1

Privacy and Civil Liberties Impact Assessment 

for the 

State Small Business Credit Initiative Reporting 

May 12, 2022 

Reviewing Official 

Ryan Law 

Deputy Assistant Secretary for Privacy, 

Transparency & Records 

 Departmental Offices 

Department of the Treasury 
2

Section 1: Introduction

PCLIAs are required for all systems and projects that collect, maintain, or disseminate personally 

identifiable information (PII). The system owner completed this assessment pursuant to 

Section 208 of the E-Government Act of 2002 (“E-Gov Act”), 44 U.S.C. § 3501, Office of the 

Management and Budget (OMB) Memorandum 03-22, “OMB Guidance for Implementing the 

Privacy Provisions of the E-Government Act of 2002,” and Treasury Directive 25-07, “Privacy 

and Civil Liberties Impact Assessment (PCLIA),” which requires Treasury Offices and Bureaus 

to conduct a PCLIA before: (1) developing or procuring information technology (IT) systems or 

projects that collect, maintain or disseminate PII from or about members of the public, or 

(2) initiating a new collection of information that: (a) will be collected, maintained, or 

disseminated using IT; and (b) includes any PII permitting the physical or online contacting of a 

specific individual, if identical questions have been posed to, or identical reporting requirements 

imposed on, 10 or more persons (not including agencies, instrumentalities, or employees of the 

federal government). 

It is the policy of the Department of the Treasury (“Treasury” or “Department”) and its Bureaus 

to conduct a PCLIA when PII is maintained in a system or by a project. This PCLIA provides the 

following information regarding the system or project: (1) an overview of its purpose and 

functions; (2) a description of the information collected; (3) a description of the how information 

is maintained, used, and shared; (4) an assessment of whether the system or project is in 

compliance with federal requirements that support information privacy; and (5) an overview of 

the redress/complaint procedures available to individuals who may be affected by the use or 

sharing of information by the system or project. 

Section 2: System Overview 

Section 2.1: System/Project Description and Purpose 

On March 11, 2021, the President signed into law the American Rescue Plan Act of 2021 

(ARPA), which provided $10 billion to fund the State Small Business Credit Initiative (SSBCI). 

Through SSBCI, the Department of the Treasury (“Treasury” or “the Department”) will provide 

funds to states, the District of Columbia, territories, eligible municipalities, and Tribal 

governments (“participating jurisdictions”) to expand existing or to create new small business 

investment programs, including state capital access programs, collateral support programs, loan 

participation programs, loan guarantee programs, and venture capital programs.

 

Participating jurisdictions are required by statute to report SSBCI data to Treasury on a 

quarterly and annual basis. 12 U.S.C. 5706. Each quarterly report from a participating 

jurisdiction must include basic information about the jurisdiction’s use of federal funding. Id. at 

5706(a)(2). Each annual report must include additional breakdowns of SSBCI data, and the 

statute empowers Treasury, in its “sole discretion,” to require additional information to carry 

out the purposes of the program. Id. at 5706(b). In accordance with this statutory authority, 

Treasury issued an interim final rule (IFR) setting out certain transaction-level data that 

participating jurisdictions are required to report annually. 87 Fed. Reg. 13628 (March 10, 
3

2022). Treasury has also issued Capital Program Reporting Guidance to provide additional 

guidance to participating jurisdictions on collection and reporting of the information required by 

the IFR as well as other transaction-level data. Consistent with the overall statutory structure of 

the SSBCI program, information will be collected from small businesses by participating 

jurisdictions or by the financial institutions or other lenders, investors, or other contracted 

entities that interact directly with these businesses.

Treasury has carefully chosen the information to be collected in order to meet the goals of (i) 

implementing SSBCI, (ii) understanding SSBCI program outcomes, and (iii) promoting and 

evaluating compliance with the SSBCI statute, rules, and guidance. For example, the IFR 

requires reporting of certain demographic information relating to the owners of businesses that 

participate in SSBCI,1 which is important for the implementation of and compliance with (i) 

program requirements regarding allocations related to business enterprises that are owned and 

controlled by socially and economically disadvantaged individuals (SEDI-owned and controlled 

businesses) and (ii) applicable legal requirements related to nondiscrimination and 

nondiscriminatory uses of federal funds. Id. at 13629. The data collection mandated by the IFR 

also enables Treasury to understand SSBCI program outcomes, allowing Treasury to analyze 

and report on the populations that SSBCI funding is benefiting. Id. Thus, this SSBCI information 

collection supports the mission of the Department by helping to successfully carry out its 

statutory mandate relating to the SSBCI program.

1. ☐ A PCLIA is being done for this system for the first time. 

2. ☐ This is an update of a PCLIA previously completed and published under this same 

system or project name. 

3. ☒ This is an update of a PCLIA previously completed and published for a similar system 

or project that is undergoing a substantial modification or migration to a new system or 

project name. The date the earlier PCLIA was published was 1.31.2022. This PCLIA 

updates and supersedes the original PCLIA. 

Section 2.2: Authority to Collect

Federal agencies must have proper authority before initiating a collection of information. The 

authority is sometimes granted by a specific statute, by Executive order (EO) of the President or 

other authority. The following specific authorities authorize SSBCI to collect information: 

• Small Business Jobs Act of 2010 (SBJA), Title III—State Small Business Credit Initiative 

(SSBCI), Public Law 111 – 240, § 3001, as amended by the American Rescue Plan Act of 

2021 (ARPA), Title III, Subtitle C—State Small Business Credit Initiative (SSBCI), Public 

Law 117-2, §3301.

• Executive Order On Advancing Racial Equity and Support for Underserved Communities 

Through the Federal Government (January 20, 2021). 

The information may also be collected pursuant to a more general requirement or authority. All 

1

 While lenders and other financial entities participating in SSBCI must request the demographic information 

described in the IFR, participating small businesses have the option to choose “prefer not to respond” or to not 

respond by leaving the request blank. 87 Fed. Reg. 13628, 13629. 
4

Treasury systems and projects derive general authority to collect information from: 

• 31 U.S.C. § 321 – General authorities of the Secretary establish the mission of the 

Department of the Treasury 

• 5 U.S.C. § 301 – Department regulations for the operations of the department, conduct of 

employees, distribution and performance of its business, the custody, use, and 

preservation of its records, papers, and property. 

Section 2.3: Privacy Act Applicability; SORN Requirement 

Under certain circumstances, federal agencies are allowed to exempt a system of records from 

certain provisions in the Privacy Act. This means that, with respect to information systems and 

papers files that maintain records in that system of records, the agency will not be required to 

comply with the requirements in Privacy Act provisions that are properly exempted. If this 

system or project contains records covered by the Privacy Act, the applicable Privacy Act system 

of records notice(s) (SORNs) (there may be more than one) that cover the records in this system 

or project must list the exemptions claimed for the system of records (it will typically say: 

“Exemptions Claimed for the System” or words to that effect). 

