# Presentation: 293543

## USDA Privacy Basics

- Required by 9/15/2006
- OCIO

## Welcome

| Welcome to the Privacy course. This course introduces you to the Privacy Act of 1974 and how it applies to you in your work at the United States Department of Agriculture (USDA). Since USDA employees and contractors process personal information every day, it is essential that the Privacy Act be understood and practiced by everyone. |
| --- |

## Objectives 

- Upon successful completion of this course, you will be able to do the following:
- Explain the importance of the Privacy Act of 1974 as it relates to the Department as a whole and to you as an employee of the Department and a custodian of USDA data that is protected by the Privacy Act.
- List the procedures mandated by the Privacy Act for the collection, maintenance, use, and disclosure of personal information.
- Exercise controls and safeguards to preserve the integrity and confidentiality of collected personal information.
- Upon completion of this course, you will be directed to complete an assessment. In order to receive credit for completing this course, you must pass the assessment. You will be allowed to take the assessment as many times as necessary to pass.

## Course Content

| This course is comprised of the following three topics:

Privacy Act Overview 
Information Management 
Risk Management

 |
| --- |

## Topic 1:  Privacy Act Overview

- What Is the Privacy Act?
- The Privacy Act is a law passed by the Congress in 1974 for the purpose of protecting, through regulation, personal information that is collected, maintained, and disseminated by any Federal government entity. The Act protects the information of individuals who are either United States citizens or aliens lawfully admitted for permanent residence.
- On the next slide is a breakdown of where you can find the Records Maintained on Individuals section, Title 5, which has become known as the Privacy Act of 1974.

## Privacy Act Breakdown

| Title 5: | Government Organization and Employees |
| --- | --- |
| Part 1: | The Agencies Generally |
| Chapter 5: | Administrative Procedure |
| Subchapter II: | Administrative Procedure |
| Section 552a: | Records Maintained on Individuals |

## Why Should I Be Concerned About the Privacy Act? 

- As a USDA employee, you may be in a position where you access or process an individual's personal information that is protected by the Privacy Act. You are legally responsible for ensuring that this information is protected against misuse or unauthorized disclosure. Remember, the Privacy Act applies to the custody of personal information by all Federal government agencies.

## Some recent headlines: Personal Information lost or stolen from the US Government

***Charge Card Data Disappears for 1.2 Million Federal Government Employees***
- Bank of America charge card records for employees from 30 Federal agencies and the Senate have disappeared, probably while in transit from one Bank of America facility to another. It is not known whether the tapes, which contain names, addresses, and social security numbers, were lost or stolen.
***Social Security Numbers Stolen from a Government Contractor***
- Science Applications International Corporation, a research and engineering firm with Federal government contracts, had names and social security numbers stolen from their computer records. The records of approximately 45,000 former military and intelligence personnel, including some of the nation's top officials, are included among those stolen.

## Whose Information Is Protected?

- The Privacy Act protects the information of individuals who are either United States citizens or aliens lawfully admitted for permanent residence. It also allows these individuals to access and amend their government records. The Act does not protect the information of deceased individuals, foreign nationals, or organizations.

## What Personal Information Is Protected? 

- Protected information includes any personal information that is maintained in some type of a System of Records by a Federal agency. It does not matter whether the records are maintained in a filing cabinet or a computerized database. This information could include, but is not limited to, social security numbers, financial transactions, and medical history. The information can be accessed by using an individual's name or some other type of identifier.

##  How Are Records Retrieved by Identifiers?

- When records are contained within a System of Records, they are retrieved by some identifying field within the record. Some examples of personal identifying fields include the following:
-   Name of the individual
-   Social security number
-   Other identifying number
-   Fingerprint
-   Voiceprint
-   Photograph

## What Employee Information Is Protected? 

- If you are a current employee of the Federal government, some elements of your personal information are not protected under the Privacy Act, such as:
-   Your name
-   Your pay grade
-   The agency for which you work

