up to $5000 plus court costs may be awarded for these circumstances:
- If an officer or employee of an agency knowingly releases records improperly to a person or agency not entitled to receive it.
- If and officer or employee willfully maintains a Privacy Act system without publishing a notice in the *Federal Register.*
- Any person who knowingly and willfully requests or obtains any record concerning an individual from an agency under false pretenses.

## Module 1:  Overview of the Privacy ActTopic 7:  Collecting Information from Individuals

**The Privacy Act has certain requirements for collecting information from individuals.  **
**These include:**
- 	1)**  **Maintaining only information that is _relevant_ 		   and _necessary_ to accomplish a purpose of the  	   agency required by statute or Executive Order,
- 	2) Trying to collect the information directly from the 	  subject of the file, and

## Module 1:  Overview of the Privacy ActTopic 7:  Collecting Information from Individuals

- 	3)  Providing a Privacy Act notification 	statement to the individuals 	providing information which must 	include:
- 	-  The authority to collect the 	 	  information
- 	-  The purpose for which the  	   	  information will be used
- 	-  Other parties outside the 	 	   	 Department to whom the  	  	     	 information will be shared
- 	-  The effects of not providing the 	  	 information

- 	**Does the Privacy Act allow agencies to collect of Social Security Numbers?  **
** **
**	****The collection of the  SSN must be:**
**Required by law, or**
**Required before January 1, 1975**

**Module 1:  Overview of the Privacy Act****Topic 7:  Collecting Information from Individuals**

- 	A companion to the Privacy Act is the Paperwork Reduction Act (PRA).
- 	It also has requirements for collecting information from members of the public.
- 	Contact your bureau/office Information Collection Clearance Officer if you are collecting the same information from 10 or more members of the public.

**Module 1:  Overview of the Privacy Act****Topic 7:  Collecting Information from Individuals**

## Module 1:  Overview of the Privacy ActTopic 8:  Notifying the Public

**The Privacy Act requires that a Government office must publish a Privacy Act system of records notice in the *****Federal Register***** **_**before**_** operating a new or amended system of records.  **
- It provides important information to the public, and
- It is an important guideline for the employee handling the information.
**Consult with your Privacy Act Officer for guidelines on preparing the notice.****  **

## Module 1:  Overview of the Privacy ActTopic 9:  Rights of the Subject of the File and Exemptions

**	****The person whose information has been collected has some control and rights over information the Government collects on them.**
**	****1.  Request to determine if a system **
**	****     ****contains records on them**
- 43 CFR 2.60 –2.61
- 	2.  **Request to access their records**
- 43 CFR 2.62 – 2.66
- 	3.  **Request to amend their records**
- 43 CFR 2.70 – 2.77

## Module 1:  Overview of the Privacy ActTopic 9:  Rights of the Subject of the File and Exemptions

- 	**Some Privacy Act system of records are exempt from certain requirements of the Act (such as those listed in the previous slide). This happens when the system is: **
- Compiled in anticipation of a civil action or proceeding, or
- The system of records was identified in rulemaking as an **“EXEMPT”** Privacy Act system of records
**	****(**See the list of DOI exempt systems in the Handout and DOI Privacy Act regulations (43 CFR 2.79))

## Module 1:  Overview of the Privacy ActTopic 10:  Restrictions on Disclosing Privacy Act Records

- 	The subject of the file must provide a _**written consent**_ to allow disclosure of information from a Privacy Act system to a third party.
- 	There are certain _exceptions_ to this consent rule.

