Privacy and Civil Liberties Impact Assessment

Template version 4.4

Shared Accounting Module (SAM)

September 1, 2020

Bureau Certifying Official

David J. Ambrose

Chief Security Officer and Chief Privacy Officer

Bureau of the Fiscal Service

Department of the Treasury

The mission of the Bureau of the Fiscal Service (Fiscal Service) is to promote the financial integrity and 

operational efficiency of the federal government through exceptional accounting, financing, collections, 

payments, and shared services.

This Privacy and Civil Liberties Impact Assessment (PCLIA) is a public document and will be made 

available to the general public via the Fiscal Service Privacy and Civil Liberties Impact Assessment (PCLIA) 

webpage (PCLIA WEBPAGE).
1

Section 1: Introduction

It is the policy of the Department of the Treasury (“Treasury” or “Department”) and its Bureaus to 

conduct a Privacy and Civil Liberties Impact Assessment (“PCLIA”) when Personally Identifiable 

Information (“PII”) is maintained in a system or by a project. PCLIAs are required for all systems and 

projects that collect, maintain, or disseminate PII, regardless of the manner in which the information is 

retrieved.

This assessment is being completed pursuant to Section 208 of the E-Government Act of 2002 (“E-Gov 

Act”), 44 U.S.C. § 3501, Office of the Management and Budget (“OMB”) Memorandum 03-22, “OMB 

Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002,” and Treasury 

Directive 25-07, “Privacy and Civil Liberties Impact Assessment (PCLIA).”

Section 2: Definitions

Agency – means any entity that falls within the definition of the term “executive agency” as defined in 

31 U.S.C. § 102.

Certifying Official – The Bureau Privacy and Civil Liberties Officer(s) who certify that all requirements in 

TD and TD P 25-07 have been completed so a PCLIA can be reviewed and approved by the Treasury 

Deputy Assistant Secretary for Privacy, Transparency, and Records.

Collect (including “collection”) – means the retrieval, receipt, gathering, or acquisition of any PII and its 

storage or presence in a Treasury system. This term should be given its broadest possible meaning.

Contractors and service providers – are private companies that provide goods or services under a 

contract with the Department of the Treasury or one of its bureaus. This includes, but is not limited to, 

information providers, information processors, and other organizations providing information system 

development, information technology services, and other outsourced applications.

Data mining – means a program involving pattern-based queries, searches, or other analyses of 1 or 

more electronic databases, where – (a) a department or agency of the federal government, or a nonfederal entity acting on behalf of the federal government, is conducting the queries, searches, or other 

analyses to discover or locate a predictive pattern or anomaly indicative of terrorist or criminal activity 

on the part of any individual or individuals; (b) the queries, searches, or other analyses are not subjectbased and do not use personal identifiers of a specific individual, or inputs associated with a specific 

individual or group of individuals, to retrieve information from the database or databases; and (c) the 

purpose of the queries, searches, or other analyses is not solely – (i) the detection of fraud, waste, or 

abuse in a government agency or program; or (ii) the security of a government computer system.

Disclosure – When it is clear from its usage that the term “disclosure” refers to records provided to the 

public in response to a request under the Freedom of Information Act (5 U.S.C. § 552, “FOIA”) or the 

Privacy Act (5 U.S.C. § 552a), its application should be limited in that manner. Otherwise, the term 
2

should be interpreted as synonymous with the terms “sharing” and “dissemination” as defined in this 

manual. 

Dissemination – as used in this manual, is synonymous with the terms “sharing” and “disclosure” 

(unless it is clear from the context that the use of the term “disclosure” refers to a FOIA/Privacy Act 

disclosure).

E-Government – means the use of digital technologies to transform government operations to improve 

effectiveness, efficiency, and service delivery.

Federal information system – means a discrete set of information resources organized for the 

collection, processing, maintenance, transmission, and dissemination of information owned or under 

the control of a federal agency, whether automated or manual.

Final Rule – After the NPRM comment period closes, the agency reviews and analyzes the comments 

received (if any). The agency has the option to proceed with the rulemaking as proposed, issue a new or 

modified proposal, or withdraw the proposal before reaching its final decision. The agency can also 

revise the supporting analyses contained in the NPRM (e.g., to address a concern raised by a member of 

the public in response to the NPRM).

Government information – means information created, collected, used, maintained, processed, 

disseminated, or disposed of by or for the federal government.

Individual – means a citizen of the United States or an alien lawfully admitted for permanent residence. 

If a question does not specifically inquire about or an issue does not clearly involve a Privacy Act System 

of Records , the term should be given its common, everyday meaning. In certain contexts, the term 

individual may also include citizens of other countries who are covered by the terms of an international 

or other agreement that involves information stored in the system or used by the project.

Information – means any representation of knowledge such as facts, data, or opinions in any medium or 

form, regardless of its physical form or characteristics. This term should be given the broadest possible 

meaning. This term includes, but is not limit to, information contained in a Privacy Act System of 

Records .

Information technology (IT) – means any equipment or interconnected system or subsystem of 

equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, 

movement, control, display, switching, interchange, transmission, or reception of data or information by 

the executive agency, if the equipment is used by the executive agency directly or is used by a 

contractor under a contract with the executive agency that requires the use: (i) of that equipment; or (ii) 

of that equipment to a significant extent in the performance of a service or the furnishing of a product. 

It includes computers, ancillary equipment (including imaging peripherals, input, output, and storage 

devices necessary for security and surveillance), peripheral equipment designed to be controlled by the 

central processing unit of a computer, software, firmware and similar procedures, services (including 

support services), and related resources; but does not include any equipment acquired by a federal 

contractor incidental to a federal contract. Clinger-Cohen Act of 1996, 40 U.S.C. § 11101(6).

Major Information system – embraces “large” and “sensitive” information systems and means “a 

system or project that requires special management attention because of its importance to an agency 
3

mission; its high development, operating, or maintenance costs; or its significant role in the 

administration of agency programs, finances, property, or other resources.” OMB Circular A-130, § 6.u. 

This definition includes all systems that contain PII and are rated as “MODERATE or HIGH impact” under

Federal Information Processing Standard 199. 

