Privacy Impact Assessment (PIA)

for the 

Department of Education Federal

Docket Management System (EDFDMS)

Contact Point

Hilary Malawer

202-401-6148

System Owner

Hilary Malawer

Author

Levon Schlichter

Office of the General Counsel

Reviewing Official

Kathleen Styles

Chief Privacy Officer

U.S. Department of Education 

Please submit completed Privacy Impact Assessments to the Privacy Safeguards Division at 

privacysafeguards@ed.gov. 
2 

Please complete this Privacy Impact Assessment (PIA) on how information in identifiable form 

is collected, stored, protected, shared, and managed electronically by your system. You may wish 

to consult with your ISSO in completing this document. If a question does not apply to your 

system please answer with N/A.

Introduction

1.1. Describe the system including the system name, system acronym, and a brief description 

of the major functions. 

The Department of Education Federal Docket Management System (EDFDMS) provides 

the public a central online location to search, view, download, and comment on Federal 

rulemaking documents. Information collected for this system is as follows: First name, 

last name, category (such as parent/relative, student, teacher, local educational agency, or 

lender), city, country, State or province, email address, organization name, submitter’s 

representative, government agency type, government agency, additional information 

provided in the ‘‘General Comments’’ section, and other supporting documentation 

furnished by the submitter. 

1.2. Describe the purpose for which the personally identifiable information (PII)1 is 

collected, used, maintained, or shared. 

Information is being collected on individuals who voluntarily provide individually 

identifying information when submitting a public comment or supporting materials in 

response to a Department rulemaking document or notice in the Federal Docket 

Management System (FDMS). 

1.3. Is this a new system, or one that is currently in operation? 

This system is currently in operation. 

1.4. Is this PIA new, or is it updating a previous version? If this is an update, please include 

the publication date of the original 

This is updating the PIA published November 27, 2007. 

 

1 The term “personally identifiable information” refers to information which can be used to distinguish or trace an

individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined

with other personal or identifying information which is linked or linkable to a specific individual, such as date and

place of birth, mother’s maiden name, etc. 

https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2007/m07-16.pdf 
3 

1.5. Is the system operated by the agency or by a contractor?

This system is operated by the agency.

2. Legal Authorities and Other Requirements

If you are unsure of your legal authority, please contact your program attorney.

2.1. What specific legal authorities and/or agreements permit and regulate the collection and 

use of data by the system? 

The system is maintained under the authority of Section 206(d) of the E-Government Act 

of 2002 (Pub. L. 107–347, 44 U.S.C. 3501 note); 20 U.S.C. 3474; 20 U.S.C. 1221e-3; 5 

U.S.C. 301; and 5 U.S.C. 553. 

2.2. Is the information in this system retrieved by name or personal identifier? If so this 

system will need to be covered by a Privacy Act System of Records Notice(s) 

(SORN(s))2

? If no, explain why not. If yes, provide the SORN name and number, or 

indicate that a SORN is in progress.

Registered users will have accounts that are managed by the access control lists that are 

password protected. Search functions allow public (non-registered) users to search for 

information that is part of the publicly available set of information. The Department of 

Education Federal Docket Management System (EDFDMS) (18-09-05) Privacy Act 

System of Records Notice published May 3, 2017 (82 FR 20597). 

Records Management

If you do not know your records schedule, please consult with your records liaison or 

RMHelp@ed.gov. 

2.3. Does a records retention schedule, approved by National Archives and Records 

Administration (NARA), exist for the records contained in this system? If yes, please 

provide the NARA schedule number. 

Records contained in this system are covered by NARA approved records schedule 

disposition authority N1-441-09-4-1e. 

 

2 A System of Records Notice (SORN) is a formal notice to the public that identifies the purpose for which PII is 

collected, from whom and what type of PII is collected, how the PII is shared externally (routine uses), and how to 

access and correct any PII maintained by ED. https://connected.ed.gov/om/Documents/SORN-Process.pdf 
4 

2.4. Is the PII contained in this system disposed of appropriately, and in accordance with the 

timelines in the records disposition schedule? 

