1

MD #: 0470.1

Department of Homeland Security

 Management Directive System

MD Number: 0470.1

PRIVACY ACT

COMPLIANCE

1. Purpose

This directive establishes the Department of Homeland Security (DHS) policy for Privacy 

Act Compliance.

2. Scope

This directive applies to all DHS organizational elements.

3. Authorities

This directive is governed by numerous Public Laws and national policy, such as:

A. The Privacy Act of 1974, as amended, 5 U.S.C. 552a, Public Law (Pub.L.) 93-579.

B. The Homeland Security Act of 2002, codified in Title 6, US Code.

C. DHS Privacy Act Regulations, 68 FR 4056 (Jan. 27, 2003).

4. Definitions

A. Individual: A citizen of the United States or an alien lawfully admitted for permanent 

residence. 

B. Privacy Act Record: Any item, collection, or grouping of information about an 

individual that is maintained by DHS in a system of records, including, but not limited to, the 

individual's education, financial transactions, medical history, and criminal or employment 

history and that contains the name, or an identifying number, symbol, or other identifying 

particular assigned to the individual, such as a finger or voice print or a photograph. 

C. Responsible Official: The official having custody of the records requested, or a 

designated official, who makes initial determinations whether to grant or deny requests for 

notification, access to records, accounting of disclosures, and amendments of records. 
2

MD #: 0470.1

D. System Manager: The official identified in the system notice who is responsible for 

the operation and management of the system of records. 

E. System of Records: A group of any records under the control of DHS from which 

information is retrieved by the name of the individual or by some identifying number, 

symbol, or other identifying particular assigned to the individual. 

F. Designated DHS Official: Senior DHS officials as designated by the Secretary, 

Deputy Secretary or Under Secretaries.

5. Responsibilities

System managers, program managers, and agency personnel (such as personnel 

specialists, finance officers, investigators, acquisition officials, attorneys/advisors, public 

affairs and disclosure officials) who have information contained in a system of records 

incident to the conduct of official business, shall be knowledgeable about the provisions 

and requirements of the Privacy Act and privacy provisions of the Homeland Security Act. 

A. The Privacy Officer shall:

1. ensure that the use of technology sustains, and does not erode, privacy 

protections relating to the use, collection and disclosure of personal information;

2. ensure that personal information contained in Privacy Act systems of records 

is handled in full compliance with fair information practices in the Privacy Act of 

1974;

3. evaluate legislative and regulatory proposals involving collection, use and 

disclosure of personal information by the Federal Government;

4. conduct a privacy impact assessment of proposed rules of the Department 

on the privacy of personal information, including the type of personal information 

collected and the number of people affected; 

5. prepare a report to Congress on an annual basis on activities of the 

Department that affect privacy, including complaints of privacy violations, 

implementation of the Privacy Act of 1974, internal controls and other matters; and 

6. shall approve the notices and rules required to be published by the Privacy 

Act of 1974, as amended. This includes the authority to ratify, where necessary, any 

such rule previously issued. The authority in this paragraph may not be delegated. 

During the absence of the Privacy Officer, any required notices and rules shall be 

approved by the Deputy Secretary. 

B. The Departmental Disclosure Officer - (DDO) shall: 

1. coordinate the implementation and management of the Privacy Act within 

DHS;
3

MD #: 0470.1

2. act as the principal point of contact and the Department's representative for 

matters related to the Privacy Act; 

3. issue, and revise as needed, DHS regulations implementing the Privacy Act 

and review proposed changes to agency disclosure regulations; 

4. assign Privacy Act requests to appropriate responsible officials for action 

and follow up as necessary; 

5. notify a requester when all the information needed to process a request for 

records was not provided; 

6. collect, review, consolidate, and submit the data for the biennial Report to 

Congress on Computer Matching Programs for transmittal to OMB; and for the 

Secretary’s annual report to Congress on Department activities that affect privacy; 