National Security systems – a telecommunications or information system operated by the federal 

government, the function, operation or use of which involves: (1) intelligence activities, (2) cryptologic 

activities related to national security, (3) command and control of military forces, (4) equipment that is 

an integral part of a weapon or weapons systems, or (5) systems critical to the direct fulfillment of 

military or intelligence missions, but does not include systems used for routine administrative and 

business applications, such as payroll, finance, logistics, and personnel management. Clinger-Cohen Act 

of 1996, 40 U.S.C. § 11103. 

Notice of Proposed Rule Making (NPRM) – the Privacy Act (Section (J) and (k)) allow agencies to use the 

rulemaking process to exempt particular systems of records from some of the requirements in the Act. 

This process is often referred to as “notice-and-comment rulemaking.” The agency publishes an NPRM 

to notify the public that the agency is proposing a rule and provides an opportunity for the public to 

comment on the proposal before the agency can issue a final rule. 

Personally Identifiable Information (PII) –any information that can be used to distinguish or trace an 

individual’s identity, either alone or when combined with other personal or identifying information that 

is linked or linkable to a specific individual. 

Privacy and Civil Liberties Impact Assessment (PCLIA) – a PCLIA is:

(1) a process conducted to: (a) identify privacy and civil liberties risks in systems, programs, and 

other activities that maintain PII; (b) ensure that information systems, programs, and other 

activities comply with legal, regulatory, and policy requirements; (c) analyze the privacy and 

civil liberties risks identified; (d) identify remedies, protections, and alternative or additional 

privacy controls necessary to mitigate those risks; and (e) provide notice to the public of 

privacy and civil liberties protection practices.

(2) a document that catalogues the outcome of that privacy and civil liberties risk assessment 

process.

Protected Information – as the term is used in this PCLIA, protected information the same definition 

given to that term in TD 25-10, section 4.

Privacy Act Record – any item, collection, or grouping of information about an individual that is 

maintained by an agency, including, but not limited to, the individual’s education, financial transactions, 

medical history, and criminal or employment history and that contains the individual’s name, or the 

identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or 

voice print or a photograph. 5 U.S.C. § 552a (a)(4).

Reviewing Official – The Deputy Assistant Secretary for Privacy, Transparency, and Records who reviews 

and approves all PCLIAs as part of her/his duties as a direct report to the Treasury Senior Agency Official 

for Privacy. 
4

Routine Use – with respect to the disclosure of a record outside of Treasury (i.e., external sharing), the 

sharing of such record for a purpose which is compatible with the purpose for which it was collected 5 

U.S.C. § 552a(a)(7).

Sharing – any Treasury initiated distribution of information to government employees or agency 

contractors or grantees, including intra- or inter-agency transfers or exchanges of Treasury information, 

regardless of whether it is covered by the Privacy Act. It does not include responses to requests for 

agency records under FOIA or the Privacy Act. It is synonymous with the term “dissemination” as used 

in this assessment. It is also synonymous with the term “disclosure” as used in this assessment unless it 

is clear from the context in which the term is used that it refers to disclosure to the public in response to 

a request for agency records under FOIA or the Privacy Act. 

System – as the term used in this manual, includes both federal information systems and information 

technology.

System Owner – Official responsible for the overall procurement, development, integration, 

modification, or operation and maintenance of a system.

System of Records – a group of any records under the control of Treasury from which information is 

retrieved by the name of the individual or by some identifying number, symbol, or other identifying 

particular assigned to the individual. 5 U.S.C. § 552a (a)(5).

System of Records Notice – Each agency that maintains a System of Records shall publish in the 

Federal Register upon establishment or revision a notice of the existence and character of the System of 

Records , which notice shall include: (A) the name and location of the system; (B) the categories of 

individuals on whom records are maintained in the system; (C) the categories of records maintained in 

the system; (D) each routine use of the records contained in the system, including the categories of 

users and the purpose of such use; (E) the policies and practices of the agency regarding storage, 

retrievability, access controls, retention, and disposal of the records; (F) the title and business address of 

the agency official who is responsible for the System of Records ; (G) the agency procedures whereby an 

individual can be notified at her/his request if the System of Records contains a record pertaining to 

him; (H) the agency procedures whereby an individual can be notified at her/his request how she/he can 

gain access to any record pertaining to him contained in the System of Records , and how she/he can 

contest its content; and (I) the categories of sources of records in the system. 5 U.S.C. § 552a (e)(4).

Section 3: System Overview 

Section 3.1: System/Project Description and Purpose

SAM is a major application owned by the Fiscal Accounting Division of the Bureau of the Fiscal Service 

(Fiscal Service), Department of the Treasury. SAM is developed by the Federal Reserve Bank of St. Louis

(FRB-STL) and supported by both FRB-STL and Fiscal Service. The application is used nationwide by 

Federal Program Agencies (FPAs).

The SAM application is a central repository of business rules used to validate and classify the accounting 

transactions provided by feeder systems and report the information to the Central Accounting Reporting 
5

System (CARS) through the Central Accounting Front End (CAFÉ) module. SAM receives CARS master 

data information and applies the updates to the application’s data tables.

SAM supports the program needs of FPAs and cash management for the Department of Treasury. SAM 

information assets include accounting classification data, user permission data related to a user’s role 

with SAM, agency organization data, user activity data, and CARS master data which includes Treasury 

Account Symbols (TAS), Business Event Type Codes (BETC) and Agency Location Codes (ALC).

PII is used to register and provision system users.

.

It supports the mission of the Bureau by allowing those registered to access and use the SAM system.

Estimated Number of Individuals Whose Personally Identifiable Information is Maintained in the 

System or by the Project

☒ 0 – 999 ☐ 1000 – 9,999 ☐ 10,000 – 99,999

☐ 100,000 – 499,999

☐ 10,000,000 – 99,999,999

☐ 500,000 – 999,999

☐ 100,000,000 – 999,999,999

☐ 1,000,000 – 9,999,999

☐ 1,000,000,000 +

Section 3.2: Authority to Collect

Fiscal Service develops and maintains the SAM system under the authority of statute 12 U.S.C. 

5018, which grants Financial Agent authority to the U.S. Treasury. SAM is a tool used by the U.S. 

