1

The Department of the Treasury 

Semiannual 2015 Report on Privacy and 

Civil Liberties Activities Pursuant to 

Section 803 of the Implementing 

Recommendations of the 9/11 Commission 

Act of 2007

For the reporting period

February 1, 2015 to July 31, 2015

1. Introduction

Treasury designates the Treasury Assistant Secretary for Management (ASM) as Treasury’s 

Privacy and Civil Liberties Officer (PCLO). As the Department’s PCLO, the ASM is 

responsible for implementing the 9/11 Commission Act privacy and civil liberties 

requirements.

To assist the ASM with these responsibilities, Treasury Directive (TD) 25-04, “The Privacy 

Act of 1974, As Amended,” designates the Deputy Assistant Secretary for Privacy, 

Transparency, and Records (DASPTR) as the ASM’s principal advisor on issues related to 

privacy and civil liberties. The DASPTR leads the Office of Privacy, Transparency, and 

Records (PTR) and provides the ASM with day-to-day support in executing his PCLO duties.

Section 803 of the 9/11 Commission Act of 20071, sets forth the following requirements:

“(f) Periodic Reports-

(1) In General –

The privacy officers and civil liberties officers of each department, agency, or 

element referred to or described in subsection (a) or (b) shall periodically, but 

not less than semiannually2

, submit a report on the activities of such 

officers—

(A)(i) to the appropriate committees of Congress, including 

the Committee on the Judiciary of the Senate, the Committee on the 

Judiciary of the House of Representatives, the Committee on 

Homeland Security and Governmental Affairs of the Senate, 

the Committee on Oversight and Government Reform of the House of 

Representatives, the Select Committee on Intelligence of the Senate, 

 1 42 U.S.C. § 2000ee-1. 2 Pursuant to the Intelligence Authorization Act for Fiscal Year 2014, Pub. L. No. 113-126 (July 7, 2014), the 

reporting period was changed from quarterly to semiannually.
2

and the Permanent Select Committee on Intelligence of the House of 

Representatives;

(ii) to the head of such department, agency, or element; and

(iii) to the Privacy and Civil Liberties Oversight Board; and

(B) which shall be in unclassified form to the greatest extent possible, 

with a classified annex where necessary.

(2) Contents –

Each report submitted under paragraph (1) shall include information on the 

discharge of each of the functions of the officer concerned, including—

(A) information on the number and types of reviews undertaken;

(B) the type of advice provided and the response given to such advice;

(C) the number and nature of the complaints received by the 

department, agency, or element concerned for alleged violations; and

(D) a summary of the disposition of such complaints, the reviews and 

inquiries conducted, and the impact of the activities of such officer.”

2. Privacy Reviews

Treasury reviews programs and information technology (IT) systems that may have privacy 

implications. For purposes of this report, reviews include the following Treasury activities: 

1. Privacy Threshold Analyses, which are the Treasury mechanism for reviewing IT 

systems, programs, and other activities for privacy protection issues to determine 

whether a more comprehensive Privacy and Civil Liberties Impact Assessment (PCLIA)

is required; 

2. Privacy Impact Assessments (Treasury PCLIAs), as required by the E-Government 

Act of 20023; 

3. System of Records Notices, as required under the Privacy Act and any associated 

Final Rules for Privacy Act exemptions4; 

4. Privacy Act Statements, as required under the Privacy Act5, to provide notice to 

individuals at the point of collection; 

5. Computer Matching Agreements, as required under the Privacy Act;6

6. Data Mining Reports, as required by Section 804 of the 9/11 Commission Act of 

2007; 7

7. Privacy Compliance Reviews;

8. Privacy reviews of IT and program budget requests, including Office of Management 

and Budget Exhibit 300s and Enterprise Architecture Alignment Requests through the 

Department of Homeland Security Enterprise Architecture Board; and 

9. Other privacy reviews, such as implementation reviews for information sharing 

agreements. 

 3 44 U.S.C. § 3501 note.

4 5 U.S.C. § 552a(j), (k).

5 5 U.S.C. § 552a(e)(3).

6 42 U.S.C. § 2000ee-3. 7 6 U.S.C. § 142.
3

3. Privacy and Civil Liberties Impact Assessments

The PCLIA process is one of Treasury’s key mechanisms to ensure that programs and 

technologies sustain, and do not erode, privacy protections. As of July 31, 2015, Treasury 

completed PCLIAs for 100 percent of its operational Federal Information Security Management 

Act (FISMA) systems subject to the requirement.

During the reporting period, Treasury published 63 new, updated, or renewed PCLIAs. Two of 

these PCLIAs are summarized below. All published Treasury PCLIAs are available 

at http://www.treasury.gov/privacy/PIAs/Pages/default.aspx. Please consult our website for the 

full text of the PCLIAs summarized below.

Appeals Centralized Database System (ACDS): http://www.irs.gov/pub/irs-pia/acds-pia.pdf

ACDS is a mission critical system supporting the activities of the Internal Revenue Service 

(IRS) Appeals organization (“Appeals”). ACDS is a web-based application that has no external 

interfaces and is only accessible from the IRS intranet. ACDS supports and captures 

information on many of the core business activities, including inventory and statute control, 

tracking case status and issues, assigning employees to cases, creating and maintaining 

employee timesheets, and documenting case reviews. ACDS records case time and monitors 

the progress of the Appeal’s workload. Additionally, ACDS is used for all Appeal’s 

management information statistics and produces management information reports. The reports 

generated by ACDS are used to improve the quality of service and to provide IRS executives 

with timely and accurate metrics on how well the Appeals organization is meeting its strategic 

goals and supporting IRS and Treasury goals. 