## Module 1:  Overview of the Privacy ActTopic 10:  Restrictions on Disclosing Privacy Act Records

- 	**The 12 EXCEPTIONS to the consent before release rule are:**
- To employees with a legitimate “need to know”,
- When the FOIA requires release,
- For a “routine use” identified in the *Federal Register* notice,
- To the Bureau of Census,

## Module 1:  Overview of the Privacy ActTopic 10:  Restrictions on Disclosing Privacy Act Records

- 	5.   For Statistical Use (Can’t identify individuals),
- 	6.   To the National Archives,
- 	7.   To civil or criminal law enforcement,
- 	8.   For compelling circumstance affecting the health 	  or safety of the individual (must be justified),
- 	9.   To the either House of Congress (when in an 	 	  oversight capacity),
- 	10.  To Comptroller General (GAO Activities),

## Module 1:  Overview of the Privacy ActTopic 10:  Restrictions on Disclosing Privacy Act Records

- 	11. Pursuant to a Court Order (subpoena signed by 	       judge), and
- 	12.  To a consumer reporting agency.
- 	(See 43 CFR 2.56 and 383 DM 7)

## Module 1:  Overview of the Privacy ActTopic 11:  The FOIA and Privacy Act Interface

- Per the Dept. of Justice, a person’s access request for his own record maintained in a system of records should be processed under           BOTH the Privacy Act and the FOIA.
- 	(See DOI FOIA regulations 43 CFR 2.27 and DOI Privacy Act Manual Sections 383 DM 7.3)

## Module 1:  Overview of the Privacy ActTopic 11:  The FOIA and Privacy Act Interface

- See the chart in the Handouts on a comparison of the FOIA and Privacy Act provisions.
- FOIA Exemptions 6 and 7(C) also protect an individual’s privacy rights.

## Module 1:  Overview of the Privacy ActTopic 11:  The FOIA and Privacy Act Interface

- What questions should you ask when processing an individuals request for their information?

## Module 1:  Overview of the Privacy ActTopic 11:  The FOIA and Privacy Act Interface

_**Situation I**_
**An individual wants a copy of a record about himself (called – “first party request”)****	**
**The questions to ask:**
- 	1.  Is this a DOI (agency) record?  If “no” then:
- 	If personal	--	Not a responsive record
-     If from a 	--	OPM decides              	Central PA system

## Module 1:  Overview of the Privacy ActTopic 11:  The FOIA and Privacy Act Interface

- 	2.  If this is an agency record, does the information come from a Privacy Act system of records?
- 	3.  If “no”, then will the FOIA apply?
- 	4.  If “yes”, do you have a copy of the Privacy Act system of records notice that covers the information?
- 	5.  Does the notice indicate that the system is an “exempt” system (very last item on the system notice)?
- 	-  If a Privacy Act exemption does not apply,           Mr. Citizen should receive access to his Privacy Act records.  The Agency cannot rely on a FOIA exemption alone to deny Mr. Citizen access to their records.

## Module 1:  Overview of the Privacy ActTopic 11:  The FOIA and Privacy Act Interface

**If a Privacy Act Exemption Applies**
- Where a Privacy Act exemption applies, Mr. Citizen is not entitled to obtain access to his records under the Privacy Act.
- But he may still be able to obtain access to his records under the FOIA.
- If BOTH a Privacy Act and FOIA exemption apply,       Mr. Citizen is not entitled to that information
- (See guidelines at 43 CFR 2.61(a), 2.64, and 2.79, and 383 DM 6)

## Module 1:  Overview of the Privacy ActTopic 11:  The FOIA and Privacy Act Interface

- 	_**Situation II**_
**	****A person who is not the subject of the record (“third party requester”) requests information about another person.**
**The questions to ask:**
- Is the information requested from a Privacy Act system of records?
- If not, does the FOIA apply to the information?

## Module 1:  Overview of the Privacy ActTopic 11:  The FOIA and Privacy Act Interface

- 	2.  If the information is from a Privacy Act system of records, is the requester one of the parties identified in the exceptions to the consent rule (see 43 CFR 2.56   and Topic 10)?
- 		-  Are they an officer or employee of the Department (not another agency) who has a need for the record in the performance of their duties?
- 		-  Are they identified in the Privacy Act system of records notice under the “Routine Use” section?

## Module 1:  Overview of the Privacy ActTopic 11:  The FOIA and Privacy Act Interface

- 		-  Has the subject of the file provided them with a written consent letter to release the information to them?
- 		-  Are they requesting the information under the FOIA?
- 		-  Do the other exemptions identified in                      43 CFR 2.56 (c)(2)-(10) apply?

