Privacy Impact Assessment (PIA) 

for the 

DocketScope 

October 18, 2022 

For PIA Certification Updates Only: This PIA was reviewed on Enter date by Name of reviewer 

certifying the information contained here is valid and up to date. 

Contact Point 

Contact Person/Title: Alice Yao/Information System Owner 

Contact Email: alice.yao@ed.gov 

System Owner 

Name/Title: Alice Yao/Information System Owner 

Principal Office: Office for Civil Rights 

Please submit completed Privacy Impact Assessments to the Privacy Office at 

privacysafeguards@ed.gov 

FY 2020 
 

 

 

 

 

 

 

Please complete this Privacy Impact Assessment (PIA) on how personally identifiable 

information (PII) is collected, stored, protected, shared, and managed electronically by your 

system. You may wish to consult with your ISSO in completing this document. 

If a question does not apply to your system, please answer with N/A. 

1. Introduction 

1.1. Describe the system including the name, acronym, and a brief description of the program 

or purpose for the system. 

DocketScope is a web-based platform that the U.S. Department of Education’s 

(Department) Office for Civil Rights (OCR) procured in order to assist with OCR’s 

review and analysis of public comments that were received in response to the July 2022 

Notice of Proposed Rulemaking (NPRM) published in the Federal Register, to amend 

the implementing regulations for Title IX of the Education Amendments of 1972. 

Comments are submitted by members of the public to the Federal Docket Management 

System (FDMS) (and its public-facing analog, Regulations.gov). Before submitting a 

comment, all commenters are requested not to include personally identifiable 

information (PII) in their comment and informed that their comment will be made public 

on Regulations.gov. The Department reviews submitted comments for three main 

purposes: 

• Detecting duplicate comments (i.e., comments that contain identical or nearly 

identical text, commonly seen in form letter submissions); 

• Labeling comments by issue area; and 

• Detecting and redacting third-party PII (i.e., PII about individuals other than 

the individual who submitted the comment) included within the comments. 

These functions are required for the Department to be able to post comments to 

Regulations.gov for public viewing, to review the comments, and to begin the process of 

drafting final regulations. The Department uses DocketScope to review and label 

comments by issue area only, and not for the drafting process of the final rule. Moving 

forward, the Department intends to use DocketScope for the same purposes identified 

above for future rulemakings. 

The Department requests access to the public comments from FDMS. After access has 

been provided, DocketScope downloads the public comments from FDMS, which 

Department users review through DocketScope’s website. DocketScope groups 

comments together as duplicates or near duplicates by detecting similarities between 

comments, and Department users would view these groups as a redline comparison to 

show differences between comments to expedite their review. The ability to review 

Fiscal Year 2020 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

duplicate documents in groups facilitates compliance with the requirements of the 

Administrative Procedure Act, which requires that final regulations respond to all 

substantive issues raised in public comments on proposed regulations. 

All comments are also labeled by issue area. Once comments are labeled by issue area, 

the text of the comments are compiled into reports for each issue area, which 

Department users will request and download from DocketScope. These reports will be 

used by the Department to draft summaries of the comments relevant to a particular 

issue area for the preamble to the final regulations. The summarization of the comments 

does not occur within DocketScope. The Department only uses DocketScope to review 

and label comments by issue area, and not for the drafting process for the final 

regulations. 

Once the final rule has been drafted, comments will be removed from DocketScope and 

will be retained internally within the Department for five years after publication of the 

final rule, in accordance with the Records Retention schedule. While providing the 

service to the Department, DocketScope may have access to data as part of the 

administration for the system. 

In addition, Department users manually review every comment to detect third-party PII. 

Any comment that contains third-party PII is redacted in FDMS before it is posted on 

Regulations.gov for public viewing. 

1.2. Describe the purpose for which the personally identifiable information (PII)1 is collected, 

used, maintained or shared. 

Comments are provided by the public in response to proposed rulemakings published in 

the Federal Register. DocketScope may collect PII on individuals that is provided as part 

of the comment submission process for proposed rulemakings. Commenters may 

voluntarily include PII such as name, city, and State when submitting their comments. 

The Department reviews comments received from the public, and the substantive issues 

raised in those comments, when drafting of the final regulations. Information, to include 

PII, associated with the comment are used to detect duplicate comments or label 

comments by issue area. 

