Privacy Impact Assessment

For

ED.gov Blogs

Date:

March 18, 2015

Point of Contact:

Jill James

jill.james@ed.gov

System Owner:

Carollynn Hammersmith

Carollynn.Hammersmith@usdedeop.onmicrosoft.com

Authors:

Alan Smigielski and Jill James

alan.smigielski@ed.gov 

Office of Communications and Outreach

U.S. Department of Education

Office of Management Privacy Safeguards Division
Privacy Impact Assessment

1. System Information. 

Describe the system - include system name, system acronym, and a description of the system, to include 

scope, purpose and major functions. Indicate whether the system is new or existing and whether or not 

the PIA is new or being updated from a previous version; specify whether the system is “agency” or 

“contractor.”

The Secretary’s Homeroom Blog and office and initiative blogs hosted on www.ed.gov (at 

www.ed.gov/blog and www.ed.gov/edblogs respectively) are WordPress blog instances that support the 

Department of Education’s (ED) efforts to facilitate an ongoing dialogue with the American public on 

education issues. Blog articles provide insights on the activities of schools, programs, grantees, and other 

education stakeholders to promote continuing discussion of educational innovation and reform. Articles 

do not endorse any educational product, service, curriculum or pedagogy.

2. Legal Authority. 

Cite the legal authority to collect and use this data. What specific legal authorities, arrangements, and/or 

agreements regulate the collection of information?

The President’s Memorandum on Transparency and Open Government (January 21, 2009) and the 

Director of the Office of Management and Budget’s (OMB) Open Government Directive Memorandum 

(December 8, 2009), direct agencies to harness new technologies to engage the public and provide 

concrete steps to implement the system of transparency, participation, and collaboration. They also 

encourage the solicitation of public feedback to identify information of the greatest use to the public, 

assess and improve levels of collaboration, and identify new opportunities for cooperation in government.

In response to this Memorandum, ED developed its Open Government Plan. 

http://www.ed.gov/open/plan. This plan encourages public participation using web-based collaboration 

tools and will use such tools to engage the public. Accordingly, the Department uses social media 

websites or applications for external relations (such as communications, outreach, and public dialogue), to 

provide information about or from the Department, to encourage citizen participation, engagement, and 

collaboration, to provide a new channel for ED to broadcast core messages targeted at the ED community 

and to provide customer service. The Department uses these tools to make information and services 

widely available, while promoting transparency and accountability. Any information that ED places on a 

social media website or application will also be made available through ED’s official website 

(www.ed.gov), or other official means, whenever possible. 

The Department also has authority to perform “public information functions, including the provision, 

through the use of the latest technologies, of useful information about education and related opportunities 

to students, parents, and communities.” 20 U.S.C. Section 3412(e) (2). Although ED uses social media 

websites and applications, it does not actively seek sensitive PII, nor does it collect, maintain, or 

disseminate sensitive PII from individuals who interact with its authorized social media websites and 

applications.

In very limited circumstances, ED may use the minimum amount of non-sensitive PII that it receives if 

that information is necessary for the proper performance of agency functions and has practical utility. 

OMB Circular A-130. For example, if a user provides an e-mail address, and requests the Department to 

respond, ED may use the e-mail address only to respond.

Office of Management and Budget’s Memorandum “Social Media, Web-Based Interactive Technologies, 

and the Paperwork Reduction Act” 

http://www.whitehouse.gov/sites/default/files/omb/assets/inforeg/SocialMediaGuidance_04072010.pdf 

2
Privacy Impact Assessment

addresses the “applicability of the PRA to social media and web-based interactive technologies,” 

including blogs. The memo explains that “certain uses of social media and web-based interactive 

technologies will be treated as equivalent to activities that are currently excluded from the PRA.” It 

continues:

“Notably, OMB’s regulations implementing the PRA exclude facts or opinions provided in response to 

general solicitations published in the Federal Register or other publications. As agencies increasingly use 

web-based technologies as a means of ‘publishing’ such solicitations, OMB believes that it is appropriate 

to exclude these activities as well. This Memorandum identifies a series of other activities that, consistent 

with the text and purposes of the PRA, OMB has determined may be excluded from its purview. Such 

activities include many uses of wikis, the posting of comments, the conduct of certain contests, and the 

rating and ranking of posts or comments by website users.”

3. Characterization of the Information. 

What elements of personally identifiable information (PII) are collected and maintained by the system 

(e.g., name, social security number, date of birth, address, phone number)? What are the sources of 

information (e.g., student, teacher, employee, university)? How is the information collected (website, 

paper form, on-line form)? Is the information used to link or cross-reference multiple databases?

ED has several external blogs managed by program offices. These blogs increase ED's online presence 

and are another method for the public to interact with ED. Each blog has the functionality to allow readers 

to comment with a screen name and requires them to provide an e-mail address. The e-mail address is not 

visible to other blog readers. This information is not used to link or cross-reference any other databases.

The Homeroom Blog (www.ed.gov/blog) occasionally collects a user's first name, last name, and e-mail 

address for event registration purposes, and in some cases, ED collects informal feedback and stories. For 

informal feedback, name and email address are not required. In some blog posts that collect informal 

feedback, users can also choose whether to opt in to the Department’s newsletter.

4. Why is the information collected? 

How is this information necessary to the mission of the program, or contributes to a necessary agency 

activity? Given the amount and any type of data collected, discuss the privacy risks (internally and/or 

externally) identified and how they were mitigated.

