1

The Department of the Treasury 

Semiannual 2015 Report on Privacy and 

Civil Liberties Activities Pursuant to 

Section 803 of the Implementing 

Recommendations of the 9/11 Commission 

Act of 2007

For the reporting period

August 1, 2015 to January 31, 2016

1. Introduction

The Department of the Treasury (Treasury) designates the Treasury Assistant Secretary for

Management (ASM) as its Privacy and Civil Liberties Officer (PCLO). As the PCLO, the ASM 

is responsible for implementing the 9/11 Commission Act of 2007’s privacy and civil liberties 

requirements.

To assist the ASM with these responsibilities, Treasury Directive (TD) 25-04, “The Privacy 

Act of 1974, As Amended,” designates the Deputy Assistant Secretary for Privacy, 

Transparency, and Records (DASPTR) as the ASM’s principal advisor on issues related to 

privacy and civil liberties. The DASPTR leads the Office of Privacy, Transparency, and 

Records (PTR) and provides the ASM with day-to-day support in executing his PCLO duties.

Section 803 of the 9/11 Commission Act, 42 U.S.C. 2000ee-1, sets forth the following 

requirements. The Intelligence Authorization Act for Fiscal Year 2014, Pub. L. No. 113-126 

(July 7, 2014), changed the reporting period from quarterly to semiannually.

“(f) Periodic Reports –

(1) In General –

The privacy officers and civil liberties officers of each department, agency, or 

element referred to or described in subsection (a) or (b) shall periodically, but 

not less than semiannually,

1 submit a report on the activities of such officers—

(A)(i) to the appropriate committees of Congress, including the 

Committee on the Judiciary of the Senate, the Committee on the Judiciary 

of the House of Representatives, the Committee on Homeland Security 

and Governmental Affairs of the Senate, the Committee on Oversight and 

Government Reform of the House of Representatives, the Select 

Committee on Intelligence of the Senate, and the Permanent Select 

Committee on Intelligence of the House of Representatives;

 
2

(ii) to the head of such department, agency, or element; and

(iii) to the; Privacy and Civil Liberties Oversight Board and

(B) which shall be in unclassified form to the greatest extent possible, 

with a classified annex where necessary.

(2) Contents –

Each report submitted under paragraph (1) shall include information on the 

discharge of each of the functions of the officer concerned, including—

(A) information on the number and types of reviews undertaken;

(B) the type of advice provided and the response given to such advice;

(C) the number and nature of the complaints received by the 

department, agency, or element concerned for alleged violations; and

(D) a summary of the disposition of such complaints, the reviews and 

inquiries conducted, and the impact of the activities of such officer.”

2. Privacy Reviews

Treasury reviews programs and information technology (IT) systems that may have privacy 

implications. For purposes of this report, reviews include the following Treasury activities: 

1. Privacy Threshold Analyses, which are the Treasury mechanism for reviewing IT 

systems, programs, and other activities for privacy protection issues to determine 

whether a more comprehensive Privacy and Civil Liberties Impact Assessment

(PCLIA) is required;

2. Privacy and Civil Liberties Impact Assessments (Treasury PCLIA), as required by the 

E-Government Act of 2002;

2

3. System of Records Notices, as required under the Privacy Act and any associated 

Final Rules for Privacy Act exemptions;

3

 

4. Privacy Act Statements, as required under the Privacy Act,

4 to provide notice to 

individuals at the point of collection; 

5. Computer Matching Agreements, as required under the Privacy Act;5

6. Data Mining Reports, as required by Section 804 of the 9/11 Commission Act of 

2007;6

7. Privacy Compliance Reviews;

8. Privacy reviews of IT and program budget requests, including Office of Management 

and Budget Exhibit 300s and Enterprise Architecture Alignment Requests through the 

Department of Homeland Security Enterprise Architecture Board; and 

9. Other privacy reviews, such as implementation reviews for information sharing 

agreements. 

3. Privacy and Civil Liberties Impact Assessments

 2 44 U.S.C. § 3501 note.

3 5 U.S.C. § 552a(j), (k).

4 5 U.S.C. § 552a(e)(3).

