1

The Department of the Treasury 

Semiannual 2017 Report on Privacy and 

Civil Liberties Activities Pursuant to 

Section 803 of the Implementing 

Recommendations of the 9/11 Commission 

Act of 2007

For the reporting period

October 1, 2016 to March 31, 2017

1. Introduction

The Assistant Secretary for Management (ASM) is the Department of the Treasury’s (Treasury) 

Privacy and Civil Liberties Officer (PCLO). As the PCLO, the ASM is responsible for

implementing the 9/11 Commission Act of 2007’s privacy and civil liberties requirements.

To assist the ASM with these responsibilities, Treasury Directive (TD) 25-04, “The Privacy 

Act of 1974, as amended,” designates the Deputy Assistant Secretary for Privacy, 

Transparency, and Records (DASPTR) as the ASM’s principal advisor on issues related to 

privacy and civil liberties. The DASPTR leads the Office of Privacy, Transparency, and 

Records (PTR) and provides the ASM with day-to-day support in executing his PCLO duties.

Section 803 of the 9/11 Commission Act, 42 U.S.C. § 2000ee-1, sets forth the following 

requirements: 

(f) Periodic Reports –

(1) In General –

The privacy officers and civil liberties officers of each department, agency, or 

element referred to or described in subsection (a) or (b) shall periodically, but 

not less than semiannually; submit a report on the activities of such officers—

(A)(i) to the appropriate committees of Congress, including the 

Committee on the Judiciary of the Senate, the Committee on the Judiciary 

of the House of Representatives, the Committee on Homeland Security 

and Governmental Affairs of the Senate, the Committee on Oversight and 

Government Reform of the House of Representatives, the Select 

Committee on Intelligence of the Senate, and the Permanent Select 

Committee on Intelligence of the House of Representatives;

(ii) to the head of such department, agency, or element; and

(iii) to the Privacy and Civil Liberties Oversight Board.

(B) which shall be in unclassified form to the greatest extent possible, 

with a classified annex where necessary.
2

(2) Contents –

Each report submitted under paragraph (1) shall include information on the 

discharge of each of the functions of the officer concerned, including—

(A) information on the number and types of reviews undertaken;

(B) the type of advice provided and the response given to such advice;

(C) the number and nature of the complaints received by the 

department, agency, or element concerned for alleged violations; and

(D) a summary of the disposition of such complaints, the reviews and 

inquiries conducted, and the impact of the activities of such officer.

The Intelligence Authorization Act for Fiscal Year 2014, Pub. L. No. 113-126 (July 7, 2014), 

changed the reporting period from quarterly to semiannually.

2. Privacy Reviews

Treasury reviews programs and information technology (IT) systems that may have privacy 

implications. Reviews include the following Treasury activities: 

a) Privacy and Civil Liberties Threshold Analyses, which are the Treasury mechanism 

for reviewing IT systems, programs, and other activities for privacy protection issues 

to determine whether a more comprehensive Privacy and Civil Liberties Impact 

Assessment (PCLIA) is required; 

b) Privacy and Civil Liberties Impact Assessments as required by the E-Government Act 

of 2002;

1

c) System of Records Notices, as required under the Privacy Act and any associated 

Final Rules for Privacy Act exemptions;

2

 

d) Privacy Act Statements, as required under the Privacy Act,

3 to provide notice to 

individuals at the point of collection; 

e) Computer Matching Agreements, as required under the Privacy Act;4

f) Data Mining Reports, as required by Section 804 of the 9/11 Commission Act of 

2007;5

g) Privacy Compliance Reviews;

h) Privacy reviews of IT and program budget requests, including Office of Management 

and Budget Exhibit 300s and Enterprise Architecture Alignment Requests through the 

Department of Homeland Security Enterprise Architecture Board; and,

i) Other privacy reviews, such as implementation reviews for information sharing 

agreements. 

 1 44 U.S.C. § 3501 note.

2 5 U.S.C. § 552a(j),(k). 3 5 U.S.C. § 552a(e)(3).

4 42 U.S.C. § 2000ee-3. 5 6 U.S.C. § 142.
3

3. Privacy and Civil Liberties Impact Assessments (PCLIA)

The PCLIA process is one of Treasury’s key mechanisms to ensure that programs and 

technologies sustain, and do not erode, privacy protections. During the reporting period, 

Treasury published 100 new, updated, or renewed PCLIAs. All published Treasury PCLIAs are 

available at http://www.treasury.gov/privacy/PIAs/Pages/default.aspx. One example of a new 

PCLIA is summarized below:

On October 17, 2016, the Internal Revenue Service (IRS) published a PCLIA for the Affordable 