ED collects the screen name and e-mail address of commenters on ED blogs for the purpose of blog 

moderation. These fields facilitate commenting and discussion and allow moderation of the blog where 

necessary. 

Individuals may comment on items posted on blogs. The individual must provide a screen name and a 

valid email address. Only the screen name is visible to the public. Both the e-mail and screen name have 

been voluntarily shared with ED, and are captured and saved through ED's records management 

processes. The screen names and email addresses are not used for any other purpose.

For blog posts seeking informal feedback, the feedback form explains that the information provided, and 

the users first name, may be used in Department of Education communications and on the website and 

blog.

3
Privacy Impact Assessment

5. Social Security Number (SSN).

If an SSN is collected and used, describe the purpose of the collection, the type of use, and any 

disclosures. Also specify any alternatives that you considered, and why the alternative was not selected. 

If system collects SSN, the PIA will require a signature by the Assistant Secretary or designee. If no SSN 

is collected, no signature is required.

ED Blogs do not collect SSNs.

6. Uses of the Information. 

What is the intended use of the information? How will the information be used? Describe all internal 

and/or external uses of the information. What types of methods are used to analyze the data? Explain 

how the information is used, if the system uses commercial information, publicly available information, or 

information from other Federal agency databases.

E-mail address and screen name are collected when blog readers voluntarily elect to comment on a blog 

post. These fields facilitate commenting and discussion and allow moderation of the blog where 

necessary. The information from blog comments is not used for any other purpose.

Information collected from informal forms is used internally to help get an idea of different public 

reactions. Publicly, the information, including first name and examples from the stories they opted to 

provide, may be used in Department speeches or public-facing communications.

7. Internal Sharing and Disclosure. 

With which internal ED organizations will the information be shared? What information is shared? For 

what purpose is the information shared?

All of the comments captured through the management of ED's blogs consist of information that is or was 

publicly accessible. E-mail addresses provided by commenters are accessible only to blog admin staff. PII 

that has been removed from a blog comment in accordance with our comment and posting policy is 

retained in the records of the office that manages the blog.

8. External Sharing and Disclosure. 

With what external entity will the information be shared (e.g., another agency for a specified 

programmatic purpose)? What information is shared? For what purpose is the information shared? 

How is the information shared outside of the Department? Is the sharing pursuant to a Computer 

Matching Agreement (CMA), Memorandum of Understanding or other type of approved sharing 

agreement with another agency?

All comments and screen names captured through the management of ED's blogs are information that is 

or was publicly accessible. 

E-mail addresses provided by commenters are not shared outside the Department and are not shared 

pursuant to a CMA, MOU or other type of sharing agreement with another agency.

4
Privacy Impact Assessment

9. Notice. 

Is notice provided to the individual prior to collection of their information (e.g., a posted Privacy 

Notice)? What opportunities do individuals have to decline to provide information (where providing the 

information is voluntary) or to consent to particular uses of the information (other than required or 

authorized uses), and how individuals can grant consent? 

All information collected through ED's blogs is information voluntarily shared by individuals with ED. 

On each blog maintained by ED, there is a link to the blog's comment and posting policy. The 

comment and posting policy tell visitors: "To protect your own privacy and the privacy of others, 

please do not include personally identifiable information, such as name, Social Security number, 

addresses, phone numbers or email addresses in the body of your comment. If you do voluntarily 

include your name in a comment, which we generally do not recommend, that comment may or may 

not be posted on these pages. If your comment is posted, your name may be redacted or removed. In no 

circumstances will comments be posted that contain Social Security numbers, addresses, email address, 

phone numbers, or similar personally identifiable information." The privacy policy is available at 

http://www.ed.gov/blog/comments-policy/.

10. Web Addresses. 

List the web addresses (known or planned) that have a Privacy Notice.

The privacy policy is available at http://www.ed.gov/blog/comments-policy/.

11. Security. 

What administrative, technical, and physical security safeguards are in place to protect the PII? 

Examples include: monitoring, auditing, authentication, firewalls, etc. Has a C&A been completed? Is 

the system compliant with any federal security requirements? 

All PII is secured in accordance with ED's internal directive on PII. In particular, sensitive PII removed 

from a blog in accordance with the comment and posting policy is stored electronically in a passwordprotected file.

12. Privacy Act System of Records. 

Is the information within the system retrieved by personal identifier? If so, is a system of records being 

created or altered under the Privacy Act, 5 U.S.C. 552a? Is this a Department-wide or Federal 

Government-wide SORN? If a SORN already exists, what is the SORN Number? 

A system of record notice is not needed because the information collected is not retrieved by any personal 

identifiers. Therefore, a system of record as defined by the Privacy Act is not being created and the 

reporting requirements of OMB Circular A-130 do not apply.

5
Privacy Impact Assessment

13. Records Retention and Disposition. 

Is there a records retention and disposition schedule approved by the National Archives and Records 

Administration (NARA) for the records created by the system development lifecycle AND for the data 

collected? If yes – provide records schedule number:

A records retention and disposition schedule has not yet been submitted for approval by the National 

Archives and Records Administration (NARA) for Ed.gov Blogs. When completed, the draft schedule 

will be submitted to NARA for review and approval. Until such time as NARA accepts a retention and 

disposition schedule, these records will be treated as permanent and will not be destroyed.

6