The records in this system will be retained and disposed of in accordance with the 

Department’s Record Schedule ED 253 – Rulemaking Case Files. Under ED 253 part 

C, Notices of Proposed Rulemaking, Public Comments, and Negotiated Rulemaking 

Records, records are temporary. The date to start the clock for record-keeping purposes 

is December 31 of the year in which the final rule was published. Records in this 

system will be destroyed/deleted five years after publication.

3. Characterization and Use of Information

Collection

3.1. List the specific personal information data elements (e.g. name, email, address, phone 

number, date of birth, Social Security Number, etc.) that the system collects, uses, 

disseminates, or maintains.

The system collects the name and email address of the commenter, although anyone who 

prefers to submit a comment without providing this personal information has that option. 

3.2. Does the system collect only the minimum amount required to achieve the purpose 

stated in Question 1.2 

Yes.

3.3. What are the sources of information collected (e.g., individual, school, another agency, 

commercial sources, etc.), how is the information collected from stated sources (paper 

form, webpage, database, etc.), and how is this information validated or confirmed?3

Anyone from the public can submit a comment through this system but the most common 

sources of information are parents, educational organizations, and local and state 

governments. The comments are typically submitted through a webpage but there is the 

option to mail in a comment that would then be uploaded into the system. The 

information is not confirmed or validated. We are transparent about the fact that this is 

voluntarily submitted information for which we do not certify the veracity. However, 

anyone can amend their personal information contained in the system by contacting the 

system manager. 

3.4. Describe how and why the system uses the information to achieve the purpose stated in 

Question 1.2 above

 

3 Examples include form filling, account verification, etc.
5 

Personal information is entered into the system voluntarily by the commenter for the 

purpose of identifying the source of the public comment. 

3.5. Does the system collect Social Security Numbers? If so, explain the purpose of its 

collection, type of use, and any disclosures. *Please note if the system collects SSN, the 

PIA will require a signature by the Assistant Secretary or equivalent.* 

No.

3.6. Specify any alternatives considered in the collection of SSN and why the alternatives 

were not selected.

N/A

4. Notice

4.1. How does the system provide individuals notice about the collection of PII prior to the 

collection of information (i.e. written Privacy Act notice, link to a privacy policy, etc.)? 

If notice is not provided, explain why not. 

There is a written Privacy Act notice published in the Federal Register on May 3, 2017 

(82 FR 20597). In addition, whenever ED seeks public comment, it provides an 

explanation to the public that the information voluntarily submitted to the system will be 

made publicly available. Lastly, a privacy notice is provided on regulations.gov each 

time a member of the public uses the website to submit a comment.

4.2. Provide the text of the notice, or the link to the webpage where notice is posted. 

https://www.gpo.gov/fdsys/pkg/FR-2017-05-03/pdf/2017-08950.pdf. 

4.3. What opportunities are available for individuals to consent to uses, decline to provide 

information, or opt out of the project? 

Individuals may submit a comment anonymously and, thus, decline to provide personal 

information as part of their public comment. 

5. Information Sharing

Internal

5.1. Will information be shared internally with other ED organizations, if so, which ones? 
6 

The personal information provided voluntarily by the commenter (i.e. the commenter’s 

name) is publicly available but it is also shared among a number of ED offices. 

5.2. What information will be shared and with whom? 

The substance of the comment is primarily shared but in many cases personal information 

identifying the commenter is also shared (if it was provided voluntarily by the 

commenter).

5.3. What is the purpose for sharing the specified information with the specified internal 

organizations? Does this purpose align with the stated purpose in Question 1.2 above? 

The personal information is shared as a byproduct of reviewing and analyzing public 

comments as part of the statutorily required rulemaking process.

External

5.4. Will the information contained in the system be shared with external entities (e.g. 

another agency, school district, etc.)?

Yes. The personal information is made publicly available on regulations.gov website (if 

it was voluntarily provided by the commenter) and is available to any external entity that 

wishes to review the rulemaking record on the Internet. 

5.5. What information will be shared and with whom? 

The public comments are shared to all interested parties through the Internet, including 

the personal information of the commenter (if the commenter voluntarily provided this 

information). 

5.6. What is the purpose for sharing the specified information with the specified external 

entity? Does this purpose align with the stated purpose in Question 1.2 above? 