Helpful Hint for answering questions in this section and later questions about Privacy Act 

exemptions: If you know there is a SORN covering the PII in this system, the answer is probably 

“yes.” If the system maintains PII, but that PII is not actually retrieved by a personal identified, 

the answer is “no.” At the bottom of the applicable SORN(s), you will find a section that says: 

“Exemptions Claimed for the System.” If the answer is “None” (or anything that indicates no 

exemptions are claimed): (1) your bureau or office does not exempt the system of records from 

any Privacy Act requirements; and (2) when you are asked in this template whether your bureau 

or office exempts the system of records from certain provisions in the Privacy Act, your answer 

will always be “No.”

All answers in this section must be provided in the space as instructed after checking the 

appropriate box(es). 

Section 2.3(a) Please check ALL statements below that apply to your system or project and 

provide any additional information requested. Please read all possible responses before 

selecting an answer. 

1. ☐ The system or project does not retrieve records about an individual using an 

identifying number, symbol, or other identifying particular assigned to the individual. A 

SORN is not required with respect to the records in this system.

2. ☒ The system or project does retrieve records about an individual using an identifying 

number, symbol, or other identifying particular assigned to the individual. A SORN is 

required with respect to the records in this system. Treasury does not collect personally 

identifiable information (PII) directly from individuals or business owners who apply for 

or receive capital under the SSBCI program. Treasury provides funds to participating 

jurisdictions and those participating jurisdictions, along with private lenders or 

investors, make determinations regarding eligibility and distribute the funds to selected 

businesses. Although information is not collected directly by Treasury, participating 
5

jurisdictions do collect (sometimes through or with private lenders or investors) and 

provide to Treasury particular demographic information, including information 

regarding SEDI- owned businesses that apply for or receive SSBCI funding. This may 

include the records of sole proprietors and individuals whose demographic information 

will be used to determine if a business is SEDI-owned and controlled. Treasury maintains 

a SORN, TREASURY .013, “Department of the Treasury Civil Rights Complaints and 

Compliance Review Files,” which covers records Treasury collects regarding recipients 

of financial assistance and other covered entities to monitor and ensure compliance with 

Federal laws (in this case, to ensure compliance with legal requirements related to 

nondiscrimination and nondiscriminatory uses of federal funds). 

Treasury also collects contact information from the point of contact for each eligible 

jurisdiction and certain contracted entities. This is typically business contact information, 

but it sometimes unclear if, for example, a phone number is personal or business. 

Treasury maintains a system of records notice (Treasury .017 - Correspondence and 

Contact Information - 81 FR 78266 (Nov. 7, 2016)) that covers contact information if the 

information provided is personal and is otherwise covered by the Privacy Act. 

Additionally, records covering Treasury employee and contractor use of the Treasury 

information system in which these records are stored are covered by Treasury .015, 

General Information Technology Access Account Records - 85 FR 73353. 

3. ☐ A SORN was identified in the original PCLIA and a determination was made during 

this current PCLIA update that modifications [choose one] ☐ were ☐ were not required 

to that SORN. [If modifications were made, generally describe them here]. The current 

applicable SORN is: [Provide here the SORN number(s), system of records name(s) and 

the citation to the SORN(s) in the Federal Register.] 

4. ☒ A SORN(s) was not identified or required in the original PCLIA, but a determination 

was made during this current PCLIA update that a SORN(s) is now required. When the 

original PCLIA was published in January, Treasury had not yet determined what 

information it was going to collect. The decision to collect certain information, including 

demographic information, was reflected in the Interim Final Rule [87 Fed. Reg. 13628] 

published in the Federal Register on March 10, 2022. As discussed above, Treasury 

maintains a SORN, TREASURY .013, “Department of the Treasury Civil Rights 

Complaints and Compliance Review Files,” that covers this information to the extent it is 

received, held, or used by Treasury. 

5. ☒ A SORN was published. With respect to the demographic information collected and 

maintained by Treasury, no exemptions are taken from any Privacy Act requirements. 

There are other records in the system of records that are exempt from certain 

requirements. 

6. ☐ Exemptions are claimed from the following Privacy Act provisions in the applicable 

SORN(s): [List here all exemptions taken in the applicable SORN; Hint: it’s at the end of 

the SORN]: The citation to the applicable Notice of Proposed Rulemaking and/or Final 

Rule is[provide here the Federal Register Citation to the NPRM and Final Rule (if a Final 

Rule was required)]. 
6

Section 3: Information Collection 

Section 3.1: Relevant and Necessary 

The Privacy Act requires “each agency that maintains a system of records [to] maintain in its 

records only such information about an individual as is relevant and necessary to accomplish 

a purpose of the agency required to be accomplished by statute or by executive order of the 

President.” 5 U.S.C. § 552a (e)(1). It allows federal agencies to exempt records from certain 

requirements (including the relevant and necessary requirement) under certain conditions. 

5 U.S.C. §552a (k). The proposed exemption must be described in a Notice of Proposed 

Rulemaking (“NPRM”). In the context of the Privacy Act, the purpose of the NPRM is to 

give the public notice of a Privacy Act exemption claimed for a system of records and solicit 

public opinion on the proposed exemption. After addressing any public concerns raised in 

response to the NPRM, the agency must issue a Final Rule. It is possible for some, but not 

all, of the records maintained in the system or by the project to be exempted from the Privacy 

Act through the NPRM/Final Rule process. 

Section 3.1(a) Exemption Claimed from this Requirement?

1. ☒ The PII (about sole proprietors and POCs) maintained in this system or by this project is 

not exempt from 5 U.S.C. § 552a(e)(1), the Privacy Act’s requirement that an agency 

“maintain in its records only such information about an individual as is relevant and 

necessary to accomplish a purpose of the agency required to be accomplished by statute 

or by executive order of the President.”

2. ☐ The PII maintained in this system or by this project is exempt from 5 U.S.C. 

§ 552a(e)(1), because [See Appendix B for a list of acceptable bases for claiming this 

exemption and cut and paste here all that apply].

Section 3.1(b) Continuously Assessing Relevance and Necessity 

1. ☐ The PII in the system is not maintained in a system of records. Therefore, the Privacy 

requirements do not apply. [Explain here what you do to ensure relevance and necessity 

despite the fact that the Privacy Act does not apply]. 

2. ☐ The PII in the system is maintained in a system of records, but the agency exempted 

these records from the relevance and necessity requirement. [Explain here what you do to 

ensure relevance and necessity to the extent possible despite the fact the records are 

exempt from this requirement]. 

3. ☐ The system owner conducted an assessment prior to collecting PII for use in the 

system or project to determine which PII data elements and types (see Section 3.2 below) 

were relevant and necessary to meet the system’s or project’s mission requirements. 

During this analysis, in conducting the “relevance and necessity” analysis that is 

documented in this PCLIA, the system owner reevaluated the necessity and relevance of 

all PII data elements and determined that they are still relevant and necessary. Every time 

this PCLIA is updated, this ongoing assessment will be revisited. If it is determined at 

any time that certain PII data elements are no longer relevant or necessary, the system 

owner will update this PCLIA to discuss how the data element was removed from the 

system and is no longer collected. 
7

4. ☒ With respect to PII currently maintained (as of the time this PCLIA is being done) in 

the system or by the project, the PII ☒ is limited to only that which is relevant and 

necessary to meet the system or project’s mission requirements. In assessing how to 

implement the ARPA requirements, Treasury was determined to minimize the personally 

identifiable information (PII) it collected and stored in its information systems. To do 

that, Treasury first assessed what information was required for it to perform its required 

functions under the law. Treasury determined that it needed the demographic information 

because it was required to determine if jurisdictions were using their SEDI allocations 

appropriately, and to facilitate robust reporting. During the PCLIA process, the system 

always undergoes a review to ensure the continuing relevance and necessity of the PII in 

the system. 