## What Employee Information Is Protected?  (cont.)

- It should also be noted that USDA is not liable for the protection of Privacy information stored or transmitted by the employee for personal activities.
- Questions concerning these conditions should be directed to APHIS’s privacy officer, Leisa Banks - FOIA Officer - 4700 River Road, Unit 50 - Riverdale, MD 20737-1232 - Tel. (301) 734-5267 - Fax. (301) 734-5941

## Quiz 1

- Whose personal information is protected by the Privacy Act? Select all answers that apply.

|            |  |  |
| --- | --- | --- |

|            |  | Living United States citizens 
Aliens lawfully admitted for permanent residence 
Deceased United States citizens 
Foreign nationals |
| --- | --- | --- |

**Notes:**
The Privacy Act protects the information of individuals who are either United States citizens or aliens lawfully admitted for permanent residence. It also allows these individuals to access and amend their government records. 

## Are There Any Penalties for Violations? 

- Remember, as an employee of USDA, you are personally responsible for protecting Privacy information. Penalties for unauthorized disclosure or misuse could result in a misdemeanor conviction and a fine of up to $5,000.
- Examples of violations include:
-    Maintaining an unauthorized System of Records
-    Unauthorized disclosure of personal information from a System of Records
-    Requesting and/or obtaining records under false pretenses

## What About the Freedom of Information Act? 

- The Freedom of Information Act (FOIA) provides public access to Federal government records and information on its activities. Generally, an individual or organization submits a formal request to an agency for specific information. The agency then analyzes the request for sensitivity, and decides on whether or not to release the information. Some Federal government records are protected from disclosure by exemptions and exclusions, such as information related to National Security and the Privacy Act. Remember, the Privacy Act places limitations and restrictions on the disclosure of personal information in order to ensure confidentiality.

## What About Contractors Working for the Federal Government? 

- Since the Privacy Act only applies to Federal agencies, the Act requires agencies to put the appropriate language into its contracts to cover all individuals who process or maintain protected information. Therefore, employees and contractors share the same responsibilities under the Privacy Act.

## Quiz 2

- Is the following statement true or false?Employees and contractors share the same responsibilities under the Privacy Act.
- 	True
- 	False

**Notes:**
Employees and contractors share the same responsibilities under the Privacy Act because agencies are required to put appropriate language into contracts to cover all individuals who process or maintain protected information. 

## Topic 2:  Information Management

- The following slides will cover the second topic:
-  **Information Management**

## Are There Specific Procedures?

| To be in compliance with the Privacy Act and some related regulations, there are a few basic requirements for the agencies.
They include:
Establish a Privacy Program that includes training and tools for employees. 
Conduct, prepare, and submit Privacy Impact Assessments. 
Establish and publish System of Records (SOR) Notices in the Federal Register.  |
| --- |

## What Is a Privacy Impact Assessment?

- The Privacy Impact Assessment (PIA), which is mandated by the eGovernment Act of 2002, is a process for determining how personal information is handled by USDA. The PIA also addresses information security and the impact of information disclosure on an individual. The PIA is an important first step prior to the actual collection of any personal data.

## What Is a System of Records? 

- A single record is any item or grouping of information about an individual. A group of these records is known as a "System of Records." The Privacy Act applies to personal data that is contained in any System of Records where an individual's information is retrieved by name or some other type of identifier. It does not matter whether these records are on paper or in a computerized database; the Privacy Act applies either way.

## More on a System of Records 

|     Prior to establishing and using a System of Records, notice must be given to the Office of the Federal Register. This allows the public to comment or question the Federal government's collection and storage of Privacy Act protected data. This notice must include a description of the system and the information to be collected, why it is needed, where it is located, agency practices protecting Privacy information, and how individuals can access and amend their records. |
| --- |

## Quiz 3

| Of the following activities related to the Privacy Act, which would be performed first? 

Collecting information from a customer 
Conducting a Privacy Impact Assessment 
Providing a customer with a Privacy Act Statement
Establishing a System of Records in the Federal Register  |
| --- |

**Notes:**
2.  Preparing a Privacy Impact Assessment is an important first step prior to the actual collection of any personal data. PIAs are submitted to the USDA Office of the Chief Information Officer (OCIO). 

