# Presentation: 716748

** **

**The Privacy Toolbox**

**Office of the ****Chief Information Officer**

## Government Privacy Policy Framework

**FISMA and Privacy Management Reporting**
**OMB M-05-15**

**Privacy Act**

**Computer Matching**

**E-Gov Act**

**FISMA**

**FOIA**

**OMB **
**A-130**

**OMB A-11**

**OMB M-03-22**

**OMB M-99-18**

**OMB M-00-13**

**OMB M-05-15**

**OMB M-05-24**
**  ****(HSPD-12)**

**HIPPA**

**Consolidated**
**Appropriations Act of 2005**

**FISMA now requires agencies to demonstrate in their reporting activities compliance with three decades worth of federal privacy laws and Government requirements.**

**Affects CIOs, IT, Web, and Project Management **
**Personnel and **_**ANYONE**_ **handling information**
** ****on individuals**

## The Privacy Act – Foundation of Privacy Framework

- The Act focuses on four basic policy objectives:
- To _**restrict disclosure**_ of personally identifiable records maintained by Executive agencies;
-  To grant individuals increased _**rights of access**_ to agency records maintained on themselves;
- To grant individuals the _**right to seek amendment**_ of agency records that are not accurate, relevant, timely, or complete; and
- To establish a _**code of "fair information practices**_"

## Fair Information Practices --

- Code to regulate the:
- Collection
- Maintenance
- Use, and
- Dissemination of personal information on individuals
- Provides **CONTROLS** and assurances through the **LIFE CYCLE** of information management.

## Government Privacy Policy Framework

**The Computer Matching and Privacy Protection Act of 1987:**
- Requirements when comparison of Privacy Act databases
**The Freedom of Information Act:**
- Exemptions 6 and 7(C)
**The E-Government Act of 2002:**
- Section 208 of the E-Government Act of 2002 requires privacy provisions for databases and websites.  Privacy Impact Assessments are to be used to build in privacy in IT systems.

## Government Privacy Policy Framework

**The Federal Information Security Management Act of 2002 (FISMA):**
-    -  Improving the security and privacy of sensitive information in Federal computer systems.
**Health Insurance Portability and Accountability Act of 1996:**
**    ****-  **Standards for handling of medical information
**The Consolidated Appropriation Act of 2005:**
- Several provisions related to privacy require a Privacy Officer, privacy and data protection procedures and policies, and independent third-party reviews

## Government Privacy Policy Framework

**The Paperwork Reduction Act of 1995** (As amended by the Clinger-Cohen):
- Addresses authority and procedures to collect information from individual members of the public and Privacy Act compliance.
**The Paperwork Elimination Act of 1998:**
- Federal agencies must allow individuals the option to submit information or transact with the agency electronically, when practicable, and to maintain records electronically, when practicable.  Requires analysis of privacy impact.

## Government Privacy Policy Framework

**Office of Management and Budget (OMB) Circular A-130, Appendix I:  **Agency Responsibilities for Maintaining Information About Individuals
**OMB Circular A-11:  **Budget Submissions (Sec. 53 on Info Technology and E-Gov
**OMB Circular A-16:  **Coordination of Geographic Information.  See sections on protecting privacy in GIS info.
**OMB Circular A-123:**
- Management Accountability - compliance with federal laws

## Government Privacy Policy Framework

**OMB Memorandum M-99-18**, Privacy Policies on Federal Web Sites (June 2, 1999)
**OMB Memorandum M-00-13**, Privacy Policies and Data Collection on Federal Web Sites
- 	(June 22, 2000)
**OMB Memorandum M-03-22**, OMB Guidance for Implementing the Privacy Provisions of theE-Government Act of 2002 (September 30, 2003)
**OMB Memorandum, M-05-15**, FY 2005 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management (June 13, 2005)
**OMB Memorandum, M-05-24**, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors (August 5, 2005)

## Departmental Privacy Policy Framework

- Previous Government Statutes and Requirements,
- Departmental FOIA and Privacy Act Regulations             (43 CFR Subparts A –G),
- Departmental Privacy Act, Manual Sections    383 DM 1-13,
- Departmental FOIA Manual, 383 DM 15,
- CIO Bulletins and Memos, and
- DOI and Government references are also available on the Interior Privacy Program and FOIA Websites at:  _[www.doi.gov/ocio/privacy](http://www.doi.gov/ocio/privacy)__ and __[www.doi.gov/foia](http://www.doi.gov/foia)_
**                                                             **