1.3. Is this a new system, or one that is currently in operation? 

1 The term “personally identifiable information” refers to information which can be used to distinguish or trace an 

individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined 

with other personal or identifying information which is linked or linkable to a specific individual, such as date and 

place of birth, mother's maiden name, etc. OMB Circular A-130, page 33 

Fiscal Year 2020 Privacy Impact Assessment -Page 2 
 

 

 

 

 

 

 

 

 

 

 

New System 

1.4. Is this PIA new, or is it updating a previous version? 

New PIA 

1.5. Is the system operated by the agency or by a contractor? 

Contractor 

1.5.1. If the system is operated by a contractor, does the contract or other acquisitionrelated documents include privacy requirements? 

N/A

Yes 

2. Legal Authorities and Other Requirements 

If you are unsure of your legal authority, please contact your program attorney. 

2.1. What specific legal authorities and/or agreements permit and regulate the collection and 

use of data by the system? Please include name and citation of the authority. 

When the Department decides to engage in rulemaking, the Administrative Procedure 

Act (APA), Pub.L. 79–404, 60 Stat. 237, requires the Department to issue proposed 

regulations for public comment and the Department is required to address all substantive 

issues raised in those comments. 

SORN 

2.2. Is the information in this system retrieved by an individual’s name or personal identifier 

such as a Social Security Number or other identification? 

No 

2.2.1. If the above answer is YES, this system will need to be covered by Privacy Act 

System of Records Notice(s) (SORN(s)).2

 Please provide the SORN name, number, 

Federal Register citation and link, or indicate that a SORN is in progress. 

N/A

2 A System of Records Notice (SORN) is a formal notice to the public that identifies the purpose for which PII is 

collected, from whom and what type of PII is collected, how the PII is shared externally (routine uses), and how to 

access and correct any PII maintained by ED. https://connected.ed.gov/om/Documents/SORN-Process.pdf 

Fiscal Year 2020 Privacy Impact Assessment -Page 3 
 

 

 

 

 

2.2.2. If the above answer is NO, explain why a SORN was not necessary. For 

example, the information is not retrieved by an identifier, the information is not 

maintained in a system of records, or the information is not maintained by the 

Department, etc. 

N/A

Commenters may, but are not required to, provide their names. Comments are 

retrieved by tracking numbers generated by the FDMS/Regulations.gov system. 

These numbers are associated with comments and not particular individuals. 

Records Management 

If you do not know your records schedule, please consult with your records liaison or send 

an email to RMHelp@ed.gov 

2.3. What is the records retention schedule approved by National Archives and Records 

Administration (NARA) for the records contained in this system? Please provide all 

relevant NARA schedule numbers and disposition instructions. 

The records maintained or transmitted through DocketScope fall under the following 

records schedule: 

• Department of Education Retention Schedule 253 (NARA #N1-441-09-004) 

Rulemaking Case Files, item c. Notices of Proposed Rulemaking, Public 

Comments, and Negotiated Rulemaking Records. Disposition: Temporary. Cut 

off annually upon publication of final rule. Destroy/delete 5 years after 

publication. 

2.4. Is the PII contained in this system disposed of appropriately, and in accordance with the 

timelines in the records disposition schedule? 

Yes 

3. Characterization and Use of Information 

Collection 

3.1. List the specific PII elements (e.g., name, email, address, phone number, date of birth, 

Social Security, etc.) that the system collects, uses, disseminates, or maintains. 

Commenters may voluntarily provide their name, address, phone number, email address, 

organization name, representative name (if comment is submitted by someone other than 

Fiscal Year 2020 Privacy Impact Assessment -Page 4 
 

 

 

 

 

 

 

 

 

commenter or on behalf of an organization), or government agency. Commenters are 

advised to remain anonymous if they do not wish to share this information. 

Department employees and contractors provide name, organization, email address, 

username, password, and phone number (optional) to access the DocketScope system. 

3.2. Does the system collect only the minimum amount required to achieve the purpose 

stated in Question 1.2? 

Yes 

DocketScope may collect PII on individuals when the individuals provide PII as part of 

the comment submission process for proposed rulemakings that are published in the 

Federal Register. Commenters have the option to provide PII, but PII is not required in 

order to submit a comment. Information, to include PII, associated with the comment 

are used to further detect duplicate comments or label comments by issue area. 