## Are There Specific Procedures for Collecting Data?

- You may play a role in handling Privacy Act information as part of your routine duties as a USDA employee. Therefore, there are a few basic rules that you need to remember when collecting this data:
-    Provide the individual with a Privacy Act Statement.
-    Collect only relevant and necessary information and nothing more.
-    Maintain records according to agency requirements.
-    Disclose information only when authorized.

## What Is a Privacy Act Statement? 

| The Privacy Act Statement, which informs of the authority, purpose, and routine use of the data to be collected, must be given to the individual BEFORE taking any information.
Although this data can be disclosed for routine use purposes, it is protected from other disclosures unless authorized by the individual. Therefore, a Privacy Act Statement must be supplied also to employees when their information is being collected for a System of Records. |
| --- |

## A sample Privacy Act Statement for gathering employee parking information

| PRIVACY ACT STATEMENT
AUTHORITY: 5 U.S.C. 301, Public Law 107-71.
PRINCIPAL PURPOSE(S): To facilitate the timely processing of parking requests, confirm eligibility, prevent misuse of government resources, and provide contact information for ensuring compliance with parking management and security regulations.
ROUTINE USE(S): This information will be matched with lists at other Federal agencies to ensure that you are not listed as a disqualifying rideshare participant or holder of another form of vehicle worksite parking permit.
DISCLOSURE: Voluntary; however, failure to furnish the information on this form may result in disapproval of your request for a parking permit. |
| --- |

## Are There Rules for Maintaining the Records?

- A few basic rules for both employee and non-employee records include the following:
-   Maintain the records with the highest degree of accuracy and security.
-   Use the records for official USDA business only.
-   Disclose the records only to authorized individuals.
- Note: Remember to collect only relevant and necessary information and nothing more.

## What Is Relevant Information? 

- Relevant information refers to the types of Privacy Act information that are specified in the corresponding System of Records Notice. Consequently, you must keep within the scope of the System of Records Notice, which authorizes you to collect the specified relevant information and nothing more.
- In addition to conducting your official duties, you also must be careful not to violate the Privacy Act by maintaining any unauthorized System of Records, even if for personal use. For example, keeping a spreadsheet or even a paper record of officemates' birthdays or home addresses would be a violation of the Privacy Act.

## When Can I Disclose Records?

| Basically, personal information may not be disclosed without the individual's consent. There are some exceptions, such as official use of the data within USDA agencies. Examples may include employees' time and attendance records or travel authorizations. If a disclosure is made beyond USDA, or you need more specifics on these exceptions, please contact your privacy officer, whose name is listed in the Resources. |
| --- |

## Can an Individual See His or Her Own Record?

- The Privacy Act guarantees individuals the right to access their records and amend them if or when necessary. The procedures for an individual's access to and amendment of his/her records are detailed in the System of Records Notice that is submitted to the Office of the Federal Register.

## Quiz 4

- You are ready to collect personal information that will be stored in a System of Records. Before you begin, you must present the customer with a copy of what document?
- Privacy Impact Statement
- Privacy Act
- Privacy Act Statement
- Privacy Impact Assessment

**Notes:**
The Privacy Act Statement, which informs a customer of the authority, purpose, and routine use of the data to be collected, must be provided BEFORE taking any information. 

## Topic 3:  Risk Management

- Over the following pages, topics related to
- Risk Management will be discussed.

## Controls and Safeguards 

- Unauthorized Privacy Act disclosure can come from a variety of sources both inside and outside USDA. Therefore, it is important that all employees follow security procedures and exercise proper safeguards.
- Examples of some areas of concern are:
-  Computer Security
-  Communications
-  Physical Security
-  Telecommuting
-  Social Engineering

## Computer Security 

- Because information protected by the Privacy Act is stored in a System of Records, most of this data is housed in a database that is accessed through a computer. Although USDA has security controls in place, you must do your part to adequately safeguard information and use your computer in a responsible manner, including the proper use of passwords.

