2. What are the sources of the information in the system?

a. Is the source of the information from the individual or is it taken from
another source? If not directly from the individual, then what other source?

Data on covered employees is provided by the individuals' employer, The records
include, but are not limited to, identifying information such as: name(s),
employer; employee identification number, position, and quantitative and
qualitative information with respect to the employee's performance. The types of
records in the system may be comprehensive compensation data provided by the
individual's employer for current and prior years; information relating to
compensation plan design and documentation; and company performance data
relating to compensation plans.

b. What Federal agencies are providing data for use in the system?

The system receives no data from other federal agencies for use.

c. What State and/or local agencies are providing data for use in the system?
The system receives no data from state and/or local agencies.
d. From what other third party sources will data be collected?

In addition to data provided by the individual’s employer, the Special Master's
staff may also extract data from company filings submitted though the SEC’s
EDGAR database. Staff may obtain compensation data from Equilar Inc.,
which compiles data from public filings. Information collected from these
sources may consist of comprehensive compensation data provided by
individual's employer for current and prior years; information relating to
compensation plan design and documentation; and company performance data
relating to compensation plans.

e. What information will be collected from the employee and the public?
No information is collected directly from either the employee or from the public.
3. Accuracy, Timelines, and Reliability

a. How is data collected from sources other than bureau records verified for
accuracy?

The accuracy of the data submitted by each company is certified by the
company’s chief executive officer upon submission. Data extracted from the
SEC’s Edgar database is required to be accurate by the SEC. Finally, data


contracts enter into with contractors. In addition, the contractors and the system of
records are subject to the Treasury’s regulations on conflicts of interest and
confidentiality of information issued pursuant to EESA.

6. Do other systems share data or have access to the data in the system? If yes, explain.
No.

7. Who will be responsible for protecting the privacy rights of the public and
employees affected by the interface?

The Treasury will be responsible for protecting the privacy rights (as specified in the
Privacy Act, 5 U.S.C. § 552a, and other relevant legal requirements).

8. Will other agencies share data or have access to the data in this system (e.g. Federal,
State, Local, and Others)?

Other agencies will not have access to information contained in the system, except as
permitted by the Privacy Act or the System of Records Notice for this system which
details a number of Routine Uses to allow disclosure of data from this system to other
Federal Agencies.

9. How will the data be used by the other agency?

Information contained in the system may be used by other agencies in connection with
the administration of the Program and for legal and/or compliance purposes. Please see
response to item 8 immediately above.

10. Who is responsible for assuring proper use of the data?

The Treasury and the Office of the Special Master are responsible for assuring that
information contained in the system is used properly.

RESPONSIBLE OFFICIALS:

System Owner:
Bruce Mackay
Lead Executive Compensation Specialist
Office of Financial Stability
Department of the Treasury
202-622-4093

Bruce.mackay@do.treas.gov

System Manager:


5. How will the new data be verified for relevance and accuracy?
Not applicable. No new data is created or derived.

6. If the data is being consolidated, what controls are in place to protect the data from
unauthorized access or use?

Access to the data is limited to members of the Office of the Special Master who are
chartered to review, analyze and develop recommended compensation structures.

7. If processes are being consolidated, are the proper controls remaining in place to
protect the data and prevent unauthorized access? Explain.

The data is submitted in an encrypted manner by the company to a secure Treasury
mailbox. Data is then moved to either a controlled access SharePoint or controlled access
shared drive.

8. How will the data be retrieved? Does a personal identifier retrieve the data? If yes,
explain and list the identifiers that will be used to retrieve information on the
individual.

Data is submitted and stored, generally, in Excel format. Data includes the employee’s
name and a randomly assigned id number. Data may be consolidated or reviewed based
on name and/or employee id. Other records may be received and stored in PDF format.
These may be reviewed online or in paper copy. These documents may include name
and/or employee id.

9. What kinds of reports can be produced on individuals? What will be the use of these
reports? Who will have access to them?

Data is reviewed on an individual and aggregate company basis to determine the
appropriate compensation structure for the individual and company. The data is
maintained within the Office of the Special Master.

Maintenance and Administrative Controls

1. Ifthe system is operated in more than one site, how will consistent use of the system
and data be maintained in all sites?