## Module 1:  Overview of the Privacy ActTopic 11:  The FOIA and Privacy Act Interface

**The Third Party Request is Made Under the FOIA**
**(A “third party” requester cannot cite                                 the Privacy Act for disclosure)**
- Is the information from an “exempt” Privacy Act system of records?
- If “yes”  --  no release and also examine for FOIA exemptions
- If “no” – also examine for a FOIA exemptions

## Module 1:  Overview of the Privacy ActTopic 11:  The FOIA and Privacy Act Interface

- If the information is not from an “exempt” system, does a FOIA exemption apply?
- If yes, then there is no release to the third party.
- If EITHER a FOIA exemption or Privacy Act exemption applies, there is no release.

## Module 1:  Overview of the Privacy ActTopic 12:  Assuring the Integrity of  Records

- The Privacy Act requires “appropriate administrative, technical and physical safeguards to ensure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity . .”

## Module 1:  Overview of the Privacy ActTopic 12:  Assuring the Integrity of  Records

- The Privacy Act requires that personal information on individuals be protected from unauthorized disclosure and provides for both civil and criminal penalties for violation of the Act.
- A key purpose of these requirements is to prevent unauthorized access.

## Module 1:  Overview of the Privacy ActTopic 12:  Assuring the Integrity of  Records

- DOI Privacy Act regulations,      _[43 CFR 2.51](http://a257.g.akamaitech.net/7/257/2422/05dec20031700/edocket.access.gpo.gov/cfr_2003/octqtr/43cfr2.51.htm)__, provide minimum safeguards required for Privacy Act systems of records. _

## 	1.  For Records Maintained in Manual Form
Areas with Privacy Act information shall have Privacy Warning Notices posted.

Only authorized personnel in areas that maintain Privacy Act records.

Access to the records shall be restricted by their storage in locked metal file cabinets or a locked room.
	(See DOI Privacy Act regulations at 43 CFR 2.51        and 383 DM 8) 	

- Areas with Privacy Act information shall have Privacy Warning Notices posted.
- Only authorized personnel in areas that maintain Privacy Act records.
- Access to the records shall be restricted by their storage in locked metal file cabinets or a locked room.
- 	(**See DOI Privacy Act regulations at 43 CFR 2.51        and 383 DM 8)**** **

**Module 1:  Overview of the Privacy Act****Topic 12:  ****Assuring the Integrity of  Records**

## 
Security supplemented with lockable file cabinets or containers or changing the lock or locks for the room so they may not be opened by a master key.

The Office of Management and Budget requires that each bureau annually review it’s recordkeeping and disposal policies and practices to ensure compliance with the Act.
	See draft Recordkeeping Checklist in handouts 

- Security supplemented with lockable file cabinets or containers or changing the lock or locks for the room so they may not be opened by a master key.
- The Office of Management and Budget requires that each bureau annually review it’s recordkeeping and disposal policies and practices to ensure compliance with the Act.
**	****See draft Recordkeeping Checklist in handouts **

**Module 1:  Overview of the Privacy Act****Topic 12:  ****Assuring the Integrity of  Records**

## 	II.  For Records Maintained in Computerized Form

Records subject to National Institute of Science and Technology (NIST) safeguards (see NIST special publications)

Maintained by security requirements for personnel records set out in 5 CFR 293.106 and 293.107.

- Records subject to National Institute of Science and Technology (NIST) safeguards (see NIST special publications)
- Maintained by security requirements for personnel records set out in 5 CFR 293.106 and 293.107.