7. coordinate, review, revise, and submit: 

(a) the Privacy Act compilation of notices of DHS' systems of records for 

publication in the Federal Register; 

(b) notices and reports on new or altered systems of records to the Office of 

Management and Budget (OMB), Congress, and the Federal Register on 

behalf of DHS; 

(c) notices on minor changes to systems of records to the Federal Register 

on behalf of DHS;

(d) notices, reports, and proposed rules to OMB, Congress, and the Federal 

Register concerning exempt systems of records on behalf of DHS; and 

(e) notices and reports for computer matches covered under the provisions 

of the Computer Matching and Privacy Protection Act of 1988 to OMB, 

Congress, and the Federal Register on behalf of DHS; 

8. be prepared to report the results of reviews conducted by DHS 

organizational elements as specified in OMB Circular A-130, Appendix I, paragraph 

3.a., to the Director, OMB, including any corrective action taken; 

9. furnish policy, technical advice, and assistance to DHS organizational 

elements on publication of notices of systems of records and the conduct of Privacy 

Impact Assessments; 

10. review all DHS forms and data collection screens and the Privacy Impact 

Assessments related thereto used to collect information about individuals (except 

forms and data collection screens developed and used by the individual DHS units),

reserving the right to disapprove the use of any such forms or data collection 

screens determined noncompliant with the Privacy Act and implementing 

regulations and guidelines; 

11. supervise the implementation of the Privacy Act within DHS; and 
4

MD #: 0470.1

12. ensure that all DHS organizational elements:

(a) establish procedures necessary to carry out the provisions of this 

Directive, OMB Circular A-130, Appendix I, and the Privacy Act; 

(b) provide guidance for employees and contractors who are involved in 

designing, operating, or maintaining DHS Privacy Act systems of records; 

and 

(c) conduct Privacy Act training of employees and contractors who are 

involved in maintaining DHS Privacy Act systems of records or who have 

access to records contained in such systems. 

13. in partnership with the Privacy Officer, participate on government-wide task 

forces on computer technology concerned with establishing or affecting policies for 

collecting, compiling, using, maintaining and safeguarding Federal Privacy Act 

systems of records. 

C. The Under Secretaries and all DHS Designated Officials, as it relates to their 

respective offices, shall: 

1. establish internal procedures to ensure the effectiveness of DHS’ Privacy Act 

program and to safeguard individual privacy in the collection, compilation, 

maintenance, use, and dissemination of Federal records. For units transferring into 

DHS where such internal procedures may already exist, they may continue to be 

used until amended or replaced by the DHS Privacy Officer. The procedures shall 

be consistent with this Directive and:

(a) the Homeland Security Act of 2002;

(b) the Privacy Act of 1974, as amended; 

(c) the Computer Matching and Privacy Protection Act of 1988; 

(d) the Federal Information Security Management Act; 

(e) OMB Circular A-130; 

(f) applicable National Archives and Records Administration, Office of 

Personnel Management (OPM) and Office of Federal Register guidelines;

and

(g) DHS Privacy Act Regulations.

2. submit the following, as required, to the Departmental Disclosure Officer for 

the review and approval of the Privacy Officer: 

(a) accurate data for the Biennial Computer Matching Report to Congress

and the Secretary’s Annual Privacy Report to Congress; 

(b) other reports as required by OMB Circular A-130, or as required by the 

Departmental Disclosure Officer. 
5

MD #: 0470.1

3. submit the following, as required, to the Departmental Disclosure Officer for 

the review and approval of the Privacy Officer: 

(a) a notice and/or report for each new or altered system of records, along 

with the Privacy Impact Assessment; 

(b) a proposed and final rule, along with the Privacy Impact Assessment, for 

any determination to exempt a system of records; 

(c) a notice and report of the establishment or alteration of a matching 

program; and 

(d) any proposed rules or amendments to existing Privacy Act regulations, 

along with the Privacy Impact Assessment, for review and concurrence prior 

to the review and concurrence procedures under MD-0490.

