‘suogoipsun! “QUON oO “Alesseoeu J} SUBDS 84) v ueog
‘SNOUBA UL z “sse00id Aq pajeana sanss| ayeIpawoy BUS SQIEWWIOD/S218UILIOD
Bulpued suope6ary ‘ONP JO SUONBIO!A -UON paysenbai-Aunsealy
40 suoneBojly
“suBoS 84} 6 “Aessaoou 6
‘ul payquap! 4] suds e1p Aq pajeenal
senss| Jo senss| ayerpewie, pue Ajquap! ueog
uonerpewiey PUE SUO}EOIA gos JenUB}od SUSqeM J8WE}U] BOS LORDS,
40} saysqem Aunsees) jo sueos
Ayqquow ‘augnos jonpuod
“yeaoudde gig. z “sseooid Zz
soye Sv mamnoi pieog AuGeyul e1eq I arte
ysuand 4) ByEUIpIOG. PUE BEs1ENQ MOEN J
‘yesunog 1 ‘Beidgyeinsodx3 “senewoye 6g “eBesn Buneujuije pue 6s
3P1UD JO OID ld 2118804 Guyojdxe pue ‘sanjewaye Buyojdxe ‘sNSS
neaung ey YyBnoy, "SNSS jo esn. ‘asn 0} Buysodoid Jo Bursn suo UO
pejpuey Bujeq Suyeuwna suseyshs Ajquep! 0} sesseoud uopoepey Jo uoReUIWIIS NSS
81 JUEPIOU! SIYL NUOS pve ‘Vid ‘OOe
UGA GWO ej BuyBesene]
“paoeides sem ¥ SPIED Ald 880] oy “sjuaweynber oy
‘seBpeq Joypue poly “yoeqpegy GINO pue yoy AoeAud (sNuOs)
21m spodal eol|oq pue siskjeue {IM eoueliduioo aunsue SOHN HOS /@SN euNoY
seye SNYOS: 0} SNYOS 40 smainas BulobuQ, (4OS) spucdey Jo Wajshg
peysiiang
“yoeqpes} se “squeweunbas Joy JUEUILIEACD Suse
pue sisfjeue “2 Pue GINO WIM soue!|dwco
49UE Sid Pue Aveo @unsue 0} Sid (svid) sjuewssassy
paysiand Buymainey “paunbe, you s ped) Aoenud/(Sy1d)
Vid © yey) ainsua 0} sesuodse: sashjeuy pjoysaiy, BAU
Wid ezAjeue 0} seoyjo pue
sneaung YM 20M BulobuG:
a) a a a =a
esuodsey pure ex|Apy

E102 ‘Le saquieseq
200Z JO OW UOISSIWWOD |.}/6 AU} JO E08 UOHDag JepuN
SOMANOY SOE! III pue AoeAug UO Yodey AaenD

Ainseai] ay} Jo yuoupedeq



e OMB Memorandum 07-16 reviews conducted to minimize the volume of PII
necessary for the proper performance of an agency function, Social Security
number (SSN) use reduction efforts, or initiatives related to combating identity
theft;

e OMB Circular A-130 reviews consist of reviews of SORNs, routine use
descriptions, agency security contacts, recordkeeping and disposal policies,
training practices, continued Privacy Act exemptions under 5 U.S.C. § 552a (j)(2),
(k), and Computer Matching Programs;

Persistent Tracking Technology features used on a website;

Achievement of machine readability, which ensures that website users are
automatically alerted about whether site privacy practices match their personal
privacy preferences;

e Reviews under 5 C.F.R. part 1320 (collection of information/Paperwork
Reduction Act);

e Information Sharing Environment Privacy Guidelines Assessment including
policies and system reviews; and

e Reviews related to the OMB Circular A-11, Exhibit 300 process.

4.2. Advice: Advice includes written policies, procedures, guidance, or interpretations of
requirements for circumstances or business processes that respond to privacy or civil liberties
issues or concerns.

4.3. Response to Advice: Specific action taken in response to Treasury advice. Examples of
Responses to advice include issuing a regulation, order, or directive; interpreting or otherwise
issuing guidance as a result of advice; reaching an agreement related to the Advice; and
developing training programs or other procedures that enhance understanding of the issue
that precipitated the request for advice.

4.4. Disposition of Complaints: Treasury action in response to a privacy or civil liberties
complaint. In response to a complaint, the Department will:

1. Take direct action (description in the summary report);

2. Refer to another agency or entity that may be able to assist in addressing the
complaint (referral agency and explanation in summary report); or

3. Determine that no action is required (explanation in summary report).

The Department will continue to submit quarterly reports in coordination with OMB. The
next quarterly report is due March 30, 2014, and will cover the period December 1, 2013,
through February 28, 2014. The data collection period for each report ends approximately 30
days prior to the report deadline.


The Department of the Treasury
FY 2014 Q1 Report on Privacy and Civil
Liberties Activities Pursuant to Section 803
of the Implementing Recommendations of
the 9/11 Commission Act of 2007

For the reporting period
September 1 to November 30, 2013

1. Introduction

The Treasury Department is committed to protecting the privacy and civil liberties of
individuals in all Treasury programs. In recognition of potential threats to individual privacy
resulting from global expansion of information technology (IT), the Department will
continue its vigilant oversight of the Personally Identifiable Information (PII) entrusted to its
care. In coordination with the Office of Management and Budget (OMB), the Office of
Privacy, Transparency, and Records (OPTR) has established a standard reporting framework
tailored to the missions and functions of the Department. Accordingly, below is a summary
of the OPTR functions pursuant to Section 803 of the Implementing Recommendations of
the 9/11 Commission Act of 2007 (P.L. 110-53). :

2. Department Actions

Treasury OPTR Initiatives

During this reporting period, Treasury completed its biennial review of all systems of records
notices (SORNs) as required by the Privacy Act of 1974 (5 U.S.C. § 552a) and Office of
Management and Budget Circular No. A-130. This review led to the decommissioning of
one system of records and minor changes to accurately describe the current state of the
systems of records. Such changes included updating system locations and system manager
addresses, and revisions to organizational titles. The biennial review was submitted to OMB,
the Senate, and the House for review on December 13, 2013.

