Privacy Impact Assessment

For

Department of Education Contests

Date:

March 27, 2015

Point of Contact and Author:

Kristen Lefevre

Kristen. Lefevre @ed.gov

System Owner:

Kristen Lefevre

Office of Management

U.S. Department of Education

Office of Management Privacy Safeguards Division
Privacy Impact Assessment

Introduction

The Department of Education (“the Department” or “ED”) often uses contests to encourage citizen 

participation, engagement, and collaboration, provide information about the Department, provide ED with 

another channel to broadcast its core messages targeted at its stakeholders, and to provide customer 

service.

Under OMB M-10-13, an agency may publish one PIA to cover multiple websites or applications that are 

functionally comparable, as long as the agency’s practices are substantially similar across each website 

and application. This PIA covers all contests sponsored by ED that meet the criteria described below. ED 

will prepare a separate PIA for any contest that differs substantially, or that raises distinct privacy risks 

from those covered by this PIA. 

In order to reach potential contestants, the contest organizer may use tools such as ED’s website, e-mail, 

paper submission, and current, authorized social media websites and applications owned by ED or by a 

third party. For a definition of “social media,” and the types that may be used for contests, please see the 

PIA for Social Media websites and Applications found at

http://www2.ed.gov/notices/pia/smwa_050111.pdf.

Due to the dynamic nature of social media, this PIA will not list ED’s authorized social media websites

and applications to be used in contests. An updated list of ED’s current media presence can be found at 

http://www.ed.gov/about/overview/focus/social-media.html.

1. System Information 

Describe the system - include system name, system acronym, and a description of the system, to include 

scope, purpose and major functions. Indicate whether the system is new or existing and whether or not 

the PIA is new or being updated from a previous version; specify whether the system is “agency” or 

“contractor.”

ED may host a contest on ED’s website, a social media site or application such as Facebook, on a video 

site, such as YouTube, on a partner’s third-party website, or on any other publicly available platform. The 

Department will typically make information about the contest available to the public through multiple 

means, including through the Department’s official website, or other official means. The eligible public 

is generally provided with the opportunity to enter the contest using non-electronic means as well, unless 

the contest specifically concerns electronic communications, e.g., producing a video to be posted on You 

Tube. 

This is an agency system, and this is a new PIA.

2. Legal Authority

Cite the legal authority to collect and use this data. What specific legal authorities, arrangements, and/or 

agreements regulate the collection of information?

Under 20 U.S.C. §§ 3402(1) & (3) and 3412(e)(2), the Department has the authority to perform public 

information functions, through the use of the latest technologies, of useful information about education 

and related opportunities to conduct contests.

Additionally, the President’s Memorandum on Transparency and Open Government (January 21, 2009) 

and the Director of Office of Management and Budget’s (OMB) Open Government Directive 

Memorandum 10-06 (December 8, 2009), directs agencies to harness new technologies to engage the 

2
Privacy Impact Assessment

public and provide concrete steps to implement the system of transparency, participation, and 

collaboration. 

This Memorandum also encourages the solicitation of public feedback to identify information of the 

greatest use to the public, assess and improve levels of collaboration, and identify new opportunities for 

cooperation in government. The Directive specifically called upon executive agencies to use innovative 

methods such as prizes and challenges to obtain ideas from and to increase collaboration with those in the 

private sector, non-profit and academic communities. OMB subsequently issued “Guidance on the Use of 

Challenges and Prizes to Promote Open Government” in Memorandum 10-11 (March 8, 2010), which 

strongly encouraged agencies to “utilize prizes and challenges as tools for advancing open government, 

innovation, and the agency’s mission.”

In response to these Memoranda, ED developed its Open Government Plan: 

http://www.ed.gov/open/plan. This plan encourages public participation using web-based collaboration 

tools and will use such tools to engage the public. Accordingly, the Department uses social media 

websites or applications for external relations (such as communications, outreach, and public dialogue), 

to provide information about or from the Department, to encourage citizen participation, engagement, 

and collaboration, to provide a new channel for ED to broadcast core messages targeting the ED 

community and to provide customer service. The Department uses these tools to make information and 

services widely available, while promoting transparency and accountability. Any information about a 

contest that ED places on a social media website or application will also be made available through 

ED’s official website (www.ed.gov), or other official means, whenever possible.

3. Characterization of the Information 

What elements of personally identifiable information (PII) are collected and maintained by the system 

(e.g., name, social security number, date of birth, address, phone number)? What are the sources of 

information (e.g., student, teacher, employee, university)? How is the information collected (website, 

paper form, on-line form)? Is the information used to link or cross-reference multiple databases?