3.3. What are the sources of PII collected (e.g., individual, school, another agency, 

commercial sources, etc.)? 

Commenters are individuals, organizations, or government agencies. All information is 

provided voluntarily at the commenter’s discretion. Administrators of the system are 

Department employees and/or contractors. 

3.4. How is the PII collected from the stated sources listed in Question 3.3 (e.g., paper form, 

web page, database, etc.)? 

Commenters submit both their comment and PII through the Regulations.gov website. 

Department employees and contractors provide their information through DocketScope. 

3.5. How is the PII validated or confirmed to ensure the integrity of the information 

collected?3 Is there a frequency at which there are continuous checks to ensure the PII 

remains valid and accurate? 

Comments and/or PII submitted by members of the public or organizations in response 

to rulemaking or notices published in the Federal Register are not verified for accuracy. 

3 Examples include restricted form filling, account verification, editing and validating information as it’s collected, 

and communication with the individual whose information it is. 

Fiscal Year 2020 Privacy Impact Assessment -Page 5 
 

 

 

 

 

 

 

Use 

3.6. Describe how the PII is used to achieve the purpose stated in Question 1.2 above. 

The Department is required to address all substantive issues raised in the public 

comments for NPRMs published in the Federal Register, regardless of the submitter and 

any PII provided in the comment. 

3.7. Is the system using PII for testing/researching new applications or information systems 

prior to deployment or for training employees? 

No 

3.7.1. If the above answer is YES, what controls are in place to minimize the risk and 

protect the data? 

N/A

Social Security Numbers 

It is the Department’s Policy that, in order to collect Social Security Numbers, the System Owner 

must state the collection is: 1) authorized by law, 2) necessary for an agency purpose, and 3) 

there is no reasonable alternative. 

3.8. Does the system collect Social Security Numbers? Note that if the system maintains 

Social Security Numbers but does not explicitly collect them, answer 3.8.1 to address the 

purpose for maintaining them. 

No 

3.8.1. If the above answer is YES, explain the purpose for its collection, and how the 

SSN will be used. 

N/A

3.8.2. Specify any alternatives considered in the collection of SSNs and why the 

alternatives were not selected. 

N/A

4. Notice 

4.1. How does the system provide individuals with notice about the collection of PII prior to 

its collection (e.g., direct notice, such as a Privacy Act Statement (if applicable) or 

public notice, such as a SORN, PIA,)? If notice is not provided, explain why not. 

Fiscal Year 2020 Privacy Impact Assessment -Page 6 
 

 

 

 

 

 

 

 

 

Before submitting a comment, all commenters are informed on the Regulations.gov 

website that their comment will be publicly available. The Regulations.gov user notice 

states the following: “The material you submit to a Federal department or agency 

through Regulations.gov may be seen by various people. Any personal information 

included in the comment form or in an attachment will be provided to the department or 

agency to which your comment is directed and may be publicly disclosed in a docket or 

on the Internet (via Regulations.gov, a federal agency website, or a third-party, nongovernment website with access to publicly disclosed data on Regulations.gov).” 

The Title IX NPRM (see link in question 4.2) also included the following language: 

“The Department's policy is to generally make comments received from members of the 

public available for public viewing on the Federal eRulemaking Portal at 

http://www.regulations.gov. Therefore, commenters should include in their comments 

only information about themselves that they wish to make publicly available.” 

4.2. Provide the text of the notice or the link to the webpage where the notice is posted if 

notice is provided other than by SORN or PIA. 

N/A

Title IX NPRM - https://www.federalregister.gov/documents/2022/07/12/2022-

13734/nondiscrimination-on-the-basis-of-sex-in-education-programs-or-activitiesreceiving-federal 

Regulations.gov User Notice - https://www.regulations.gov/user-notice 

4.3. What opportunities are available for individuals to consent to uses (including new uses 

of previously collected PII), decline to provide PII, or opt out of the project? 