5. ☒ With respect to PII maintained in the system or by the project, there is a process in 

place to continuously reevaluate and ensure that the PII remains relevant and necessary. 

During the PCLIA process, the system always undergoes a review to ensure the 

continuing relevance and necessity of the PII on the system. If a determination is made 

that particular PII is no longer relevant and necessary in between PCLIA updates, this 

PCLIA will be updated at that time. 

Section 3.2: PII and/or information types or groupings 

PII identified below is used by the system or project to fulfill the purposes stated in Section 2.2 

above– Authority to Collect. 

Treasury does not collect PII directly from individuals who apply for loan under the SSBCI 

program. Participating jurisdictions collect information from the businesses (applicants) seeking 

capital, sometimes through or with private lenders or investors. These jurisdictions and/or 

entities proceed with the disbursement of SSBCI funds upon selection of recipients. Participating 

jurisdictions are required to send certain data to Treasury (including certain demographic data 

collected) so it can complete its quarterly and annual reports as required by the SBJA, as 

amended by ARPA. 

Section 3.3 Sources from which PII is obtained 

Focusing on the context in which the data was collected and used (i.e., why it is collected and 

how it is used), check ALL sources from which PII is collected/received and stored in the 

system or used in the project. Members of the Public 

☒ Members of the Public (i.e., including individuals who are current federal employees 

who are providing the information in their “personal” capacity (unrelated to federal 

work/employment). All of the following are members of the public. Please check relevant 

boxes (based on the context of collection and use in this system) for members of the 

public whose information is maintained in the system (only check if relevant to the 

purpose for collecting and using the information): 

☒ Members of the general public (current association with the federal 

government, if any, is irrelevant to the collection and use of the information by the 

system or project). 
8

☐ Retired federal employees. Discuss here how/why PII is collected from this 

source.

☐ Former Treasury employees. Discuss here how/why PII is collected from this 

source. 

☒ Federal contractors, eligible entities, interns, detailees, etc. (data logging of 

system administrators’ and system users’ activities on the system; administrators 

and users do not submit data under SBJA, as amended by ARPA) (see Section 2.2 

for the full citation).

☐ Federal job applicants. 

☐ Other: [Explain here]. Discuss here how/why PII is collected from this source.

2. Current Federal Employees, Interns, and Detailees 

☒ Current Federal employees (data logging of system administrators’ and system users’ 

activities on the system; administrators and users do not submit data under ARPA) 

☒ Interns. (data logging of Treasury system administrators’ and system users’ activities 

on the system; administrators and users do not submit data under SBJA, as amended by 

ARPA)

☒ Detailees. (data logging of Treasury system administrators’ and system users’ 

activities on the system; administrators and users do not submit data under SBJA, as 

amended by ARPA)

☐ Other employment-related positions. [name the position here and discuss how/why 

PII is collected from this source.]. 

3. Treasury Bureaus (including Departmental Offices) 

☐ Other Treasury Bureaus: (name the bureau(s) here and identify the bureau/office 

information system from which the PII originated) and (how/why PII is collected from 

this source.). 

4. Other Federal Agencies 

☐ Other federal agencies: (name each agency here and explain how/why PII is collected 

from this source.). 

5. State and Local Agencies 

☒ State and local agencies: States, the District of Columbia, territories, eligible 

municipalities, and Tribal governments as defined in SBJA as amended by ARPA that 

submit information to Treasury under the SSBCI program. 

6. Private Sector 

☒ Private sector organizations (for example, banks and financial organizations, data 

brokers or other commercial sources). 

7. Other Sources 
9

☐ Other sources not covered above (for example, foreign governments). 

(Name the other sources here and explain how/why PII is collected from this source). 

Section 3.4: Privacy and/or civil liberties risks related to collection 

When Federal agencies request information from an individual that will be maintained in a 

system of records, they must inform the individual of the following: “(A) the authority (whether 

granted by statute, or by executive order of the President) which authorizes the solicitation of the 

information and whether disclosure of such information is mandatory or voluntary; (B) the 

principal purpose or purposes for which the information is intended to be used; (C) the routine 

uses which may be made of the information, as published pursuant to paragraph (4)(D) of this 

subsection; and (D) the effects on [the individual], if any, of not providing all or any part of the 

requested information.” 5 U.S.C § 522a(e)(3). This is commonly called a Privacy Act Statement. 

The OMB Guidelines also note that subsection (e)(3) is applicable to both written and oral (i.e., 

interview) solicitations of personal information. Therefore, even if a federal employee or 

contractor has a fixed list of questions that they orally ask the individual in order to collect their 

information, this requirement applies. 

Section 3.4(a) Collection Directly from the Individual to whom the PII pertains 

1. ☒ None of the PII in the system collected under ARPA was collected directly from an 

individual to whom it pertains. Treasury does not directly collect the PII in the system 

from the individuals to whom it pertains. The information is collected by participating 

jurisdictions, sometimes through or with private lenders or investors. Treasury does not 

use the information to make decisions regarding eligibility for SSBCI-funded programs. 

Credit and investment decisions are made by the participating jurisdictions and/or 

private lenders or investors. 

2. ☐ Some or ☐ all of the information in this system was collected directly from an 

individual to whom it pertains.

Section 3.4(b) Privacy Act Statements. 

1. ☒ None of the PII in the system was collected directly from the individuals to whom it 

pertains. Therefore, a Privacy Act Statement is not required. Treasury does not collect 

any PII directly from the small businesses or associated individuals to whom it pertains, 

but rather the information is collected by participating jurisdictions either directly or 

through private lenders or investors. Nevertheless, Treasury intends to require that 

participating jurisdictions provide a Privacy Act Statement to those from whom they are 

collecting data, or cause the lenders or investors who are interacting directly with small 

businesses to provide the same. The Privacy Act Statement will address sole proprietors 

who might apply for SSBCI-funded programs, but will also include a general notice to 

SSBCI applicants that are not sole proprietors. Treasury intends to direct businesses that 

are not sole proprietorships to the applicable SORNs and provide a link to the PCLIA for 

this system so they can acquire additional general information on the program and how 

Treasury will use and protect their information (even though they are not otherwise 

covered by the Privacy Act). 
10

2. ☐ Some ☐ All of the PII in the system was collected directly from the individual to 

whom it pertains. Therefore, a Privacy Act Statement was posted at the point where the 

PII was collected directly from the individual. That Privacy Act Statement was provided 

to the individual ☐ on the form in which the PII was collected ☐ on a separate sheet of 

paper that the individual could retain; or ☐ in an audio recording or verbally at the point 

where the information was collected (e.g., on the phone) or ☐ other [please explain]. 