The system is not operated in more than one site. Data is maintained on a controlled-
access shared drive, a controlled-access SharePoint, a relational database with limited
access and paper copies maintained in the Office of the Special Master in the Main
Treasury building.


collected from Equilar Inc. reflects data that is extracted from SEC filings.
Access to Equilar-compiled data is through a subscription service and can be
checked against actual SEC filings.

b. How is data checked for completeness?

Special Master's Office staff review all submitted data elements.

c. Is the data current? What steps or procedures are taken to ensure the data
is current and not out-of-date? Name the document (e.g., data models.)

All requested data is current for the applicable time periods. With respect to data
provided by Equilar, the data can be checked against actual SEC filings.

d. Are the data elements described in detail and documented? If yes, what is
the name of the document?

At present, the data elements are contained in Excel spreadsheets. These
spreadsheets are not titled.

Attributes of the Data

1. Is the use of the data both relevant and necessary to the purpose for which the
system is being designated?
Yes. The data that the Office of the Special Master has requested, and which the
companies are required to submit information by the Interim Final Rule (IFR) on
Executive Compensation, is both relevant and necessary for the determinations of
compensation payments and structures required by the IFR.

2. Will the system derive new data or create previously unavailable data about an
individual through aggregation from the information collected, and how will this be
maintained and filed?

No new data is created beyond what is provided by the individual’s employer or what is
obtained through publicly disclosed filings.

3. Will the new data be placed in the individual’s record?
Since no new data is created, no data is added to an individual’s record.

4, Can the system make determinations about employees/public that would not be
possible without the new data?

Not applicable. No new data is created or derived.


TARP Standards for Compensation and Corporate Governance — Executive
Compensation Information System--Treasury/DO.219

10. If the system is being modified, will the Privacy Act SORN require amendment or

revision? Explain.

This is a new system of records with a new SORN.

Access to Data

1

Who will have access to the data in the system? (e.g., contractors, users, managers,
system administrators, developers, others.)

Information in the system will be accessible only to the Special Master and his staff. In
addition, the Office of the Special Master may disclose information as permitted by the
Privacy Act and pursuant to the System of Records Notice for this system.

How is access to the data by a user determined? Are criteria, procedures, controls,
and responsibilities regarding access documented?

Access to the data is limited solely to members of the Office of the Special Master. This
includes access to the shared drive, SharePoint and paper copies.

Will users have access to all data on the system or will the user’s access be
restricted?

Only members of the Office of the Special Master have access to all the data on the
system.

What controls are in place to prevent the misuse (e.g., unauthorized browsing of
data by those having access? (list processes and training materials.)

Data in electronic format is encrypted or password protected. Direct access is limited to
employees within the Office of Financial Stability whose duties require access. The
building where the records are maintained is located after hours and has a 24 hour
security guard. Personnel screening and training are employed to prevent unauthorized
disclosures

Are contractors involved with the design and development of the system and will
they be involved with the maintenance of the system? If yes, was Privacy Act
contract clauses inserted in their contracts and other statutory and regulatory
measures addressed?

Contractors were involved with the design and development of the system, but do not
have access to any PII contained within the system. However, Treasury inserted Privacy
Act clauses in the Agreements with the contractors, and these terms are mirrored in any


Privacy Impact Assessment
For the

TARP Standards for Compensation & Corporate Governance
Executive Compensation Information System

February 24, 2010

Contact Point
Robert Jackson, Jr.
Department of the Treasury
1500 Pennsylvania Avenue, NW.
Washington D.C. 20220
202 522-0667

Robert.Jackson@do.treas.gov

Reviewing Official:

Dale Underwood
Privacy Officer
United States Department of the Treasury
Dale.Underwood@do.treas.gov



Eric MacPherson

Executive Compensation Specialist
Office of Financial Stability
Department of the Treasury
202-622-2208
Eric.macpherson@do.treas.gov

Information System Security Manager:
IT Reviewing Official:
Michael Duffy
Chief Information Officer
Department of the Treasury
202-622-5093
Michael.Duffy@do.treas.gov

Office of Financial Stability (OFS) Privacy Analyst:

Tracy Rogers

Privacy Analyst
Department of the Treasury
202-927-8868

Tracy.Rogers@do.treas.gov

Approval Signature

=

A Wada! Ye [ze

Dale Undérwooi
Privacy Officer
Unites States Department of the Treasury


What are the retention periods of data in this system?

