The Department of the Treasury

Semiannual 2015 Report on Privacy and 

Civil Liberties Activities Pursuant to 

Section 803 of the Implementing 

Recommendations of the 9/11 Commission 

Act of 2007

For the reporting period 

August 1, 2014 to January 31, 2015

1. Introduction

The Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 

Commission Act), P.L. 110-53, require the Department of the Treasury (Treasury) to appoint 

a senior officer to serve as its Privacy and Civil Liberties Officer (PCLO). Treasury

designates the Treasury Assistant Secretary for Management (ASM) as Treasury’s PCLO. 

As the Department’s PCLO, the ASM is responsible for implementing the 9/11 Commission 

Act privacy and civil liberties requirements. 

To assist the ASM with these responsibilities, Treasury Directive (TD) 25-04, “The Privacy 

Act of 1974, As Amended,” designates the Deputy Assistant Secretary for Privacy, 

Transparency, and Records (DASPTR) as the ASM’s principal advisor on issues related to 

privacy and civil liberties. The DASPTR leads the Office of Privacy, Transparency, and 

Records (PTR) and provides the ASM with day-to-day support in executing his PCLO duties. 

Treasury is publishing this report pursuant to Section 803 of the 9/11 Commission Act, 

which requires the PCLO to periodically, but no less than semiannually, prepare a report on 

the privacy and civil liberties activities of the Department. Accordingly, below is a 

description and summary of the Department’s activities for the reporting period.

2. Treasury Actions

Treasury is committed to protecting the privacy and civil liberties of individuals who may be 

affected by its programs. In recognition of potential threats to individual privacy and civil 

liberties resulting from information technology, Treasury continues its vigilant oversight of 

the personally identifiable information (PII) entrusted to its care. During this reporting 

period, two major events occurred: PTR continued the Treasury-wide initiative to expand its 

compliance documentation and the Internal Revenue Service (IRS) continued its reduction of 

Social Security numbers (SSNs.)
2

Departmental Initiatives

PTR is working with Treasury bureaus to expand its Privacy Impact Assessment (PIA) 

template and manual to include an assessment of both the privacy and civil liberties risks 

associated with the collection, maintenance, and disposition of PII. The revised template and 

manual modify current Treasury implementation of the e-Government Act of 2002 and 

Office of Management and Budget (OMB) Memorandum 03-22, “OMB Guidance for 

Implementing the Privacy Provisions of the E-Government Act of 2002,” to incorporate the 

expanded responsibilities assigned to the ASM by TD 25-09, “Privacy and Civil Liberties 

Activities Pursuant to Section 803 of the Implementing Recommendations of the 9/11 

Commission Act of 2007, P.L. 110-53” and National Institute for Standards & Technology 

(NIST) Special Publication 800-53, Appendix J (Revision 4) (requiring agency Senior 

Agency Officials for Privacy (SAOP) to assess and certify system privacy controls before 

they are authorized to operate). When completed and approved, the assessment will be 

renamed “Privacy and Civil Liberties Impact Assessment” to reflect its broadened scope. 

PTR continues to lead Treasury’s implementation of NIST 800-53, Appendix J, system 

privacy controls through a revision of current TD 25-07, “Privacy Impact Assessment.” 

These controls ensure that appropriate privacy controls are embedded in information 

practices throughout system development and implementation. PTR is working very closely 

with the Office of the Chief Information Office (OCIO) to ensure the privacy controls are 

embedded in applicable Treasury systems and policies. For example, PTR worked with the 

OCIO to revise TD 85-01, “Department of the Treasury Information Technology (IT) 

Security Program,” to assign responsibility for implementing the privacy controls to the 

DASPTR.

In addition to the activities mentioned above, PTR continues to conduct reviews required by:

the Privacy Act of 1974, as amended; the e-Government Act of 2002; the Consolidated 

Appropriations Act of 2005; OMB Circular A-130, Appendix 1, “Federal Agency 

Responsibilities for Maintaining Records About Individuals”; and OMB Memorandum 07-

16, “Safeguarding Against and Responding to the Breach of Personally Identifiable 

Information.” Examples of the reviews conducted under these authorities include Privacy 

Threshold Assessments (PTA), PIAs, investigations and remedial measures to address

incidents involving PII, and reviews of documents related to OMB Exhibit 300, “Planning, 

Budgeting, Acquisition, and Management of Information Technology Capital Assets.”

Treasury currently maintains 627 systems containing PII. To increase transparency and 

provide the public with greater access to information about its systems and their associated 

safeguards, Treasury posts PIAs and System of Records Notices (SORN) to the following 

websites: 

PIAs: http://www.treasury.gov/privacy/PIAs

SORNs: http://www.treasury.gov/privacy/issuances
3

IRS Initiatives

During this reporting period, the IRS continued implementing its comprehensive strategy to 

prevent identity theft. These efforts focus on eliminating the use of SSNs on payment 

notices, and protecting tax information. This included thirty-five additional notices with an 

annual volume of 17.5 million SSNs masked. In addition, the IRS added a Two-Dimensional 

barcode to twenty-two automated collection notices with an annual volume of 5.2 million to 

replace previously masked SSNs to further protect identities.

The IRS also conducted a Business Process Risk Assessment (BPRA) on the Contractor End 

of Contract process. Consistent with OMB M-06-15 and M-07-16, the BPRA is a tool 

available to ensure the IRS has adequate safeguards to prevent the intentional or negligent 

misuse of, or unauthorized access to, PII. The BPRA focused on how IRS contractors 

dispose of PII and other Sensitive but Unclassified data at the conclusion of the contract, or 

when the PII is no longer needed by the contractor. 