3. The Privacy Act Statement contained the following: 

a. ☒ The authority (whether granted by statute, or by Executive order of the 

President) which authorizes the solicitation of the information. 

b. ☒ Whether disclosure of such information is mandatory or voluntary. 

c. ☒ The principal purpose or purposes for which the information is intended to be 

used. 

d. ☒ The individuals or organizations outside of Treasury with whom the 

information may be/ will be shared. 

e. ☒ The effects on the individual, if any, if they decide not to provide all or any 

part of the requested information. 

Section 3.4(c) Use of Full Social Security Numbers 

Treasury is committed to eliminating unnecessary collection, use, and display of full Social 

Security numbers (“SSN”) and redacting, truncating, and anonymizing SSNs in systems and 

documents to limit their accessibility to individuals who do not have a need to access the full 

SSN in order to perform their official duties. Moreover, the Privacy Act provides that: “It shall 

be unlawful for any Federal, State or local government agency to deny to any individual any 

right, benefit, or privilege provided by law because of such individual’s refusal to disclose his 

social security account number.” Pub. L. No. 93–579, § 7. This provision does not apply to: 

(1) any disclosure which is required by federal statute; or (2) any disclosure of an SSN to any 

federal, state, or local agency maintaining a system of records in existence and operating before 

January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such 

date to verify the identity of an individual. Id. at § 7(a)(2)(A)-(B). 

Section 3.4(d) Justification of Social Security Numbers. 

1. ☒ N/A No full SSNs are maintained in the system or by the project. [Explain if any 

portion of the SSN short of the full 9 digits is used in the system: Explain]; if the full SSN 

is located anywhere in the system (even if it is redacted, truncated or anonymized when 

viewed by users, please check number 2 below)].

2. ☐ Full SSNs are maintained in the system or by the project and the following approved 

Treasury uses of SSNs apply: 

☐ security background investigations; 

☐ interfaces with external entities that require the SSN; 

☐ a legal/statutory basis (e.g. where collection is expressly required by statute); 

☐ when there is no reasonable, alternative means for meeting business 

requirements; 
11

☐ statistical and other research purposes; 

☐ delivery of government benefits, privileges, and services; 

☐ for law enforcement and intelligence purposes; 

☐ aging systems with technological limitations combined with funding 

limitations render impracticable system modifications or replacements to add 

privacy risk reduction tools (partial/truncated/redacted or masked SSNs); and 

☐ as a unique identifier for identity verification purposes. 

Section 3.4(e) Controls implemented to limit access to and or improper disclosure of full 

Social Security Numbers. 

1. ☒ Full SSNs are not maintained in the system or by the project. 

2. ☐ Full SSNs are maintained in the system or by the project and the following controls 

are put in place to reduce the risk that the SSN will be seen or used by someone who does 

not have a need to use the SSN in order to perform their official duties (check ALL that 

apply): 

a. ☐ The entire SSN data field is capable of suppression (i.e., being turned off) and 

the data field is suppressed when the SSN is not required for particular system 

users to perform their official duties. 

b. ☐ The SSN field is visible, but the SSN itself is blurred or distorted in some 

way so it is not capable of being read by users who do not require the SSN to 

perform their official duties. 

c. ☐ Within the system, an alternative number (e.g., an Employee ID) is displayed 

to all system users who do not require the SSN to perform their official duties. 

The SSN is only linked to the alternative number within the system and when 

reporting outside the system (to an agency that requires the full SSN). The SSN 

is not visible to system users (other than administrators). 

d. ☐ The SSN is truncated (i.e., shortened to the last 4 digits of the SSN) when 

displayed to all system users for whom the last four digits (but not the full) SSN 

are necessary to perform their official duties. 

e. ☐ Full or truncated SSNs are only downloaded to spreadsheets or other 

documents for sharing within the bureau or agency when disclosed to staff 

whose official duties require access to the full or truncated SSNs for the 

particular individuals to whom they pertain. No SSNs (full or truncated) are 

included in spreadsheets or documents unless required by each recipient to 

whom it is disclosed in order to perform their official duties (e.g., all recipients 

have a need to see the SSN for each employee in the spreadsheet). 

f. ☐ Other: [Please describe].

Section 3.4(f) Denial of rights, benefits, or privileges for refusing to disclose Social Security 

Number. 

1. ☒ N/A No SSNs are maintained in the system or by the project. 

2. ☐ Full SSNs are collected, but no individual will be denied any right, benefit, or 

privilege provided by law if the individual refuses to disclose their SSN for use in the 
12

system or project. If the individual chooses not to provide their SSN [please describe 

here what will happen (something less than denial of a privilege etc.) if the individual 

chooses not to provide their SSN].☐ Full SSNs are collected, and the individual will be 

denied the following right, benefit, or privilege provided by law if they refuse to disclose 

their SSN: [please identify the right, benefit, or privilege if the individual will be denied 

if they choose not to provide their SSN: Identify here]. Denial of this right, benefit or 

privilege does not violate the law because: [choose one of the two boxes below]: 

a. ☐ SSN disclosure is required by the following Federal statute or 

Executive Order; OR

b. ☐ The SSN is disclosed to a Federal, state, or local agency that maintains a 

system of records that was in existence and operating before January 1, 1975, 

and disclosure was required under statute or regulation adopted prior to such 

date to verify the identity of an individual.

Section 3.4(g) Records describing how individuals exercise First Amendment rights 

The Privacy Act requires that Federal agencies “maintain no record describing how any 

individual exercises rights guaranteed by the First Amendment unless expressly authorized by 

statute or by the individual about whom the record is maintained or unless pertinent to and 

within the scope of an authorized law enforcement activity.” 5 U.S.C. § 552a(e)(7). 

1. ☒ N/A. The system or project does not maintain information describing how an 

individual exercises their rights guaranteed by the First Amendment. 

2. ☐ The system or project does maintain information describing how an individual 

exercises their rights guaranteed by the First Amendment. If you checked this box, please 

check the box below that explains Treasury’s authorization for collecting this 

information:

a. ☐ The individual about whom the information was collected or maintained 

expressly authorizes its collection/maintenance. The individual about whom the 

information was collected or maintained expressly authorized its collection by

[explain here how the individual expressly authorizes collection] (for example, 

individuals may expressly authorize collection by requesting in writing that 

Treasury share information with a third party, e.g., their Congressman]; 

b. ☐ The information maintained is pertinent to and within the scope of an 

authorized law enforcement activity because [generally discuss here the nature 

and purpose of the information collected and the law enforcement activity]; 

c. ☐ The following statute expressly authorizes its collection: [provide here the 

name of and citation to the statute and the language from that statute that 

expressly authorizes collection] [your response MUST contain all three if you use 

a statute as the basis for the collection].

Section 4: Maintenance, use, and sharing of the information 

Section 4.1: Ensuring accuracy, completeness, and timeliness of information collected, 

maintained, and shared when it is used to make determinations about individuals 
13

The Privacy Act and Treasury policy require that Treasury bureaus and offices take additional 

care when collecting and maintaining information about individuals when it will be used to make 

determinations about those individuals (e.g., whether they will receive a federal benefit). This 

includes collecting information directly from the individual where practicable and ensuring that 

the information is accurate, relevant, timely and complete to assure fairness to the individual 

when making a determination about them. This section addresses the controls/protections put in 

place to address these issues. 

