Privacy Impact Assessment (PIA) for the 

Voluntary Student Engagement Form 

Sep 26, 2018 

This PIA was originally approved on Oct 31, 2014 and reviewed on Sep 26, 2018 by

the system owner certifying the information contained here is current and up to date. 

Contact Point 

Contact Person/Title: 

Contact Email: 

Darlene.Mayo@ed.gov 

Darlene.Mayo@ed.gov 

System Owner 

Program Office: 

Name/Title: 

Office of Communication & Outreach (OCO) 

Karen Stratman 

Please submit completed Privacy Impact Assessments to the Privacy Safeguards Division at 

privacysafeguards@ed.gov. 
Please complete this Privacy Impact Assessment (PIA) on how personally identifiable information (PII) is 

collected, stored, protected, shared, and managed electronically by your system. You may wish to consult with your 

ISSO in completing this document. If a question does not apply to your system, please answer with N/A. 

All text responses are limited to 1,500 characters. If you require more space, please contact the Privacy 

Safeguards Team. 

1. Introduction 

1.1 Describe the system including the system name, system acronym, and a brief description of the major 

functions. 

ED’s Office of Communications and Outreach (OCO), to better serve both communications efforts and recognize 

the voice of constituents served by grant programs, has developed a tool to solicit information. The Voluntary 

Student Engagement Form, or V-SEF, is used to gather data from students with whom the Secretary or other 

high-level officials interact. 

1.2 Describe the purpose for which the personally identifiable information (PII)1

 is collected, used, 

maintained or shared. 

This system is intended to provide a process or method to solicit information from students who interact with 

high- level officials in the Department of Education. By amplifying the student experiences through various 

communications and outreach means we can better inform the public. It will ultimately allow the public to better 

understand how ED programs and policies are affecting youth. It will also ensure that stakeholders who share 

their stories will receive a more standard and consistent response. 

The overall objective of this form and corresponding data would be to collect the personal narrative and contact 

information of individual students, strengthening the ‘megaphone’ component of our Department by providing a 

youthful voice to bureaucratic policy operations. 

1 The term “personally identifiable information” refers to information which can be used to distinguish or trace an individual's identity, such as their name, social security 

number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and 

place of birth, mother's maiden name, etc. https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2007/m07-16.pdf 

ED-EMV-003.01 FY 18 Page 1 of 16 
1.3 Is this a new system, or one that is currently in operation? 

Currently Operating System 

1.4 Is this PIA new, or is it updating a previous version? If this is an update, please include the 

publication date of the original. 

Updated PIA Original Publication Date: 10/31/2014 

1.5 Is the system operated by the agency or by a contractor? 

Agency 

2. Legal Authorities and Other Requirements 

If you are unsure of your legal authority, please contact your program attorney. 

2.1 What specific legal authorities and/or agreements permit and regulate the collection and use of data by 

the system? 

The U.S. Department of Education has legal authority through 20 U.S.C. Section 3412(e) (2) to perform public 

information functions, including the provision, through the use of the latest technologies, of useful information 

about education issues and related opportunities to students, parents, and communities. 

SORN 

2.2 Is the information in this system retrieved by an individual's name or personal identifier such as a 

Social Security Number or other identification? Please answer YES or NO. 

No 

ED-EMV-003.01 FY 18 Page 2 of 16 
N/A If the above answer is YES this system will need to be covered by a Privacy Act 

System of Records Notice(s) (SORN(s)).2

 Please provide the SORN name and 

number, or indicate that a SORN is in progress. 

2.2.1 

Records Management 

If you do not know your records schedule, please consult with your records liaison or send an email to 

RMHelp@ed.gov. 

2.3 Does a records retention schedule, approved by the National Archives and Records Administration 

(NARA), exist for the records contained in this system? If yes, please provide the NARA schedule 

number. 

Yes, the schedule number is ED Record Schedule 113 revised on July 15, 2010. 

The NARA disposition authority is DAA-GRS-2013-0002-0009 for GRS 4.1, Item 040. 

Records are temporary. Destroy 3 years after form is discontinued, superseded, or canceled, but longer retention 

is authorized if needed for business use. 

A System of Records Notice (SORN) is a formal notice to the public that identifies the purpose for which PII is collected, from whom and what type of PII is 

https://connected.ed.gov/om/Documents/

collected, how the PII is shared externally (routine uses), and how to access and correct any PII maintained by ED. 

SORN-Process.pdf 

ED-EMV-003.01 FY 18 Page 3 of 16 

2 
2.4 Is the PII contained in this system disposed of appropriately, and in accordance with the timelines in 

the records disposition schedule? Please answer YES or NO. 

Yes 

3. Characterization and Use of Information 

Collection 

3.1 List the specific personal information data elements (e.g., name, email, address, phone number, date 

of birth, Social Security Number, etc.) that the system collects, uses, disseminates, or maintains. 

