Privacy Impact Assessment

For

Office of Non-Public Education (ONPE) and Military Affairs Team (MAT) 1

Constituent Inquiry Log (CIL) and Database

Date:

September 24, 2015

Point of Contact: Isadora Binder

System Owner: Maureen Dowling

Author: Isadora Binder

Office of Innovation and Improvement

U.S. Department of Education

1 Note that the MAT CIL and databases perform the same functions and meet the same requirements as those for 

the ONPE CIL and database. The primary difference is that the MAT serves military-connected stakeholders and 

ONPE serves a nonpublic school constituency. 

Office of Management Privacy Safeguards Division

 
Privacy Impact Assessment

1. System Information. Describe the system - include system name, system acronym, and 

a description of the system, to include scope, purpose and major functions. Indicate 

whether the system is new or existing, and whether or not the PIA is new or being 

updated from a previous version; specify whether the system is ‘agency’ or ‘contractor.

ONPE CIL

ED’s Office of Non-Public Education (ONPE) is updating its Constituent Inquiry Log (CIL) 

in Microsoft Access for team (only) use. The CIL serves as a searchable information 

repository of inquiries and their responses for staff knowledge management, a tool for

staff to track their own individual progress on inquiry closeout, and a source to inform 

staff on inquiry trends that require technical assistance. 

The current CIL catalogs the following categories: Contact type, assigned to, category, 

subcategory, inquiry subject, initial notes, affiliation, interested party, date of receipt, 

date of final resolution, city/county, states/territories, and response. 

The updated CIL enables staff to add attachments—including inquiries, responses, and 

associated documents—as searchable resources as well as track employee progress on 

inquiry closeouts. Also, staff can enter organization name, point of contact, email, and 

telephone number to manage inquiry closeout. Staff accesses this information in the CIL 

by doing a search for organizations or outstanding inquiries and reviewing such entries. 

In addition, staff may run reports to inform technical assistance efforts.

ONPE Database

ONPE maintains a contact list in Microsoft Access for team (only) use to efficiently and 

effectively contact stakeholders and distribute information regarding ED grants, 

programs, initiatives, policies, and events such as the annual Private School Leadership 

Conference to ONPE constituents. ONPE adds contacts as new relationships develop or

when personnel change at organizations listed in the database. 

In general stakeholders provide contact information (business cards, for example) at 

meetings/events or by email or their contact information is in the public domain. 

Constituents include, but are not limited to, associations, government agencies, leaders 

of organizations, school personnel, and parents. The current database includes the 

following categories: Name, job title, other role, telephone number, email, organization, 

organization website, organization acronym, pertinent notes and address. 

2 
Privacy Impact Assessment

2. Legal Authority. Cite the legal authority to collect and use this data. What specific 

legal authorities, arrangements, and/or agreements regulate the collection of 

information?

ONPE CIL

The Congress declared that the establishment of a Department of Education is in the 

public interest to encourage increased involvement of the public, parents, and students 

in federal education programs per 20 U.S.C. 3402 (3). Communication and outreach are 

essential to encouraging involvement in federal education programs. ONPE’s data 

collection informs its communication and outreach efforts. ED has authority through 20 

U.S.C. Section 3412(e) (2) to perform public information functions and disseminate 

useful information about education issues and related opportunities to students, 

parents, and communities through the use of the latest technologies. This is an 

inherently governmental function. According to the OMB Circular number A-130 Revised 

government information is seen as a “national resource.”

ONPE Database

The Congress declared that the establishment of a Department of Education is in the 

public interest to encourage increased involvement of the public, parents, and students 

in federal education programs per 20 U.S.C. 3402 (3). Communication and outreach are 

essential to encouraging involvement in federal education programs. ONPE’s data 

collection informs its communication and outreach efforts. ED has authority through 20 

U.S.C. Section 3412(e) (2) to perform public information functions and disseminate 

useful information about education issues and related opportunities to students, 

parents, and communities through the use of the latest technologies. This is an 

inherently governmental function. According to the OMB Circular number A-130 Revised 

government information is seen as a “national resource.” 

3. Characterization of the Information. What elements of personally identifiable 

information (PII) are collected and maintained by the system (e.g., name, social 

security number, date of birth, address, phone number)? What are the sources of 

information (e.g., student, teacher, employee, university)? How is the information 

collected (website, paper form, on-line form)? Is the information used to link or crossreference multiple databases?

ONPE CIL

Staff may enter the following personally identifiable information, to the extent 

provided, in the CIL: Organization name, point of contact, email, and telephone number. 

