# Presentation: 444580

## Privacy Eyes: THEY’RE WATCHING YOU INTEGRATE PRIVACY PRACTICES WITH BUSINESS PROCESES

- Miriam Brown-Lam
- Department of the Interior
- Departmental Privacy Act Officer

## Privacy in the Federal Government

- “**The individual’s right to privacy must be protected in Federal Government information activities involving personal information.”**
- 	(OMB Circular A-130: Management of Federal Information Resources, Basic Considerations and Assumptions:  Sec. 7.g.)
-  **“****The purpose of this section is to ensure sufficient protections for the privacy of personal information as agencies implement citizen-centered electronic Government.”**
- 	(Section 208 of the E-Government Act of 2002)

## Privacy Requirements

- The Privacy Act of 1974 mandated requirements for the collection of personal information
- Providing guidance for the collection, maintenance, use and disposition of records containing privacy information
- Before electronic expanded government and the advance of Information Technology

## Privacy Requirements

- As systems are developed for business processes, it is important for system owners and managers to understand what the Privacy obligations are to comply with the statutory requirements
- Statutory requirements must be met before systems are operable (see (e)(4) of the Privacy Act)

## Privacy in Business Practices	

- Privacy reporting requirements have increased dramatically
- OMB has issued substantial guidance to reflect increased concern regarding
- System development with Privacy information
- Reporting of systems that contain Privacy information
- How agencies are to handle incidents involving breaches of Privacy information

## Privacy in Business Practices

- All personnel must be aware of their responsibilities as outlined in the Privacy Act
- IT System developers, owners and managers must know and understand the requirements of the Privacy Act as they relate to IT systems

## Privacy in Business Practices

- Agencies are now required to report to OMB if major IT systems have met the obligations associated with the Privacy Act

## Government Privacy Framework

**Privacy Act**
**of 1974**

**Computer Matching**

**E-Gov Act**

**FISMA**

**FOIA**

**OMB **
**A-130**

**OMB A-11**

**OMB M-03-22**

**OMB M-99-18**

** ****OMB M-00-13**

**  ****OMB M-05-08**

**OMB M-05-24**
**  ****(HSPD-12)**

**HIPPA**

**Consolidated**
**Appropriations Act of 2005**

**FISMA requires agencies to demonstrate in their reporting activities compliance with three decades worth of federal privacy laws and Government requirements.**

**Affects CIOs, IT, Web,  **
**Security and Project**
**Management Personnel -- **
_**ANYONE**_ **handling **
**and making decisions on**
** ****Information **
**about individuals**

-      **OMB M-06-15**

**OMB 06-16**

**OMB 06-19**

**OMB M-06-20**

**OMB M-07-16**

**OMB M-07-19**

**OMB M-08-09**

**OMB M-05-15**

## Government Privacy Policy Applies to:

- Information on **individuals **      (United States citizens, and lawfully admitted permanent residents)
- Does not apply to information about persons representing:
- Businesses, governments, or organizations
- Does not apply to statistical information not linked to the individual’s name or unique identifier

## Government Privacy Policy Applies to: 

- Paper Records
- Databases
- Intra and Inter-Agency Data Sharing
- Agency Records in any Format
- Data  Warehouses
- Websites and Portals
- New Technology
-    (e.g., GIS, Wireless)

## The Privacy Act – Foundation of Privacy Framework

**The Act focuses on four basic policy objectives:**
- To _**restrict disclosure**_ of personally identifiable records maintained by Executive agencies;
- To grant individuals increased _**rights of access**_ to agency records maintained on themselves;
- To grant individuals the _**right to seek amendment**_ of agency records that are not accurate, relevant, timely, or complete; and
- To establish a _**code of "fair information practices**_"

## Fair Information Practices --

_**Code to regulate the**_**:**
- Collection
- Maintenance
- Use, and
- Dissemination of personal information on individuals

## The Privacy Act

- Provides CONTROLS and assurances throughout the LIFE CYCLE of information management.
- Covers information on individuals that is in a “system of records.”

## The Privacy Act 

- A System of Records is:
- A group of any records under the control of any agency from which information is retrieved by the name of an individual **or** by some identifying number, symbol, or other identifying particular assigned to the individual. (Privacy Act of 1974, (a)(5))

## The Privacy ActAn Overview

- Retrieved v Retrievable
- OMB guidelines explain that a system of records exists if:
- 	(1)  There is an indexing or retrieval capability using identifying particulars built into the system, and
- 	(2)  The agency does in fact retrieve records about individuals by references to some personal identifier

##   Requirements of the Privacy Act Cover the       “Information Life Cycle”

- Consideration as to whether there is an **authority to COLLECT** the information
**Minimizing the collection** of information on individuals – only collect what is absolutely needed
**Publishing a notice** for public comment of the existence and character of, or changes to an existing **Federal Register** Privacy Act notice
-  (See DOI Privacy Act regulations at 43 CFR 2.48 – 2.50)