VSEF collects basic PII and contact information including the student or guardian's name, home address 

(including city and state), email, phone number, school/organization, and a contact person for the school/ 

organization and their position. Additionally, VSEF collects student/guardian provided personal narratives which 

include, but are not limited to, lessons learned, future aspirations, and roadblocks or assistance in achieving those 

aspirations. 

3.2 Does the system collect only the minimum amount required to achieve the purpose stated in Question 

1.2? Please answer YES or NO. 

Yes 

3.3 What are the sources of information collected (e.g., individual, school, another agency, commercial 

sources, etc.)? 

The sources of information are students and/or guardians or school officials. Data will be collected electronically 

and paper-form and stored in an electronic format on the internal network of ED. 

ED-EMV-003.01 FY 18 Page 4 of 16 
3.4 How is the information collected from stated sources (paper form, web page, database, etc.)? 

Data will be collected electronically and paper-form and stored in an electronic format on the internal network of 

ED. 

3.5 How is this information validated or confirmed?3 

This information is confirmed to the extent possible using publicly available data, such as social media, website 

search, and news articles. 

Examples include form filling, account verification, etc. 

ED-EMV-003.01 FY 18 Page 5 of 16 

3 
Use 

3.6 Describe how and why the system uses the information to achieve the purpose stated in 

Question 1.2 above. 

The information provided is completely voluntary and must be completed by someone over the age of 18. If a 

youth under the age of 18 would like to submit a story or experience, it must be completed by a guardian. The 

information will be used for youth engagement purposes, such as inviting youth to a meeting with senior ED 

officials or adding them to receive our ED Youth Voices newsletter. This narrative information provided is 

intended for message development purposes. By responding to the questions the individual/guardian is providing 

consent for the responses to be used in the creation of external facing content (such as blogs, speeches, 

presentations and newsletters) that will be shared publicly along with your first name, school/organization and 

city. 

3.7 Is the project using information for testing a system or for training/research purposes? Please 

answer YES or NO. 

No 

N/A If the above answer is YES, what controls are in place to minimize the risk and 

protect the data? 

3.7.1 

ED-EMV-003.01 FY 18 Page 6 of 16 
3.8 Does the system use "live" PII for the development or testing of another system? Please answer YES 

or NO. 

No 

3.8.1 N/A If the above answer is YES, please explain.

Social Security Numbers 

It is the Department's Policy that, in order to collect Social Security Numbers, the System Owner must state 

the collection is: 1) authorized by law, 2) necessary for an agency purpose, and 3) there is no reasonable 

alternative. 

3.9 Does the system collect Social Security Numbers? Please answer YES or NO. 

No 

3.9.1 N/A If the above answer is YES, explain the purpose for its collection, and how the 

SSN will be used. *Please note if the system collects SSNs, the PIA will 

require a signature by the Assistant Secretary or equivalent.* 

ED-EMV-003.01 FY 18 Page 7 of 16 
3.10 N/A Specify any alternatives considered in the collection of SSN and why the alternatives were not

selected. 

4. Notice 

4.1 How does the system provide individuals notice about the collection of PII prior to the collection of 

information (i.e. written Privacy Act notice, link to a privacy policy, etc.)? If notice is not provided, 

explain why not. 

Students (or guardian/school official, in coordination with the student) completing the Voluntary Student 

Engagement Form receive multiple opportunities when completing V-SEF to decline to participate. Participation 

is entirely voluntary, and this is made clear in the title of the document ‘Voluntary Student Engagement Form.’ It 

has a connotation that the document in itself is non-obligatory and the student has the right to decline 

participation. 

ED-EMV-003.01 FY 18 Page 8 of 16 
4.2 N/A Provide the text of the notice, or the link to the webpage where the notice is posted.

"...Completing this form is voluntary, and your responses will be cataloged by location, subject and/or 

educational priority. This form is to be completed by persons 18 years of age or older. If the student is 17 years of 

age or younger it must be completed by a guardian..." 

4.3 What opportunities are available for individuals to consent to uses, decline to provide information, or 

opt out of the project? 

The form, states that “this information will be cataloged by location, subject and/or education priority.” This 

privacy notice at the beginning of the document, following the title that is labeled voluntary, notifies individuals 

what their collected information will be used for. 

On the form, it requests that the student check a box if contact is permissible. If the student checks said box, may 

follow up with them to further engage on this and other education issues and provide subscription to ED Youth 

Voices newsletter. If this box is not checked, ED still has consent to use the narrative they provide on the latter 

portion of the form. 

5. Information Sharing 

Internal 

5.1 Will information be shared internally with other ED organizations? Please answer YES or NO. If the 

answer is NO, please skip to Question 5.4. 

No 

ED-EMV-003.01 FY 18 Page 9 of 16 
5.2 N/A What information will be shared and with whom?