Treasury, Fiscal Service, the Federal Reserve System and Federal Agencies and 12 U.S.C. 391, 

which grants Fiscal Agent authority to the U.S. Treasury. Fiscal Service has designated the Federal 

Reserve Bank of St. Louis to build and operate SAM under this authority. 

Section 4: Information Collection

Section 4.1: Relevant and Necessary

Section 4.1(a) Please check all of the following that are true:

1. ☐ None of the PII maintained in the system or by the project is part of a Privacy Act System of 

Records ;

2. ☒ All of the PII maintained in the system or by the project is part of a System of Records and 

none of it is exempt from the Privacy Act relevant and necessary requirement;

3. ☐ All of the PII maintained in the system or by the project is part of a System of Records and all 

of it is exempt from the Privacy Act relevant and necessary requirement;

4. ☐ Some, but not all, of the PII maintained in the system or by the project is part of a System of 

Records and the records to which the Privacy Act applies are exempt from the relevant and 

necessary requirement; and

5. ☐ Some, but not all, of the PII maintained in the system or by the project is part of a System of 

Records and none of the records to which the Privacy Act applies are exempt from the relevant 

and necessary requirement.
6

Section 4.1(b) ☐ Yes ☒ No ☐ N/A With respect to PII maintained in the system or by the project 

that is subject to the Privacy Act’s relevant and necessary requirement, was an assessment conducted 

prior to collection (e.g., during Paperwork Reduction Act analysis) to determine which PII types (see 

Section 4.2 below) were relevant and necessary to meet the system’s or project’s mission 

requirements? 

Section 4.1(c) ☒ Yes ☐ No ☐ N/A With respect to PII currently maintained in the system or by the 

project that is subject to the Privacy Act’s relevant and necessary requirement, is the PII limited to 

only that which is relevant and necessary to meet the system’s or project’s mission requirements?

Section 4.1(d) ☒ Yes ☐ No ☐ N/A With respect to PII maintained in the system or by the project that 

is subject to the Privacy Act’s relevant and necessary requirement, is there a process to continuously 

reevaluate and ensure that the PII remains relevant and necessary?

 

Section 4.2: PII and/or information types or groupings

To perform their missions, federal agencies must necessarily collect various types of information. The 

checked boxes below represent the types of information maintained in the system or by the project. 

Information identified below is used by the system or project to fulfill the purpose stated in Section 3.2 –

Authority to Collect.

Biographical/General Information 

☒ Name ☐ Gender ☐ Group/Organization 

Membership

☐ Date of Birth ☐ Race ☐ Military Service Information

☐ Home Physical/Postal 

Mailing Address

☐ Ethnicity ☐ Personal Home Phone or Fax 

Number

☐ Zip Code ☐ Personal Cell Number ☐ Alias (including nickname)

☒ Business Physical/Postal 

Mailing Address

☐ Business Cell Number ☒ Business Phone or Fax 

Number

☐ Personal e-mail address ☐ Nationality ☐ Mother’s Maiden Name

☒ Business e-mail address ☐ Country of Birth ☐ Spouse Information

☐ Personal Financial 

Information (including loan 

information)

☐ City or County of Birth ☐ Children Information

☐ Business Financial 

Information (including loan 

information)

☐ Immigration Status ☐ Information about other 

relatives.

☐ Marital Status ☐ Citizenship ☐ Professional/personal 

references or other information 

about an individual’s friends, 

associates or acquaintances.
7

☐ Religion/Religious 

Preference

☐ Device settings or 

preferences (e.g., security 

level, sharing options, 

ringtones).

☐ Global Positioning System 

(GPS)/Location Data

☐ Sexual Orientation ☐ Usernames, avatars, etc. ☐ Secure Digital (SD) Card or 

Other Data stored on a card or 

other technology

☐ Cell tower records (e.g., 

logs. user location, time etc.)

☐ Network communications 

data

☐ Cubical or office number

☐ Contact lists and 

directories (known to contain 

personal information)

☐ Contact lists and 

directories (not known to 

contain personal information, 

but uncertain)

☐ Contact lists and directories 

(known to contain only business 

information)

☐ Education Information ☐ Resume or curriculum 

vitae

☐ Other (please describe): 

☐ Other (please describe): ☐ Other (please describe): 

______________________

☐ Other (please describe):

______________________

Identifying Numbers 

☐ Full Social Security number ☐ Health Plan Beneficiary Number

☐ Truncated/Partial Social Security number 

(e.g., last 4 digits)

☐ Alien Registration Number

☐ Personal Taxpayer Identification Number ☐ Business Taxpayer Identification Number (If 

known: ☐ sole proprietor; ☐ non-sole 

proprietor)

☐ Personal Credit Card Number ☐ Business Credit Card Number (If known: ☐ 

sole proprietor; ☐ non-sole proprietor)

☐ Personal Vehicle Identification Number ☐ Business Vehicle Identification Number (If 

known: ☐ sole proprietor; ☐ non-sole 

proprietor)

☐ Personal License Plate Number ☐ Business License Plate Number (If known: 

☐ sole proprietor; ☐ non-sole proprietor)

☐ File/Case ID Number (individual) ☐ File/Case ID Number (business) (If known: ☐ 

sole proprietor; ☐ non-sole proprietor)

☐ Personal Professional License Number ☐ Business Professional License Number (If 

known: ☐ sole proprietor; ☐ non-sole 

proprietor)

☐ Employee Identification Number ☐ Patient ID Number 

☐ Business Bank Account Number ☐ Personal Bank Account Number

☐ Commercially obtained internet 

navigation/purchasing habits of individuals

☐ Government obtained internet 

navigation/purchasing habits of individuals

☐ Business License Plate Number (non-soleproprietor)☐ Driver’s License Number
8

☐ Personal device identifiers or serial numbers ☐ Other Identifying Numbers (please 

describe):____________________________

☐ Passport Number and Passport information 

(including full name, passport number, DOB, 

POB, sex, nationality, issuing country 

photograph and signature) (use “Other” if some 

but not all elements are collected)

☐ Other Identifying Numbers (please 

describe):____________________________

Medical/Emergency Information Regarding Individuals

☐ Medical/Health 

Information

☐ Worker’s Compensation Act 

Information

☐ Patient ID Number

☐ Mental Health 

Information

☐ Disability Information ☐ Emergency Contact 

Information (e.g., a third party 

to contact in case of emergency)

