Privacy Impact Assessment (PIA)

the 

On-Line Application System (OLAS)

for School Ambassador Fellows Program (SAF)

12/1/2016

Contact Point

Karen Stratman

(202) 205-8719

System Owner

Caryn Kuzner

Author

Gillian Cohen-Boyer

Office of Communications & Outreach

Reviewing Official

Kathleen Styles

Chief Privacy Officer
2

U.S. Department of Education

Please complete this Privacy Impact Analysis (PIA) of how information in identifiable form is 

collected, stored, protected, shared, and managed electronically by your system. You may wish 

to consult with your ISSO in completing the following document. If a question does not apply to 

your system please answer with N/A.

Should any questions arise, please do not hesitate to contact the Privacy Safeguards team at 

privacysafeguards@ed.gov

1. Introduction

1.1. Describe the system including the system name, system acronym, and a brief description 

of the major functions.

The multiple program On-Line Application System (OLAS) allows individuals to apply 

to the School Ambassador Fellows (SAF) Program. Eligible candidates are allowed to 

complete and submit their applications electronically. OLAS for SAF is reached through 

the SAF’s main site, www.ed.gov/programs/schoolfellowship. OLAS is software-as-aservice procured by the Department from a vendor that specializes in application

management software.

On the main site, users can view general information about the program including the 

mission of the program, eligibility criteria, application process information, and 

frequently asked questions, without providing any personal information at all.

The OLAS site provides secure access for authorized users to enter, save, update, view, 

approve, submit and print application information. These features can only be accessed 

with a valid user ID and password. A system of access levels is implemented. Privileges 

are assigned on a need to know basis.

1.2. Describe the purpose for which the personally identifiable information (PII)1 is 

collected, used, maintained, or shared.

The Intergovernmental Personnel Act (IPA) mobility program regulations (5 CFR part 

334), revised effective May 29, 1997, allow federal agencies to facilitate cooperation 

 1 The term “personally identifiable information” refers to information which can be used to distinguish or trace an

individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined

with other personal or identifying information which is linked or linkable to a specific individual, such as date and

place of birth, mother’s maiden name, etc. 

https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2007/m07-16.pdf 
3

between the Federal Government and the non-Federal entity through the temporary 

assignment of skilled personnel. In order to identify the most skilled personnel for the 

position of Ambassador Fellow for the sound public purpose of gaining practicing 

teachers’ and principals’ unique approaches to solving educational problems and assisting 

in developing and identifying support for effectively implementing Federal policies and 

programs. In turn, the experience provides Fellows and their sending schools and districts 

with developmental experience, which will enhance the assignee's performance in his or 

her regular job.

The OLAS system reproduces exactly the content of the existing paper-based application 

system, but allows applicants and school staff to submit applications electronically, 

through links on the Department of Education’s website. Offering an electronic 

application option is consistent with the Government Paperwork Elimination Act 

(GPEA), Pub. L. 105-277, which directs the Government to allow citizens to use 

electronic technologies when filing information with, or retrieving information from 

Federal agencies. The paper-based option for submitting applications remains available, 

for those without Internet access, and for those who prefer to use a paper-based system.

1.3. Is this a new system, or one that is currently operating?

This is a new system that will replace PSAonline for the U.S. Presidential Scholars 

Program and also be utilized by OCO’s School Ambassador Fellows Program.

1.4. Is this PIA new, or is it updating a previous version?

This PIA updates the version used for the Teacher and Principal Ambassador Fellows

Programs (note: the program name has been changed to School Ambassador Fellows 

(SAF) Program).

1.5. Is the system operated by the agency or by a contractor?

This system is a COTS product, specifically software-as-a-service procured by the 

Department of Education. It is hosted by Amazon Web Services.

2. Legal Authorities and Other Requirements

2.1. What specific legal authorities and/or agreements permit and regulate the collection and 

use of data by the system?

The Intergovernmental Personnel Act (IPA) mobility program regulations (5 CFR part 

334), revised effective May 29, 1997, allow federal agencies to facilitate cooperation 
4

between the Federal Government and the non-Federal entity through the temporary 

assignment of skilled personnel. In order to identify the most skilled personnel for the 

position of Ambassador Fellow for the sound public purpose of gaining practicing 

teachers’ and principals’ unique approaches to solving educational problems and assisting 

in developing and identifying support for effectively implementing Federal policies and 

programs. In turn, the experience provides Fellows and their sending schools and districts 

with developmental experience, which will enhance the assignee's performance in his or 

her regular job.

SORN

2.2. Is this system covered by a Privacy Act System of Records Notice(s) (SORN(s))2? If no, 

explain why not. If yes, provide the SORN name and number, or indicate that a SORN 

is in progress. 

This system is covered by the Government-wide SORN OPM/GOVT-5 - Recruiting, 

Examining, and Placement Records.

Records Management 

2.3. Does a records retention schedule approved by National Archives and Records 

Administration (NARA) exist for the records contained in this system? If yes, please 

provide the NARA schedule number.