## Why Are Passwords Important? 

| A password, along with your user ID, allows you to access your computer and the USDA network. Your password may give you access to sensitive data and/or data that is protected by the Privacy Act. Therefore, it is your responsibility to ensure that all activity done under your user ID and password actually is performed by you. Protect your password; memorize it; do not write it down; change it regularly using a mixture of letters, numbers, and/or symbols that are hard to guess; and never share your password. |
| --- |

**Notes:**
Note: Your agency will require you to change your password every 60 days, or less for some systems. 

## What if a USDA Web Site Is Used? 

- If a USDA Web Site is used to acquire personal information, then, as with other methods of gathering information, a Privacy Act Statement must be presented to the user on the Web page. Remember, the Privacy Act applies to all personal information that will be stored in a System of Records where the record is retrieved by using a personal identifier.

## Quiz 5

- When should you change your password? Select all answers that apply.
- Every six months
- Once a year
- When you think someone else might know it
- On a regular basis

**Notes:**
3 & 4:  You should change your password immediately if you think someone else might know it. Otherwise, change it on a regular basis. 

## What About Other Methods for Communicating Personal Information? 

- If you are handling Privacy Act information, remember that care should be exercised for all methods of communicating personal information, including:
-   Emails
-   Fax transmittals
-   Telephone conversations

## How Safe Is Email? 

- Email is **not a secure method** to communicate Privacy Act information. Since email is used to communicate a variety of information to the Internet and other agencies within USDA, Privacy Act information can be easily intercepted, misdirected, and disclosed. Unless your agency has specifically approved the use of email for the sharing of Privacy Act information, you should use other approved methods that are discussed in the next few screens.

## What About Faxes? 

- A fax is a **fairly secure method** of communication. However, because a fax machine transmits a printed document, the following steps are necessary to ensure that the transmission is as secure as possible.
- Notify the recipient that a fax is being sent.
- Before pressing the fax machine's send button, check that you have entered the correct telephone number for the recipient's fax machine.
- Verify by phone or email that the fax was received.

## How Safe Is the Telephone? 

| A land line telephone is fairly safe. However, conversations on cordless telephones and cell phones can easily be overheard or intercepted. Therefore, keep the following points in mind:
Cordless telephones and cell phones are not secure communication devices. 
Do not discuss Privacy information over cordless telephones or cell phones. 
Use your office telephone if you plan to discuss Privacy information. 
Do not discuss Privacy information in an area where you may be overheard. |
| --- |

## Quiz 6

- Which of the following communication methods should not be used when handling information protected by the Privacy Act? Select all answers that apply.
- Cordless telephone
- Cell phone
- Land-line telephone
- Fax machine

**Notes:**
3 & 4:  Cell phones and cordless telephones are not secure communication devices because their conversations can be overheard or intercepted. A non-cordless land line should always be used when discussing protected information on the telephone or fax machine. 

## What About My Physical Surroundings?

- You can take a number of measures to safeguard personal and sensitive information within your workspace. Some of these measures include the following:
- Position your computer screen so that others cannot see it unless invited.
- Do not have your computer screen facing a window if it can be viewed from the outside with some type of video/digital recording device. (continued on next slide)

## More About My Physical Surroundings

- Do not discuss protected information in an area where your conversation could be overheard by someone who does not have access to the same information.
- Shred discarded papers that contain protected information.
- Lock filing cabinets that contain protected information.
- Do not leave documents containing protected information on your desk when you are not in your workspace.
- Always password protect your computer screen when you are not in your workspace.

## What About Telecommuting? 

| The Privacy Act applies to protected personal information whether you work in the office, on the road, or at home. Therefore, take the same precautions wherever you are working. Examples include:
If you are teleworking, ensure that your agency has approved your telework arrangement, including the use of Privacy Act data. 
Only work on Privacy Act information in your agency-approved computer and working environment. 
Do not view Privacy Act information in public areas, such as on airplanes, hotel lobbies, and Internet cafes. 
If you are traveling, do not let your laptop out of your sight unless it is in a secure location.  |
| --- |

## Are There Any Other Concerns?

- As long as there are dishonest people in the world, there will always be other concerns regarding the protection of personal and/or sensitive data. One of these is what is known as **social engineering**. Social engineers rely on weaknesses in human nature rather than software to trick people into revealing passwords and other personal information. They are very skilled in gaining your trust by posing as someone with a legitimate need to know Privacy information. Social engineers may even be someone you know.