☐ Other (please describe): ____________________________________________________

Biometrics/Distinguishing Features/Characteristics of Individuals

☐ Physical description/

characteristics (e.g., hair, eye 

color, weight, height, sex, 

gender)

☐ Signatures ☐ Vascular scans

☐ Fingerprints ☐ Photos ☐ Retina/Iris Scans

☐ Palm prints ☐ Video ☐ Dental Profile

☐ Voice audio recording ☐ Scars, marks, tattoos ☐ DNA Sample or Profile

☐ Other (please describe): 

______________________

☐ Other (please describe): 

_______________________

☐ Other (please describe): 

_______________________

Specific Information/File Types 

☐ Taxpayer Information/Tax 

Return Information

☐ Law Enforcement 

Information

☐ Security 

Clearance/Background Check 

Information

☐ Civil/Criminal History 

Information/Police Records 

(government source)

☐ Credit History Information 

(government source)

☐ Bank Secrecy Act Information

☐ Civil/Criminal History 

Information/Police Records 

(commercial source)

☐ Credit History Information 

(commercial source)

☐ National Security/Classified 

Information

☐ Protected Information (as 

defined in Treasury Directive 

25-10)

☐ Case files ☐ Personnel Files

☐ Information provided 

under a confidentiality 

agreement 

☐ Information subject to the 

terms of an international or 

other agreement 

☐ Other (please describe): 

______________________

Audit Log and Security Monitoring Information
9

☒ User ID assigned to or 

generated by a user of 

Treasury IT

☒ Date and time an individual 

accesses a facility, system, or 

other IT

☐ Files accessed by a user of 

Treasury IT (e.g., web navigation 

habits)

☐ Passwords generated by or 

assigned to a user of Treasury 

IT

☐ Internet or other queries 

run by a user of Treasury IT

☐ Contents of files accessed by 

a user of Treasury IT

☐ Biometric information used 

to access Treasury facilities or 

IT

☐ Video of individuals 

derived from security cameras

☐ Public Key Information (PKI).

☐ Information revealing an 

individual’s presence in a 

particular location as derived 

from security token/key fob, 

employee identification card 

scanners or other IT or devices

☐ Still photos of individuals 

derived from security 

cameras.

☐ Internet Protocol (IP) Address

☐ Other (please describe): ☐ Other (please describe): ☐ Other (please describe):

_____________________

Other

☐ Other (please describe: ______________ ☐ Other (please describe: _______________

☐ Other (please describe: ______________ ☐ Other (please describe: _______________

Section 4.3: Sources of information and the method and manner of collection

Individuals Individuals Individuals Individuals

Specific PII identified 

in Section 4.2 that 

was acquired from 

this source: First 

Name.

Specific PII identified 

in Section 4.2 that 

was acquired from 

this source: Last 

name.

Specific PII identified 

in Section 4.2 that 

was acquired from 

this source: Work 

email

Specific PII identified 

in Section 4.2 that 

was acquired from 

this source: Work 

physical and postal 

address.

Manner in which 

information is 

acquired from source 

by the Treasury 

project/system: The 

first name is entered 

on a paper form. 

Manner in which 

information is acquired 

from source by the 

Treasury 

project/system: The last 

name is entered on a 

paper form.

Manner in which 

information is acquired 

from source by the 

Treasury 

project/system: The 

work email is entered 

on a paper form.

Manner in which 

information is 

acquired from source 

by the Treasury 

project/system: The 

work email and postal 

address is entered and 

on a paper form.

☒ From a paper or 

electronic form 

provided to 

individuals, the public 

or members of a 

particular group

☒ From a paper or 

electronic form 

provided to individuals, 

the public or members 

of a particular group

☒ From a paper or 

electronic form 

provided to individuals, 

the public or members 

of a particular group

☒ From a paper or 

electronic form 

provided to

individuals, the public 

or members of a 

particular group
10

Please identify the 

form name: SAM 

Access Authorization 

Form

Please identify the form 

name: SAM Access 

Authorization Form

Please identify the form 

name: SAM Access 

Authorization Form

Please identify the 

form name: SAM 

Access Authorization 

Form

_________________

☐ Received in paper 

format other than a 

form.

☐ Received in paper 

format other than a 

form.

☐ Received in paper 

format other than a 

form.

☐ Received in paper 

format other than a 

form.

☐ Delivered to the 

project on disk or 

other portable device 

and uploaded to the 

system.

☐ Delivered to the 

project on disk or other 

portable device and 

uploaded to the system.

☐ Delivered to the 

project on disk or other 

portable device and 

uploaded to the system.

☐ Delivered to the 

project on disk or 

other portable device 

and uploaded to the 

system.

☐ Accessed and 

downloaded or 

otherwise acquired via 

the internet

☐ Accessed and 

downloaded or 

otherwise acquired via 

the internet

☐ Accessed and 

downloaded or 

otherwise acquired via 

the internet

☐ Accessed and 

downloaded or 

otherwise acquired via 

the internet

☐ Email ☐ Email ☐ Email ☐ Email 

☐ Scanned documents 

uploaded to the 

system.

☐ Scanned documents 

uploaded to the system.

☐ Scanned documents 

uploaded to the system.

☐ Scanned documents 

uploaded to the 

system.

☐ Bulk transfer ☐ Bulk transfer ☐ Bulk transfer ☐ Bulk transfer

☐ Extracted from 

particular technology 

(e.g., radio frequency 

identification data 

(RFID) devices, video 

or photographic 

cameras, biometric 

collection devices).

☐ Extracted from 

particular technology 

(e.g., radio frequency 

identification data 

(RFID) devices, video or 

photographic cameras, 

biometric collection 

devices).

☐ Extracted from 

particular technology 

(e.g., radio frequency 

identification data 

(RFID) devices, video or 

photographic cameras, 

biometric collection 

devices).

☐ Extracted from 

particular technology 

(e.g., radio frequency 

identification data 

(RFID) devices, video 

or photographic 

cameras, biometric 

collection devices).

