Office of Management Privacy Safeguards Division

Privacy Impact Assessment

For

OCO Contact Lists 

Date: 8/9/2012

Point of Contact: Samuel Ryan 

System Owner: Cynthia Dorfman

Author: Samuel Ryan 

Office of Communications and Outreach

U.S. Department of Education
Privacy Impact Assessment

2 

1. System Information. Describe the system - include system name, system acronym, and a 

description of the system, to include scope, purpose and major functions.

ED’s Office of Communications and Outreach (OCO) is updating its contact lists to a hybrid of 

MS Excel/Outlook and GovDelivery source. GovDelivery is a source that helps government 

connect with the public through social media and email. OCO contact list objectives are to 

efficiently and effectively distribute ED information to key constituencies via a contact list in 

MS Excel/Outlook and/or GovDelivery source. GovDelivery source and MS Excel/Outlook will 

be used to disseminate information regarding ED grants, programs, initiatives, or policies to 

interested parties through the OCO contact list. Headquarters can also utilize this information if 

they need to distribute information to a key constituency. In the past, OCO has only utilized one 

of these applications, but by combining the two applications, it allows for a greater utilization of 

the information that is collected. Currently OCO receives contact information in three different 

ways: constituents call the OCO staff requesting to be added to contact lists, constituents sign up 

at events, and members of the education community are identified by an online search. These 

members can be from, but not limited to, associations, business leaders, community based 

organizations, teachers, researchers, and foundations. 

Under the new system, this information will be collected from the different methods described 

above and entered into MS Outlook, MS Excel or GovDelivery. All of the information obtained 

will be added into the corresponding fields and a notes section where OCO staff can place 

pertinent information, such as how this individual was added into the contact list and when this 

addition occurred. Each contact should provide his or her name and email address, and should 

indicate a category of interest. This will determine the scope of information they will receive 

from ED. If the contact grants permission, ED will also collect a phone number, address, and 

organization. 

2. Legal Authority. Cite the legal authority to collect and use this data. What specific legal 

authorities, arrangements, and/or agreements regulate the collection of information? 

ED has authority through 20 U.S.C. Section 3412(e) (2) to perform public information functions, 

including the provision, through the use of the latest technologies, of useful information about 

education issues and related opportunities to students, parents, and communities. This is an 

inherently governmental function; according to the OMB Circular number A-130 Revised 

government information is seen as a “national resource”.

3. Characterization of the Information. What elements of personally identifiable information 

(PII) are collected and maintained by the system (e.g., name, social security number, date of 

birth, address, phone number)? What are the sources of information (e.g., student, teacher, 

employee, university)? How the information is collected (website, paper form, on-line form)? 

Is the information used to link or cross-reference multiple databases?

ED collects basic identifying information such as: name, organization, email address, phone 

number, address/zip code, city, categories of interest, and agenda/activities. The sources of 

information are students, teachers, universities, community based organizations and other 
Privacy Impact Assessment

3 

government agencies. The information will be collected through paper form, on-line and a 

website. The information is not used to link or cross reference multiple databases, but the 

information can be shared amongst individuals and organizations in conducting outreach on 

behalf of the U.S. Department of Education. 

Information is also collected from individuals requesting to receive information from OCO 

regarding grants, pertinent education policies, and ED outreach events in their community and 

other information deemed pertinent by senior leadership. 

The information may be collected in three different ways: constituents’ contact OCO requesting 

to be added to the distribution list, constituents sign up at events, education members are 

identified through an online search are sent to public list of officials or associations. These 

members can be from, but not limited to, associations, business leaders, community based 

organizations, teachers, researchers, and foundations. 

4. Why is the information collected? How is this information necessary to the mission of the 

program, or contributes to a necessary agency activity? Given the amount and any type of data 

collected, discuss the privacy risks (internally and/or externally) identified and how they were 

mitigated.

This is part of an overall communications strategy that includes email messages, e-newsletters, 

press releases, webinars, blogs, etc. This is a cost savings measure by reducing travel, as directed 

in Executive Order 13589, in-person interviews and postal mailing costs. The information is 

collected so the OCO staff can disseminate information and interact with key stakeholders. Also, 

this information is utilized as an assessment tool to identify where the OCO staff’s efforts have 

been targeted and what the stakeholders will be working on, either in direct outreach or through 

the contact list, in order to maintain a productive network of contacts. 

OCO will collect contact information such as email addresses in order to disseminate 

information to interested stakeholders. This is an inherently governmental function; according to 

the OMB Circular number A-130 Revised government information is seen as a “national 

resource”. In order to ensure that these contacts are receiving information they desire, specific 

staff maintain contact lists focusing in specific stakeholders e.g. youth, parents, teachers. As 

stated above, typically the information disseminated through the contact list is grant information, 

pertinent education policies, ED outreach events in a community and other information deemed 

pertinent by senior leadership. We are also collecting state, city and zip code in order to 

understand the demographics of those interested in ED’s programs, so that we can better design 

outreach strategies. Collecting information about organizations’ agenda for the next year will 

allow the OCO to better coordinate outreach activities and serve their customers. Although there 

is a small privacy risk in collecting this data compared to not collecting it, but this risk has been

properly mitigated with security and data handling measures as discussed below and individuals 

can asked to be removed from the list at any time. 
Privacy Impact Assessment

4 

5. Social Security Number (SSN). If an SSN is collected and used, describe the purpose of the 

collection, the type of use, and any disclosures. Also specify any alternatives that you 

considered, and why the alternative was not selected. If system collects SSN, the PIA will require 

a signature by the Assistant Secretary or designee. If no SSN is collected, no signature is required.