The Privacy Act requires that Federal agencies “maintain all records which are used by the 

agency in making any determination about any individual with such accuracy, relevance, 

timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the 

determination.” 5 U.S.C § 552a(e)(5). If a particular system of records meets certain 

requirements (including the NPRM process defined in Section 3.1 above), an agency may 

exempt the system of records (or a portion of the records) from this requirement. Exemptions 

may be found at the bottom of the relevant SORN next to the heading: “Exemptions Claimed for 

this System.”

Section 4.1(a) Exemption from the accuracy, relevance, timeliness, and completeness 

requirements in section (e)(5) of the Privacy Act. 

1. ☐ None of the information maintained in the system or by the project that is part of a 

system of records is exempt from the accuracy, relevance, timeliness, and completeness 

requirements in section (e)(5) of the Privacy Act. 

2. ☐ All ☐ Some of the PII maintained in the system or by the project is part of a system 

of records and is exempt from the accuracy, relevance, timeliness, and completeness 

requirements in section (e)(5) of the Privacy Act. The exemption claimed for these 

records is appropriate because [please see Appendix B which contains sample 

justifications for this exemption and provide the appropriate bases here [more than one 

bases may apply].

3. ☒ The PII maintained in the system or by the project is not: (a) part of a system of 

records as defined in section (e)(5) of the Privacy Act. Treasury does not make adverse 

determinations about which applicants receive SSBCI program benefits (so direct 

collection from the individual is not an issue). The lenders or investors (who are making 

decisions about whether applicants receive benefits) are collecting the information 

directly from the applicants about which they will make a decision. Applicants should 

consult with their participating jurisdictions or the lender or investor to which they 

submitted their application if they believe the SSBCI applications were denied because of 

the quality of the data used by the entities to make an adverse determination. Treasury 

uses the information it receives from participating jurisdictions to determine compliance 

with the SSBCI statute and other applicable federal laws, rules, and guidance, and to 

understand SSBCI program outcomes. 

4. ☐ None of the information maintained in the system or by the project is part of a system 

of records as defined in section (e)(5) of the Privacy Act, but the information in the 

system is used to make adverse determinations about individuals (defined in the Privacy 

Act as U.S. Citizens and legal permanent residents). Despite the fact that the Privacy Act 
14

does not apply, the following protections are in place to ensure fairness to the individual: 

explain here .

Section 4.1(b) Protections in place despite exemption from the accuracy, relevance, 

timeliness, and completeness requirements 

1. ☒ None of the information maintained in the system or by the project that is part of a 

system of records is exempt from the accuracy, relevance, timeliness, and completeness 

requirements in section (e)(5) of the Privacy Act. 

Treasury does not make adverse determinations about which applicants receive SSBCI 

program benefits. Applicants should consult with their participating jurisdiction or the 

lender or investor to which they submitted their application if they believe the SSBCI 

applications were denied because of the quality of the data used by these entities to make 

an adverse determination. Treasury uses the information it receives from participating 

jurisdictions to determine compliance with the SSBCI statute and other applicable 

federal laws, rules, and guidance, and to understand SSBCI program outcomes. 

2. ☐ For all information maintained in the system or by the project that is part of a system 

of records that is exempt from the accuracy, relevance, timeliness, and completeness 

requirements in section (e)(5) of the Privacy Act, the following efforts are made to ensure 

accuracy, relevance, timeliness, and completeness to the extent possible without 

interfering with the (check one) ☐ law enforcement ☐ intelligence ☐ other [describe 

here] mission requirements for which the system or project was created [choose ALL

that apply]: 

a. ☐ The exempt information is not actually used to make any adverse 

determinations about individuals. 

b. ☐ The exempt information is not actually used to make any adverse 

determinations about individuals without additional research and investigation to 

ensure accuracy, relevance, timeliness, and completeness. 

c. ☐ Individuals and organizations to whom PII from the system or project is 

disclosed (as authorized by the Privacy Act) determine its accuracy, relevance, 

timeliness, and completeness in a manner reasonable for their purposes before they 

use it to make adverse determinations about individuals. 

d. ☐ Individuals about whom adverse determinations are made using PII from this 

system or project are given an opportunity to explain or modify their information 

(check one) ☐ before ☐ after the adverse determination is made. During this 

process, individuals are allowed to: [discuss here

e. ☐ Other: (please describe):

3. ☐ No additional efforts are made to ensure accuracy, relevance, timeliness, and 

completeness to the extent possible because it would interfere with mission 

requirements. 

Section 4.1(c) Collecting information directly from the individual when using it to make 

adverse determinations about them. 

Section 552a(e)(2) of the Privacy Act requires that Federal agencies that maintain records in a 

system of records are required to collect information to the greatest extent practicable directly 
15

from the individual when the information about them may result in adverse determinations about 

their rights, benefits, and privileges under Federal programs. Agencies may exempt a system of 

records from this requirement under certain circumstances and if certain conditions are met. 

1. ☒ Treasury does not use the records maintained in this system to make any adverse 

determinations about individuals. Decisions about whether an applicant receives SSBCI 

funding are made by participating jurisdictions and/or private lenders or investors.

Treasury does not receive the information until after an adverse (or positive) decision 

has been made. 

2. ☐ The records maintained by this system or project are used to make adverse 

determinations about individuals and [check all that apply]: 

a. ☐ These records were exempted from the Privacy Act provision that requires 

collection directly from the subject individual to the greatest extent practicable. 

Exemption of these records is proper because [explain here why the records were 

exempted; sample responses are provided in Appendix B of this template]. 

b. ☐ These records were not exempted from the requirement to collect information 

directly from the individual to the greatest extent practicable and [check the relevant 

box below and provide the information requested]. 

i. ☐ All records used to make an adverse determination are collected directly from 

the individual about whom the decision is made. ☐ A combination of records 

collected from third parties and directly from the individual about whom the 

determination is made are used to make the determination because [please 

explain here why third-party data is required to make this determination; e.g., 

third-party data is required to verify the accuracy of the information provided by 

the individual seeking a privilege or benefit].

iii. ☐ None of the records used to make adverse determinations are collected directly 

from the individual about whom determinations are made because seeking the 

information directly from the individual might [select ALL that apply]:

☐ alert the individual to the fact that their conduct is being observed or 

investigated; 

☐ cause the individual to alter or modify their activities to avoid detection; 

☐ create risks to witnesses or other third parties if the individual is alerted to 

the fact that their conduct is being observed or investigated; 

☐ Other: (please describe here).

Section 4.1(d) Additional controls designed to ensure accuracy, completeness, timeliness,

and fairness to individuals in making adverse determinations 

1. Administrative Controls. Individuals about whom information is collected are given the 

following opportunities to amend/correct/update their information to ensure it is accurate, 

timely and complete to the extent reasonably necessary to assure fairness when it is used 

to make a determination about them: 

a. ☒ Treasury does not use the PII collected to make adverse determinations about an 

individual’s rights, benefits, or privileges under federal programs. Those decisions 
16

are made by participating jurisdictions and/or the financial institution or other 

lender or investor to which the applicant submitted its application. 