4. establish an internal review of all office forms and data collection screens 

used to collect information, to include the Privacy Impact Assessment, about 

individuals to ensure that the forms and screens are in compliance with the Privacy 

Act and implementing regulations and guidelines.

D. The Under Secretary for Management shall: 

 1. provide oversight, guidance and support to the DDO;

2. provide assistance as needed to the DDO regarding any proposed or 

anticipated change to computer installations, communications networks, or other 

electronic data collecting mechanisms which may be potentially subject to the 

Privacy Act; 

 3. assist DHS organizational elements in the implementation of uniform and 

consistent policies and standards governing the acquisition, maintenance and use 

of computers or other electronic or telecommunications equipment in the collection, 

compilation, maintenance, use, or dissemination of Privacy Act records; 

4. provide security guidance to the bureaus regarding the processing, storing, 

transferring or receiving of information on individuals by computer, electronic or 

other telecommunications means or networks; 

 5. with and through the Departmental Disclosure Office, participate on governmentwide task forces on computer technology concerned with establishing or affecting 

policies for collecting, compiling, using, maintaining and safeguarding Federal 

Privacy Act systems of records; and

6. provide the DDO with proposed data collection screens, or other electronic 

data collecting mechanisms used to collect information about individuals, for 

Privacy Act compliance review, along with the Privacy Impact Assessment, prior to 

their use on the Intranet or Internet. 

E. The Associate General Counsel (General Law ) shall: provide assistance as 

required by the Privacy Officer and the Departmental Disclosure Officer in the clearance of 
6

MD #: 0470.1

reports, notices of systems of records, proposed rules, and other related matters to be 

submitted by DHS to Congress, OMB, and other parties. The Associate General Counsel, 

General Law, shall also handle all appeals of denials made pursuant to paragraph 5.G(2) 

of this Directive.

F. Systems Managers shall:

1. ensure compliance with the Privacy Act and notify the Departmental Disclosure 

Officer when establishing, maintaining, revising, or deleting a system of records; 

 2. establish administrative, technical and physical controls for storing and 

safeguarding records. Subject to the internal operating procedures of the DHS 

components, controls shall be consistent with DHS's security and recordkeeping 

regulations to ensure the protection of records systems from unauthorized access or 

disclosure, and from physical damage or destruction; and 

3. establish and implement appropriate means for the accounting of disclosures 

made pursuant to the Act. 

G. Responsible Officials shall: 

1. ensure that Privacy Act requests are processed in accordance with DHS' 

disclosure regulations; 

2. determine whether to grant or deny requests for notification, access to records, 

accounting of disclosures, and amendments records; 

 3. notify the requester of any determination(s) made pursuant to paragraph 

 5.G.(2); 

4. determine all costs for processing a request and determine whether 

duplication fees will be charged to the requester or waived; and 

5. retrieve records retired to the Federal Records Center if they are needed to 

process a request. 

H. Appeal Authorities. The Associate General Counsel, General Law, is the DHS 

appeal authority. He or she shall, upon receipt of a request for a review of a refusal 

to grant access, amend or account for a record, either affirm or reverse the initial 

determination that denies access, amendment or accounting of a record under the 

Privacy Act. 

6. Policy & Procedures

A. Policy: All employees shall be made aware of, and comply with, the Privacy Act 

and that information about individuals shall be collected, maintained, used, and 

disseminated in accordance with the Privacy Act and DHS regulations. Employees 

shall further be advised of the possible consequences for violations of the Privacy 
7

MD #: 0470.1

Act or DHS implementing authority.

B. Procedures: DHS procedures for compliance with the Privacy Act are 

 documented in the DHS Privacy Act Regulations, 68 FR 4056 (Jan. 27, 2003). 

C Questions or Concerns Regarding the Process: Any questions or concerns 

 regarding this directive should be addressed to the DDO.