3. Semiannual Reporting Matrix

The attached reporting matrix consolidates all Treasury privacy and civil liberties activities

during the reporting period, including data on the reviews conducted, reference to the 

advisory guidance delivered, and information about written complaints received and 

processed.

3.1. Types of Potential Complaints:

3.1.1 Privacy Complaint: A privacy complaint is a written allegation filed with 

Treasury concerning a problem with or violation of privacy protections in the 

administration of the programs and operations of Treasury that may be the 

cause of harm or violation of personal or information privacy. This 

information may include: process and procedural issues, such as consent, 

collection, and appropriate notice; 

• Non-Privacy Act of 1974 issues or identity theft mitigation; or 

• Privacy Act of 1974 issues.

3.1.2 Civil Liberties Complaint: A written allegation filed with Treasury alleging 

harm or violation of an individual’s constitutional rights. Types of civil 

liberties complaints include, but are not limited to:

• First Amendment (Freedom of speech, religion, assembly, and 

association);

• Fourth Amendment (Protection against unreasonable search and 

seizure); and 

• Fifth Amendment or Fourteenth Amendment, § 1 (Due process and 

equal protection).

4. Reporting Categories
4

 4.1. Reviews: Reviews include Treasury privacy and civil liberties activities delineated by 

controlling authorities, such as the Privacy Act of 1974, 5 U.S.C. § 552a; e-Government Act 

of 2002 (P.L. 107-347); Consolidated Appropriations Act of 2005 (P.L. 108-447); OMB 

Circular A-130, Appendix 1; and OMB M-07-16. Included in this report are:

• PTAs – review of an IT system’s use of information to determine whether a PIA

is required;

• PIA (soon to be renamed PCLIA) – refers to both a risk assessment for privacy 

issues and a document representing the output of that process. PIAs are 

conducted to: identify privacy risks in systems, programs and other activities that 

maintain PII; ensure that information systems, programs and other activities 

comply with legal, regulatory, and policy requirements; analyze the privacy and 

civil liberties risks identified; identify remedies, protections and alternative or 

additional privacy controls necessary to mitigate those risks; and provide notice to 

the public of privacy and civil liberties protection practices. 

• OMB M 07-16 reviews – conducted to minimize the volume of PII necessary for 

the proper performance of an agency function, SSN use reduction efforts, or 

initiatives related to combating identity theft;

• OMB Circular A-130 reviews – consist of reviews of systems of records notices 

(SORNs), routine use descriptions, agency security contacts, recordkeeping and 

disposal policies, training practices, continued Privacy Act exemptions under 5 

U.S.C § 552a (j)(2), (k), and Computer Matching Programs;

• Ensuring machine readability of privacy policies on Treasury websites, which 

ensures that website users are automatically alerted about whether site privacy 

practices match their personal privacy preferences;

• Reviews under 5 C.F.R. part 1320 – collection of information/Paperwork 

Reduction Act;

• Information Sharing Environment Privacy Guidelines Assessment including

policies and system reviews; and 

• Reviews related to the OMB Circular A-11, Exhibit 300 process.

4.2. Advice: Advice includes written policies, procedures, guidance, or interpretations of 

requirements for circumstances or business processes that respond to privacy or civil liberties 

issues or concerns. 

4.3. Response to Advice: Specific action taken in response to Treasury advice. Examples of 

Responses to advice include issuing a regulation, order, or directive; interpreting or otherwise 

issuing guidance as a result of advice; reaching an agreement related to the advice; and 

developing training programs or other procedures that enhance understanding of the issue 

that precipitated the request for advice.

4.4. Disposition of Complaints: Treasury action in response to a privacy or civil liberties 

complaint. In response to a complaint, Treasury will:

1. Take direct action (description in the summary report);
5

2. Refer the complaint to another agency or entity that may be able to assist in 

addressing it (referral agency and explanation in summary report); or

3. Determine that no action is required (explanation in summary report).

Treasury will continue to submit semiannual reports in coordination with OMB. The next 

semiannual report is due August 30, 2015, and will cover the period of Febraury 1, 2015,

through July 31, 2015. The data collection period for each report ends approximately 30 

days prior to the report deadline.
Department of the Treasury

Semiannual Report on Privacy and Civil Liberties Activities 

under Section 803 of the 9/11 Commission Act of 2007

January 31, 2015

Reviews Advice and Response Complaints Dispositions

Type Number Type Number Response Type Number

Privacy Threshold Analyses 

(PTAs)/Privacy Impact 

Assessments (PIAs) PTA/29 

PIA/71

Ongoing work with bureaus 

and offices to analyze PTA 

responses to ensure that a PIA 

is not required. Reviewing 

PIAs to ensure clarity and 

compliance with OMB and EGovernment Act requirements. 5 PRIVACY 0

System of Records (SOR) 

Routine Use/ SOR Notices 

(SORNs)

8

Ongoing reviews of SORNs to 

ensure compliance with 

Privacy Act and OMB 

requirements. 1

SSN Elimination or Redaction 

on Forms

3

Leveraging the OMB Exhibit 

300, PIA, and SORN 

processes to identify systems 

using or proposing to use 

SSNs, exploring alternatives 

and eliminating usage. 0 .

Computer Matching 

Agreements (CMAs)

58

Support the Data Integrity 

Board review process of 

computer Matching 

Agreements originating in your 

Bureau. 0

Section 508 Internet Website 

Scan

86%

Conduct routine, monthly 

scans of Treasury websites for 

potential 508 violations and 

identify and remediate issues 

revealed by the scans if 

necessary. 0 CIVIL LIBERTIES 5

One case 

determined no 

action appropriate, 

four cases still 

pending.

Treasury-requested NonCommerce/Commerce Site 

Scan 1

Remediate issues revealed by 

the scans if necessary. 0