☐ Fax ☐ Fax ☐ Fax ☐ Fax

☐ Extracted from 

notes of a phone 

interview or face to 

face contact

☐ Extracted from notes 

of a phone interview or 

face to face contact

☐ Extracted from notes 

of a phone interview or 

face to face contact

☐ Extracted from 

notes of a phone 

interview or face to 

face contact

☐ Other: Please 

describe:

_________________

☐ Other: Please 

describe:

_________________

☐ Other: Please 

describe:

_________________

☐ Other: Please 

describe:

_________________
11

☐ Other: Please 

describe:

_________________

☐ Other: Please 

describe:

_________________

☐ Other: Please 

describe:

_________________

☐ Other: Please 

describe:

_________________

Section 4.4: Privacy and/or civil liberties risks related to collection

Notice of Authority, Principal Uses, Routine Uses, and Effect of not Providing Information

When federal agencies use a form to obtain information from an individual that will be maintained in a 

System of Records , they must inform the individual of the following: “(A) the authority (whether 

granted by statute, or by executive order of the President) which authorizes the solicitation of the 

information and whether disclosure of such information is mandatory or voluntary; (B) the principal 

purpose or purposes for which the information is intended to be used; (C) the routine uses which may 

be made of the information as published pursuant to paragraph (4)(D) of this subsection; and (D) the 

effects on her/him, if any, of not providing all or any part of the requested information.” 5 U.S.C § 

522a(e)(3).

Section 4.4(a) ☒ Yes ☐ No Is any of the PII maintained in the system or by the project collected 

directly from an individual? 

Section 4.4(b) ☒ Yes ☐ No ☐ N/A Was the information collected from the individual using a form 

(paper or electronic)? 

Section 4.4(c) ☐ Yes ☒ No ☐ N/A If the answer to Section 4.4(b) was “yes,” was the individual 

notified (on the form in which the PII was collected or on a separate form that can be retained by 

the individual) about the following at the point where the information was collected (e.g., in a form; 

on a website).

☐ The authority (whether granted by statute, or by Executive order of the President) which 

authorizes the solicitation of the information.

☐ Whether disclosure of such information is mandatory or voluntary.

☐ The principal purpose or purposes for which the information is intended to be used.

☐ The individuals or organizations outside of Treasury with whom the information may be/ 

will be shared.

☐ The effects on the individual, if any, if they decide not to provide all or any part of the 

requested information.

Use of Social Security Numbers

Social Security numbers (“SSNs”) are commonly used by identity thieves to commit fraudulent acts 

against individuals. The SSN is one data element that has a heightened ability to harm the individual and 

requires more protection when used. Therefore, in an effort to reduce risk to individuals and federal 

agencies, government-wide initiatives aimed at eliminating unnecessary collection, use, and display of 

SSN have been underway since OMB required agencies to review their SSN practices in 2007. 
12

In addition, the Privacy Act provides that: “It shall be unlawful for any federal, state or local government 

agency to deny to any individual any right, benefit, or privilege provided by law because of such 

individual’s refusal to disclose his social security account number.” Pub. L. No. 93–579, § 7. This 

provision does not apply to: (1) any disclosure which is required by federal statute; or (2) any disclosure 

of an SSN to any federal, state, or local agency maintaining a System of Records in existence and 

operating before January 1, 1975, if such disclosure was required under statute or regulation adopted 

prior to such date to verify the identity of an individual. Id. at § 7(a)(2)(A)-(B).

Section 4.4(d) ☐ Yes ☒ No ☐ N/A Does the system or project maintain SSNs?

Section 4.4(e) ☐ Yes ☐ No ☒ N/A Are there any alternatives to the SSNs as a personal identifier?

Section 4.4(f) ☐ Yes ☐ No ☒ N/A Will an individual be denied any right, benefit, or privilege 

provided by law if the individual refuses to disclose their SSN? If yes, please check the applicable 

box:

☐ SSN disclosure is required by Federal statute or Executive Order. ; or

☐ the SSN is disclosed to any federal, state, or local agency maintaining a System of 

Records in existence and operating before January 1, 1975, and disclosure was required 

under statute or regulation adopted prior to such date to verify the identity of an individual. 

If checked, please provide the name of the System of Records below. 

Section 4.4(g) ☐ Yes ☐ No ☒ N/A When the SSN is collected, are individuals given notice whether 

disclosure is mandatory or voluntary, the legal authority such number is solicited, and what uses will 

be made of it?

First Amendment Activities

The Privacy Act provides that federal agencies “maintain no record describing how any individual 

exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the 

individual about whom the record is maintained or unless pertinent to and within the scope of an 

authorized law enforcement activity.” 5 U.S.C. § 552a(e)(7).

Section 4.4(h) ☐ Yes ☒ No Does the system or project maintain any information describing how an 

individual exercises their rights guaranteed by the First Amendment? 

Section 4.4(i) If the system or project maintains information describing how an individual exercises 

their rights guaranteed by the First Amendment, do any of the following exceptions apply (the 

information may be maintained if any of the exceptions apply)?

☒ N/A (system or project does not maintain any information describing how an individual 

exercises their rights guaranteed by the First Amendment, so no exceptions are needed)

☐ The individual about whom the information was collected or maintained expressly 

authorizes its collection/maintenance. 

☐ The information maintained is pertinent to and within the scope of an authorized law 

enforcement activity.
13

☐ There is a statute that expressly authorizes its collection. 

Section 5: Maintenance, use, and sharing of the information

The following sections require a clear description of the system’s or project’s use of information.

Section 5.1: Describe how and why the system or project uses the information it 

collects and maintains

Please describe all of the uses of the information types and groupings collected and maintained by the 

system or project (see Section 4.2), including a discussion of why the information is used for this 

purpose and how it relates to the mission of the bureau or office that owns the system. 

The general information is used to create a unique identifier for access to SAM. This usage is 

consistent with the Fiscal Service’s mission to promote the financial integrity and operational 

efficiency of the federal government through data transparency.

Collecting Information Directly from the Individual When Using it to Make Adverse 

Determinations About Them

The Privacy Act requires that federal agencies “collect information to the greatest extent 

practicable directly from the subject individual when the information may result in adverse 

determinations about an individual’s rights, benefits, and privileges under federal programs.” 5 U.S.C. 

§ 552a(e)(2).

