1 

Privacy and Civil Liberties Impact Assessment 

Addendum to Privacy Impact Assessment

for the

USA Staffing System

August 28, 2020

Reviewing Official 

Timothy H. Skinner

Bureau Privacy and Civil Liberties Officer

Departmental Offices

Department of the Treasury
☐

2 

☐

☐

☐

☐

☒

This addendum addresses the Civil Liberties aspect of the USA Staffing Privacy Impact 

Assessment (PIA) conducted by the Office of Personnel Management (OPM). The Civil 

Liberties section of the Treasury Privacy and Civil Liberties Impact Assessment template is 

found in section 3.3(g), 4.1(c) through 4.4(c) 

Section 3.3(g) Records describing how individuals exercise First Amendment rights 

The Privacy Act requires that Federal agencies “maintain no record describing how any individual 

exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the 

individual about whom the record is maintained or unless pertinent to and within the scope of an 

authorized law enforcement activity.” 5 U.S.C. § 552a(e)(7). 

1. N/A. USA Staffing does not maintain information describing how an individual 

exercises their rights guaranteed by the First Amendment. 

2. The system or project does maintain information describing how an individual 

exercises their rights guaranteed by the First Amendment. If you checked this box, 

please check the box below that explains Treasury’s authorization for collecting this 

information: 

a. The individual about whom the information was collected or maintained 

expressly authorizes its collection/maintenance. The individual about whom the 

information was collected or maintained expressly authorized its collection by

[explain here how the individual expressly authorizes collection] (for example, 

individuals may expressly authorize collection by requesting in writing that 

Treasury share information with a third party, e.g., their Congressman]; 

b. The information maintained is pertinent to and within the scope of an 

authorized law enforcement activity because [generally discuss here the nature 

and purpose of the information collected and the law enforcement activity]; 

c. The following statute expressly authorizes its collection: [provide here the 

name of and citation to the statute and the language from that statute that 

expressly authorizes collection] [your response MUST contain all three if you use 

a statute as the basis for the collection].

Section 4.1(c) Collecting information directly from the individual when using it to make 

adverse determinations about them

Section 552a(e)(2) of the Privacy Act requires that Federal agencies that maintain records in a system of 

records are required to collect information to the greatest extent practicable directly from the individual 

when the information about them may result in adverse determinations about their rights, benefits, and 

privileges under Federal programs. Agencies may exempt a system of records from this requirement 

under certain circumstances and if certain conditions are met.

Please check ALL statements below that apply to your system or project and provide any additional 

information requested. 

1. The records maintained by this system or project are not used to make any adverse 

determinations about individuals [...].
☐

3 

☐

☒

☐

☐

☐

☐

☐

☐

☒

☒

☐

2. ☒ The records maintained by USA Staffing are used to make adverse determinations about 

individuals and [check all that apply]:

a. These records were exempted from the Privacy Act provision that requires 

collection directly from the subject individual to the greatest extent 

practicable. Exemption of these records is proper because.

b. These records were not exempted from the requirement to collect information 

directly from the individual to the greatest extent practicable and [check the relevant 

box below and provide the information requested]. 

i. All records used to make an adverse determination are collected directly from 

the individual about whom the decision is made.

ii. A combination of records collected from third parties and directly from the 

individual about whom the determination is made are used to make the 

determination because [please explain here why third-party data is required to 

make this determination; e.g., third-party data is required to verify the accuracy 

of the information provided by the individual seeking a privilege or benefit].

iii. None of the records used to make adverse determinations are collected 

directly from the individual about whom determinations are made because 

seeking the information directly from the individual might [select ALL that 

apply]: 

 alert the individual to the fact that their conduct is being observed or 

investigated; 

 cause the individual to alter or modify their activities to avoid detection;

 create risks to witnesses or other third parties if the individual is alerted to the 

fact that their conduct is being observed or investigated;

 Other: (please describe here).

Section 4.2 Data-Mining

As required by Section 804 of the Implementing Recommendation of the 9/11 Commission Act of 2007

(“9-11 Commission Act”), Treasury reports annually to Congress on its data mining activities. For a 

comprehensive overview of Treasury’s data mining activities, please review the Department’s Annual 

Privacy Act and Data Mining reports available at: http://www.treasury.gov/privacy/annual-reports. 