This information falls under GRS 1, Item 32. Merit Promotion Case Files. Records 

relating to the promotion of an individual that document qualification standards, 

evaluation methods, selection procedures, and evaluations of candidates. Destroy after 

OPM audit or 2 years after the personnel action is completed, whichever is sooner. (N1-

GRS-79-2 item 1).

2.4. Is the PII contained in this system disposed of appropriately, and in accordance with the 

timelines in the records schedule? 

Yes.

3. Characterization and Use of Information

Collection

3.1. Identify all the personally identifiable information (PII) that the system collects, uses, 

disseminates, or maintains.

 2 A System of Records Notice (SORN) is a formal notice to the public that identifies the purpose for which PII is 

collected, from whom and what type of PII is collected, how the PII is shared externally (routine uses), and how to 

access and correct any PII maintained by ED. https://connected.ed.gov/om/Documents/SORN-Process.pdf
5

The only elements of personally identifiable information (PII) would include the 

applicant’s name, email and phone contact information, and place of employment. This 

information will be included in their resumes which are a required application 

component, as well as referenced through a required letter of recommendation from their 

employer for the position. No Sensitive PII (SPII) will be stored.

3.2. Is this information collected the minimum necessary to achieve the purpose stated in the 

introduction?

Yes.

3.3. What are the sources of information collected (e.g., individual, school, another agency, 

etc.) and how is the information collected from stated sources (paper form, webpage, 

database, etc.)?

The sources of information include the following:

• Individual applicants via electronic submission

• Applicant’s employer via electronic submission

3.4. How is accuracy of the data ensured?

Data is submitted by the individuals completing the applications and the employer they 

choose to recommend them. In addition, ED OCO personnel (staff and contractors), 

systems and processes comply with National Institute of Standards and Technology 

(NIST) 800-53 controls for a Moderate Application which includes administrative, 

technical and physical controls. These controls are in place to ensure integrity, 

availability, accuracy and relevancy of the data and to mitigate privacy risks.

Use

3.5. Describe how and why the system uses the information to achieve the purpose stated in 

Question 1 above.

The system collects information entered by the applicant and the employer selected by 

the applicant to allow for the applicant to be evaluated for the opportunity of participating 

in the School Ambassador Fellows (SAF) Program for one year. The work of the U.S. 

Department of Education has significant impact on teachers and school leaders. One 

portion of the Department’s mission is to collect and share data on education and to focus 

national attention on key educational issues.
6

Our School Ambassador Fellows add a critical school-level perspective and help the 

Department to more effectively share information about education policy and public 

resources with the field. The identification of the school leaders who are poised to play 

these roles for ED requires a rigorous and open selection process that enables 

practitioners to express their interest in the position and to demonstrate their ability to 

meet the programs’ eligibility and performance criteria. The first step of this process 

requires demonstrating that one is a current school leader and by identifying one’s 

workplace and providing a letter or recommendation from that employer. We must then 

be able to be in contact with all applicants to notify them if they have been selected to 

move on to additional stages of selection or not, which requires the submission of email 

and/or phone contact information.

The OLAS system reproduces exactly the content of the existing paper-based application 

system, but allows applicants and school staff to submit applications electronically, 

through links on the Department of Education’s website. Offering an electronic 

application option is consistent with the Government Paperwork Elimination Act 

(GPEA), Pub. L. 105-277, which directs the Government to allow citizens to use 

electronic technologies when filing information with, or retrieving information from 

Federal agencies. The paper-based option for submitting applications remains available, 

for those without Internet access, and for those who prefer to use a paper-based system.

3.6. Explain if the system uses commercial information, publically available information, or 

information from other Federal agency databases.

The system does not use commercial information, publically available information, or 

information from other Federal agency databases. The sources of information are 

described in Question 3.3.

Social Security Numbers

3.7. Does the system collect Social Security Numbers? If so, explain the purpose of its 

collection, type of use, and any disclosures. *Please note if the system collects SSN, the 

PIA will require a signature by the Assistant Secretary or equivalent.*

N/A

3.8. Specify any alternatives considered in the collection of SSN and why the alternatives 

were not selected.

N/A
7

4. Notice

4.1. How does the system provide individuals notice about the collection of PII prior to the 

collection of information? If notice is not provided, explain why not.

School leaders have the opportunity to apply to the SAF Program, but they are not 

required to apply. If a candidate chooses to apply to the program, they are aware that the 

collection of PII is necessary in order for them to be considered for the fellowship. 

Users are notified that registration and submission of some PII is necessary because 

applications cannot be submitted anonymously. The Privacy Notice will be posted on 

our program websites under the application process. We will indicate in the application 

package and on the website, that submission of one’s application indicates the 

applicant’s consent to use their resume containing contact information and place of 

employment in the process of assessing their ability to meet program eligibility 

requirements and that their contact information will not be shared with any other entities.

4.2. What opportunities are available for individuals to consent to uses, decline to provide 

information, or opt out of the project?

If invited individuals do not want their PII used, they can choose not to complete the 

registration and application process. There is no opt-out option once a person's PII is 

already in the system.