Section 5.1(a) ☐ Yes ☒ No Is it possible that the information maintained in the system or by the 

project may be used by Treasury to make an adverse determination about an individual’s rights, 

benefits, and privileges under federal programs (e.g., decisions about whether the individual will 

receive a financial benefit, get a clearance or access to a Treasury facility, obtain employment with 

Treasury)? 

Section 5.1(b) ☐ Yes ☒ No Is it possible that Treasury will share information maintained in the 

system or by the project with a third party external to the Department that will use the information 

to make an adverse determination about an individual’s rights, benefits, and privileges under 

federal programs? 

Section 5.1(c) ☐ Yes ☐ No ☒ N/A If information could potentially be used to make an adverse 

determination about an individual’s rights, benefits, and privileges under federal programs, does 

the system or project collect information (to the greatest extent practicable) directly from the 

individual? 

Data Mining

As required by Section 804 of the Implementing the 9/11 Commission Recommendations Act of 2007

(“9-11 Commission Act”), Treasury reports annually to Congress on its data mining activities. For a 
14

comprehensive overview of Treasury’s data mining activities, please review the Department’s Annual 

Privacy reports available at: http://www.treasury.gov/privacy/annual-reports.

Section 5.1(d) ☐ Yes ☒ No Is information maintained in the system or by the project used to 

conduct “data-mining” activities as that term is defined in the Implementing the 9-11 Commission 

Act? 

Section 5.2: Ensuring accuracy, completeness, and timeliness of information 

collected, maintained, and shared

Exemption from Accuracy, Relevance, Timeliness, and Completeness Requirements

The Privacy Act requires that federal agencies “maintain all records which are used by the agency in 

making any determination about any individual with such accuracy, relevance, timeliness, and 

completeness as is reasonably necessary to assure fairness to the individual in the determination.” 5 

U.S.C. § 552a(e)(5). If a particular System of Records meets certain requirements (including the NPRM

process defined in Section 2 above), an agency may exempt the System of Records (or a portion of the 

records) from this requirement. 

Section 5.2(a) ☐ Yes ☒ No Is all or any portion of the information maintained in the system or by 

the project: (a) part of a System of Records and (b) exempt from the accuracy, relevance, 

timeliness, and completeness requirements in sections (e)(5) of the Privacy Act? 

Computer Matching

The Computer Matching and Privacy Protection Act of 1988 amended the Privacy Act, imposing 

additional requirements when Privacy Act systems of records are used in computer matching programs. 

Matching programs must be conducted pursuant to a matching agreement between the source and 

recipient agencies. The matching agreement describes the purpose and procedures of the matching and

establishes protections for matching records. 

Section 5.2(b) ☐ Yes ☒ No Is any of the information maintained in the system or by the project (a) 

part of a System of Records and (b) used as part of a matching program? 

Section 5.2(c) ☐ Yes ☐ No ☒ N/A Is there a matching agreement in place that contains the 

information required by Section (o) of the Privacy Act? 

Section 5.2(d) ☐ Yes ☐ No ☒ N/A Are assessments made regarding the accuracy of the records 

that will be used in the matching program? 

Section 5.2(e) ☐ Yes ☐ No ☒ N/A Does the bureau or office that owns the system or project 

independently verify the information, provide the individual notice and an opportunity to contest 

the findings, or obtain Data Integrity Board approval in accordance with Section (p) of the Privacy 

Act before taking adverse action against the individual? 
15

Ensuring Fairness in Making Adverse Determinations About Individuals

Federal agencies are required to “maintain all records which are used by the agency in making any 

determination about any individual with such accuracy, relevance, timeliness, and completeness as is 

reasonably necessary to assure fairness to the individual in the determination.” 5 U.S.C. § 552a(e)(5). 

This requirement also applies when merging records from two or more sources where the merged 

records are used by the agency to make any determination about any individual. 

Section 5.2(f) ☐ Yes ☒ No With respect to the information maintained in the system or

by the project, are steps taken to ensure all information used to make a determination about

an individual is maintained with such accuracy, relevance, timeliness, and completeness as

is reasonably necessary to assure fairness to the individual in the determination?

Merging Information About Individuals

Section 5.2(g) ☐ Yes ☒ No Is information maintained in the system or by the project merged with 

electronic or non-electronic information from internal or external sources (e.g., other files or 

systems)? 

Section 5.2(h) ☐ Yes ☐ No ☒ N/A Once merged, is the information used in making determinations 

about individuals (e.g., decisions about whether the individual will receive a financial benefit or 

payment, get a clearance or access to a Treasury facility, obtain employment with Treasury, etc.)? 

Section 5.2(i) ☐ Yes ☐ No ☒ N/A Are there documented policies or procedures for how 

information is merged? 

Section 5.2(j) ☐ Yes ☐ No ☒ N/A Do the documented policies or procedures address how to 

proceed when partial matches (where some, but not all of the information being merged matches a 

particular individual) are discovered after the information is merged?

Section 5.2(k) ☐ Yes ☐ No ☒ N/A If information maintained in the system or by the project is used 

to make a determination about an individual, are steps taken to ensure the accuracy, relevance, 

timeliness, and completeness of the information as is reasonably necessary to assure fairness to the 

individual?

Policies and Standard Operating Procedures or Technical Solutions Designed to Ensure 

Information Accuracy, Completeness, and Timeliness

 Section 5.2(l) ☐ Yes ☒ No ☐ N/A If information maintained in the system or by the

project is used to make any determination about an individual (even if it is an exempt

System of Records ), are there documented policies or standard operating procedures for the 

system or project that address the accuracy, completeness, and timeliness of the information? 
16

Section 5.2(m) ☐ Yes ☒ No Does the system or project use any software or other technical 

solutions designed to improve the accuracy, completeness, and timeliness of the information used 

to make an adverse determination about an individual's rights, benefits, and/or privileges 

(regardless of if it is an exempt System of Records )? 

Accuracy, Completeness, and Timeliness of Information Received from the Source

Section 5.2(n) ☐ Yes ☒ No Did Treasury or the bureau receive any guarantee, assurance, or other 

information from any information source(s) regarding the accuracy, timeliness and completeness of 

the information maintained in the system or by the project? 