There are risks inherent in participating jurisdictions, lenders, or investors collect 

and maintain sensitive demographic data, including the risk that this information is 

not kept private or is used in ways that may be detrimental to a small business or its

owners. For example, there are risks associated with public disclosure of this 

information by lenders, investors, or participating jurisdictions. In addition, there 

are risks associated with the use of this information for purposes beyond those 

related to the SSBCI program, such as the use of information for marketing or sales 

to third parties. Moreover, there are risks that demographic information collected in 

connection with financial transactions could be used to discriminate in lending or 

investment. 

Treasury has carefully considered these risks and the benefits of collecting this data, 

including the importance of this data to enable Treasury to assess the impacts and 

effectiveness of the SSBCI program. Treasury has determined that some of these risks 

will likely be mitigated, at least in part, by (i) nondiscrimination requirements that 

apply to the use of federal financial assistance, (ii) Equal Credit Opportunity Act 

(ECOA) requirements that apply to certain lending transactions, (iii) privacy and 

antidiscrimination requirements imposed on certain financial institutions by their 

prudential regulators, and (iv) any applicable state privacy or antidiscrimination 

laws. In addition, because the degree of legal protection will vary by participating 

jurisdiction, and applicable legal requirements may not fully cover every type of 

entity or transaction involved in SSBCI programs, Treasury has also included 

additional controls in the design of the SSBCI program to further mitigate these risks 

to the maximum extent feasible. For example, in the Allocation Agreement that all 

participating jurisdictions will be required to execute, jurisdictions that are not 

Tribal governments must agree to comply with statutes and regulations prohibiting 

discrimination, which include, but are not limited to: 

(a) Title VI of the Civil Rights Act of 1964 (42 U.S.C. § 2000d et seq.) and 

Treasury’s implementing regulations at 31 C.F.R. Part 22;

(b) Section 504 of the Rehabilitation Act of 1973, as amended (29 U.S.C. § 

794);

(c) the Age Discrimination Act of 1975, as amended (42 U.S.C. §§ 6101 et 

seq.), and Treasury’s implementing regulations at 31 C.F.R. Part 23; 

(d) Title II of the Americans with Disabilities Act of 1990, as amended (42 

U.S.C. §§ 12101 et seq.); and 

(e) Title IX of the Education Amendments of 1972, 20 U.S.C. § 1681 et seq., 

and Treasury’s implementing regulations, 31 C.F.R. Part 28. 

Additionally, the Allocation Agreement requires a participating jurisdiction to 

comply with Treasury guidance related to internal control and financial management 

system requirements and to comply with the standard for financial management 

systems, including internal control requirements, specified at 2 C.F.R. §§ 200.302 
17

and 200.303. See also 2 C.F.R. § 200.303(e) (requiring a non-federal entity to 

“[t]ake reasonable measures to safeguard protected personally identifiable 

information and other information the Federal awarding agency or pass-through 

entity designates as sensitive or the non-Federal entity considers sensitive consistent 

with applicable Federal, State, local, and tribal laws regarding privacy and 

responsibility over confidentiality”). Finally, the Allocation Agreement requires a 

participating jurisdiction to comply with—and to cause any entities it designates or 

contracts to implement approved SSBCI programs, to comply with—the SSBCI 

statute (12 U.S.C. § 5701 et seq.), as amended or replaced from time to time, and 

Treasury’s SSBCI regulations, guidance, and other requirements, as in effect from 

time to time. 

Treasury’s Capital Program Reporting Guidance requires that “demographicsrelated data elements may only be collected and used for purposes of the SSBCI 

program and must not be used for any other purposes (e.g., for marketing, sale to 

third-parties for profit).” It further provides that “[e]ach participating jurisdiction 

shall establish data privacy and security requirements for the demographic-related 

information described in Table 7 that include appropriate measures to ensure that 

the privacy of the individuals is protected." As described above, this language is also 

relevant to the requirement in the Allocation Agreements that participating 

jurisdictions must require that designated or contracted entities also comply with the 

requirements set forth in Treasury guidance. 

Treasury also retains the authority to terminate the Allocation Agreement with any 

participating jurisdiction if it materially fails to comply with any term or condition 

under the Allocation Agreement. 

b. ☐ The records maintained in the system or by the project are used to make adverse 

determinations and (select one) ☐ are ☐ are not exempt from the access provisions 

in the Privacy Act, 5 U.S.C. 552a(d). 

c. ☒ Treasury has published regulations in place describing how individuals may seek 

access to and amendment of their records under the Privacy Act. The

Treasury/bureaus FOIA and Privacy Act disclosure regulations can be found at 

31 C.F.R. Part 1, Subtitle A, Subparts A and C. 

d. ☐ Individuals who provide their information directly to Treasury for use in the 

system or by the project are provided notice of the adverse determination and an 

opportunity to amend/correct/ update their information [choose one] ☐ before ☐

after it is used to make a final, adverse determination about them. This is 

accomplished by [describe here how this process works and the protections in place, 

including redress/appeals processes; if notice is provided after an adverse 

determination is made, explain here why notice could not be provided before a 

determination was made, and the protections in place]: Descriptions. 

e. ☐ Individuals who provide their information directly to Treasury for use in the 

system or by the project are expressly told at the point where the information is 

collected that they need to keep their information accurate, current and complete 
18

because it could be used to make adverse determinations about them. This is 

accomplished by [describe here how/where/when individuals are told they need to 

keep their information updated before it is used to make adverse decisions about 

them; include the exact language provided to the individuals]: Description. 

f. ☐ All manual PII data entry by federal employees/contractors is verified by a 

supervisor or other data entry personnel before it is uploaded to the system (e.g., PII 

entered into the system from paper records is double-checked by someone else before 

it’s uploaded to the system). This is accomplished by: [describe here how this 

process works]. 

g. ☐ Other: [please describe here]. 

2. Technical controls. The system or project also includes additional technical controls to 

ensure that PII is maintained with such accuracy, relevance, timeliness and completeness 

as is reasonably necessary to assure fairness to the individual when it is used to make a 

determination about them. The following additional protections are relevant to this 

system or project

a. ☒ No additional technical controls are available to ensure accuracy, relevance, 

timeliness and completeness. 

b. ☐ Automated data feeds are used to refresh/update the information in the system 

(where the system is reliant on updates from another system). These automated 

data feeds occur: [state here the frequency of updates] and [state here what 

happens when the data is updated and why the system is reliant on another system 

for its data]. 

c. ☐ Technical and/or administrative controls put are in place to ensure that when 

information about an individual is acquired from multiple sources for 

maintenance in a single file about a particular individual, it all relates to the same 

individual. This is accomplished by: [describe here the method or process used to 

ensure that information merged about an individual from multiple sources for 

inclusion in a single file, all relates to the same person]. 

d. ☐ Address verification and correction software (software that validates, updates 

and standardizes the postal addresses in a database). 

e. ☐ Technical and/or administrative controls put are in place to ensure that when 

information about an individual is acquired from multiple sources for maintenance in a 

single file about a particular individual, it all relates to the same individual . This is 

accomplished by: [describe here the method or process used to ensure that information 

merged about an individual from multiple sources for inclusion in a single file, all relates 

to the same person].

f. ☐ Address verification and correction software (software that validates, updates 

and standardizes the postal addresses in a database). 

g. ☐ Automated data feeds are used to refresh/update the information in the system 

(where the system is reliant on updates from another system). These automated 

data feeds occur: [state here the frequency of updates] and [state here what 

happens when the data is updated and why the system is reliant on another system 

for its data]. 

h. ☐ Other: [please describe here] 
19

Section 4.2 Data-Mining 

As required by Section 804 of the Implementing Recommendation of the 9/11 Commission Act 

of 2007 (“9-11 Commission Act”), Treasury reports annually to Congress on its data mining 

activities. For a comprehensive overview of Treasury’s data mining activities, please review the 

Department’s Annual Privacy Act and Data Mining reports available at: 

http://www.treasury.gov/privacy/annual-reports.