**COLLECT**

**        ****MAINTAIN**

**        ****USE**

**        ****DISPOSE**

##    Requirements of the Privacy Act Cover   the “Information Life Cycle”

**Providing Notice** to the Individual When **Collecting from Forms** and providing information on:
- The authority to collect the information;
- The purpose(s) for which the information is intended to be used;
- The routine uses which may be made of the information; and
- The effects on the individual for not providing all or any part of the requested information (43 CFR 2.48)

**COLLECT**

**        ****MAINTAIN**

**        ****USE**

**        ****DISPOSE**

**Maintaining records with such accuracy, relevance, timeliness, and completeness** as is reasonably necessary to assure fairness to the individual
- Maintaining **no record** describing how an individual **exercises rights guaranteed by the First Amendment**
-    (See 43 CFR 2.48)

**COLLECT**

**        ****MAINTAIN**

**        ****USE**

**        ****DISPOSE**

**Requirements of the Privacy Act Cover the “Information Life Cycle”**

## Requirements of the Privacy Act Cover the “Information Life Cycle”

- Establishing appropriate **administrative, technical and physical safeguards** to ensure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity
- Publishing notices for **inter-agency matching programs** (See 43 CFR 2.51)

**COLLECT**

**        ****MAINTAIN**

**        ****USE**

**        ****DISPOSE**

- Ensuring
- information is **USED only for the purposes the system was developed**
**access rights** to the subject
**disclosure restrictions** for third party requests for information are followed
**that sharing of the information** outside of the Agency is **to only those identified in the Federal Register Privacy Act system notice** (43 CFR 2.64 and 2.56)

**COLLECT**

**        ****MAINTAIN**

**        ****USE**

**        ****DISPOSE**

**Requirements of the Privacy Act Cover the “Information Life Cycle”**

## Requirements of the Privacy Act Cover the “Information Life Cycle”

- Identify in the *Federal Register*  notice the policy and practices of the agency regarding **storage, retrievability, access controls, retention, and DISPOSAL of the records**
- Must follow **NARA and NIST requirements for disposal of sensitive information**
- 	See 5 U.S.C. 552a(e) of the Privacy Act and DOI Privacy Manual Sections 383 DM 8 & 9)

**COLLECT**

**        ****MAINTAIN**

**        ****USE**

**        ****DISPOSE**

## The Privacy Act Collection Requirements

- Government employees must follow certain legal requirements to collect information from individuals.
- If you wish to collect the same information from 10 or more members of the public you will need to contact your bureau/office Information Collection Clearance Officer.

## Collection Requirements 

- Office of Management and Budget approvals may be required for such collections.  **These requirements apply to information collected from websites as well.**

## The Privacy Act Collection Requirements

**Other Privacy Act requirements which must be considered before collecting information from individuals include:**** **
- Collecting the information directly from the subject of the file, and
- Providing a Privacy Act notification statement on the form collecting the information (again this also **applies to Internet forms**).

## The Privacy Act - Collection Requirements

- Minimization Principle –
- Only maintain information about an individual that is _**relevant and necessary**_ to accomplish a purpose of the agency required to be accomplished by statute or by Executive Order of the President.
- Cannot stockpile information that is not necessary now but may be of use in the future.
- Cannot collect information you don’t have a legal authority to collect.

- 	Does the Privacy Act allow agencies to collect of Social Security Numbers?
- 	The collection of the  SSN must be:
- Required by law, or
- Required before
-   January 1, 1975

**The Privacy Act -**
**Collecting Social Security Numbers***** ***

- Before you collect information that will create a new Privacy Act system of records, or change another, you must publish a notice in the *Federal Register* .  This is called a Privacy Act system of records notice (SORN).
- Published notices that cover the Privacy Act records maintained by the Department are posted on the Department’s Privacy Program Website and can be viewed at the Government Printing Office website.

**The Privacy Act -****Notification Requirements**

##  The Privacy Act –  Notification Requirements

- These notices are
- 	important resources
- 	for the public.  They
- 	provide information
- 	on the purpose of the
- 	system and how it will
- 	be maintained and
- 	used.

## The Privacy Act Notification Requirements

- Employees should use these notices as guidelines when making decisions about information from Privacy Act systems of records.
- If you make decisions about information from Privacy Act systems, do you have a copy of the applicable Privacy Act notice to identify the restrictions on the information?

##      Notification procedure:  To determine whether the records are maintained on you in this system, write to the System Manager or, with respect to records maintained in the office for which he is responsible.   (See 43 CFR 2.60) 

**     **_**Notification procedure**_**:**  To determine whether the records are maintained on you in this system, write to the System Manager or, with respect to records maintained in the office for which he is responsible.   (See 43 CFR 2.60)
**     **_**Record access procedures**_**:**  To see your records, write the officials listed in the Notification procedure. Describe as specifically as possible the records sought. If copies are desired, indicate the maximum you are willing to pay. (See 43 CFR 2.63)
**     **_**Contesting record procedures**_**:**  To request corrections or the removal of material from your files, write to the System Manager. (See 43 CFR 2.71)
**      **_**Record source categories**_**:**  Legal records such as titles, deeds, probates and birth notices.