Section 4.2(a) Is the PII maintained in the system used to conduct data-mining? 

1. The information maintained in USA Staffing is not used to conduct “data-mining” 

activities as that term is defined in the 9-11 Commission Act. Therefore, no privacy or 

civil liberties issues were identified in responding to this question. 

2. The information maintained in this system or by this project is used to conduct “datamining” activities as that term is defined in the 9-11 Commission Act. This system is 

included in Treasury’s annual report to Congress which can be found on the external 

Treasury privacy website.

3. The information maintained in this system or by this project is used to conduct “datamining” activities as that term is defined in the 9-11 Commission Act, but this system is 

not included in Treasury’s annual report to Congress which can be found on the external 
☐

☐

4 

☒

☐

☒

☐

Treasury privacy website. This system will be added to the next Treasury Data-mining 

report to Congress. 

Section 4.3 Computer Matching

The Computer Matching and Privacy Protection Act (CMPPA) of 1988 amended the 

Privacy Act by imposing additional requirements when Privacy Act systems of records 

are used in computer matching programs. 

Pursuant to the CMPPA, there are two distinct types of matching programs. The first 

type of matching program involves the computerized comparison of two or more 

automated federal personnel or payroll systems of records or a system of federal 

personnel or payroll records with non-federal records. This type of matching program 

may be conducted for any purpose. The second type of matching program involves the 

computerized comparison of two or more automated systems of records or a system of 

records with non-federal records. The purpose of this type of matching program must be 

for the purpose of eligibility determinations or compliance requirements for applicants, 

recipients, beneficiaries, participants, or providers of services for payments or in-kind 

assistance under federal benefit programs, or recouping payments or delinquent debts 

under such federal benefit programs. See 5 U.S.C. § 522a(a)(8). Matching programs 

must be conducted pursuant to a matching agreement between the source (the agency 

providing the records) and recipient agency (the agency that receives and uses the records 

to make determinations). The matching agreement describes the purpose and procedures 

of the matching and establishes protections for matching records. 

Section 4.3(a) Records in the system used in a computer matching program. 

1. The PII maintained in the system or by the project is not part of a Privacy Act system 

of records. Therefore, it is not subject to CMPPA requirements. 

2. The information maintained in USA Staffing is part of a Privacy Act system of 

records, but is not used as part of a matching program. 

3. The information maintained in the system or by the project is part of a Privacy Act 

system of records and is used as part of a matching program. [If whether a Matching 

Agreement was executed and published as required by the CMPPA/Privacy Act; if no 

Matching Agreement was executed, please explain here why]: Explain here.

Section 4.3(b) Is there a matching agreement? 

1. N/A

2. There is a matching agreement in place that contains the information required by 

Section (o) of the Privacy Act. Therefore, no privacy and civil liberties risks were 

identified in response to this section. That matching agreement may be found at: 

[provide here the URL to the website where the CMA agreement can be found].

3. There is a matching agreement in place, but it does not contain all of the information 

required by Section (o) of the Privacy Act. The following actions are underway to amend 

the agreement to ensure that it is compliant [discuss here the issues that were discovered 

that required amendment and how those issues are being mitigated/fixed]: Discuss here. 
☐

☐

5 

☐

☐

☐

☐

☒

Section 4.3(c) What procedures are followed before adverse action is taken against an 

individual who is the subject of a matching agreement search?

1. N/A

2. The bureau or office that owns the system or project conducted an assessment 

regarding the accuracy of the records that are used in the matching program and the 

following additional protections were put in place: 

a. The results of that assessment were independently verified by [explain here how 

and by whom accuracy is independently verified; include the general activities 

involved in the verification process].

b. Before any information subject to the matching agreement is used to suspend, 

terminate, reduce, or make a final denial of any financial assistance or payment 

under a Federal benefit program to an individual: (choose one of the following):

i. The individual receives notice and an opportunity to contest the findings; OR 

ii. The Data Integrity Board approves the proposed action with respect to the 

financial assistance or payment in accordance with Section (p) of the Privacy 

Act before taking adverse action against the individual. 

3. No assessment was made regarding the accuracy of the records that are used in the 

matching program. 

Responsible Officials 

Approval Signature 

________________________________ 

Timothy H. Skinner 

Bureau Privacy and Civil Liberties Officer

Departmental Offices, & Records