## This Government Privacy Policy Framework Applies to:

**Information on individuals       (United States citizens, and lawfully admitted permanent residents)**
**Does not apply to information about persons representing: **
- Businesses, governments, or organizations,
**Does not apply to statistical information not linked to the individual’s name or unique identifier**

## Privacy Requirements–    Broad in Scope

**Accountability**
**Identifying Purposes**
**Consent**
**Limiting Collection**
**Limiting Use, Disclosure, Retention**
**Accuracy**
**Publishing Notices**

**Safeguards**
**Openness**
**Individual Access**
**Challenging Compliance**

## Government Privacy Policy Applies to - 

**Paper Records**
**Databases**
**Intra and Inter-Agency Data Sharing **
**Agency Records in any Format**
**Data  Warehouses**
**Websites and Portals**
**New Technology **
**   ****(e.g., GIS, Wireless)****	**

## Privacy and Foresight“Plan Ahead or Find Trouble on the Doorstep” -- Confucius

**Privacy – EACH STEP OF THE WAY!!**

## What Privacy Requirements 
are There that Have to be 
Implemented in LCM?

**are There that Have to be **
**Implemented in LCM?**

## Privacy and Life Cycle Management

**Intent of the Privacy Act to implement privacy principles in phases such as:**
**Collection:  **(Authority to collect the information and minimize what is collected)
**Design:**  (Data sharing restrictions, access controls, etc.)
**Maintenance and Use: ** (Regulatory safeguard standards, restrictions on access internally and disclosure to parties outside the Department, restrictions on use, dealing with violations, and training)
**Disposition:  **Federal Records Act requirements, records schedules, plans and proper disposal of sensitive information)

## Privacy and LCM Interface

**System Development Life Cycle**

- -  Privacy Impact
- Assessment
- (PIA)
- Info Collection
- Analyze Data
- Review for
- FOIA sensitive
- data
- -  Risk Analysis
- Use and
- Restrictions
- - Exhibit 300
- Privacy Notices
- Records
-  Schedule

- -  PIA to
- address
- change in
- privacy
- from last
- phase.
- Privacy risks
- Privacy
-  controls
- Privacy
-  Planning
- Contract
-   requirements

- -  PIA to
- address
- changes from
- last phase.
- System
-   integration
- Security
-  C&A
-   Controls for
- handling of
- sensitive info
- in Business
-   Rules

- -  PIA to
- address
- changes from
- last phase.
- Data
-  quality
-  assurance.
- Mgmt
-   controls
- Audit
-   trails
- Access
-   controls
- - Safeguards

- -  PIA to
- address
- changes from
- last phase.
- Info
-  preservation
- Sanitization
- Appropriate
-   disposal of
-   sensitive
-   info

**Initiation**

**Acquisition/**
**Development**

**Operation/**
**Maintenance**

**Implementation**

**Disposal**

**HSPD-12**
**Requirements**

**Complying with**
**FIPS-201 &**
**OMB Memo**
**M-05-24**

## Privacy and OMB Exhibit 300

**OMB Circular A-11 provides guidelines on preparing budget submissions to OMB**
**The Exhibit 300 is required to justify the budget for major IT investments**
**There are many questions concerning what privacy protection measures were taken when planning and developing the investments**

## Privacy and OMB Exhibit 300

- Section I.F.  Risk Inventory and Assessment...Was a Privacy Risk Assessment Done?
- Have you identified if the system contains information on individuals?
- Do you know if it’s a Privacy Act system and what FOIA sensitive information apply?
- Do the rules of behavior identify the proper handling procedures for restricting a Privacy Act system?
- Do you know what the Federal Register published restrictions are?

## Privacy and OMB Exhibit 300s

- Did the technical evaluation ensure that Privacy Act requirements are met? – Need to know what a Privacy Act system is and what the requirements are to do this.
- Are Privacy Warning Notices posted or employees aware of the sensitive nature of the information, it’s handling and penalties involved?                   (see 383 DM 8)

## DOI Privacy Act Warning Notice

**	**

## Privacy and OMB Exhibit 300

- Are sensitive functions divided among different individuals?
- Are mechanisms in place for holding users responsible for their actions?
- Does management regularly review the list of persons with physical access to sensitive facilities?
- Are there plans to properly dispose of or archive information on individuals? (e.g., is information or media purged, overwritten, degaussed, or destroyed?) (see 383 DM 8)

## Privacy and OMB Exhibit 300

- Sec. II.B.2.D. Have All System Users Been Appropriately Trained in the Past Year, Including Business Rules and Consequences for Violating the Rules?
- Apply your regulatory and internal requirements to educate employees who handle Privacy Act information
- See FAR and DIAR privacy requirements and clauses for contracts
- Include Privacy Act handling requirements in meta data (see 383 DM 7 and 9)
- Include requirements in IT Security business rules

## Privacy and OMB Exhibit 300

- Sec. II.B.3.  How Does the Agency Ensure the Effective Use of Security Controls and Authentication Tools to Protect Privacy for Those** **Systems that Promote or Permit Public Access?
- Do you know what systems have information on individuals to categorize them as Privacy Act sensitive systems?
- Have internal “need to know” requirements been established?
- Do you know what the restrictions are for sharing the information outside the Department?