## Quiz 7

- Which of the following tips should you incorporate to avoid becoming a victim of social engineering? (Select the best answer)
- Do not type anything into the computer unless you know the expected results.
- Do not participate in telephone surveys.
- Do not give out information about yourself or other employees.
- All of these.

**Notes:**
4:  To avoid becoming a victim of social engineering, you should not participate in telephone surveys, supply personal information, or type anything into your computer unless you know the expected results. 

## What's Identity Theft? 

- Identity Theft is when someone copies or assumes your identity. It occurs by someone using your name, address, social security number, or other information without your knowledge to commit fraud or other crimes. When personal information falls into the wrong hands, an identity thief could open charge accounts to purchase merchandise or get cash advances, obtain loans, buy or rent, and get utility services. Unfortunately, the list is endless.

## A recent example of identity theft 

- ChoicePoint, a provider of decision-making information for businesses and government, disclosed that individuals pretending to be legitimate customers stole social security numbers and other personal information on approximately 145,000 consumers. ChoicePoint sent letters to each of these consumers alerting them of the situation and steps that they could take to monitor and protect their information, including one year of free credit monitoring and unlimited credit reports. Unfortunately, some of these individuals had already become victims of identity theft.

## For more information on this:

- For more information on identity theft prevention and what to do if you become a victim, visit the Federal Trade Commission's Web site at _[www.ftc.gov](http://www.ftc.gov/)_**.**** **

## Some Basic Do's 

- Everyone is responsible for doing his or her part to ensure that the collection, maintenance, and dissemination of an individual's personal data are in compliance with the Privacy Act of 1974. Some basic rules to assist you in maintaining the confidentiality, integrity, and availability of this data include the following:
-   Do follow security procedures.
-   Do recognize the accountability assigned to your user ID and password.
-   Do shred sensitive documents, and destroy diskettes and compact discs before disposal.
-   Do log out or lock your workstation before leaving it unattended.
-   Do recognize the Privacy Act issues all around you.
-   Do provide a Privacy Act Statement before collecting information.
-   Do safeguard others' personal information with due care.
-   Do account for any disclosures made beyond USDA.

## Some Basic Don'ts 

| Some basic "don't" rules to assist you in maintaining the confidentiality, integrity, and availability of data protected by the Privacy Act include the following:
Don't share your user ID and password. 
Don't allow yourself to be a victim of social engineering by giving out information to unauthorized individuals. 
Don't obtain Privacy Act information unless it is part of your assigned duties. 
Don't collect personal information without providing a Privacy Act Statement. 
Don't use personal information for unauthorized purposes. 
Don't disclose personal information beyond USDA without authorization.  |
| --- |

## Quiz 8

- Which department or other government entity should you contact for more information on identity theft prevention and what to do if you become a victim?
- Department of Justice
- Department of Commerce
- Federal Trade Commission
- USDA

**Notes:**
3:  For more information on identity theft prevention and what to do if you become a victim, you should visit the Federal Trade Commission’s Web site at www.ftc.gov. 

## You have completed the Privacy course. This course introduced you to the Privacy Act of 1974 and how it relates to your work at USDA. You have learned about the mandated procedures for your information-collecting activities, and how to practice controls and safeguards to preserve the integrity and confidentiality of collected personal information.

- You have completed the *Privacy* course. This course introduced you to the Privacy Act of 1974 and how it relates to your work at USDA. You have learned about the mandated procedures for your information-collecting activities, and how to practice controls and safeguards to preserve the integrity and confidentiality of collected personal information.

## The assessment contains 10 questions, consisting of the following types:
Multiple Choice 
True or False 
A minimum passing score of 70 percent will be required to receive credit for successful course completion. You will be able to retake the test as many times as necessary to pass.
Good luck!

- The assessment contains 10 questions, consisting of the following types:
- Multiple Choice
- True or False
- A minimum passing score of 70 percent will be required to receive credit for successful course completion. You will be able to retake the test as many times as necessary to pass.
- Good luck!