**Module 1:  Overview of the Privacy Act****Topic 12:  ****Assuring the Integrity of  Records**

## 
The bureau is responsible for assuring that there are specific procedures for protecting the Privacy Act records. 

These should be in writing and be posted or periodically brought to the attention of employees working with the records 

- The bureau is responsible for assuring that there are specific procedures for protecting the Privacy Act records.
- These should be in writing and be posted or periodically brought to the attention of employees working with the records

**Module 1:  Overview of the Privacy Act****Topic 12:  ****Assuring the Integrity of  Records**

## 
Convert Privacy Warning Notices into electronic form to inform the user of the restrictions and penalties

Follow NIST publication, the “Security Self-Assessment Guide for Information Technology Systems”: SP 800-26, which provides a checklist for safeguarding IT systems and sensitive and confidential information
	(See DOI Privacy Act regulations at 43 CFR 2.51 and 383 DM 8)

- Convert Privacy Warning Notices into electronic form to inform the user of the restrictions and penalties
- Follow NIST publication, the “Security Self-Assessment Guide for Information Technology Systems”: SP 800-26, which provides a checklist for safeguarding IT systems and sensitive and confidential information
- 	(See DOI Privacy Act regulations at 43 CFR 2.51 and 383 DM 8)

**Module 1:  Overview of the Privacy Act****Topic 12:  ****Assuring the Integrity of  Records**

## DOI Privacy Act Warning Notice

## Safeguards must be in place to assure the integrity and confidentiality of the records while in transit.
When the records are transferred to a Federal Records Center (FRC) the appropriate use restrictions applicable must be specified on the transfer form (See 384 DM 4).
Records transferred to the FRC remain under the jurisdiction of the Department and subject to Privacy Act requirements.
Disclosure requirements must be identified with the records.

- When the records are transferred to a Federal Records Center (FRC) the appropriate use restrictions applicable must be specified on the transfer form (See 384 DM 4).
- Records transferred to the FRC remain under the jurisdiction of the Department and subject to Privacy Act requirements.
- Disclosure requirements must be identified with the records.

**Module 1:  Overview of the Privacy Act****Topic 12:  ****Assuring the Integrity of  Records - Transfer**

## Module 1:  Overview of the Privacy ActTopic 12:  Assuring the Integrity of  Records -  TIPS

**Privacy Breaches Must be Avoided**
- Here are some tips to ensure the general protection of personal information of individuals:
-   Take privacy protection seriously;
-   Respect the privacy of members of the public and other DOI employees;
-   Perform a Privacy Risk Assessment.  Has what I’ve done increased the risk of unauthorized access to the information now or in another situation?;
-   Know the Privacy Act requirements;

## Module 1:  Overview of the Privacy ActTopic 12:  Assuring the Integrity of  Records -  TIPS

-   Take precautions to ensure that only appropriate persons can see or have access to the information (e.g., where do you place sensitive files and how is your PC screen positioned);
-   Never discuss personal information about other individuals in places where you may be overheard;

## Module 1:  Overview of the Privacy ActTopic 12:  Assuring the Integrity of  Records -  TIPS

-   Follow your bureau/office procedures for responding to access and disclosure requests for information protected by the Privacy Act.
-   Contact your Privacy Act Officer or Coordinator for advice on implementing the Privacy Act requirements.

## Module 1:  Overview of the Privacy ActTopic 13:   Safeguarding Your Own Information 

- 	Valuable Resources for Citizens
**The Federal Trade Commission’s (FTC) consumer protection web site provides helpful information on how to protect your personal information. Visit the site at: **_[http://www.ftc.gov/privacy/index.html. ](http://www.ftc.gov/privacy/index.html.)_
**Another helpful FTC site provides valuable information on what to do if you become a victim of identity theft. Visit the site at:  **_[http://www.consumer.gov/idtheft/](http://www.consumer.gov/idtheft/)_
**The FTC also provides helpful information on          minimizing the risks of privacy violations. Visit the site at:  **_[http://www.ftc.gov/bcp/conline/pubs_x000b_/credit/](http://www.ftc.gov/bcp/conline/pubs%0B/credit/)_**idtheft.htm **

## Module 1:  Overview of the Privacy ActTopic 14:  Privacy Act Records Management Requirements

- 	All Privacy Act records must have a records disposition schedule and are subject to Federal Records Act (FRA) requirements for paper and electronic records.
- 	There are circumstances that may freeze the requirements to dispose of information as required by the FRA and the Privacy Act.