Care Act (ACA) Information Returns (AIR). The AIR system processes information returns and 

reports required by the ACA. The ACA AIR adds the following functions to the existing system:

a) Processes reports from pharmaceutical companies on Branded Prescription Drugs (BPD) 

to facilitate the assessment of the BPD fee required 26 U.S.C. § 9008. 

b) Processes reports from health insurers to facilitate the assessment of the Insurance 

Provider Fee (IPF) on health insurance policies required by 26 U.S.C. § 9010.

c) Collects and processes Form 1095A Information Returns from Federal/State Exchanges.

d) Submits and processes Form 1095-B Health Coverage, 1095-C Employer Provided 

Health Insurance Offer and Coverage, 1094-B Transmittal of Health Coverage 

Information Returns, and 1094-C Transmittal of Employer-provided Health Insurance 

Offer and Coverage Information Returns.

e) Validates additional business rules for paper and electronic returns.

f) Processes information related to the Transmitter Control Code (TCC) that identifies the 

transmitter of the electronic forms.

g) Processes forms associated with the Achieving Better Life Experience (ABLE) Act.

4. System of Records Notices

During the reporting period, Treasury published 58 new and updated SORNs. All Treasury 

SORNs, Notices of Proposed Rulemaking, and Final Rules for Privacy Act Exemptions are 

available at http://www.treasury.gov/privacy/issuances/Pages/default.aspx. Treasury has 

determined that the information contained in its systems of records is accurate, timely, relevant, 

complete, and necessary to maintain the proper performance of a documented agency function. 

Please consult our website or the Federal Register for the full text of our SORNs. 

Treasury published its inventory of 16 Treasury-wide systems of records and 41 Departmental 

Offices systems of records in the Federal Register (FR) on November 7, 2016, at 81 FR 78266 

and 81 FR 78298.

Treasury’s Bureau of Engraving and Printing (BEP) published one new SORN. BEP .051, Chief 

Counsel Files System, contains records necessary for BEP attorneys to provide legal advice to 

BEP management on various matters. Additionally, the system manages the workload of BEP 

legal staff, tracks the status, progress, and disposition of matters assigned to the legal staff in 

matters such as litigation and/or administrative proceedings in which BEP is a party, and matters 

in which the Office of the Chief Counsel must provide advice. The Office of the Chief Counsel 

is responsible for collecting, reviewing, redacting, and producing BEP records, in support of 

processing and resolving BEP legal matters. This system has an effect on individual privacy that 
4

is balanced by the need to collect and maintain information related to legal matters. This new 

system of records was last published on November 4, 2016, at 81 FR 77003.

5. Computer Matching Programs

Treasury participates in 14 active computer matching programs in accordance with the Privacy 

Act of 1974, as amended. The computer matching provisions of the Privacy Act improve

oversight of the disclosure of automated Privacy Act records in inter-agency information sharing 

arrangements known as matching programs and protect the due process rights of individuals 

whose records are exchanged in such programs. To comply with the Act, as well as all relevant 

regulations and guidance, Treasury has established a Data Integrity Board to review and approve 

associated matching agreements. All Treasury Computer Matching Program Agreements are 

available at: https://www.treasury.gov/privacy/Computer-MatchingPrograms/Pages/default.aspx. 

During the reporting period, the Data Integrity Board reviewed and approved two re-established

18-month agreements and one 12-month renewal agreement. Those computer matching 

programs are listed below:

a) The Fiscal Service (FS) and Department of Housing and Urban Development (HUD) 

matching program is a part of the Do Not Pay Initiative (DNP)6, which seeks to 

reduce improper federal payments. This matching program allows Treasury/FS to 

provide information to HUD that allows the agency to determine a party’s eligibility 

to participate in federal procurement and/or assistance programs or benefits. On 

December 23, 2016, HUD published notice in the Federal Register of the reestablished agreement, effective January 23, 2017. It is available at 81 FR 94402. 

b) The IRS and Treasury Inspector General for Tax Administration (TIGTA) matching 

program assists in the detection and deterrence of fraud, waste, and abuse in the 

programs and operations of the IRS and related entities. On February 3, 2017, 

Treasury published notice of an 18-month re-establishment of the matching program, 

effective March 10, 2017. It is available at 82 FR 9277. 

c) The IRS and Social Security Administration (SSA) matching program allows the IRS 

to disclose specific return information to SSA about taxpayers whose Medicare Part B

and/or prescription drug coverage insurance premium(s) may be subject to premium

subsidy adjustments. On March 9, 2017, Treasury approved a 12-month renewal of 

the matching program, effective March 31, 2017. The original agreement is available 

at 80 FR 48950. 

6. Privacy Compliance Reviews

Treasury conducts Privacy Compliance Reviews (PCR) to ensure that programs and technologies 

implement and maintain appropriate protections for personally identifiable information (PII). 