Submitting comments in response to Departmental rulemaking or Federal Register 

notices are completely voluntary. The Regulations.gov website does not require PII from 

an individual unless they voluntarily choose to provide it. Individual members of the 

public voluntarily submitting comments have control over the inclusion of PII provided 

when commenting on a notice. Individuals are provided notice on the Regulations.gov 

website and in published Federal Register notices that comments received may be 

viewed by the public, and individuals may choose not to submit any information they do 

not want to have made public. 

Fiscal Year 2020 Privacy Impact Assessment -Page 7 
 

 

 

4.4. Is the notice referenced in Question 4.1 reviewed and revised when there are changes in 

the practice, policy, or activities that affect the PII and privacy to ensure that individuals 

are aware of and can consent to, where feasible, these changes? 

Yes 

5. Information Sharing and Disclosures 

Internal 

5.1. Will PII be shared internally with other ED principal offices? If the answer is NO, please 

skip to Question 5.4. 

Yes 

5.2. What PII will be shared and with whom? 

N/A

The Department may share comments internally with Department principal offices (e.g., 

Office of General Counsel (OGC)) upon request from the authorized Department staff 

and in connection with their review of the final regulations during the drafting process. 

Because the comments are also publicly available on Regulations.gov, authorized 

personnel from other Department principal offices may also choose to access the 

information themselves as opposed to requesting it from OCR. 

5.3. What is the purpose for sharing the specified PII with the specified internal 

organizations? 

N/A

See the response for question 5.2. 

External 

5.4. Will the PII contained in the system be shared with external entities (e.g., another 

agency, school district, the public, etc.)? If the answer is NO, please skip to Question 

6.1. 

Yes 

Fiscal Year 2020 Privacy Impact Assessment -Page 8 
 

 

 

 

 

 

 

5.5. What PII will be shared and with whom? List programmatic disclosures only.

4 

Note: If you are sharing Social Security Numbers externally, please specify to 

whom and for what purpose. 

N/A

The Department will share the comments with: 

• the General Services Administration (GSA), as part of the administration of 

FDMS. 

• the public on the Regulations.gov website. 

5.6. What is the purpose for sharing the PII with the specified external entities? 

N/A

The Department’s policy is to generally make comments received from members of the 

public available for viewing on Regulations.gov. The Department redacts PII on third 

parties submitted as part of a public comment. 

5.7. Is the sharing with the external entities authorized? 

N/A

Yes 

5.8. Is the system able to provide and retain an account of any disclosures made and make it 

available upon request? 

N/A

No 

5.9. How is the PII shared with the external entity (e.g., email, computer match, encrypted 

line, etc.)? 

N/A

Comments are shared between DocketScope and FDMS through an encrypted tunnel. 

Comments received from members of the public are available for public viewing on 

Regulations.gov. 

4 If this information is covered by Privacy Act System of Records Notice (SORN) please list only relevant 

programmatic disclosures listed under the Routine Uses section. 

Fiscal Year 2020 Privacy Impact Assessment -Page 9 
 

 

 

 

 

 

 

5.10. Is the sharing pursuant to a Computer Matching Agreement (CMA), 

Memorandum of Understanding (MOU), or other type of approved sharing agreement 

with another agency? 

N/A

Yes 

5.11. Does the project place limitation on re-disclosure? 

N/A

No 

6. Redress 

6.1. What are the procedures that allow individuals to access their own information? 

Once comments are reviewed and third-party PII redacted, comments are posted to 

Regulations.gov, a public website where any member of the public may access them. 

6.2. What procedures are in place to allow the subject individual to correct inaccurate or 

erroneous information? 

A member of the public could contact OCR via email or telephone for assistance with 

such revision. There is Department contact information located within the Title IX 

NPRM where the public are directed for any questions or issues they may have. 

6.3. How does the project notify individuals about the procedures for correcting their 

information? 

There is Department contact information located within the Title IX NPRM where the 

public are directed for any questions or issues they may have. In addition, this PIA 

notifies individuals about the procedures for correcting their information. 

7. Safeguards 

If you are unsure which safeguards will apply, please consult with your ISSO. 

7.1. Does the principal office work with their CSO/ISSO to build privacy & security into the 

system and build privacy extensions to the extent feasible? 

Yes 

7.2. Is an Authorization to Operate (ATO) required? 

Fiscal Year 2020 Privacy Impact Assessment -Page 10 
 

 

 

 

 

 

 

 

 

 

Yes 

7.3. Under NIST FIPS Pub. 199, what is the security categorization of the system: Low, 

Moderate, or High? 