4.3. Provide the text of the notice, or the link to the webpage where notice is posted.

The OLAS privacy policy is available at the following link:

www.ed.gov/programs/schoolfellowship

5. Information Sharing

Internal

5.1. Will information be shared internally with other ED organizations, if so, which ones?

SAF applications will be shared with ED Staff who serve as reviewers as part of the 

selection processes. These are staff members at ED across the organization who have 

either served as teachers or principals prior to coming to ED or who work on issues 

directly related to teacher and principals. Review teams are always comprised of three 

people and we seek balance between ED staff members, current Fellows (who are also 

ED Staff members) or former Fellows who no longer are employed by ED. Applications 

will be maintained in secured, password protected electronic folders, and reviewers will 

only have access to the subset of applicants for which they are responsible. 

5.2. What information will be shared and with whom?
8

Fellows’ contact information will be shared with the entities in the previous answer.

5.3. What is the purpose for sharing the specified information with the specified internal 

organizations? Does this purpose align with the stated purpose in Question 1, above?

The information is used by the Department to perform the following functions:

• Verify eligible candidates; 

• Provide technical assistance and respond to e-mail requests from system users; 

• Conduct the annual selection of Fellows; 

• Announce the program’s finalists to the general public; 

• Produce program recognition materials;

• Inform national, State and local media so that they may publicize Fellows

and the program; 

• Notify State and local education officials of Fellows in their States, 

districts or schools. 

External

5.4. Will the information contained in the system be shared with external entities (e.g. 

another agency, school district, etc.)?

The only external sharing of applications would be with former Fellows who no longer 

serve in official capacity with ED. As they will not have access to the secured electronic 

files, Alums will be provided with encrypted versions of the select files. There will be no 

sharing of information for purposes outside of the above disclosure requirements or for 

anything other than the primary purpose(s) of collecting the information. Any contractor 

responsible for the operations of this website, including contractors, must comply with 

the requirements of the Privacy Act in the handling of information collected through the 

website.

Information about the winners will be disclosed to each winner’s state school 

superintendent and school officials. 

5.5. What information will be shared and with whom?

Fellows’ contact information will be shared with the entities in the previous answer.

5.6. What is the purpose for sharing the specified information with the specified external 

entity? Does this purpose align with the stated purpose in Question 1 above?

The specified information will be shared with the entities mentioned above so that the 

Fellows may be congratulated and recognized by these entities for their achievement.
9

5.7. How is the information accessed and used by the external entity?

This information is mailed or securely emailed by the Department.

5.8. If the project is using the information for testing a system or for training/research 

purposes, what controls are in place to minimize the risk and protect the data? 

N/A

5.9. Is the sharing pursuant to a Computer Matching Agreement (CMA), Memorandum of 

Understanding (MOU) or other type of approved sharing agreement with another 

agency? 

N/A

5.10. Does the project place limitations on re-disclosure?

No.

6. Redress

6.1. What are the procedures that allow individuals to access their own information?

Users are provided with login credentials to access the system containing their 

information.

6.2. What procedures are in place to allow the subject individual to correct inaccurate or 

erroneous information?

Users may edit most fields. If a field is not editable, the user is instructed to call or email 

the SAF Program to correct the information.

6.3. How does the project notify individuals about the procedures for correcting their 

information?

Users are provided opportunities to edit fields in the system and are instructed to call or 

email the SAF Program to correct information that can only be edited by an 

administrator.
10

7. Safeguards

7.1. Does the principal office work in accordance with OCIO to build privacy & security into 

the system and build privacy extensions to the extent feasible?

Yes. 

7.2. What procedures are in place to determine which users may access the information and 

how does the project determine who has access?

A system of access levels is implemented. Privileges are assigned on a need to know 

basis.

7.3. What administrative, technical, and physical safeguards are in place to protect the 

information?

ED OCO personnel (staff and contractors), systems and processes comply with National 

Institute of Standards and Technology (NIST) 800-53 controls for a Moderate 

Application which include administrative, technical and physical controls. These 

controls are in place to ensure integrity, availability, accuracy and relevancy of the data 

and to mitigate privacy risks.

7.4. Has an Authority to Operate (ATO) been granted?

Yes. 

7.5. Does the IT system have logging capabilities that can provide an account for all 

disclosures and make this account available to individuals in the record?

Disclosures from this system are unlikely to be made, except in furtherance of the 

primary purpose of the system. If any nonstandard disclosures were to be made for any 

unanticipated reason, the system owner would maintain a record of the disclosures with 

the required data elements such as date of the disclosure and recipient of the disclosure to 

include mailing address, content of the disclosure, and purpose of the disclosure.

8. Auditing and Accountability

8.1. How does the system owner ensure that the information is used in accordance with 

stated practices in this PIA?
11

ED OCO personnel (staff and contractors), systems and processes comply with National 

Institute of Standards and Technology (NIST) 800-53 controls for a Moderate 

Application which include administrative, technical and physical controls. 

8.2. What are the privacy risks associated with this system and how are those risks 

mitigated?

ED OCO personnel (staff and contractors), systems and processes comply with National 

Institute of Standards and Technology (NIST) 800-53 controls for a Moderate 

Application which include administrative, technical and physical controls. These 

controls are in place to ensure integrity, availability, accuracy and relevancy of the data 

and to mitigate privacy risks.