The Department is obligated under statute to make public comments (including personal 

information when voluntarily provided by the commenter) publicly available on the 

Internet to promote public participation in our rulemaking processes and this purpose is 

consistent with the purpose of the system. 

5.7. How is the information accessed and used by the external entity?
7 

The information, including the personal information, is accessed through regulations.gov 

primarily for the purpose of reviewing the rulemaking record. 

5.8. If the project is using the information for testing a system or for training/research 

purposes, what controls are in place to minimize the risk and protect the data? 

N/A

5.9. Does the system use “live” PII for the development or testing of another system? If so, 

please explain.

N/A

5.10. Is the sharing pursuant to a Computer Matching Agreement (CMA), Memorandum of 

Understanding (MOU) or other type of approved sharing agreement with another agency? 

N/A

5.11. Does the project place limitations on re-disclosure? 

No because the public comment, including the personal information of the commenter (if 

voluntarily provided by the commenter), is publicly available information. 

6. Redress4

6.1. What are the procedures that allow individuals to access their own information?

An individual may search regulations.gov for their information. An individual may also 

inquire whether a record with their personal information exists in the system by 

contacting the system manager.

6.2. What procedures are in place to allow the subject individual to correct inaccurate or 

erroneous information? 

An individual can amend inaccurate personal information in the system by contacting the 

system manager.

6.3. How does the project notify individuals about the procedures for correcting their 

information? 

 

4 If the system has a System of Records Notice (SORN), please provide a link to the SORN in Question 6.1 and 

proceed onto Section 7. Safeguards.
8 

Information on how to correct an individual’s personal information in the system is 

available in ED’s SORN at https://www.gpo.gov/fdsys/pkg/FR-2017-05-03/pdf/2017-

08950.pdf. 

7. Safeguards

If you are unsure which safeguards will apply, please consult with your ISSO

7.1. Does the principal office work with their CSO/ISSO to build privacy & security into the 

system and build privacy extensions to the extent feasible? 

Yes. The managing partner, the Environmental Protection Agency, takes the lead on this 

but ED reviews the privacy and security measures to ensure compliance with applicable 

ED regulations and protocols. 

7.2. What procedures are in place to determine which users may access the information and 

how does the project determine who has access? 

Access to electronic and paper EDFDMS records that are not otherwise available to the 

public through FDMS is limited to those Department and contract staff who require the 

records to perform their official duties consistent with the purposes for which the 

information was collected. Personnel whose official duties require access to either 

electronic or written EDFDMS records that are not otherwise available to the public 

through FDMS are trained in the proper safeguarding and use of the information. 

7.3. What administrative, technical, and physical safeguards are in place to protect the 

information? 

Access to electronic and paper EDFDMS records that are not otherwise available to the 

public through FDMS is limited to those Department and contract staff who require the 

records to perform their official duties consistent with the purposes for which the 

information was collected. Personnel whose official duties require access to either 

electronic or written EDFDMS records that are not otherwise available to the public 

through FDMS are trained in the proper safeguarding and use of the information. 

7.4. Is an Authority to Operate (ATO) required? Has one been granted?

An ATO is required and one has been granted. 

7.5. Is the system able to provide an accounting of disclosures? 
9 

Generally, the system does not collect private information that needs to be accounted for. In 

the unlikely event that there is a disclosure that requires an accounting, we will keep an 

accurate accounting. 

8. Auditing and Accountability

8.1. How does the system owner ensure that the information is used in accordance with 

stated practices in this PIA?

Before the comment is made publicly available, only the small team of people working 

directly on analyzing and responding to public comments has access to the comments 

through the system. 

8.2. What are the privacy risks associated with this system and how are those risks 

mitigated?

There is a risk that a commenter could provide PII about a third party without the consent 

of the third party. To protect against this risk, ED staff review the public comments 

closely before making them publicly available and we may redact this information. 
10 

Official Signatures

Date

Date

FOR SYSTEMS THAT COLLECT, MAINTAIN AND OR TRANSFER SSNS: 

Date

Date

Senior Program Official

Computer Security Officer/Information System 

Security Officer

Assistant Secretary or equivalent or designee 

Kathleen Styles, Chief Privacy Officer