The PCR is a collaborative effort that helps improve a program’s ability to comply with existing 

privacy requirements by identifying and remediating gaps in compliance documentation, 

 6 More information about DNP is available here: https://www.donotpay.treas.gov/.
5

including PCLIAs, SORNs, and formal agreements, such as memoranda of understanding and 

memoranda of agreement. Treasury conducts informal PCRs with its bureaus when necessary.

During this reporting period, the IRS Privacy Office (PO) worked with stakeholders on the pilot 

program Identity Theft Refund Fraud (IDTTRF) Information Sharing and Analysis Center 

(ISAC). The PO worked with the ISAC team to resolve issues relating to limiting PII, the

contractor data center, and the development of an internal review process prior to posting on the 

ISAC site. The PO also worked with the IRS project office to prepare, complete and post 

PCLIAs about three Private Collection Agencies (PCA). The PO assigned a senior manager and 

an analyst to the project office to address any privacy issues before the program was 

implemented in April of 2017. This resulted in the elimination of Social Security number 

collection on notices, an authentication stage, and replaced it with a unique account number. The 

unique account number will be used by the taxpayer and collection agency to authenticate 

taxpayers, contractors’ safeguards, testing, and data sharing. 

Furthermore, the IRS continues to improve the PCLIA process by incorporating all PCLIA types 

into the Privacy Impact Assessment Management System (PIAMS). PIAMS is now the IRS’s 

single repository for all PCLIAs/PIAs (System, SharePoint, Survey, Social Media, Qualifying 

Questionnaire, and Major Change Determinations) that allows the IRS to better manage, track, 

and report on these programs. It also reduces customer burden by making it easier for the 

customers to create, submit, and track these documents. 

The IRS continues to perform quality measurement reviews that observe accuracy, completeness, 

and adherence with the plain language requirements in submitted PCLIAs. The outcomes

indicate average accuracy rates between 93% and 95% for each measure, and are used to 

improve the PCLIA process through additional training of both submitters and reviewers. 

Lastly, the IRS began an innovative review of pre-award contract solicitations that involve PII to 

address the insertion of the correct privacy and disclosure clauses. Any concerns identified 

during the reviews will be addressed through communications and training for contracting 

officers and contracting officer’s representatives.

7. Advice and Responses

Treasury provides privacy advice throughout the year to its bureaus and offices. Two examples

of guidance are included below: 

a) Treasury updated and implemented the following templates to comply with the new 

Office of Management and Budget (OMB) Circular No. A-108, Federal Agency 

Responsibilities for Review, Reporting, and Publication under the Privacy Act, guidance7

issued in December 2016:

• Office of Federal Register SORN Template Full Notice,

• Office of Federal Register Matching Notice Template Full Notice, and 

 7 https://obamawhitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m 17 12 0.pdf
6

• Office of Federal Register Matching Notice Template Notice Revision.

b) The Office of the Comptroller of the Currency Privacy Program Office provided advice 

and guidance to the following teams regarding the new OMB M-17-12, Preparing for and 

Responding to a Breach of Personally Identifiable Information requirements8

: 

• The Data Breach Response Team, regarding new requirements in OMB M-17-12.

• The Large Bank Supervision group, regarding updates to language in guidance 

documents related to the identification and access control to PII owned by the 

group.

• The Acquisitions Management Group, regarding required updates to contract 

language.

• The SharePoint system administrators, regarding a new process requiring site 

administrators to obtain privacy program office approval before creating any new 

SharePoint site used for the collection or storage of PII. 

In each of the situations described above the advice was accepted and acted upon as required.

8. Privacy Complaints and Dispositions

For purposes of Section 803 reporting, complaints are written allegations of harm or violation of 

privacy compliance requirements filed with Treasury’s privacy and civil liberties programs. The 

categories of complaints reflected in Appendix A are aligned with the categories detailed in the 

OMB Memorandum 08-21, FY 2008 Reporting Instructions for the Federal Information Security 

Management Act and Agency Privacy Management. U.S. citizens, Legal Permanent Residents, 

visitors, and aliens may submit complaints.

9. Conclusions

As required by the 9/11 Commission Act, and in accordance with the Intelligence Authorization 

Act for Fiscal Year 2014, Pub. L. No. 113-126 (July 7, 2014), this semiannual report summarizes 

Treasury’s privacy activities from October 1, 2016, through March 31, 2017. Treasury will 

continue to work with the Congress, colleagues in other federal departments and agencies, and 

the public to protect privacy in all of our efforts.

Attachments

 8 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12_0.pdf
7

Department of the Treasury

Semiannual Report on Privacy and Civil Liberties Activities

under Section 803 of the 9/11 Commission Act of 2007