**Speak to your Records Manager about current policy**

## Module 1:  Overview of the Privacy ActTopic 14:  Privacy Act Records Management Requirements

- 	FYI - The Privacy Act and Freedom of Information Act case files are listed under General Records Schedule 14

## Module 2E-Government Act Privacy Requirements

**Topic 1:  Key Provisions of Section 208**
**Topic 2:  The Privacy Impact Assessment**
**Topic 3:  Web Privacy Requirements**

## Module 2:  E-Government Act of 2002 Privacy Requirements

- Goal of bringing the Government more fully into the electronic age and improving public access to e-Government services.
- New rules for federal agencies that are designed to protect the privacy of citizens using e-Government services
- 	(see Sec. 208 of the Act, and
- 	OMB Memo M-03-22)

**Don’t let privacy be**
** “****road kill” **
**on the information highway!!**

## Module 2:  E-Government Act of 2002 Privacy RequirementsTopic 1:  Key Provisions of Sec. 208

**The Privacy Provisions Involve:**
- 	-  	_Web privacy policies_ for     	Government Internet sites, and
- 	-  	Conducting _Privacy Impact _	_Assessments (PIA)_

## Module 2:  E-Government Act of 2002 Privacy RequirementsTopic 2:  The Privacy Impact Assessment

-  **The PIA is:**** **
**  **An analysis of how information  	on individuals is handled 	through the information life 	cycle.
-   A analysis of privacy risks at 	he different phases of a 	system’s development and 	through the information life 	cycle.
-   Meant to be a tool to design in 	privacy requirements.

## Module 2:  E-Government Act of 2002 Privacy RequirementsTopic 2:  The Privacy Impact Assessment

**The Department’s PIA is available through:**
** **The DOI Privacy Program Web site at   	_[http://www.doi.gov/ocio/privacy](http://www.doi.gov/ocio/privacy)__ _
-  Your Capital Planning Coordinator, Privacy Act 	Officer, or IT Security Manager

## Module 2:  E-Government Act of 2002 Privacy RequirementsTopic 2:  The Privacy Impact Assessment

- 	According to the OMB guidance, a PIA is required for systems where information about an individual can be retrieved by their name or other identifier (or identifiable form)
- 	The privacy principles should be applied to information in electronic and paper format

## Module 2:  E-Government Act of 2002 Privacy RequirementsTopic 2:  The Privacy Impact Assessment

**A PIA is required when:**
- Developing or procuring IT systems or projects,
- Initiating, consistent with the Paperwork Reduction Act, a new electronic collection of information in identifiable form for 10 or more persons, and
- A system change creates new privacy risks.

## Content of a Privacy Impact Assessment

- What information is being collected?
- Why is it being collected?
- What is the intended use of the information?
- With whom will the info will be shared?
- What are the options the individual has in providing the information?
- How will the information will be secured?
- Is there a Privacy Act system of records notice for the system?
- What are the maintenance and  administrative controls in place?

## Module 2:  E-Government Act of 2002 Privacy RequirementsTopic 3:  Web Privacy Requirements

- The E-Government Act of 2002 includes web privacy policy requirements.  They include:
- 1. Posting Web privacy policies on websites that are major entry points and frequently visited websites
- 2. Posting specific Web privacy policies when collecting information from the public from interactive web forms.
- 3. Posting specific Web privacy policies according to the Federal Trade Commission standards when pages are directed at children 13 yrs or under.

## Module 2:  E-Government Act of 2002 Privacy Requirements

**Other Web privacy requirements include:**
- Performing PIAs on websites that collect information from individual members of the public (vs. employees), and
- Developing an invisible code that provides the visitor’s computer with privacy standards (called “machine readable privacy policy”)

## Module 2:  E-Government Act of 2002 Privacy Requirements

- For more specific information on the requirements of Section 208 of the                 E-Government Act refer to the Office of Management and Budget (OMB) memorandum of September 26, 2003 -        (M-03-22)
**	**(www.whitehouse.gov/omb/memoranda/m03-22.html)