OPTR also led an effort to review and revise the Department’s FY 2012 - 2013 Culture of
Privacy Awareness training. In compliance with OMB Memorandum A-130, Management
of Federal Information Resources, which requires the Department to review its Privacy Act
training practices biennially, employees are using the revised training to meet their annual
privacy training requirements for FY 2014.

Treasury conducted other reviews during the reporting period as required by: the Privacy
Act; the E-Government Act of 2002 (P.L. 107-347); the Consolidated Appropriations Act of
2005 (P.L. 108-447); OMB Circular A-130, Appendix 1; and OMB M-07-16. Examples of
the reviews conducted under these authorities include Privacy Threshold Analyses, Privacy


Impact Assessments (PIAs), investigation and remedial measures to address incidents
involving personally identifiable information, and reviews of documents related to the OMB
Exhibit 300 process.

OPTR routinely provides guidance to Treasury’s bureaus regarding the preparation and
completion of PIAs and System of Records Notices (SORNs). This guidance is intended to
strengthen OPTR oversight of the PIA and SORN processes to ensure compliance with
Privacy Act and E-Government Act requirements.

Treasury has 311 systems that contain PII. As of September 30, 2013, all 244 systems that
are known to require a PIA had met this requirement. Of the 311 systems in the inventory,
288 are required to have, and have completed and published, SORNs. To provide the public
with greater access and transparency, Treasury’s PIAs and SORNs may be viewed at the
following URLs:

PIAs: http://www.treasury.gov/privacy/PIAs/Pages/default.aspx
SORNs: http://www.treasury. gov/privacy/issuances/Pages/default.aspx#TREASURY

IRS Initatives

During this reporting period, the IRS continued implementing its comprehensive identity
theft strategy. This effort focuses on preventing refund fraud, investigating crimes, and
assisting victimized taxpayers. Work to prevent identity theft and refund fraud continues to
grow, touching nearly every part of the organization, and includes:

Identity Protection Personal Identification Number (IP PIN) — The IRS issues IP PINs to
taxpayers victimized by identity theft to verify their identity and provide added protection fof
electronic filing of tax returns. For the 2014 filing season, the IRS will issue 1.2 million IP
PINs to taxpayers with an identity theft account marker. New pages at irs.gov on the IP PIN
process provide information to taxpayers qualified to receive an IP PIN as well as
information regarding the new IP PIN replacement process.

Return Review Program (RRP) — The IRS is fortifying the RRP for the prevention and initial
identification of fraudulent federal tax returns. The RRP is focused on recognizing identity
theft, thwarting the issuance of fraudulent refunds, and expediting the resolution of tax issues
affecting identity theft victims. Through the RRP, the IRS has, for example, implemented a
variety of mechanisms to stop criminals from using deceased individuals’ identities to
perpetrate fraud. One preventative measure for the upcoming filing season involves locking
the accounts of more than 11 million deceased taxpayers who no longer have a filing
requirement.

Business Master File (BMF) Identity Theft — The IRS is seeing an increase in the number of
bogus business and employment returns filed with intent to steal identities, conceal fraud,
and claim fraudulent refunds. This quarter, a team of cross-functional subject matter experts
met to discuss BMF identity theft and the impact to tax administration. The team established
a framework for the operating divisions to craft specific functional guidance and developed a
new form, Form 14039-B, Identity Theft Affidavit - Business, for reporting business incidents.


3. Quarterly Reporting Matrix
The attached reporting matrix consolidates all Treasury privacy and civil liberties activities,

including data on the reviews conducted, reference to the advisory guidance delivered, and
information about written complaints received and processed.

3.1. Types of Potential Complaints

3.1.1. Privacy Complaint: A privacy complaint is a written allegation filed with the
Department concerning a problem with or violation of privacy protections in the
administration of the programs and operations of the Department that may be the cause of
harm or violation of personal or information privacy. This information may include:

e Process and procedural issues, such as consent, collection, and
appropriate notice;
Non-Privacy Act of 1974 issues or identity theft mitigation; or
Privacy Act of 1974 issues.

3.1.2. Civil Liberties Complaint: A written allegation filed with the Department
alleging harm or violation of an individual’s constitutional rights. Types of civil liberties
complaints include, but are not limited to:

e First Amendment (Freedom of speech, religion, assembly, and
association);

e Fourth Amendment (Protection against unreasonable search and
seizure); and

e Fifth Amendment or Fourteenth Amendment, § 1 (Due process and
equal protection).

4. Reporting Categories

4.1. Reviews: Reviews include Treasury privacy and civil liberties activities delineated by
controlling authorities, such as the Privacy Act. OMB Circular A-130, Appendix 1; and
OMB Memo M-07-16. Examples include:

e Privacy Threshold Analyses (PTAs) — review of an IT system’s use of data to
determine whether a PIA is required;

e PIAs — both a risk assessment process and a document representing the output of
that process. PIAs are conducted to: identify privacy and civil liberties risks in
systems, programs, and other activities that maintain PII; ensure that information
systems, programs, and other activities comply with legal, regulatory, and policy
requirements; analyze the privacy and civil liberties risks identified; identify
remedies, protections, and alternative or additional privacy controls necessary to
mitigate those risks; and provide notice to the public of privacy and civil liberties
protection practices;