## Privacy and OMB Exhibit 300s

- Sec. II.B.3.  How Does the Agency Ensure the Effective Use of Security Controls and Authentication Tools to Protect Privacy for Those Systems that Promote or Permit Public Access?
- Are the builders of this system and those who manage and maintain it aware of the Department’s privacy protection policies and access controls?
- Have COTRs provided contractors with the Departmental privacy guidelines?

## Privacy and OMB Exhibit 300s

- Sec. II.B.5.  If a Privacy Impact Assessment was Conducted, Please Provide a Copy to OMB
**...............****What is a Privacy Impact Assessment?**

## Privacy Impact Assessments

## Privacy Impact Assessments

- OMB Memo M-03-22 of Sept. 2003 requires it for any instance that may affect the privacy rights of an individual (_[http://www.whitehouse.gov/omb/memoranda/m03-22.html](http://www.whitehouse.gov/omb/memoranda/m03-22.html)_)
- New EGov Act of 2002 requirement
- DOI PIA developed in Oct. 2002 (See OCIO Bulletin 2002-015) copy at _[www.doi.gov/ocio/privacy/](http://www.doi.gov/ocio/privacy/)_

## Privacy Impact Assessments

- Required for DOI IT Security Certification and Accredidation Process
- Required with information collection packages to OMB
- Required when a Privacy Act notice is being published in the Federal Register**	**

## Privacy Impact Assessments

- Checklist to ensure that existing Privacy Act and Gov’t privacy requirements are being applied to:
- Collections of information about individuals,
- New or amended information systems with info about individuals through each life cycle, and
- System changes that create a privacy risk

## Privacy Impact Assessments

- Only applies to collections of information
- 	and information systems about individuals
- Addresses privacy concerns when designing, developing, maintaining information in identifiable form (info linked to the individual in some way – by name, SSN, unique identifier)
- Ensures that privacy protections are considered when collecting, using, maintaining, safeguarding, disposing of Information – through the whole life cycle

## Privacy Impact Assessments

- According to the OMB guidelines on the E-Government Act of 2002, PIAs are conducted before:
- Developing or procuring IT systems or projects that collect, maintain, or disseminate info in identifiable form
- A new electronic collection of information in identifiable form from the public

## Privacy Impact Assessments

**OMB also requires them:**
**When a system change creates a new privacy risk such as:**
- Converting paper to electronic records
- Anonymous to Non-anonymous info
- Significant system management changes
- With merging, centralizing, matching databases
- New user-authenticating technology used
- Purchasing databases
- E-Gov initiatives – new interagency uses
- Change in the business process creates a new use

## Privacy Impact Assessments

**DOI requires a “Preliminary PIA” **
- An analysis to determine if the system contains information about individuals in an identifiable form at all.
**OMB allows for less analysis in responding depending on the size and complexity of the system**
- IT development stage   - Less
- Major information system – Greater
- Routine database – Less

## Privacy Impact Assessments

- The PIA is not a “reporting “ document
- It was meant to be a **DESIGN and DEVELOPMENT** tool and not prepared as a “reporting” for an Exhibit 300 and IT Security Certification.
- It is meant to be used to help make decisions regarding design, development, maintenance and changes to a system that contain information on individuals.**  **

## Privacy Impact Assessments

- The E-Government Act requires agencies to conduct a PIA before:
- 	“a.	Developing or procuring IT systems or projects that collect, maintain or disseminate information in identifiable form from or about members of the  public, or
- 	b.	Initiating, consistent with the Paperwork Reduction Act, a new electronic collection of information in identifiable form for 10 or more persons (excluding agencies, instrumentalities or employees of the federal government).”

## Privacy Impact Assessments

- According to OMB:  “In general, PIAs are required to be performed and updated as necessary where a system change creates new privacy risks.”
- PIAs should become routine when making decisions when collecting or maintaining information on individuals.
- Refer to the OMB Memorandum M-03-22, Attachment A, Section II. E. 2. for OMB examples of when a PIA should be conducted.