## Module 2:  E-Government Act of 2002 Privacy Requirements

- Two GAO reports on Federal web policies in September 2000
- One GAO survey in August 2001 on agency collection and handling of SSNs
- 2001 IG report to Congress on personal information collected from DOI websites
- 2002 IG review of DOI websites for security and privacy compliance

## Interior’s E-Privacy Measures as a Best Practice

**http://www.iaconline.org/sigs/egov/040317privacy.pdf**

## Module 3Roles and Responsibilities

**Topic 1:  Privacy Act Officer**
**Topic 2:  System Manager**
**Topic 3:  Information Collection Clearance ****	****	****      Officer**
**Topic 4:  IT Security Manager**
**Topic 5:  Records Officer**
**Topic 6:  Contracting Officer**
**Topic 7:  All Employees**

## Module 3:  Roles and Responsibilities

- 	**Your Privacy Officers and Coordinators, and System Managers are not the only ones responsible for implementing the Government privacy requirements.**
**	****You and others also have a very important role.  **

- 	According to the DOI regulations this is the official within each bureau/office assigned responsibility for bureau/office implementation of the Privacy Act and DOI regulations and guidelines on the Act.
- 	(Chapter 3 of the DOI Privacy Act manual section (383 DM 3) and Chapter 4 (383 DM 4) provide specific responsibilities)

**Module 3:  Roles and Responsibilities****Topic 1:  The Privacy Act Officer**

- Privacy Act and Government guidelines identify these persons as responsible for the administrative requirements for a Privacy Act system of records.
- They are key to the proper management of information in the system of records.

**Module 3:  Roles and Responsibilities** **Topic 2:  The System Manager**

**System Manager responsibilities include:**
-  Ensuring data collection forms include notification 	statements,
-  Ensuring that Privacy Act system of records 	notices are created and updated,
-  Coordinating and completing Privacy Impact 	Assessments,
-  Monitoring contractor compliance with the    	Privacy Act,
-  Coordinating Privacy Impact Assessments for 	new and amended systems,

**Module 3:  Roles and Responsibilities** **Topic 2:  The System Manager**

## Training users of the system on the specific handling requirements and safeguards,
Maintaining a log of access and amendments to records, and disclosures of the records,
Following the records schedule,
Reporting requirements:  Annual updates/reports, and
Reviewing random samples of contracts for Privacy Act compliance.

- Maintaining a log of access and amendments to records, and disclosures of the records,
- Following the records schedule,
- Reporting requirements:  Annual updates/reports, and
- Reviewing random samples of contracts for Privacy Act compliance.

**Module 3:  Roles and Responsibilities ****Topic 2:  The System Manager**

- This official implements the requirements of the Paperwork Reduction Act.
- 	(The Act is trigged in most cases when an agency collects the same information from 10 or more members of the public without the statutory authority and without an Office of  Management and Budget approval of the form)
- They coordinate the privacy statements required on forms with the Privacy Act Officer, and
- Implement new E-Government Act privacy requirements

**Module 3:  Roles and Responsibilities****Topic 3:  Information Collection Clearance Officer**

- These officials partner with Privacy Act Officers and Records Managers to ensure that Privacy Act system of records are:
- Identified (It Security Asset Valuation Document),
- Provided with the security measures required for the sensitivity level of the system (DOI IT Security Certifications and Accreditations and PIAs), and
- Privacy maintenance, access controls and instructions to users are included in Security and Records Plans, and Business Rules.

**Module 3:  Roles and Responsibilities****Topic 4:  IT Security Manager**

## Module 3:  Roles and ResponsibilitiesTopic 5:  The Records Manager

- Involved in completing Privacy Act system of records notices and Privacy Impact Assessments (identify the retention and disposition of the system).
-  Records Managers must be involved from the beginning in identifying a records schedule for a system of records

- Records managers identify Privacy Act system requirements in Record’s Plans (safeguards, transfers, preservation, and disposition (when no freeze)).
- Instrumental in ensuring that the Privacy Act     records review criteria is implemented.