Staff collects this information from constituents’ emails and telephone voicemails.

Constituents include, but are not limited to, associations, government agencies, leaders 

3 
Privacy Impact Assessment

of organizations, school personnel, and parents. The information is not used to link or 

cross-reference multiple databases.

ONPE Database

The database includes the following personally identifiable information: Organization, 

name, telephone number, email, and address. ONPE adds contacts as new relationships 

develop or when personnel change at organizations listed in the database. In general 

stakeholders provide contact information (business cards, for example) at 

meetings/events or by email or their contact information is in the public domain. 

Constituents include, but are not limited to associations, government agencies, leaders 

of organizations, school personnel, and parents. The information is not used to link or 

cross-reference multiple databases.

4. Why is the information collected? How is this information necessary to the mission of 

the program, or contributes to a necessary agency activity? Given the amount and any 

type of data collected, discuss the privacy risks (internally and/or externally) identified 

and how they were mitigated.

ONPE CIL

ONPE requires a tool to inform current and new staff of responses to inquiries for the 

purpose of knowledge management, to help staff manage their individual progress on 

inquiry closeout, and to track trends to inform technical assistance. This information 

allows ONPE to build internal knowledge and capacity to address inquiries, help make 

the inquiry response process more efficient, and guide the outreach activities so that 

ONPE can serve its customers effectively. Although there is a small privacy risk in 

collecting this data compared to not collecting it, this risk has been properly mitigated 

with security and data handling measures as discussed below.

ONPE Database

As the Department’s liaison to the nonpublic school community, ONPE requires a 

contact list to contact stakeholders and distribute information regarding ED grants, 

programs, initiatives, or policies to constituents efficiently and effectively. This is part of 

ONPE’s overall communications strategy that includes email messages and pertinent 

announcements to serve its customers. Although there is a small privacy risk in 

collecting this data compared to not collecting it, this risk has been properly mitigated 

with security and data handling measures as discussed below and individuals can ask to 

be removed from the list at any time. 

5. Social Security Number (SSN). If an SSN is collected and used, describe the purpose of 

the collection, the type of use, and any disclosures. Also specify any alternatives that 

4 
Privacy Impact Assessment

you considered, and why the alternative was not selected. If system collects SSN, the 

PIA will require a signature by the Assistant Secretary. If no SSN is collected, no 

signature is required.

ONPE CIL

No Social Security Numbers are collected. 

ONPE Database

No Social Security Numbers are collected. 

6. Uses of the Information. What is the intended use of the information? How will the 

information be used? Describe all internal and/or external uses of the information. 

What types of methods are used to analyze the data? Explain how the information is 

used, if the system uses commercial information, publicly available information, or 

information from other Federal agency databases.

ONPE CIL

The purpose for the ONPE CIL is to provide a knowledge management tool to inform 

current and new staff of responses to inquiries, to help staff manage their individual 

progress on inquiry closeout, and to track trends to inform technical assistance. Staff 

collects this personally identifiable information from constituents’ emails as well as

telephone calls and voicemails. The information is used by ONPE staff only to build 

internal knowledge and capacity to address inquiries, to help make the inquiry response 

process more efficient, and to guide the outreach activities so that ONPE can serve its 

customers.

ONPE Database

The purpose for the ONPE Database is to collect and maintain a contact list to 

communicate with stakeholders and distribute information regarding ED grants, 

programs, initiatives, policies, and events to constituents efficiently and effectively. The 

information is used by ONPE staff only as part of ONPE’s overall communications 

strategy. The only publically available information that this system may utilize is contact 

information for stakeholders from associations, government, and schools documented 

on organizational websites. These contacts are treated like any other contact within the 

database. Overall the database enables ONPE to reach a broad audience that it would 

be unable to reach any other way and provides opportunities for interactive 

communication. 

7. Internal Sharing and Disclosure. With which internal ED organizations will the

information be shared? What information is shared? For what purpose is the 

information shared?

5 
Privacy Impact Assessment

ONPE CIL

While the CIL is an internal tool for the ONPE team, ONPE may share CIL 

information/reports with ED staff to help serve its stakeholders more efficiently and 

effectively. Generally, ONPE has no need to share personally identifiable information

from the CIL. 

ONPE Database

ONPE may share database information within ED and its logistics contractor for the 

purposes of disseminating information to these constituents. Personally identifiable 

information shared may include organization, address, email, and telephone number. 

This information is shared internally on a need-to-know basis. 