5 42 U.S.C. § 2000ee-3. 6 6 U.S.C. § 142.
3

The PCLIA process is one of Treasury’s key mechanisms to help ensure that programs and 

technologies sustain, and do not erode, privacy protections. As of January 31, 2016, Treasury 

completed PCLIAs for 100 percent of its operational Federal Information Security Management 

Act (FISMA) systems subject to the requirement.

Treasury published 115 new, updated, or renewed PCLIAs. All published Treasury PCLIAs are 

available at - http://www.treasury.gov/privacy/PIAs/Pages/default.aspx. Please consult our 

website for the full text of the PCLIAs summarized below:

The Office of the Special Inspector General for the Troubled Asset Relief Program (SIGTARP), 

published a PCLIA for a new Information technology system (Secure Enclave). The system 

provides SIGTARP with a secure computing environment designed to house information and

records obtained during the course of its investigations, audits, and operations. The system also

enable the organization to meet its mission by ensuring the transparency of the Troubled Asset 

Relief Program (TARP), providing effective oversight in coordination with peer institutions, and

pursuing robust criminal and civil enforcement against those who waste, steal, or abuse TARP

funds. 

4. System of Records Notices

Treasury completed System of Records Notices (SORN) for 100 percent of its operational 

FISMA systems that require a SORN. SORNs receive biennial reviews to ensure that they 

comply with the standards outlined in the Privacy Act of 1974, as amended. If the biennial 

review reveals that no update is required, the original SORN remains in effect.

Treasury published two new SORNs (one of these SORNs is summarized below), three SORN 

Alterations, and one Final Rule. All Treasury SORNs, Notices of Proposed Rulemaking, and 

Final Rules for Privacy Act Exemptions are available 

at http://www.treasury.gov/privacy/issuances/Pages/default.aspx. Please consult our website for 

the full text of the SORNs summarized below:

Office of the Comptroller of the Currency (OCC) Systems of Records, January 19, 2016 at 81 FR 

2945(https://www.federalregister.gov/articles/2016/01/19/2016-00763/privacy-act-of-1974-asamended-system-of-records) 

Pursuant to the Privacy Act of 1974, as amended, 5 U.S.C. 552a, and Office of Management and 

Budget (OMB) Circular No. A-130, the OCC has completed a review of its Privacy Act systems 

of records notices to identify minor changes that will more accurately describe these records.

Department of the Treasury regulations require the Department to publish the existence and 

character of all systems of records every three years as specified in 31 CFR 1.23(a)(1). 

With respect to its inventory of Privacy Act systems of records, the OCC has determined that the 

information contained in its systems of records is accurate, timely, relevant, complete, and 
4

necessary to maintain the proper performance of a documented agency function. The OCC's 

systems of records notice was last published in its entirety on April 3, 2012, at 77 FR 20104-

20122.

This publication covers the Privacy Act systems of records that were formerly Office of Thrift 

Supervision (OTS) systems, which the OCC adopted on July 26, 2011, at 76 FR 44656. 

Treasury/OTS systems of records were transferred to the OCC pursuant to section 323 of the 

Dodd-Frank Act, 12 U.S.C. 5433. The OTS systems of records notices were last published in 

their entirety on June 29, 2009, at 74 FR 31103.

This publication gives notice of two new systems of records. Treasury/CC .341, Mass 

Communications System, contains records necessary to communicate with OCC employees in 

the event of an emergency. Treasury/CC .701, Retiree Billing System, contains records necessary 

to contact and to send bills to former OCC and OTS employees, retirees enrolled in OCC and 

OTS life insurance programs, and employees receiving annuities from the Deferred Benefit Plan.

This publication gives notice of the following actions:

Treasury/OTS .002, Correspondence and Correspondence Tracking system has been retired. The 

records have been archived or destroyed in accordance with OCC records management policies.

Treasury/OTS .003, Consumer Complaint Files system will be retired at the end of July 2016. 

All records in this system of records will be archived or merged with Treasury/CC .600, 

Consumer Complaint and Inquiry Information, before the end of July 2016.

Treasury/OTS .006, Employee Locator File system has been retired. The records in this system 

have been merged into OCC personnel and payroll records, part of the Treasury-wide system, 

Treasury .001, Treasury Personnel and Payroll System dated January 2, 2014 at 79 FR 184.Show 

citation box.