Disseminating Notice of Corrections of or Amendments to PII

Section 5.2(o) ☐ Yes ☐ No ☒ N/A Where feasible and appropriate, is there a process in place for 

disseminating corrections of or amendments to the PII maintained in the system or by the project 

to all internal and external information-sharing partners?

Section 5.2(p) ☐ Yes ☐ No ☒ N/A Where feasible and appropriate, does the process for 

disseminating corrections or amendments include notifying the individual whose information is 

corrected or amended? 

Section 5.3: Information sharing within the Department of the Treasury

Internal Information Sharing

Section 5.3(a) ☐ Yes ☒ No Is PII maintained in the system or by the project shared with other 

Treasury bureaus?

Section 5.3(b) ☒ Yes ☐ No Does the Treasury bureau or office that receives the PII limit access to 

those Treasury officers and employees who have a need for the PII in the performance of their 

official duties (i.e., those who have a “need to know”)?

Memorandum of Understanding (MOU)/Other Agreements Limiting Treasury’s Internal 

Use/Disclosure of PII

Section 5.3(c) ☐ Yes ☐ No ☒ N/A Is any of the PII maintained in the system or by the project 

subject to the requirements of a Memorandum of Understanding or other agreement (e.g., 

agreement with another federal or state agency that provided the information to the Treasury or 

subject to an international agreement or treaty) that limits or places conditions on Treasury’s 

internal use, maintenance, handling, or disclosure of the PII? 

Section 5.4: Information sharing with external (i.e., outside Treasury) organizations and individuals
17

External Information Sharing

Section 5.4(a) ☐ Yes ☒ No Is PII maintained in the system or by the project shared with 

agencies, organizations, or individuals external to Treasury? 

Accounting of Disclosures

Section 5.4(b) ☐ Yes ☐ No ☒ N/A With respect to records maintained in the system or by the 

project that are subject to the Privacy Act, do you maintain a paper or electronic log or other record 

of the date, nature, and purpose of each disclosure (not including intra-agency disclosures and FOIA 

disclosures) of a record to any person or to another agency (outside of Treasury) and the name and 

address of the person or agency to whom the disclosure is made? See 5 U.S.C § 552a(c). 

Section 5.4(c) ☐ Yes ☐ No ☒ N/A If you do not keep a running tabulation of every disclosure at 

the time it is made, are you able to reconstruct an accurate and complete accounting of disclosures 

so as to be able to respond to Privacy Act requests in a timely fashion? 

Section 5.4(d) ☐ Yes ☐ No ☒ N/A With respect to records maintained in the system or by the 

project that are subject to the Privacy Act, do you retain the log or other record of the date, nature, 

and purpose of each disclosure, for at least five years or the life of the record, whichever is longer, 

after the disclosure for which the accounting is made? 

Section 5.4(e) ☐ Yes ☐ No ☒ N/A With respect to records maintained in the system or by the 

project that are subject to the Privacy Act, does your bureau or office exempt the System of Records 

(as allowed by the Privacy Act in certain circumstances) from the requirement to make the 

accounting available to the individual named in the record? 

Section 5.4(f) ☐ Yes ☐ No ☒ N/A With respect to records maintained in the system or by the 

project that are subject to the Privacy Act, does your bureau or office exempt the System of Records 

(as allowed by the Privacy Act in certain circumstances) from the requirement to inform any person 

or other agency about any correction or notation of dispute made by the agency of any record that 

has been disclosed to the person or agency if an accounting of the disclosure was made?

Statutory or Regulatory Restrictions on Disclosure

Section 5.4(g) ☐ Yes ☒ No In addition to the Privacy Act, are there any other statutory or 

regulatory restrictions on the sharing of any of the PII maintained in the system or by the project 

(e.g., 26 U.S.C § 6103 for tax returns and return information)? 

Memorandum of Understanding Related to External Sharing

Section 5.4(h) ☐ Yes ☐ No ☒ N/A Has Treasury (including bureaus and offices) executed a 

Memorandum of Understanding, or entered into any other type of agreement, with any external 
18

agencies, organizations, or individuals with which/whom it shares PII maintained in the system or by 

the project?

Memorandum of Understanding Limiting Treasury’s Use or Disclosure of PII

Section 5.4(i) ☐ Yes ☒ No Is any of the PII maintained in the system or by the project subject to the 

requirements of a Memorandum of Understanding or other agreement (e.g., agreement with 

another federal or state agency, an international agreement or treaty, or contract with private 

vendor that provided the information to Treasury or one of its bureaus) that limits or places 

conditions on Treasury’s internal use or external (i.e., outside Treasury) sharing of the PII? 

Memorandum of Understanding Limiting External Party’s Use or Disclosure of PII

Section 5.4(j) ☐ Yes ☒ No Is any of the PII maintained in the system or by the project subject to the 

requirements of a Memorandum of Understanding or other agreement in which Treasury limits or 

places conditions on an external party’s use, maintenance, handling, or disclosure of PII shared by 

Treasury? 

Obtaining Consent Prior to New Disclosures Not Included in the SORN or Authorized by the Privacy 

Act

Section 5.4(k) ☐ Yes ☐ No ☒ N/A Is the individual’s consent obtained, where feasible and 

appropriate, prior to any new disclosures of previously collected records in a System of Records 

(those not expressly authorized by the Privacy Act or contained in the published SORN (e.g., in the 

routine uses))? 

Section 6: Compliance with federal information management requirements

Responses to the questions below address the practical, policy, and legal consequences of failing to 

comply with one or more of the following federal information management requirements (to the 

extent required) and how those risks were or are being mitigated: (1) the Privacy Act System of 

Records Notice Requirement; (2) the Paperwork Reduction Act; (3) the Federal Records Act; (4) the 

E-Gov Act security requirements; and (5) Section 508 of the Rehabilitation Act of 1973.

Section 6.1: Privacy Act System of Records Notice (SORN)

For collections of PII that meet certain requirements, the Privacy Act requires that the agency publish a 

SORN in the Federal Register.

System of Records 

Section 6.1(a) ☐ Yes ☒ No Does the system or project retrieve System of Records about an 

individual using an identifying number, symbol, or other identifying particular assigned to the 

individual? (See items selected in Section 4.2 above). 

