Privacy Impact Assessment

For

Office of General Counsel Case & Activity Management System 

(OGC-CAMS)

Date:

November 28, 2014

Point of Contact and Author: 

Terry Bashford

Terry.Bashford@ed.gov

System Owner:

Robert Wexler

Rob.Wexler@ed.gov

Office of the General Counsel (OGC)

U.S. Department of Education

Office of Management Privacy Safeguards Division
Privacy Impact Assessment

1. System Information. 

Describe the system - include system name, system acronym, and a description of the system, to include 

scope, purpose and major functions.

This document is a second-generation Privacy Impact Assessment (PIA) and reflects current information 

regarding The Office of the General Counsel’s (OGC) Case and Activity Management System (OGCCAMS). OGC-CAMS contains in-house developed applications (including modifications to adapt to 

OGC’s particular needs), commercial-off-the-shelf (COTS) software, and OpenText Document 

Management System (DMS). 

OGC-CAMS is an in-house case and document management system that stores and organizes for quick 

retrieval OGC’s day to day work product, including documents associated with on-going litigation, 

contracts, legislation reviews, and regulatory matters, and also documents reflecting OGC’s written legal 

advice contained in memorandums and emails. In general terms, the system centralizes the OGC’s 

documents for orderly accessibility and searching; prevents the loss of work product; manages all relevant 

content associated with a particular matter or case; secures confidential, privileged, deliberative and 

attorney-work product information; allows for searching and access to relevant information across the 

OGC, and provides a content and knowledge management feature that preserves the knowledge of the 

OGC developed over time. The OGC-CAMS is not accessible to Department staff outside of OGC, nor is 

it accessible to the public.

2. Legal Authority. 

Cite the legal authority to collect and use this data. What specific legal authorities, arrangements, and/or 

agreements regulate the collection of information?

The legal authorities for OGC to collect and use data are listed as follows.

20 U.S.C. § 3421 “The General Counsel (GC) shall provide legal assistance to the Secretary concerning 

the programs and policies of the Department.”

Federal Torts Claims Act (28 U.S.C. §§ 2671-2680, 1346(b); Waiver of Overpayment of Pay Act 5 

U.S.C. 5584; Military Personnel and Civilian Employees Claims Act, 31 U.S.C. 240 et seq.; Federal 

Claims Collection Act, 31 U.S.C. 951-953. See System of Records Notice (SORN) 18-09-01

5 U.S.C. §§ 3301 et seq. See SORN 18-09-02

Pub. L. 95-521, Ethics in Government Act of 1978; Pub. L. 101-194, Ethics Reform Act of 1989, as 

amended; and Executive Orders 12674, 12565, and 11222, as amended. See SORN 18-09-03

Civil Rights Act, and Federal Torts Claim Act (The authority for maintaining information consists of 

various statutes, regulations, rules or orders pertaining to the subject matter of the litigation, 

administrative complaint or adverse personnel action). See SORN 18-09-04

Section 206(d) of the E-Government Act of 2002 (Pub. L. 107-347, 44 U.S.C. § 3501 note); 5 U.S.C. § 

301; and 5 U.S.C. § 553. See SORN 18-09-05

5 U.S.C. §§ 7301, 7351, and 7353; 5 U.S.C. App. (Ethics in Government Act of 1978); 31 U.S.C. § 1353; 

E.O. 12674 (as modified by E.O. 12731). See SORN OGE/GOVT-1

5 U.S.C. App. (Ethics in Government Act of 1978); E.O. 12674 (as modified by E.O. 12731). See SORN 

OGE/GOVT-2

Federal Docket Management System (FDMS). See SORN EPA-GOVT-2.

2
Privacy Impact Assessment

3. Characterization of the Information. 

What elements of personally identifiable information (PII) are collected and maintained by the system 

(e.g., name, social security number, date of birth, address, phone number)? What are the sources of 

information (e.g., student, teacher, employee, university)? How is the information collected (website, 

paper form, on-line form)? Is the information used to link or cross-reference multiple databases?

The primary purpose of the OGC-CAMS is not to collect or store Privacy Act information; however, 

documents used by OGC attorneys in their day to day work may be saved to the OGC-CAMS by and for 

the attorney and may contain elements of personal identifiable information (PII) covered by the Privacy 

Act. This includes but is not limited to, name, SSN, DOB, addresses, telephone numbers, and financial 

and personnel related information, etc. PII may be provided to an attorney in OGC in the course of an 

ethics review or in the course of legal proceedings, claims, complaints, and other sources in response to 

OGC required legal requirements (in response to court proceedings, i.e., ethics due diligence).

4. Why is the information collected? 

How is this information necessary to the mission of the program, or contributes to a necessary agency 

activity? Given the amount and any type of data collected, discuss the privacy risks (internally and/or 

externally) identified and how they were mitigated.

OGC CAMS supports OGC’s efforts (i.e., providing legal advice, drafting and conducting legal reviews 

of Department statutes, regulations, and guidance, providing legal services in litigation, ethics reviews, 

etc.) to provide legal assistance to the Secretary and other Department officials and staff concerning the 

Department’s programs and policies.

Any PII saved to the OGC-CAMS system is stored within the EDUCATE Perot facilities in Plano TX, 

and is accessible to only OGC personnel. The risk of disclosure of PII is significantly minimized by the 

protections in place under the EDUCATE contract and the security permission controls in place by the 

OGC-CAMS product.