Treasury/OTS .012, Payroll/Personnel Systems & Payroll Records, has been retired. The records 

have been merged with OCC records within Treasury .001, Treasury Personnel and Payroll 

System dated January 2, 2014 at 79 FR 184.

Treasury/OTS .013, Mass Communication System has been retired. The records have been 

merged into Treasury/CC .341, Mass Communication System. 

Treasury/OTS .015, OTS Retiree Billing System has been retired. Records in the system were 

merged into a new OCC system, Treasury/CC .701, Retiree Billing System. Other changes 

throughout the document are editorial in nature and consist principally of revising address 

information and minor editorial changes. 

5. Privacy Compliance Reviews

The federal government conducts Privacy Compliance Reviews (PCR) to ensure that programs 

and technologies implement and maintain appropriate privacy protections for PII. The PCR is a 
5

collaborative effort that helps improve a program’s ability to comply with existing privacy 

requirements by identifying an remediating gaps in compliance documentation, including 

PCLIAs, SORNs, and formal agreements such as Memoranda of Understanding and Memoranda 

of Agreement. Treasury regularly conducts informal PCRs with its bureaus when necessary.

Treasury conducted an informal PCR on its new website, https://thenew10.treasury.gov/. From 

this review, Treasury determined that a public notice and PCLIA were appropriate means of 

providing transparency to the public. The public notice is available 

here: http://www.gpo.gov/fdsys/pkg/FR-2015-06-24/pdf/2015-15372.pdf. The PCLIA for this 

site will be posted once it is published.

6. Advice and Responses

Departmental Offices (DO), PTR, updated Treasury Directive 25-07, “Privacy and Civil 

Liberties Impact Assessment” and policy, and issued interim Guidance for conducting PCLIAs 

while the proposed revision is being reviewed. The revision of the TD will reflect Treasury’s 

compliance with the National Institute Standards Technology (NIST) 800-53 Revision 4 Security 

and Privacy Controls for Federal Information Systems and Organizations that now includes an 

appendix J Privacy Control Catalog – Privacy Controls, Enhancements, and Supplemental 

Guidance. 

7. Privacy Complaints and Dispositions

For purposes of Section 803 reporting, complaints are written allegations of harm or violation of 

privacy compliance requirements filed with privacy and civil liberties programs within Treasury. 

The categories of complaints reflected in Appendix A are aligned with the categories detailed in 

the Office of Management and Budget’s Memorandum M-08-21, FY 2008 Reporting 

Instructions for the Federal Information Security Management Act and Agency Privacy 

Management. U.S. citizens, Legal Permanent Residents, visitors, and aliens submit complaints.

Two new Privacy cases were reported, and two Privacy cases were resolved in favor of the 

government. In addition, Six Civil Rights cases were filed, and six Civil Rights cases were 

resolved in favor of the government.

8. Conclusions

As required by the 9/11 Commission Act, and in accordance with the Intelligence Authorization 

Act for Fiscal Year 2014, Pub. L. No. 113-126 (July 7, 2014), this semiannual report summarizes 

Treasury’s privacy activities from August 1, 2015 through January 31, 2016. Treasury will 

continue to work with the Congress, colleagues in other federal departments and agencies, and 

the public to protect privacy in all of our efforts.

1 Attachment
Department of the Treasury

Semiannual Report on Privacy and Civil Liberties Activities 

under Section 803 of the 9/11 Commission Act of 2007

August 1, 2015 through January 31, 2016

Reviews Advice and Response Complaints Dispositions

Type Number Type Number Response Type Number

Privacy Threshold Analyses (PTA)

Privacy Impact Assessments (PIA)

PTA / 33

PIA / 115

Ongoing work with bureaus 

and offices to analyze PTA 

responses to ensure that a PIA 

is not required. Reviewing 

PIAs to ensure clarity and 

compliance with OMB and EGovernment Act requirements. 12

Issued interim 

Guidance for 

conducting 

PCLIAs while 

the proposed 

policy 

revision is 

being 

reviewed. PRIVACY 2 2

System of Records (SOR) Routine 

Use/ SOR Notices (SORNs)

17

SSN Elimination or Redaction on 

Forms

77 .

Computer Matching Agreements 

(CMAs)

0

Section 508 Internet Website Scan

96% CIVIL LIBERTY 6 6

Treasury-requested NonCommerce/Commerce Site Scan 44