N/A

Low 

7.4. What administrative, technical, and physical safeguards are in place to protect the 

information? 

DocketScope is hosted on the AWS Government cloud computing platform. Use of 

DocketScope is limited to only that information which members of the public and 

organizations who submitted public comments provided with the knowledge and 

warning that it would be made public. 

Access to the system is limited to authorized Department users responsible for reviewing 

comments. Authorized personnel include Department employees and contractors. The 

system limits data access to Department employees and contractors on a “need to know” 

basis and controls individual users’ ability to access and alter records within the system. 

Department employees and contractors are also required to complete security and 

privacy awareness training on an annual basis. 

The DocketScope Information System Owner (ISO) is responsible for daily operational 

oversight and management of the system’s security and privacy controls and ensuring to 

the greatest possible extent that the data are properly managed and that all access to the 

data has been granted in a secure and auditable manner. The DocketScope ISO is 

responsible for ensuring that any loss, compromise, unauthorized access or disclosure of 

PII is reported to the Department’s Office of the Chief Information Officer (OCIO), the 

Student Privacy Policy Office (SPPO), and the appropriate Department officials in 

accordance with Federal policy and established Department procedures. 

7.5. Is the information in the system appropriately secured in accordance with the IT 

security requirements and procedures as required by Federal law and policy? 

Yes 

7.6. Has a risk assessment been conducted where appropriate security controls to protect 

against that risk have been identified and implemented? 

Fiscal Year 2020 Privacy Impact Assessment -Page 11 
 

 

 

 

Yes 

7.7. Please describe any monitoring, testing or evaluation conducted on a regular basis to 

ensure the security controls continue to work properly at safeguarding the PII. 

DocketScope will be entered into the Department’s Cyber Security Assessment and 

Management (CSAM) system. The CSAM system is the cybersecurity tool requiring 

monitoring, testing, and compliance to DHS, OMB, and Department cybersecurity 

mandates on a continuous basis. DocketScope is required to obtain and maintain an 

Authorization to Operate (ATO). This process includes a tri-annual independent 

assessment of all required security and privacy controls and produces Plans of Actions 

and Milestones (POA&Ms) to ensure any deficiencies are remediated. 

8. Auditing and Accountability 

8.1. How does the system owner assess and ensure that the PII is used in accordance with 

stated practices in this PIA? 

Department employees and contractors are provided security and privacy awareness and 

training as indicated in section 7.4. They are made aware that the PII contained within 

DocketScope is for collection and maintenance and not to be distributed, exported, or 

printed. In addition, Department employees and contractors sign rules of behavior 

regarding their use of information contained in Department systems. 

8.2. Does the system owner continuously monitor and audit the privacy controls to ensure 

effective implementation? 

Yes 

8.3. What are the privacy risks associated with this system and how are those risks 

mitigated? 

Privacy risks associated with DocketScope include sensitive or third-party PII being 

submitted by a public commenter as part of a comment. Public comments submitted 

through Regulations.gov are available to the public and may be viewed and searched by 

any person or organization. Members of the public voluntarily submit comments on 

Federal Register rulemaking activities or notices and have control over the personal 

information provided through their comments. Notice is provided on Regulations.gov 

and in published Federal Register notices that comments received may be viewed by the 

public, and individuals may choose not to submit any information they do not want to 

provide. 

Fiscal Year 2020 Privacy Impact Assessment -Page 12 
 

 

The risks are mitigated by the above-mentioned safeguards, limiting access to only those 

with a legitimate need to know, and working closely with the security and privacy staff 

at the Department. To further mitigate these risks, the following safeguards have been 

implemented: 

• Collecting the minimum PII necessary to achieve the system’s purpose. 

• Department users manually review every comment to detect third-party PII 

within DocketScope. Any comment that contains third-party PII is redacted in 

FDMS before it is posted on Regulations.gov for public consumption. 

• Access is granted to only those individuals that are authorized and is controlled 

with username and password. 

• System and data/information integrity are maintained through the period in 

which reviews are being conducted. 

Fiscal Year 2020 Privacy Impact Assessment -Page 13