1

The Department of the Treasury 

Semiannual 2016 Report on Privacy and 

Civil Liberties Activities Pursuant to 

Section 803 of the Implementing 

Recommendations of the 9/11 Commission 

Act of 2007

For the reporting period

February 1, 2016 to September 30, 

2016

1. Introduction

The Assistant Secretary for Management (ASM) is the Department of the Treasury’s (Treasury) 

Privacy and Civil Liberties Officer (PCLO). As the PCLO, the ASM is responsible for

implementing the 9/11 Commission Act of 2007’s privacy and civil liberties requirements.

To assist the ASM with these responsibilities, Treasury Directive (TD) 25-04, “The Privacy 

Act of 1974, As Amended,” designates the Deputy Assistant Secretary for Privacy, 

Transparency, and Records (DASPTR) as the ASM’s principal advisor on issues related to 

privacy and civil liberties. The DASPTR leads the Office of Privacy, Transparency, and 

Records (PTR) and provides the ASM with day-to-day support in executing his PCLO duties.

Section 803 of the 9/11 Commission Act, 42 U.S.C. § 2000ee-1, as amended, sets forth the 

following requirements: 

(f) Periodic Reports –

(1) In General –

The privacy officers and civil liberties officers of each department, agency, or 

element referred to or described in subsection (a) or (b) shall periodically, but 

not less than semiannually; submit a report on the activities of such officers—

(A)(i) to the appropriate committees of Congress, including the 

Committee on the Judiciary of the Senate, the Committee on the Judiciary 

of the House of Representatives, the Committee on Homeland Security 

and Governmental Affairs of the Senate, the Committee on Oversight and 

Government Reform of the House of Representatives, the Select 

Committee on Intelligence of the Senate, and the Permanent Select 

Committee on Intelligence of the House of Representatives;

(ii) to the head of such department, agency, or element; and

(iii) to the Privacy and Civil Liberties Oversight Board and

(B) which shall be in unclassified form to the greatest extent possible, 

with a classified annex where necessary.
2

(2) Contents –

Each report submitted under paragraph (1) shall include information on the 

discharge of each of the functions of the officer concerned, including—

(A) information on the number and types of reviews undertaken;

(B) the type of advice provided and the response given to such advice;

(C) the number and nature of the complaints received by the 

department, agency, or element concerned for alleged violations; and

(D) a summary of the disposition of such complaints, the reviews and 

inquiries conducted, and the impact of the activities of such officer.

The Intelligence Authorization Act for Fiscal Year 2014, Pub. L. No. 113-126 (July 7, 2014), 

changed the reporting period from quarterly to semiannually.

2. Privacy Reviews

Treasury reviews programs and information technology (IT) systems that may have privacy 

implications. For purposes of this report, reviews include the following Treasury activities: 

1. Privacy Threshold Analyses, which are the Treasury mechanism for reviewing IT 

systems, programs, and other activities for privacy protection issues to determine 

whether a more comprehensive Privacy and Civil Liberties Impact Assessment

(PCLIA) is required;

2. Privacy and Civil Liberties Impact Assessments as required by the E-Government Act 

of 2002;

1

3. System of Records Notices, as required under the Privacy Act and any associated 

Final Rules for Privacy Act exemptions;

2

 

4. Privacy Act Statements, as required under the Privacy Act,

3 to provide notice to 

individuals at the point of collection; 

5. Computer Matching Agreements, as required under the Privacy Act;4

6. Data Mining Reports, as required by Section 804 of the 9/11 Commission Act of 

2007;5

7. Privacy Compliance Reviews;

8. Privacy reviews of IT and program budget requests, including Office of Management 

and Budget Exhibit 300s and Enterprise Architecture Alignment Requests through the 

Department of Homeland Security Enterprise Architecture Board; and 

9. Other privacy reviews, such as implementation reviews for information sharing 

agreements. 

3. Privacy and Civil Liberties Impact Assessments

The PCLIA process is one of Treasury’s key mechanisms to help ensure that programs and 

 1 44 U.S.C. § 3501 note.

2 5 U.S.C. § 552a(j), (k).

3 5 U.S.C. § 552a(e)(3).

4 42 U.S.C. § 2000ee-3. 5 6 U.S.C. § 142.
3

technologies sustain, and do not erode, privacy protections. As of September 30, 2016, 

Treasury published 119 new, updated, or renewed PCLIAs. All published Treasury PCLIAs are 

available at http://www.treasury.gov/privacy/PIAs/Pages/default.aspx. One example of a new 

PCLIA is summarized below:

The Financial Crimes Enforcement Network (FinCEN), published a PCLIA for the new Egmont 

Secure Website (ESW). The ESW provides a secure online mechanism for communication 

among Egmont Group members from various foreign governments’ Financial Intelligence Units 

(FIUs). The System is used in two ways: 1) as a transmission medium for e-mails sent between 

the FIUs, which are encrypted when stored temporarily and cannot be searched until an analyst 

gathers the data (only addressees who are authorized account holders and have their own private 

key can decrypt the data to view); and 2) to provide a secure, web-based mechanism for Egmont 

members to view online reference documents. 