8. External Sharing and Disclosure. With what external entity will the information be 

shared (e.g., another agency for a specified programmatic purpose)? What 

information is shared? For what purpose is the information shared? How is the 

information shared outside of the Department? Is the sharing pursuant to a Computer 

Matching Agreement (CMA), Memorandum of Understanding or other type of 

approved sharing agreement with another agency?

ONPE CIL

Data from the ONPE CIL is not distributed outside of the Department.

ONPE Database

Constituent contact information from the ONPE Database is shared with the public only 

with the approval of the individual whose personal information ONPE has collected. For 

example, if a national private school organization leader contacts ONPE to request 

contact information for a stakeholder, ONPE will only provide the contact information 

with permission from the stakeholder. 

9. Notice. Is notice provided to the individual prior to collection of their information 

(e.g., a posted Privacy Notice)? What opportunities do individuals have to decline to 

provide information (where providing the information is voluntary) or to consent to 

particular uses of the information (other than required or authorized uses), and how 

individuals can grant consent? 

ONPE CIL

6 
Privacy Impact Assessment

ONPE does not provide notification to constituents submitting an inquiry that their 

inquiry, response, and personally identifiable information may be collected.

ONPE Database

ONPE adds constituents to the contact list if they provide contact information or if they 

are leaders in the field and their information is in the public domain. ONPE does not 

provide notification to constituents that their personally identifiable information may be 

collected.

10. Web Addresses. List the web addresses (known or planned) that have a Privacy Notice.

ONPE CIL

Not Applicable

ONPE Database

Not Applicable. ONPE enters a new stakeholder into the database at its discretion. 

11. Security. What administrative, technical, and physical security safeguards are in place 

to protect the PII? Examples include: monitoring, auditing, authentication, firewalls, 

etc. Has a C&A been completed? Is the system compliant with any federal security 

requirements?

ONPE CIL

The CIL is stored on the ONPE K drive, to which only ONPE staff has access. ED has 

established the following controls for protecting personally identifiable information. All 

physical access to Department sites is controlled and monitored at all times by security 

personnel who ensure that anyone entering the building has a badge. The computer 

systems employed by ED offer a high degree of resistance to tampering and 

circumvention. The Department uses special software programs for monitoring network 

traffic to identify unauthorized attempts to upload or change information, or otherwise 

to cause damage to this government computer system. These programs collect 

information that could help ED identify someone attempting to tamper with the 

website. All ED computers require a username and password to log in. Because the CIL is 

stored on ED computers, the firewalls and safeguards that protect ED data will protect 

the CIL’s content. 

ONPE Database

The Database is stored on the ONPE K drive, to which only ONPE staff has access. ED has 

established the following controls for protecting personally identifiable information. All 

7 
Privacy Impact Assessment

physical access to Department sites is controlled and monitored at all times by security 

personnel who ensure that anyone entering the building has a badge. The computer 

systems employed by ED offer a high degree of resistance to tampering and 

circumvention. The Department uses special software programs for monitoring network 

traffic to identify unauthorized attempts to upload or change information, or otherwise 

to cause damage to this government computer system. These programs collect 

information that could help ED identify someone attempting to tamper with the 

website. All ED computers require a username and password to log in. Because the 

Database is stored on ED computers, the firewalls and safeguards that protect ED data 

will protect the CIL’s content. 

12. Privacy Act System of Records. Is the information within the system retrieved by 

personal identifier? Is a system of records being created or altered under the Privacy 

Act, 5 U.S.C. 552a? Is this a Department-wide or Federal Government-wide SORN? If a 

SORN already exists, what is the SORN Number? 

The information collected in the ONPE CIL and Database is not retrieved by name or 

personal identifier. Therefore, a Privacy Act System of Records Notice is not necessary.

13. Records Retention and Disposition. Is there a records retention and disposition schedule 

approved by the National Archives and Records Administration (NARA) for the records 

created by the system development lifecycle AND for the data collected? If yes – 

provide records schedule number:

ONPE CIL

These records are destroyed when no longer needed for reference consistent with GRS 

Schedule 3.1, Item 020. Disposition Authority: DAA-GRS-2013-0005-0004. Destroy 3 

years after agreement, control measures, procedures, project, activity, or transaction is 

obsolete, completed, terminated or superseded, but longer retention is authorized if 

required for business use. 

ONPE Database

These records are destroyed when no longer needed for reference consistent with GRS 

Schedule 3.1, Item 051. Disposition Authority: DAA-GRS-2013-0005-0003. Destroy 5 

years after the project/activity/transaction is completed or superseded, or the 

associated system is terminated, or the associated data is migrated to a successor 

system, but longer retention is authorized if required for business use.

8