(Treasury/Fiscal Service SORNs: https://www.fiscal.treasury.gov/privacy.html)
19

Section 6.1(b) ☐ Yes ☐ No ☒ N/A Was a SORN published in the Federal Register for this System of 

Records ? 

Section 6.2: The Paperwork Reduction Act

The PRA requires OMB approval before a federal agency may collect standardized data from 10 or more 

respondents within a 12 month period. OMB requires agencies to conduct a PIA (i.e., PCLIA) when 

initiating, consistent with the PRA, a new electronic collection of PII for 10 or more persons (excluding 

agencies, instrumentalities, or employees of the federal government).

Paperwork Reduction Act Compliance

Section 6.2(a) ☐ Yes ☒ No Does the system or project maintain information obtained from 

individuals and organizations who are not federal personnel or an agency of the federal 

government (i.e., outside the federal government)? 

Section 6.2(b) ☐ Yes ☐ No ☒ N/A Does the project or system involve a new collection of 

information in identifiable form for 10 or more persons from outside the federal government? 

Section 6.2(c) ☐ Yes ☐ No ☒ N/A Did the project or system complete an Information Collection 

Request (“ICR”) and receive OMB approval?

Section 6.3: Records Management - NARA/Federal Records Act Requirements

Records retention schedules determine the maximum amount of time necessary to retain information in 

order to meet the needs of the project or system. Information is generally either disposed of or sent to 

the NARA for permanent retention upon expiration of this period.

NARA Records Retention Requirements

Section 6.3(a) ☒ Yes ☐ No Are the records used in the system or by the project covered by 

NARA’s General Records Schedules (“GRS”) or Treasury/bureau Specific Records Schedule (SRS)? 

Section 6.3(b) ☐ Yes ☒ No Did NARA approved a retention schedule for the records maintained 

in the system or by the project?

Section 6.3(c) ☐ Yes ☐ No ☒ N/A If NARA did not approve a retention schedule for the records 

maintained in the system or by the project and the records are not covered by NARA’s GRS or 

Treasury/bureau SRS, has a draft retention schedule (approved by all applicable Treasury and/or 

Bureau officials) been developed for the records used in this project or system?

All Treasury owned data maintained by this system is retained and destroyed in accordance with 

the Fiscal Service File Plan. All Treasury owned records schedules and categories within the Fiscal 

Service File Plan are approved by NARA.
20

Section 6.4: E-Government Act/NIST Compliance

The completion of Federal Information Security Modernization Act (FISMA) Security Assessment & 

Authorization (SA&A) process is required before a federal information system may receive Authority to 

Operate (“ATO”). Different security requirements apply to National Security Systems.

Federal Information System Subject to FISMA Security Assessment and Authorization

Section 6.4(a) ☒ Yes ☐ No ☐ N/A Is the system a federal information system subject to FISMA 

requirements?

Section 6.4(b) ☒ Yes ☐ No ☐ N/A Has the system or project undergone a SA&A and received an 

ATO? 

Access Controls and Security Requirements

Section 6.4(c) ☒ Yes ☐ No Does the system or project include access controls to ensure limited 

access to information maintained by the system or project?

Security Risks in Manner of Collection

Section 6.4(d) ☐ Yes ☒ No In Section 4.3 above, you identified the sources for information used in 

the system or project and the method and manner of collection. Were any security, privacy, or civil 

liberties risks identified with respect to the manner in which the information is collected from the 

source(s)? 

Security Controls When Sharing Internally or Externally

Section 6.4(e) ☐ Yes ☐ No ☒ N/A Are all Treasury/bureau security requirements met in the 

method of transferring information (e.g., bulk transfer, direct access by recipient, portable disk, 

paper) from the Treasury project or system to internal or external parties? 

Monitoring of Individuals

Section 6.4(f) ☐ Yes ☒ No Will this system or project have the capability to identify, locate, and 

monitor individuals or groups of people? 

Audit Trails

Section 6.4(g) ☒ Yes ☐ No Are audit trails regularly reviewed for appropriate use, 

handling, and disclosure of PII maintained in the system or by the project inside or outside 

of the Department? 
21

Section 6.5: Section 508 of the Rehabilitation Act of 1973

When federal agencies develop, procure, maintain, or use Electronic and Information Technology 

(“EIT”), Section 508 of the Rehabilitation Act of 1973 (as amended in 1998) requires that individuals with 

disabilities (including federal employees) must have access and use (including privacy policies and 

directives as well as redress opportunities) that is comparable to that which is available to individuals 

who do not have disabilities.

Applicability of and Compliance With the Rehabilitation Act

Section 6.5(a) ☒ Yes ☐ No Will the project or system involve the development, procurement, 

maintenance or use of EIT as that term is defined in Section 508 of the Rehabilitation Act of 1973 (as 

amended in 1998)? 

Section 6.5(b) ☒ Yes ☐ No ☐ N/A Does the system or project comply with all Section 508

requirements, thus ensuring that individuals with disabilities (including federal employees) have 

access and use (including access to privacy and civil liberties policies) that is comparable to that 

which is available to individuals who do not have disabilities? 

Section 7: Redress

Access Under the Freedom of Information Act and Privacy Act

Section 7.0(a) ☒ Yes ☐ No Does the agency have a published process in place by which individuals 

may seek records under the Freedom of Information Act and Privacy Act? 

The Treasury FOIA and PA disclosure regulations can be found at 31 C.F.R. Part 1, Subtitle A, 

Subparts A and C.

Privacy Act Access Exemption

Section 7.0(b) ☐ Yes ☒ No Was any of the information that is maintained in System of Records and 

used in the system or project exempted from the access provisions of the Privacy Act? 

Additional Redress Mechanisms

Section 7.0(c) ☐ Yes ☒ No With respect to information maintained by the project or system 

(whether or not it is covered by the Privacy Act), does the bureau or office that owns the project or 

system have any additional mechanisms other than Privacy Act and FOIA remedies (e.g., a customer 

satisfaction unit; a complaint process) by which an individual may request access to and/or 

amendment of their information and/or contest adverse determinations about denial of their rights, 

benefits, and privileges under federal programs (e.g., decisions about whether the individual will 

receive a financial benefit, get a clearance or access to a Treasury facility, obtain employment with 

Treasury)?