## Privacy Impact Assessments

- DOI’s PIA requirements extend to all systems that contain information on individuals (includes information on BOTH employees and members of the public) (Optional in OMB’s Memo (M-03-22)).
- According to OMB, PIAs should be updated  “to reflect changed information collection authorities, business processes or other factors affecting the collection and handling of information in identifiable form.”

## Privacy Impact AssessmentsKey Questions

**What information is being collected?**
**Why is it being collected?**
**What is the intended use of the information?**
**With whom the info will be shared?**
**What are the options the individual has in providing the information?**

## Privacy Impact Assessments Key Questions

**How the information will be secured?**
**Whether this is also a Privacy Act system of records? **
**What are the maintenance and  administrative controls?**

## PIA and System Networks:
In explanations following the OMB Memorandum M-03-22, OMB indicated that network system (conduits of information) where the system manager does not actually “collect, maintain or disseminate information in identifiable form” (just provides a way of transferring information) would NOT require a PIA
General Support Systems
Where these systems may maintain information as identified above, OMB is requesting that a PIA be completed.  (System managers collect, access, use the informaiton).

- In explanations following the OMB Memorandum M-03-22, OMB indicated that network system (_conduits of information_) where the system manager does not actually “collect, maintain or disseminate information in identifiable form” (just provides a way of transferring information) would NOT require a PIA
- General Support Systems
- Where these systems may _maintain_ information as identified above, OMB is requesting that a PIA be completed.  (System managers collect, access, use the informaiton).

**Privacy Impact Assessments**

- It provides a way to avoid exponential design costs to retrofit systems to meet legal requirements.
- Completing and following privacy principles in the PIA helps to build a public trust and confidence in the Government’s management of their information and encourages their involvement with E-Government.
- It is a tool to ensure that DOI is meeting it’s information stewardship responsibilities.

**Privacy Impact Assessment**
**Benefits**

- OMB requires them for budget submissions (Exhibit 300s) for projects maintaining information on individual _members of the public._
- DOI requires them to complete an IT Security Certification for both systems that maintain information on individual members of the public _**and**_ information on employees.

**Privacy Impact Assessment**
**Benefits**

## Opportunities to Work in Privacy Requirements – How Can I Embed “Privacy” Requirements in my systems?

- Respond to OMB’s Privacy Questions in the Exhibit 300
- Privacy Impact Assessments (PIA)
- Privacy Act *Federal Register* Notices (Covers purpose, maintenance, use, safeguards)
- IT Security Asset Valuation, C&A Process (PIA required for C&As), and Self-Assessments
- Risk Assessments
- Privacy Questions in DEAR
- Government Web Privacy Requirements

## FISMA now requires agencies to demonstrate 

**FISMA now requires agencies to demonstrate **
**in their reporting activities compliance with **
**three decades worth of federal privacy laws.**** **

## Privacy  and Compliance – How are Privacy Requirements Monitored?

- OMB Circular A-130, Appendix I (Eight Bureau Privacy Program Reviews)
- Privacy Impact Assessments for Exhibit 300s
- GAO Reports (Six in the last four years)
- IG Reviews (Three on Web Privacy Requirements)
- Government “Standards for Success” (Now three on Privacy requirements)
- Interior Executive Performance Element (Ensure that the organization’s records, in all formats are identified, protected, and managed in accordance with Federal and Departmental policies).
- OMB Privacy Survey for Annual FISMA Reporting – Ties in Most of the Above
-     (Managerial Oversight, Privacy Program Reviews, PIAs, Web requirements and Privacy Act system of records published in the *Federal Register*).

## Slide 50

## Avoiding Identity Theft

## Avoiding Identity Theft Valuable Resources for Citizens

**	**
- The Federal Trade Commission’s (FTC) consumer protection web site provides helpful information on how to protect your personal information. Visit the site at: _[http://www.ftc.gov/privacy/index.html. ](http://www.ftc.gov/privacy/index.html.)_
- Another helpful FTC site provides valuable information on what to do if you become a victim of identity theft. Visit the site at:  _[http://www.consumer.gov/idtheft/](http://www.consumer.gov/idtheft/)_
- The FTC also provides helpful information on minimizing the risks of privacy violations. Visit the site at:  _[http://www.ftc.gov/bcp/conline/pubs_x000b_/credit/](http://www.ftc.gov/bcp/conline/pubs%0B/credit/)_idtheft.htm

## Contacts

**Departmental Privacy Act Officers (see list at http://www.doi.gov/ocio**
**/privacy/) **