N/A What is the purpose for sharing the specified information with the specified internal organizations? 

Does this purpose align with the stated purpose in Question 1.2 above? 

5.3 

External 

5.4 Will the information contained in the system be shared with external entities (e.g. another agency, 

school district, etc.)? Please answer YES or NO. If the answer is NO, please skip to Question 5.8. 

No 

ED-EMV-003.01 FY 18 Page 10 of 16 
5.5 N/A What information will be shared and with whom? Note: If you are sharing Social Security Numbers,

externally, please specify to whom and for what purpose. 

N/A What is the purpose for sharing the specified information with the specified external organizations? 

Does this purpose align with the stated purpose in Question 1.2 above? 

5.6 

ED-EMV-003.01 FY 18 Page 11 of 16 
5.7 N/A How is the information shared and used by the external entity?

5.8 N/A Is the sharing pursuant to a Computer Matching Agreement (CMA), Memorandum of 

Understanding (MOU) or other type of approved sharing agreement with another agency? Please 

answer YES or NO. 

No 

5.9 N/A Does the project place limitation on re-disclosure? Please answer YES or NO. 

No 

6. Redress4 

6.1 What are the procedures that allow individuals to access their own information? 

Upon request, individuals can request their information by contacting the system administrator. 

If the system has a System of Records Notice (SORN), please provide a link to the SORN in Question 6.1 and proceed to Section 7 - Safeguards. 

ED-EMV-003.01 FY 18 Page 12 of 16 

4 
6.2 What procedures are in place to allow the subject individual to correct inaccurate or erroneous 

information? 

The information is provided by the individual, but there is an opportunity for individuals to correct information 

by contacting the system administrator. 

6.3 How does the project notify individuals about the procedures for correcting their information? 

The procedure would be the same for submitting a form, either contacting youth@ed.gov or the system 

administrator. 

7. Safeguards 

If you are unsure which safeguards will apply, please consult with your ISSO. 

7.1 Does the principal office work with their CSO/ISSO to build privacy & security into the system and 

build privacy extensions to the extent feasible? Please answer YES or NO. 

Yes 

ED-EMV-003.01 FY 18 Page 13 of 16 
7.2 What procedures or access controls are in place to determine which users may access the information 

and how does the project determine who has access? 

The email address that collects the Voluntary Student Engagement Form is only accessible by OCO staff who 

have a business justification. Internally, we have a locked folder where only authorized staff with a work 

justification to access the folder will be permitted. If this information is printed, it will be secured at all times, 

locked in a cabinet and the hard copy will be immediately destroyed after use. 

7.3 What administrative, technical, and physical safeguards are in place to protect the information? 

The U.S. Department of Education, like other federal agencies, has various controls and security measures in 

place to protect PII. All physical access to ED sites is controlled and monitored 24/7 by contracted security 

personnel who ensure that all persons entering the building are properly authenticated and badged to enter the 

building. 

Paper files are kept in locked file cabinets when not in use. Immediate access to these records is restricted to 

authorized staff. Authorized staff members and contractors have unique user names and passwords that must be 

used to gain access to the electronic files. A system-access protocol requires the use of a passwords meeting 

minimum character and length specifications, and that these passwords be changed on a regular basis. 

7.4 Is an Authority to Operate (ATO) required? Please answer YES or NO. 

No 

7.5 Is the system able to provide account of any disclosures made? Please answer YES or NO. 

Yes 

ED-EMV-003.01 FY 18 Page 14 of 16 
7.6 Is the information in the system appropriately secured in accordance with the IT security requirements 

and procedures as required by federal law and policy? Please answer YES or NO. 

Yes 

7.7 Has a risk assessment been conducted where appropriate security controls to protect against that risk 

been identified and implemented? Please answer YES or NO. 

No 

7.8 Please describe any monitoring, testing or evaluation conducted on a regular basis to ensure the 

controls continue to work properly at safeguarding the information. 

The Department conducts a variety of security testing activities across the enterprise as part of an overall risk 

management and continuous monitoring strategy. Some of these activities are ongoing, including infrastructure 

scans and Ongoing Security Authorization assessment testing, and some are performed as needed for major 

system changes, including ad hoc scans, Production Readiness Reviews, Security Impact Analyses, and system 

self-assessments. 

8. Auditing and Accountability 

8.1 How does the system owner ensure that the information is used in accordance with stated practices in 

this PIA? 

The system owner will share this PIA with authorized staff with a work justification to access this information. 

The system owner will meet with staff on an annual basis to ensure they are aware of the stated practices in this 

PIA. The system owner will ensure that a requesting official has a business justification to request this 

information and that they are aware of the restrictions within this PIA. The system owner will maintain a list of 

staff that request this information. 

ED-EMV-003.01 FY 18 Page 15 of 16