The records will be maintained indefinitely until a record disposition schedule submitted
to the National Archives Records Administration has been approved.

What are the procedures for disposition of the data at the end of the retention
period? How long will the reports produced be kept? Where are the procedures
documented?

The records will be maintained indefinitely as indicated in the above answer.

Is the system using technologies in ways that the bureau/office has not previously
employed (e.g., monitoring software, Smart Cards, Caller-ID)?

No.

How does the use of this technology affect public/employee privacy?
Not applicable.

Will this system provide the capability to identify, locate, and monitor individuals?
If yes, explain.

Yes. The Department collects information from each TARP recipient in connection with
the review of compensation payments and compensation structures applicable to SEOs
and certain highly compensated employees. Information with respect to certain payments
to highly compensated employees will also be reviewed in connection with a
determination of whether such payments were inconsistent with the purposes of section
111 of EESA or TARP, or were otherwise contrary to the public interest.

What kinds of information are collected as a function of the monitoring of
individuals?

The type of information collected may be:

a. Comprehensive compensation data provided by the individual’s employer for current
and prior years;

b. Information to compensation plan design and documentation; and

c. Company performance data relating to compensation plans

What controls will be used to prevent unauthorized monitoring?
Access to data is limited to the Special Master and his staff, who have a need-to-know.

Under which Privacy Act SORN does the system operate? Provide number and
name.


3. Under which Privacy Act SORN does the system operate? (Provide the system name
and unique system identifier.)

TARP Standards for Compensation and Corporate Governance - Executive
Compensation Information System--Treasury/DO.219

Data in the System

1. What categories of individuals are covered in the system?

This system of records contains information about TARP recipients. The information
pertains to:

(a.) Senior Executive Officers (SEOs). SEO is an employee of the TARP recipient who is
“named executive officer”, as that term is defined by Instruction 1 to Item 402(a)(3) of
Regulation S-K of the Federal securities laws. 17 CFR 229.402(a). A Tarp recipient that
is a “smaller reporting company,” as that term is defined by Item 10 of Regulation S-K,
17 CFR 229.10, is required to identify SEOs consistent with the immediately preceding
sentence. A Tarp recipient that is a “smaller reporting company” must identify at least
five SEOs, even if only three named executive officers are provided in the disclosure
provided that no employee must be identified as an SEO if the employee’s total annual
compensation does not exceed $100,000 as defined in Item 402 (a)(3)(1) of Regulation S-
K. 17 CFR 229.402(a)(3)(1).

(b.) Most highly compensated employees; the term “most highly compensated employee”
means the employee of the TARP recipient whose annual compensation is determined to
be the highest among all employees of the TARP recipient, provided that a former
employee who is no longer employed as of the first day of the relevant fiscal year of the
TARP recipient is not a most highly compensated employee unless it is reasonably
anticipated that such employee will return to employment with the TARP recipient during
such fiscal year.

(c.) Other employees. Certain other employees of TARP recipients may be covered by the
system in the event that the TARP recipient or the employee requests guidance from the
Department with respect to the employee’s compensation or the Department otherwise
provides guidance with respect to the employee’s compensation.


4. Review of Prior Payments: The Special Master is required to review any bonuses,
retention awards, and other compensation paid to the 5 senior executive officers and 20
next most highly-compensated employees of each TARP recipient prior to February 17,
2009, to determine whether the payments were contrary to the public interest. If the
payment is determined to be contrary to the public interest, the Special Master will be
responsible for negotiating for reimbursements of such payments.