The specific information collected will vary according to the contest, but generally, the Department will 

need to collect a contestant’s first and last name, phone number, grade, school, address, city, and state, 

along with a parental consent release form if the contestant is under the age of 18, or a release form if the 

contestant is over the age of 18. Under rare circumstances, Social Security Numbers (SSNs) may also be 

collected when needed for financial transactions. 

The PII may be collected through a variety of means, including the Department’s website or third party 

websites or applications, and would be collected directly from the contestant or from the contestant’s 

parent or guardian. If SSNs are collected, they would be collected directly from the contestant, and 

through an alternate means, not the website or application. For example, the Department may need the 

SSN of a winning contestant who won prizes worth over $600. In that circumstance, the Department 

would reach out to the contestant by telephone or U.S. Mail to obtain the SSN.

The Department will review and document information from the contestants to verify eligibility based on 

the contest’s rules and guidelines. Participation is always voluntary. If a contestant is selected as a 

finalist, but will not provide the personal information required by the contest’s rules or will not sign a 

release form (which in part provides authorization for the Department’s use and disclosure of PII), the 

contestant will not be considered as a finalist or potential winner in the contest.

3
Privacy Impact Assessment

4. Why is the information collected? 

How is this information necessary to the mission of the program, or contributes to a necessary agency 

activity? Given the amount and any type of data collected, discuss the privacy risks (internally and/or 

externally) identified and how they were mitigated.

ED collects the PII for the specific purpose of conducting the contest and publicizing the award recipients 

and their entries. ED must collect PII to ensure that contestants meet the contest requirements in order to 

confirm their eligibility, to contact contestants and winners, to award any prizes, and to attract public 

attention to the program, activity, or issue of concern to which the contest relates. 

ED will collect only PII necessary to conduct the contest and to publicize the award recipients and their 

entries. ED will not usually collect sensitive PII, such as SSNs, and will only collect the minimum 

amount of PII necessary, such as voluntarily provided contact information. Under rare circumstances, 

such as when prizes are worth $600 or more, SSNs would be collected for the limited purposes of tax 

reporting. 

While there is a small risk related to collecting and maintaining this PII, the Department mitigates that 

risk by collecting only that information that is necessary for the purpose for which it was collected. ED 

also has robust security to protect the information it collects and maintains.

5. Social Security Number (SSN)

If an SSN is collected and used, describe the purpose of the collection, the type of use, and any 

disclosures. Also specify any alternatives that you considered, and why the alternative was not selected. 

If system collects SSN, the PIA will require a signature by the Assistant Secretary or designee. If no SSN 

is collected, no signature is required.

Under rare circumstances, such as when prizes were worth $600 or more, ED is obligated to report the 

taxpayers who were awarded prizes indicating the fair market value (FMV) of the prize on an IRS Form 

1099-MISC that must be given to the prize winner and to the IRS by Jan. 31 of year following the year 

in which the prize was awarded. Because the prize winner’s name, address, and Social Security number 

must be on the form, SSNs would be collected for the limited purposes of tax reporting. There is no 

alternative to the use of SSNs for tax reporting purposes. If SSNs are collected, it would only be after a 

prize was awarded, and would not be collected through the ED’s website or a third-party website or 

application, but would instead be collected directly from the contestant.

6. Uses of the Information 

What is the intended use of the information? How will the information be used? Describe all internal 

and/or external uses of the information. What types of methods are used to analyze the data? Explain 

how the information is used, if the system uses commercial information, publicly available information, or 

information from other Federal agency databases.

ED will use the PII collected to conduct the contest and publicize the award recipients and their entries. 

ED may use a minimum amount of non-sensitive PII as necessary for the proper performance of agency 

functions and which has practical utility. For example, if ED collects contact information as part of a 

contest, then ED may use the contestant’s contact information for the purposes for which it was provided, 

or any purpose compatible with the purpose for which ED collected it. Additionally, ED will collect and 

maintain such information in compliance with applicable laws and regulations.

4
Privacy Impact Assessment

The Department also may use PII that is voluntarily submitted by finalists to confirm their eligibility, 

meaning to ensure that they have complied with the contest’s eligibility requirements. The Department 

also may use PII of the contest winners to attract public attention to the program, activity, or issue of 

concern to which the contest relates.

7. Internal Sharing and Disclosure 

With which internal ED organizations will the information be shared? What information is shared? For 

what purpose is the information shared?

ED will only share the information internally with those with a need to know in order to conduct the 

contest, and to publicize the award recipients and their entries. ED will share only the minimum 

amount of PII necessary for that purpose.

8. External Sharing and Disclosure 

With what external entity will the information be shared (e.g., another agency for a specified 

programmatic purpose)? What information is shared? For what purpose is the information shared? 

How is the information shared outside of the Department? Is the sharing pursuant to a Computer 

Matching Agreement (CMA), Memorandum of Understanding or other type of approved sharing 

agreement with another agency?