-   The Privacy Act limits and defines the disclosure of personal information by an agency.
-   Most employees have access to or manage some information from a Privacy Act system of records.
-   Often we receive inquiries or requests for the information that is in the possession and control of the Agency.

**The Privacy Act -****Disclosure Restrictions**

- Privacy Impact Assessments (PIAs) are:
- Conducted during the Design and Development of IT Systems
- To **assist** employees in identifying and addressing privacy information when planning, developing, implementing, and operating agency information management systems that maintain information on individuals.

**Privacy Impact Assessments: Integrating Privacy with Business Practices**

## PIAs

- OMB’s definition of a PIA (M-03-22) is:
- An analysis of how information is handled:
- (i) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy,
- (ii) to determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system, and
- (iii) to examine and evaluate protections.

## PIAs

- “Identifiable Form” - According to the OMB Memo M-03-22, this means information in an IT system or online collection:
- (i) that directly identifies an individual (e.g., name, address, social security number or other identifying number or code, telephone number, email address, etc.) or
- (ii) by which an agency intends to identify specific individuals in conjunction with other data elements, i.e., indirect identification.  (These data elements may include a combination of gender, race, birth date, geographic indicator, and other descriptors).

## PIAs

- Going through the PIA process helps identify sensitive systems to ensure that appropriate information assurance measures are in place (such as: system of records notices, secured storage media, secured transmission, special handling instructions, and access controls).

## PIAs

- The goals accomplished in completing a PIA include:
- Making informed policy and system design or procurement decisions.  These decisions must be based on an understanding of privacy risk, and of options available for mitigating that risk;
- Accountability for privacy issues;
- Analyzing both technical and legal compliance with applicable privacy law and regulations, as well as accepted privacy policy; and
- Providing documentation on the flow of personal information and information requirements within DOI systems.

## PIAs

- According to OMB guidance (M-03-22), the E-Government Act requires agencies to conduct a PIA before:
- Before developing or procuring IT systems or projects that collect, maintain or disseminate information in identifiable form from or about members of the public; or
- Where a system change creates new privacy risks.

## PIAs

- Initiating, consistent with the Paperwork Reduction Act, a new electronic collection of information in identifiable form from 10 or more persons (excluding agencies, instrumentalities or employees of the federal government); and
- 	(Electronic collection applies to information collected from interactive forms being placed on DOI websites or terminals, which the visitor may fill-out and in which the information is stored in DOI systems or by a contractor managing systems for the Department.)

## The DOI Privacy Office

- Is here to provide assistance to Bureau/Office Privacy Officers and DOI staff
- We want to help you achieve your programmatic goals while complying with the law

## Privacy Contacts

- 	Miriam Brown-Lam
- 	Departmental Privacy Officer
- 	_[Miriam_Brown-Lam@ios.doi.gov](mailto:Miriam_Brown-Lam@ios.doi.gov)_
- 	202-208-2588
- 	Sid Sharma
- 	Privacy Act Specialist
- 	_[Siddartha_Sharma@ios.doi.gov](mailto:Siddartha_Sharma@ios.doi.gov)_
- 	202-219-0963

## Privacy Links

- The Privacy Act of 1974
-  _[http://www.usdoj.gov/oip/privstat.htm](http://www.usdoj.gov/oip/privstat.htm)_
- DOI Privacy Office
- _[http://www.doi.gov/ocio/privacy/doi_privacy_act_officers.htm](http://www.doi.gov/ocio/privacy/doi_privacy_act_officers.htm)_
- DOI Privacy Website
- _[http://www.doi.gov/ocio/privacy/](http://www.doi.gov/ocio/privacy/)_
- OMB Memoranda
- _[http://www.whitehouse.gov/omb/memoranda/index.html](http://www.whitehouse.gov/omb/memoranda/index.html)_

## Personally Identifiable Information 

**Information which can be used to **_**distinguish**_** or **_**trace**_** an individual’s identity, **
**(such as: Names **
**Social Security Numbers **
**Biometric Records, etc.)**
_***EITHER ALONE OR ***_** when combined with other personal or identifying information which is **_**linked or linkable**_** to a specific individual**
**(such as **_**Date and Place of Birth, Mother’s Maiden Name**_**, etc.)**

**Personally Identifiable Information **
**(PII)**

## Collecting SSNs for most routine business purposes is no longer necessary!  

- NO  SSNs!

##             NOTICE!

- 1. ACCESS TO THESE RECORDS IS LIMITED TO
- 	AUTHORIZED PERSONS ONLY!
- 2. INFORMATION MAY NOT BE DISCLOSED FROM THIS FILE UNLESS PERMITTED PURSUANT TO 43 CFR 2.56.
- 3. THESE RECORDS MAY NOT BE ALTERED OR DESTROYED EXCEPT AS AUTHORIZED BY 43 CFR 2.52.
- 4. THE PRIVACY ACT CONTAINS PROVISIONS FOR CRIMINAL PENALTIES FOR KNOWINGLY AND WILLFULLY DISCLOSING INFORMATION FROM THIS FILE UNLESS PROPERLY AUTHORIZED.