The Special Master is guided by the rules and principles identified in 31 C.F.R. § 30.16 and the
Treasury regulations in evaluating the TARP recipients' employee compensation. For example,
Treasury regulations expressly make clear that the Special Master must consider the competitive
market forces in determining compensation levels that will permit the companies to remain in
business, to thrive financially, and to eventually repay the taxpayer for Tarp financial assistance.
The companies must be able to attract sufficient talent to prosper. At the same time, however,
the law requires the Special Master to take into account whether the terms and conditions of
compensations are performance based and tie compensation to the companies’ prospective
performance and financial success. In addition, the regulations make clear that the Special
Master's compensation determination should be made in such a way that considers whether
senior executives are provided incentives to avoid taking excessive risk to receive greater
amounts of compensations. The law also anticipates that a portion of compensation be tied to
repayment of Tarp financial assistance, and requires companies to "claw back" incentive
compensation that is based upon inaccurate financial statements or performance metrics.

In sum, the standards and performance the Special Master use in evaluating employee
compensation can be founded in the statue and the accompanying Treasury regulations. In these
laws, Congress and Treasury provided the Special Master the guidance needed to make his
determination.

System Application/General Information

1. What is the purpose of the system/application?

The purpose of this system is to assist the Department in carrying out its responsibilities
under Section 111 of the Emergency Economic Stabilization Act of 2008 (EESA), as
amended by the American Recovery and Reinvestment Act of 2009 (ARRA), to provide
provisions of EESA that apply to entities that receive financial assistance under TARP.

2. What legal authority authorizes the purchase or development of this
system/application?

The development and implementation of the system is authorized by 31 U.S.C. 321 as
well as Section 111 of the Emergency Economic Stabilization Act (EESA) of 2008, as
amended by the American Recovery and Reinvestment Act of 2009 (ARRA). 12 U.S.C.
§221.


Summary:

The Department of the Treasury (UST), Office of Financial Stability (OFS) is publishing this
Privacy Impact Assessment (PIA) for the Trouble Asset Release Program (TARP) Standards for
Compensation and Corporate Governance — Executive Compensation Information System.
Treasury established the TARP pursuant to its authority under the Emergency Economic
Stabilization Act (EESA) of 2008 to provide immediate liquidity and stability to the financial
system. EESA, as amended by the American Recovery and Reinvestment Act (ARRA) of 2009,
requires that the Secretary of Treasury (Secretary) promulgate standards governing executive
compensation at financial institutions that have received assistance under TARP. This PIA is
being conducted because TARP Standards for Compensation and Corporate Governance —
Executive Compensation Information System contains personally identifiable information (PII).

In October, 2008, the UST established TARP under the Emergency Economic Stabilization Act
(EESA). EESA provided immediate authority and facilities that the Secretary could use to restore
liquidity and stability to the financial system. Section 101(a) of EESA authorizes the Secretary to
establish the TARP to “purchase, and to make and fund commitments to purchase, troubled assets
from any financial institution, on such terms and conditions as are determined by the Secretary, and
in accordance with EESA and policies and procedures developed and published by the Secretary.”

On February 13, 2009, Congress enacted the ARRA, which the President signed into law on
February 17, 2009. The ARRA amended in its entirety section 111 of EESA. Section 111 of EESA
provides that certain entities that receive financial assistance from Treasury under the TARP will be
subject to specified executive compensation and corporate governance standards to be established by
the Secretary.!

On June 15, 2009, the Secretary released the Treasury’s Interim Final Rule for TARP Standards
for Compensation and Corporate Governance, which sets forth standards that will govern
executive compensation at firms participating in the TARP. The rule established the Office of
the Special Master and gave the Special Master specific powers designed to ensure that executive
pay at these firms is structured in a way that will protect taxpayers’ investment. The Special
Master has sole power and authority for:

1. Review of Payments: For any TARP recipient receiving “exceptional assistance” (an
“Exceptional Assistance Recipient”), the Special Master is required to review and
approve any payment of compensation to the 5 senior executive officers and 20 next most
highly paid employees.

2. Review of Structure: For any Exceptional Assistance Recipient, the Special Master is
required to review and approve the structure of compensation for all executive officers
and the 100 most highly compensated employees.

3. Interpretation: The Special Master has interpretive authority over the executive
compensation provisions of EESA and the Interim Final Rule. Accordingly, the Special
Master will make all determinations as to the application of those provisions to particular
facts, and all decisions as to whether their requirements have been met.

'31 CFR Part 30 Tarp Standard for Compensation and Corporate Governance