4. Systems of Records Notices

Treasury has completed a biennial review of all Systems of Records Notices (SORNs) for 

compliance with the Privacy Act of 1974, as amended. If the biennial review reveals that no 

update is required, the original SORN remains in effect.

During the reporting period, Treasury reviewed 16 SORNs and published two new SORNs. All 

Treasury SORNs, Notices of Proposed Rulemaking, and Final Rules for Privacy Act Exemptions 

are available at http://www.treasury.gov/privacy/issuances/Pages/default.aspx. Please consult 

our website for the full text of all our SORNs, including one for our Privacy Act and FOIA 

disclosures process:

Treasury .004, Freedom of Information Act/Privacy Act Request Records, September 16, 2016 

at 81 FR 63856 (https://www.federalregister.gov/documents/2016/09/16/2016-22069/privacyact-of-1974-systems-of-records). 

Treasury regulations also require publishing notice of the existence and character of all systems 

of records every three years in the Federal Register.

6

 With respect to its inventory of Privacy 

Act systems of records, Treasury has determined that the information contained in its systems of 

records is accurate, timely, relevant, complete, and necessary to maintain the proper performance 

of a documented agency function. Treasury’s systems of records notice inventory was last 

published in its entirety on November 7, 2016, at 81 FR 78266-78295.

This publication gives notice of two new systems of records. BEP .051, Chief Counsel Files 

System, contains records necessary for BEP attorneys to provide legal advice to BEP 

management on various matters. Treasury/IRS 10.008, Certified Professional Employer 

Organizations System, contains records necessary to administer a program to certify professional 

employer organizations pursuant to requirements of Title II (Section 206) of the Stephen Beck, 

Jr., Achieving a Better Life Experience Act of 2014 (ABLE Act), Pub. L. No. 113-295.

5. Privacy Compliance Reviews

 6 31 CFR 1.23(a)(1).
4

The federal government conducts Privacy Compliance Reviews (PCR) to help ensure that 

programs and technologies implement and maintain appropriate protections for personally 

identifiable information (PII). The PCR is a collaborative effort that helps improve a program’s 

ability to comply with existing privacy requirements by identifying and remediating gaps in 

compliance documentation, including PCLIAs, SORNs, and formal agreements such as 

Memoranda of Understanding and Memoranda of Agreement. Treasury regularly conducts

informal PCRs with its bureaus when necessary.

The Internal Revenue Service (IRS) Social Security Number Elimination and Reduction 

(SSN/ER) Program continued making significant strides in eliminating or reducing the use of 

SSNs within systems, forms, notices, and letters where the collection or use of the SSN was not 

necessary. The IRS is systematically reviewing existing and new notices, letters, and forms for 

unnecessary SSN use. As of FY 2016, the IRS eliminated or reduced the use of the SSNs on 138 

payment and non-payment notices, with an estimated annual volume of 54 million taxpayer 

mailings.

6. Advice and Responses

Treasury takes a proactive approach to privacy policy development by monitoring emerging 

issues, identifying gaps, issuing policy, and establishing accountability. As an example, in 2016

the IRS updated and reinforced employee policy and guidance on three privacy issues: personal 

email, electronic messaging, and shared drives. Interim guidance on “Using IRS and Personal 

Email Accounts” reinforced existing policy by providing specific procedures employees must 

follow when sending email to stakeholders, taxpayers, other IRS employees, and themselves. 

Interim guidance on “Electronic Message Usage and Preservation” reminded employees that the 

content of an electronic message may be a federal record and, if so, they must manage and 

protect the records accordingly. Interim Guidance on “Shared Drives” provided specific policy 

on methods to protect privacy when shared drives contain sensitive but unclassified (SBU) data, 

including tax information and other personally identifiable information (PII).

7. Privacy Complaints and Dispositions

For purposes of Section 803 reporting, complaints are written allegations of harm or violation of 

privacy compliance requirements filed with Treasury’s privacy and civil liberties programs. The 

categories of complaints reflected in Appendix A are aligned with the categories detailed in the 

OMB Memorandum 08-21, FY 2008 Reporting Instructions for the Federal Information Security 

Management Act and Agency Privacy Management. U.S. citizens, Legal Permanent Residents, 

visitors, and aliens may submit complaints.

8. Conclusions

As required by the 9/11 Commission Act, and in accordance with the Intelligence Authorization 

Act for Fiscal Year 2014, Pub. L. No. 113-126 (July 7, 2014), this semiannual report summarizes 

Treasury’s privacy activities from February 1, 2016 through September 30, 2016. Treasury will 

continue to work with the Congress, colleagues in other federal departments and agencies, and 
5

the public to protect privacy in all of our efforts.

1 Attachment 
6