**Module 3:  Roles and Responsibilities****Topic 5:  The Records Manager**

**If the Privacy Act system is being handled by a contractor, the Contract Officer is responsible for:**
-  Ensuring that the Privacy Act requirements are 	addressed in the work statement and contract 	clauses,
-  Providing the contractor with relevant Privacy Act 	guidelines, and
-  Ensuring that PIAs are conducted by the 	contractor.

**Module 3:  Roles and Responsibilities****Topic 6:  The Contract Officer**

**These Privacy Act requirements for contracts are identified in the Federal Acquisition Regulations (FAR) and DOI Acquisition Regulations (DIAR).**
- FAR 48 C.F.R. 24.102 (a)
- Interior Acquisition Regulations (DIAR) at            48 C.F.R.1424.1
- FAR 52.224‐1and Privacy Act Notification at    FAR 24.104 (a), and supplemental information at DIAR 1452.224‐1 and
- FAR 48 CFR 24.103 and 104

**Module 3:  Roles and Responsibilities****Topic 6:  The Contract Officer**

- Even though there are specific requirements for certain employees, _**all employees**_ play a part in privacy protection.
- The DOI Privacy Act regulations say that “those whose duties require handling of records subject to the Privacy Act shall, at all times, take care to protect the integrity, security and confidentiality of that information.”
**How often do you handle information on individuals?**

**Module 3:  Roles and Responsibilities****Topic 7:  All Employees**

- No employee of the Department may disclose records subject to the Privacy Act unless disclosure is permitted under 43 CFR 2.56 or it is to the individual to whom the record pertains (and a Privacy Act exemption and FOIA exemption do not apply)

**Module 3:  Roles and Responsibilities****Topic 7:  All Employees**

- “No employee ...may alter records unless alteration or destruction is properly undertaken in the course of the employee’s regular duties....”
- (See 43 CFR 2.52(a), (b) &  (c))

**Module 3:  Roles and Responsibilities****Topic 7:  All Employees**

## Module 4:   Where Can I Go for More Information

- The Privacy Act (5 U.S.C. 552a)
- DOI Privacy Act Regulations                        43 CFR 2.45-2.79
- DOI Privacy Act Manual Sections,               383 DM Ch 1 – 13
- Office of Management and Budget             Circular A-130, Appendix I

## Module 4:   Where Can I Go for More Information

- Electronic Government Act of 2002,           Sec. 208 on Privacy
- The Federal Information Security Management Act of 2002
- Computer Matching and Privacy       Protection Act

## Module 4:   Where Can I Go for More Information

- The DOI Privacy Program Website  _[www.doi.gov/ocio/privacy](http://www.doi.gov/ocio/privacy)__ contains links to all of the relevant statutes and regulations.  In addition, this website provides information on the following topics related to privacy:_
- The federal budget process
- Federal contracts
- Geographic information systems
- Interagency data sharing
- Privacy Impact Assessments
- Websites directed at children

## Module 4:   Where Can I Go for More Information

**	****You should find information on how to manage information in Privacy Act system of records in:**
- 	-  IT security plan business rules
- 	-  Records Plans
- 	-  Directives, memos, or program training
- 	-  Privacy Act warning notices
- 	-  System Manager guidelines or metadata for 	 	 systems
- 	-  Privacy Impact Assessments completed for the 	 system
- 	-  The Federal Register notice for the Privacy Act 	 system of  records

## Module 4:   Where Can I Go for More Information

- The DOI University will soon offer Computer Based Training (CBT) in other Information Management areas.
- Go to the DOI Univ. webpage for on-line training more CBT courses on:
- 	The Federal Records Act,
- 	IT Security for All Employees,
- 	Information Resources Management,
-   The Privacy Impact Assessment, and
-   The Freedom of Information Act

## Coming –  Early 2005DOI University Computer Based Training for All Employees on an Overview of the Privacy Act

## Any Questions?

**Contact your **
**Privacy Act Officer **
**(see list at http://www.doi.gov/ocio**
**/privacy/) **

## 
	Thank you for participating in this important training

**	****Thank you for participating in this important training**