Constituent Relationship Management (CRM) Tool: http://financialresearch.gov/siteinfo/files/ofr_privacy_and_civil_liberties_impact_assessment.pdf

CRM will assist the Office of Financial Research (OFR) with: (i) consolidating, storing, and 

managing individual business contact information obtained as a result of professional 

relationships; (ii) annotating an individual’s interest and expertise in areas of financial research 

that align with OFR’s mission; and (iii) facilitating strategic or targeted outreach efforts around 

OFR events, announcements, and publications (including capturing interest in or attendance at 

past OFR events and tracking the actual number of times and circumstances in which OFR 

reached out to the individual). 
4

CRM is designed to serve as an internal, centralized repository of business and professional 

contact information, such as names, professional affiliation, telephone numbers and other 

information. CRM provides a secure and efficient means of organizing and managing such 

information in a manner that will assist with OFR’s research based mission.

4. System of Records Notices

As of July 31, 2015, Treasury completed System of Records Notices (SORN) for 100 percent 

of its operational FISMA systems that require a SORN. SORNs receive biennial reviews to 

ensure that they comply with the standards outlined in the Privacy Act. If the biennial review 

reveals that no update is required, the original SORN remains in effect.

During the reporting period Treasury published two new SORNs (one of these SORNs is 

summarized below) three SORN Alterations, and one Final Rule. All Treasury SORNs, 

Notices of Proposed Rulemaking, and Final Rules for Privacy Act Exemptions are available 

at http://www.treasury.gov/privacy/issuances/Pages/default.aspx. Please consult our website for 

the full text of the SORNs summarized below.

Use of Shredded U.S. Currency System – BEP 

.050: https://www.federalregister.gov/articles/2015/03/17/2015-06023/privacy-act-of-1974-asamended-system-of-records

The purpose of this system of records is to establish paper-based files and an electronic 

database that facilitates the processing of requests for use of shredded U.S. currency for artistic 

or commercial purposes. Records are for internal purposes only and will facilitate the approval 

process performed by the Chief, Office of Compliance.

These records may be disclosed to appropriate agencies, entities, and persons when: (a) The 

Department suspects or has confirmed that the security or confidentiality of information in the 

system of records has been compromised; (b) the Department has determined that as a result of 

the suspected or confirmed compromise there is a risk of harm to economic or property 

interests, identity theft or fraud, or harm to the security or integrity of this system or other 

systems or programs (whether maintained by the Department or another agency or entity) that 

rely upon the compromised information; and (c) the disclosure made to such agencies, entities, 

and persons is reasonably necessary to assist in connection with the Department's efforts to 

respond to the suspected or confirmed compromise and prevent, minimize, or remedy such 

harm.
5

5. Privacy Compliance Reviews

The federal government conducts Privacy Compliance Reviews (PCR) to ensure that programs 

and technologies implement and maintain appropriate privacy protections for PII. The PCR is a 

collaborative effort that helps improve a program’s ability to comply with existing privacy 

requirements by identifying an remediating gaps in compliance documentation, including 

PCLIAs, SORNs, and formal agreements such as Memoranda of Understanding and 

Memoranda of Agreement. Treasury regularly conducts informal PCRs with its bureaus when 

necessary. During this reporting period, Treasury conducted an informal PCR on Treasury’s 

new external sub site, https://thenew10.treasury.gov/. From this review, Treasury determined 

that a public notice and PCLIA were both needed to ensure compliance. The public notice is 

available here: http://www.gpo.gov/fdsys/pkg/FR-2015-06-24/pdf/2015-15372.pdf. The 

PCLIA for this site will be posted once it is published.

6. Advice and Responses

During the reporting period, the IRS issued interim Guidance on Sending Sensitive But 

Unclassified Information and/or Work-Related Documents to External Email Addresses. This 

interim guidance, Privacy, Governmental Liaison, and Disclosure-10-0615-0003, discusses 

encryption standards for personally identifiable information transmitted outside of IRS 

networks.

Ninety-nine percent of Treasury personnel and contractors completed the mandatory computerassisted privacy training course, “A Culture of Privacy Awareness.” 

7. Privacy Complaints and Dispositions

For purposes of Section 803 reporting, complaints are written allegations of harm or violation 

of privacy compliance requirements filed with privacy and civil liberties programs within 

Treasury. The categories of complaints reflected in the following table are aligned with the 

categories detailed in the Office of Management and Budget’s Memorandum M-08-21, FY 

2008 Reporting Instructions for the Federal Information Security Management Act and Agency 

Privacy Management. U.S. citizens, Legal Permanent Residents, visitors, and aliens submit 

complaints.

8. Conclusions

As required by the 9/11 Commission Act, this quarterly report summarizes Treasury’s privacy 

activities from February1 –July 31, 2015. Treasury will continue to work with the
6

Congress, colleagues in other federal departments and agencies, and the public to ensure that 

privacy is protected in all of our efforts.
7