No Social Security Numbers are collected. 

6. Uses of the Information. What is the intended use of the information? How will the 

information be used? Describe all internal and/or external uses of the information. What types 

of methods are used to analyze the data? Explain how the information is used, if the system 

uses commercial information, publicly available information, or information from other 

Federal agency databases.

As stated above, the information will be utilized for communicating to and reaching out to 

stakeholders in an effective and efficient manner. The information collected will also allow OCO 

to enhance the effectiveness of its communication and outreach plans. The only publically 

available information that this system may utilize is the contact information for governmental 

stakeholders like state superintendents, media contacts, stakeholders, and information from other 

federal agency databases. These contacts will be treated like any other contact within the contact 

list. Overall this enables ED to reach a broad audience that we would be unable to reach any 

other way, engaging a contact/community not one time, but multiple occurrences and provides 

opportunities for interactive communications. 

7. Internal Sharing and Disclosure. With which internal ED organizations will the information be 

shared? What information is shared? For what purpose is the information shared? 

The information would be shared within ED and its contractors for the purposes of systematizing 

distribution methods and locating redundancies, disseminating information to these contacts and 

determining areas to increase communication and outreach. In terms of determining how to 

increase communication, the information that would be shared includes basic identifying 

information such as: the organization, address, email, phone number, category, and notes OCO 

staff compile. This will be shared internally on a need-to-know basis. 

8. External Sharing and Disclosure. With what external entity will the information be shared 

(e.g., another agency for a specified programmatic purpose)? What information is shared? For 

what purpose is the information shared? How is the information shared outside of the 

Department? Is the sharing pursuant to a Computer Matching Agreement (CMA), 

Memorandum of Understanding or other type of approved sharing agreement with another 

agency? 

The constituents contact information will be shared with other federal agencies, only at the 

approval/request of the individual whose personal information we have collected. When other 

Federal agencies have engagement opportunities that are in-line with stakeholder/category topic, 

they will send the contact list owner the information and the owner will send out the information 

to the contacts on the designated list. For example, an organization on OCO youth list could 

receive information from HHS regarding a HHS youth focused event. 
Privacy Impact Assessment

5 

9. Notice. Is notice provided to the individual prior to collection of their information (e.g., a 

posted Privacy Notice)? What opportunities do individuals have to decline to provide 

information (where providing the information is voluntary) or to consent to particular uses of 

the information (other than required or authorized uses), and how individuals can grant 

consent? 

Individuals will only be added to the contact list if they request it or if they are key stakeholders 

in their field and the information is public. Participation is entirely voluntary. At the initial sign 

up, individuals providing information are notified that they are being added to the contact list and 

will be receiving emailed information. This is true no matter where they sign up: in-person 

sign-in at an event, a contact made through the internet, or by phone. All emails sent from the 

contact list contain a prominent “unsubscribe” option. 

10. Web Addresses. List the web addresses (known or planned) that have a Privacy Notice. 

We are directing people to sign up for email notification through ed.gov site in the “get 

connected” section. The privacy notice can be found at 

http://www2.ed.gov/notices/privacy/index.html

11. Security. What administrative, technical, and physical security safeguards are in place to 

protect the PII? Examples include: monitoring, auditing, authentication, firewalls, etc. Has a 

C&A been completed? Is the system compliant with any federal security requirements? 

The following controls have been implemented for protecting personally identifiable 

information. All physical access to Department sites is controlled and monitored 24/7 by security 

personnel who ensure that all persons entering the building are properly badged to enter the 

building. The computer systems employed by ED offer a high degree of resistance to tampering 

and circumvention. The Department uses special software programs for monitoring network 

traffic to identify unauthorized attempts to upload or change information, or otherwise to cause 

damage to this government computer system. These programs collect no information that would 

directly identify individuals, but they do collect information that could help ED identify someone 

attempting to tamper with the Web site. Additionally, the number of individuals who can access 

the contact list is limited. All ED computers require a username and password to log in. 

In disseminating information through email, the contacts will be placed in the BCC field so no 

external individual has access to the information when they open or reply to the message. 

Because these documents are to be stored on ED computers, the firewalls and safeguards that 

protect ED data will protect these contact lists. 

12. Privacy Act System of Records. Is a system of records being created or altered under the Privacy 

Act, 5 U.S.C. 552a? Is this a Department-wide or Federal Government-wide SORN? If a SORN 

already exists, what is the SORN Number? 

A system of record notice is not needed because the information being collected is not retrieved by 

any personal identifiers. Therefore, a system of record as defined by the Privacy Act is not being 

created and the reporting requirements of OMB Circular A-130 do not apply. 
Privacy Impact Assessment

6 

13. Records Retention and Disposition. Is there a records retention and disposition schedule 

approved by the National Archives and Records Administration (NARA) for the records 

created by the system development lifecycle AND for the data collected? If yes – provide 

records schedule number:

Records are covered under General Records Schedule 23 item 7 Transitory Records. These 

records are “destroy immediately”, or when no longer needed for reference, or according to a 

predetermined time period or business rule (e.g., implementing the auto-delete feature of 

electronic mail systems). (N1-GRS-04-5, item 1)