5. Social Security Number (SSN).

If an SSN is collected and used, describe the purpose of the collection, the type of use, and any 

disclosures. Also specify any alternatives that you considered, and why the alternative was not selected. 

If system collects SSN, the PIA will require a signature by the Assistant Secretary or designee. If no SSN 

is collected, no signature is required.

OGC-CAMS stores documents provided to or obtained by an attorney in the course of their work. SSNs 

may, from time to time, be included in such documentation, particularly as they related to ethics reviews, 

personnel matters and legal claims, and court documents. Thus, documents stored within OGC-CAMS 

will contain SSNs in some documents, but this personal information will be identified and removed upon 

disposal or transfer to the National Archives Record Administration (NARA).

3
Privacy Impact Assessment

6. Uses of the Information. 

What is the intended use of the information? How will the information be used? Describe all internal 

and/or external uses of the information. What types of methods are used to analyze the data? Explain 

how the information is used, if the system uses commercial information, publicly available information, or 

information from other Federal agency databases.

Any Privacy Information saved in the system will be used in the normal course of OGC carrying out its 

responsibilities that presently applies to such information that OGC uses including information in hardcopy form. OGC-CAMS is not designed to serve as a repository for personal data. 

7. Internal Sharing and Disclosure. 

With which internal ED organizations will the information be shared? What information is shared? For 

what purpose is the information shared?

The Department of Education may disclose information contained in a record in an individual’s account 

under the routine uses listed in the Privacy Act System of Records notice without the consent of the 

individual if the disclosure is compatible with the purposes for which the record was collected.

See Routine Uses as listed in the system of records notices listed above in question #2.

8. External Sharing and Disclosure. 

With what external entity will the information be shared (e.g., another agency for a specified 

programmatic purpose)? What information is shared? For what purpose is the information shared? 

How is the information shared outside of the Department? Is the sharing pursuant to a Computer 

Matching Agreement (CMA), Memorandum of Understanding or other type of approved sharing 

agreement with another agency?

The Department of Education may disclose information contained in a record in an individual’s account 

under the routine uses listed in the Privacy Act System of Records notice without the consent of the 

individual if the disclosure is compatible with the purposes for which the record was collected. 

See Routine Uses as listed in the system of records notices listed above in question #2.

9. Notice. 

Is notice provided to the individual prior to collection of their information (e.g., a posted Privacy 

Notice)? What opportunities do individuals have to decline to provide information (where providing the 

information is voluntary) or to consent to particular uses of the information (other than required or 

authorized uses), and how individuals can grant consent? 

OGC-CAMS resides on the EDUCATE network and is restricted to OGC access; all OGC personnel are 

advised during training that the system may contain PII and that the sharing of any PII is restricted for 

only OGC’s proper use. OGC personnel are also aware that the Assistant General Counsel for their 

division is the only person authorized to grant release of PII and in the official performance of the duties 

and then only to legitimate authorized users. This is a general OGC policy and practice, which applies to 

the handling of any information stored on OGC-CAMS.

10. Web Addresses. 

List the web addresses (known or planned) that have a Privacy Notice.

OGC-CAMS does not maintain web addresses.

4
Privacy Impact Assessment

11. Security. 

What administrative, technical, and physical security safeguards are in place to protect the PII? 

Examples include: monitoring, auditing, authentication, firewalls, etc. Has a C&A been completed? Is 

the system compliant with any federal security requirements? 

OGC-CAMS uses EDUCATE as its general support system. The software maintains audit and usage logs 

(history accounting) that will be monitored by authorized OGC personnel for authorized access. System 

permissions placed within the OGC-CAMS product also control security access only authorized users.

The information is secured following the guidance of OMB Circular A-130, “Management of Federal 

Information Resources,” Appendix III, “Security of Federal Automated Information Resources,” and 

Public Law 100-235, “Computer Security Act of 1987.” OGC-CAMS resides on the Department network 

and is in compliance with Department Risk Assessment policy and procedures. The OGC-CAMS System 

Security Plan (SSP) details the security requirements and describes the security controls that are in place 

to meet those requirements. 

Sensitive data, such as that covered by the Privacy Act, must be protected from unauthorized disclosure, 

modification, and destruction. The following guidelines and procedures have been implemented for 

protecting OGC-CAMS sensitive data and resources. 

Computers are not left unattended when processing sensitive data or when sensitive data or a critical 

application system is resident in memory.

Sensitive information is secured when visitors are present.

Sensitive material is stored in a secure locked cabinet. Material is returned to locked cabinets when not in 

use.

A C&A has not been completed on OGC-CAMS but is scheduled for completion in mid-2010, after the 

system has completed development.

12. Privacy Act System of Records. 

Is a system of records being created or altered under the Privacy Act, 5 U.S.C. 552a? Is this a 

Department-wide or Federal Government-wide SORN? If a SORN already exists, what is the SORN 

Number? 

A system of record notice is not being created. Currently, there are 8 systems of records which cover 

information collected which are listed above in question #2.

13. Records Retention and Disposition. 

Is there a records retention and disposition schedule approved by the National Archives and Records 

Administration (NARA) for the records created by the system development lifecycle AND for the data 

collected? If yes – provide records schedule number:

OGC-CAMS manages records in accordance with ED 066 A 11 and records notices as listed previously in 

question #2.

5