ED will not share with other external entities information submitted to or collected by ED or by thirdparty media sites, except for with partners participating in the contest, and publicizing the award 

recipients and the winning entries. Under rare circumstances, such as when prizes were worth $600 or 

more, SSNs would be shared with the IRS for the limited purposes of tax reporting. When the contest 

winners have been selected, the Department will share the contest winner’s name, city, state of residence, 

and the name of the contest winner’s school with the public. No other contestants’ PII will be shared with 

the public.

9. Notice 

Is notice provided to the individual prior to collection of their information (e.g., a posted Privacy 

Notice)? What opportunities do individuals have to decline to provide information (where providing the 

information is voluntary) or to consent to particular uses of the information (other than required or 

authorized uses), and how individuals can grant consent? 

The solicitation to enter the contest will provide notice to contestants in whatever media the contest is 

advertised. The ED website and/or the third-party social media websites and applications will provide 

individuals who enter the contest with notice prominently placed on the site about what information 

will be collected and how that information will be used. If the contest is conducted using a social 

media website, consult the Privacy Impact Assessment for Social Media websites and Applications 

http://www2.ed.gov/notices/pia/smwa_050111.pdf, for additional information about Notice. 

10. Security 

What administrative, technical, and physical security safeguards are in place to protect the PII? 

Examples include: monitoring, auditing, authentication, firewalls, etc. Has a C&A been completed? Is 

the system compliant with any federal security requirements? 

If the contestants’ information is collected and retained in a physical file, the physical file will be stored 

in a locked cabinet with the U.S. Department of Education’s building. All physical access to Department 

5
Privacy Impact Assessment

sites are controlled and monitored 24/7 by security personnel who ensure that all persons entering the 

building are properly badged to enter the building. 

If the contestants’ information is retained electronically, it will be maintained on ED’s computer systems. 

The computer systems employed by ED offer a high degree of resistance to tampering and circumvention. 

The Department uses special software programs for monitoring network traffic to identify unauthorized 

attempts to upload or change information, or otherwise to cause damage to government computer 

systems. These programs collect no information that would directly identify individuals, but they do 

collect information that could help ED identify someone attempting to tamper with the website.

ED may conduct the contest using social media or another third-party website or application. ED does 

not actively seek sensitive PII and it does not collect, maintain, or disseminate sensitive PII from 

individuals who interact with its authorized social media websites and applications. In rare circumstances, 

if sensitive PII is collected for purposes described above, the PII will be collected and protected 

commensurate with the risk. 

The decision to authorize social media usage is a business decision and comes from a risk management 

process made by the management team with inputs from all stakeholders, including the Chief Information 

Officer, the Chief Information Security Officer, the Office of the General Counsel, the Chief Privacy 

Officer, the Office of Communications and Outreach, and the program owner. After a decision is made to 

authorize a social media use, the appropriate security safeguards will be implemented. 

Security safeguards for third-party sites are described within the terms of use published by the 

third-party social media public networks. External, non-Federal, organizations operate and control thirdparty social media websites and applications. ED provides clear and conspicuous notice in a prominent 

location at the point of dissemination that these third-party social media websites and applications are 

controlled and operated by a third-party and are not a Federal or agency website. For third-party websites 

where ED maintains an official presence, and where possible, ED will provide a link to ED’s privacy 

policy found at http://www2.ed.gov/notices/privacy/index.html.

11. Privacy Act System of Records

Is a system of records being created or altered under the Privacy Act, 5 U.S.C. 552a? Is this a 

Department-wide or Federal Government-wide SORN? If a SORN already exists, what is the SORN 

Number? 

ED does not currently maintain a system of records specifically for the PII collected for contests that ED 

conducts and which this PIA covers. However, if ED conducts a contest that isn’t covered by an existing 

system of records notice, one will be published in the Federal Register, as required by the Privacy Act.

12. Records Retention and Disposition 

Is there a records retention and disposition schedule approved by the National Archives and Records 

Administration (NARA) for the records created by the system development lifecycle AND for the data 

collected? If yes – provide records schedule number:

These records are currently unscheduled. Applicable records retention schedules will be identified and/or 

developed, and submitted to the NARA if required. Until the records retention determinations are 

finalized, no records will be destroyed.

6
Privacy Impact Assessment

13. Privacy Risks 

What other privacy risks exist and how does ED mitigate those risks?

To mitigate privacy risks, ED will only collect the PII necessary to conduct the contest and to attract 

public attention to the program, activity, or issue of concern to which the contest relates. Additionally, 

any PII collected will be shared internally only as discussed in Section 8 above and will be shared 

externally only as discussed in Section 9 above. For information on the privacy risks of using social 

media websites or applications, consult the Privacy Impact Assessment for Social Media websites and 

Applications: http://www2.ed.gov/notices/pia/smwa_050111.pdf.

.

7