Section 4.2(a) Is the PII maintained in the system used to conduct data-mining? 

1. ☒ The information maintained in this system or by this project is not used to conduct 

“data-mining” activities as that term is defined in the 9-11 Commission Act. Therefore, 

no privacy or civil liberties issues were identified in responding to this question. 

2. ☐ The information maintained in this system or by this project is used to conduct 

“data-mining” activities as that term is defined in the 9-11 Commission Act. This system 

is included in Treasury’s annual report to Congress which can be found on the external 

Treasury privacy website. 

3. ☐ The information maintained in this system or by this project is used to conduct 

“data-mining” activities as that term is defined in the 9-11 Commission Act, but this 

system is not included in Treasury’s annual report to Congress which can be found on the 

external Treasury privacy website. This system will be added to the next Treasury Datamining report to Congress. 

Section 4.3 Computer Matching 

The Computer Matching and Privacy Protection Act (CMPPA) of 1988 amended the Privacy Act 

by imposing additional requirements when Privacy Act systems of records are used in computer 

matching programs. 

Pursuant to the CMPPA, there are two distinct types of matching programs. The first type of 

matching program involves the computerized comparison of two or more automated federal 

personnel or payroll systems of records or a system of federal personnel or payroll records with 

non-federal records. This type of matching program may be conducted for any purpose. The 

second type of matching program involves the computerized comparison of two or more 

automated systems of records or a system of records with non-federal records. The purpose of 

this type of matching program must be for the purpose of eligibility determinations or 

compliance requirements for applicants, recipients, beneficiaries, participants, or providers of 

services for payments or in-kind assistance under federal benefit programs, or recouping 

payments or delinquent debts under such federal benefit programs. See 5 U.S.C. § 522a(a)(8). 

Matching programs must be conducted pursuant to a matching agreement between the source 

(the agency providing the records) and recipient agency (the agency that receives and uses the 

records to make determinations). The matching agreement describes the purpose and procedures 

of the matching and establishes protections for matching records. 

Section 4.3(a) Records in the system used in a computer matching program 

1. ☒ Except as stated above, the PII maintained in the system or by the project is not part 

of a Privacy Act system of records. The contact information is not part of a matching 

program. 
20

2. ☐ The information maintained in the system or by the project is part of a Privacy Act 

system of records, but is not used as part of a matching program. 

3. ☐ The information maintained in the system or by the project is part of a Privacy Act 

system of records and is used as part of a matching program. [If whether a Matching 

Agreement was executed and published as required by the CMPPA/Privacy Act; if no 

Matching Agreement was executed, please explain here why]: Explain here. 

Section 4.3(b) Is there a matching agreement? 

1. ☒ N/A 

2. ☐ There is a matching agreement in place that contains the information required by 

Section (o) of the Privacy Act. 

3. ☐ There is a matching agreement in place, but it does not contain all of the information 

required by Section (o) of the Privacy Act. The following actions are underway to amend 

the agreement to ensure that it is compliant. [discuss here the issues that were 

discovered that required amendment and how those issues are being mitigated/fixed]: 

Discuss here

Section 4.3(c) What procedures are followed before adverse action is taken against an 

individual who is the subject of a matching agreement search? 

1. ☒ N/A

2. ☐ The bureau or office that owns the system or project conducted an assessment 

regarding the accuracy of the records that are used in the matching program and the 

following additional protections were put in place: 

a. ☐ The results of that assessment were independently verified by [explain how and by 

whom accuracy is independently verified; include the general activities involved in 

the verification process].

b. ☐ Before any information subject to the matching agreement is used to suspend, 

terminate, reduce, or make a final denial of any financial assistance or payment under 

a Federal benefit program to an individual: 

i. ☐ The individual receives notice and an opportunity to contest the findings; OR

ii. ☐ The Data Integrity Board approves the proposed action with respect to the 

financial assistance or payment in accordance with Section (p) of the Privacy 

Act before taking adverse action against the individual. 

3. ☐ No assessment was made regarding the accuracy of the records that are used in the 

matching program. 

Section 4.4: Information sharing with external (i.e., outside Treasury) organizations and 

individuals 

Section 4.4(a) PII shared with/disclosed to agencies, organizations or individuals outside 

Treasury 

1. ☐ PII maintained in the system or by the project is not shared with agencies, 

organizations, or individuals external to Treasury. 
21

2. ☐ PII maintained in the system or by the project is shared with the following agencies, 

organizations, or individuals external to Treasury: [For each recipient, provide the 

following: (1) name of organization/type of individual; (2) the PII shared; (3) the 

purpose of the sharing; (4) identify any statutes that limit use or sharing of the 

information; (5) identity any applicable MOU]. 

3. ☒ All external disclosures are authorized by the Privacy Act (including routine uses in 

the applicable SORN). 

Section 4.4(b) Accounting of Disclosures 

An accounting of disclosures is a log of all external (outside Treasury) disclosures of records 

made from a system of records that has not been exempted from this accounting requirement. 

This log must either be maintained regularly or be capable of assembly in a reasonable amount of 

time after an individual makes a request. Certain system of records may be exempted from 

releasing an accounting of disclosures (e.g., in law enforcement investigations). 

Section 4.4(c) Making the Accounting of Disclosures Available 

1. ☒ An accounting of disclosure will be maintained with respect to disclosures of point of 

contact (where applicable) and demographic information. The other records in the 

system are not, however, maintained in a system of records subject to the Privacy Act so 

an accounting is not required. Nevertheless, disclosures of other records maintained 

pursuant to the SSBCI Program are only disclosed as stated in Section 4.4(a) above 

(even if not covered by the Privacy Act). 

2. ☐ No external disclosures are made from the system. 

3. ☐ The Privacy Act system of records maintained in the system or by the project is

exempt from the requirement to make the accounting available to the individual named in 

the record. Exemption from this requirement was claimed because: [please state here 

why the records in this system of records were exempted from this requirement]. 

4. ☐ The Privacy Act system of records maintained in the system or by the project is not

exempt from the requirement to make the accounting available to the individual named in 

the record and a log is maintained regularly. The log is maintained for at least five years 

and includes the date, nature, and purpose of each disclosure (not including intra-agency 

disclosures and FOIA disclosures) of a record to any person or to another agency (outside 

of Treasury) and the name and address of the person or agency to whom the disclosure is 

made. 

5. ☐ The Privacy Act system of records maintained in the system or by the project is not

exempt from the requirement to make the accounting available to the individual named in 

the record and a log is not maintained regularly, but is capable of being constructed in a 

reasonable amount of time upon request. The information necessary to reconstruct the log 

(i.e., date, nature, and purpose of each disclosure) is maintained for at least five years. 

Section 4.4(d) Obtaining Consent Prior to New Disclosures Not Authorized by the Privacy 

Act 

Records in a system of records subject to the Privacy Act may not be disclosed by "any means of 

communication to any person or to another agency" without the prior written request or consent 

of the individuals to whom the records pertain. 5 U.S.C. Sec. 552a(b). However, the Act also sets 
22

forth twelve exceptions to this general restriction. These 12 exceptions may be viewed at: 

https://www.justice.gov/usam/eousa-resource-manual-139-routine-uses-and-exemptions. Unless 

one of these 12 exceptions applies, the individual to whom a record pertains must provide their 

consent, where feasible and appropriate, before their records may be disclosed to anyone who is 

not listed in one of the 12 exceptions. One of these 12 exceptions also allows agencies to include 

in a notice published in the Federal Register, a list of routine uses. Routines uses are disclosures 

outside the agency that are compatible with the purpose for which the records were collected. 

Section 4.4(e) Obtaining Prior Written Consent 

1. ☐ The records maintained in the system of records are only shared in a manner 

consistent with one of the 12 exceptions in the Privacy Act, including the routine uses 

published in the Federal Register.

2. ☒ If a situation arises where disclosure (written, oral, electronic, or mechanical) must 

be made to anyone outside of Treasury who is not listed in one of the 12 exceptions in the 

Privacy Act (including the published routine uses), the individual’s prior written consent 

will be obtained where feasible and appropriate. 

Section 5: Compliance with federal information management requirements 

Responses to the questions below address the practical, policy, and legal consequences of failing 

to comply with one or more of the following federal information management requirements (to 

the extent required) and how those risks were or are being mitigated: (1) the Privacy Act System 

of Records Notice Requirement; (2) the Paperwork Reduction Act; (3) the Federal Records Act; 

(4) the E-Gov Act security requirements; and (5) Section 508 of the Rehabilitation Act of 1973. 

Section 5.1: The Paperwork Reduction Act 

The PRA requires OMB approval before a Federal agency may collect standardized data from 10 

or more respondents within a 12-month period. OMB also requires agencies to conduct a PIA (a 

Treasury PCLIA) when initiating, consistent with the PRA, a new electronic collection of PII for 

10 or more persons (excluding agencies, instrumentalities, or employees of the federal 

government). 

Section 5.1(a). 

1. ☒The system or project maintains information obtained from individuals and 

organizations who are not federal personnel or an agency of the federal government 

(i.e., outside the Federal Government).☒The project or system involves a new collection 

of information in identifiable form for 10 or more persons from outside the federal 

government. 

3. ☒ The project or system completed an Information Collection Request (“ICR”) and 

received OMB approval. OMB Control # 1505-0227.

4. ☐ The project or system did not complete an Information Collection Request (“ICR”) 

and receive OMB approval because [explain here why an ICR is either not required or 

provide the status on completing the ICR and OMB approval]. 

Section 5.2: Records Management - NARA/Federal Records Act Requirements 
23

Records retention schedules determine the maximum amount of time necessary to retain 

information in order to meet the needs of the project or system. Information is generally either 

disposed of or sent to the National Archives and Records Administration (NARA) for permanent 

retention upon expiration of this period. If the system has an applicable SORN(s), check the 

“Policies and Practices for Retention and Disposal of Records” section.

Section 5.2(a). 

1. ☒ The records used in the system or by the project are covered by a NARA’s General 

Records Schedule (GRS). The GRS is 1.2: Grant and Cooperative Agreement Records. 

2. ☐ The records used in the system or by the project are covered by a NARA approved 

Treasury bureau Specific Records Schedule (SRS). The SRS [please provide here the 

specific schedule name and identifying number] 

3. ☐ On [please state the date on which NARA approval was sought] the system owner 

sought approval from NARA for an SRS and is awaiting a response from NARA. [State 

here the retention periods you proposed to NARA].

4. ☐ The system owner is still in the process of developing a new records schedule to 

submit to NARA. 

Section 5.3: E-Government Act/NIST Compliance 

The completion of Federal Information Security Management Act (FISMA) Security Assessment 

& Authorization (SA&A) process is required before a federal information system may receive 

Authority to Operate (ATO). 

Section 5.3(a) 

1. ☒ The system is a federal information system subject to FISMA requirements. 

2. ☒The system last completed an SA&A and received an ATO on: May 23, 2021. 

3. ☐This is a new system has not yet been authorized to operate. The expected to date for 

receiving ATO is [please state here the expected date on which you expect authorization 

will be granted]. 

4. ☒The system or project maintains access controls to ensure that access to PII 

maintained is limited to individuals who have a need to know the information in order to 

perform their official Treasury duties. 

5. ☒ All Treasury/bureau security requirements are met when disclosing and transferring 

information (e.g., bulk transfer, direct access by recipient, portable disk, paper) from the 

Treasury system or project to internal or external parties. 

6. ☒ This system or project maintains an audit log of system users to ensure they do not 

violate the system and/or Treasury/bureau rules of behavior. 

7. ☐ This system or project has the capability to identify, locate, and monitor individuals or 

groups of people other than the monitoring of system users to ensure that they do not 

violate the system’s rules of behavior. [If checked, please describe this capability here, 

including safeguards put in place to ensure the protection of privacy and civil liberties.]

Section 5.4: Section 508 of the Rehabilitation Act of 1973 
24

When Federal agencies develop, procure, maintain, or use Electronic and Information 

Technology (EIT), Section 508 of the Rehabilitation Act of 1973 (as amended in 1998) requires 

that individuals with disabilities (including federal employees) must have access and use 

(including privacy policies and directives as well as redress opportunities) that is comparable to 

that which is available to individuals who do not have disabilities. 

Section 5.4(a) 

1. ☐ The project or system will not involve the development, procurement, maintenance or 

use of EIT as that term is defined in Section 508 of the Rehabilitation Act of 1973 (as 

amended in 1998)? 

2. ☐ The project or system will involve the development, procurement, maintenance or use 

of EIT as that term is defined in Section 508 of the Rehabilitation Act of 1973 (as 

amended in 1998)? If checked: 

3. ☒ The system or project complies with all Section 508 requirements, thus ensuring that 

individuals with disabilities (including federal employees) have access and use (including 

access to privacy and civil liberties policies) that is comparable to that which is available 

to individuals who do not have disabilities. 

4. ☐ The system or project is not in compliance with all Section 508 requirements. The 

following actions are in progress to ensure compliance: [please describe here the efforts 

underway to ensure compliance].

 

Responsible Officials

Approval Signature

________________________________ 

Ryan Law 

Deputy Assistant Secretary for Privacy, 

Transparency & Records 

Departmental Offices 

Department of the Treasury