Office of Information Technology (OIT) 

Adapted Privacy Impact Assessment 

12twenty 

October 17, 2023 

1100 New York Ave NW Washington, DC 20527 
Adapted Privacy Impact Assessment (Adapted PIA)

12twenty

 

2 

Section 1. Specific Purpose of the Agency’s Use of the Third-Party 

Website or Application

1.1 What is the specific purpose of the agency’s use of the third-party website or 

application, and how does that use fit with the agency’s broader mission?

The U.S. International Development Finance Corporation (DFC) will utilize 12twenty for recruiting 

purposes in support of its mission and to amplify its outreach efforts for DFC employment opportunities 

amongst early-career professionals. 12twenty is a third-party fully virtual talent acquisition platform 

that empowers students and alumni to advance their careers, helps universities better serve their 

scholars, and makes it easy for employers to connect with qualified and diverse early-career talent. 

12twenty will allow DFC to connect with a network of over 45 million students from over 750 

universities and over 150 Minority-Serving Institutions, many with specialized graduate programs, 

including business schools, law schools, and international relations schools. 

12twenty is a third-party web-based subscription-based software available at 

https://www.12twenty.com. 12twenty permits companies and organizations, including government 

agencies, to: 

• Establish Premium Employer Profiles, 

• Post job opportunities to an unlimited number of schools, 

• Promote specific job posts to increase visibility,

• Use an internal Analytics Dashboard to monitor the effectiveness of job postings, and

• Utilize 12twenty’s Global Candidate Search database, with diversity filters, to source candidates 

These actions will assist DFC in tailoring its employer brand messaging towards early-career talent and 

facilitate recruitment and outreach efforts by engaging 12twenty users and/or inviting them to apply for 

DFC positions. 12twenty users invited to and otherwise interested in applying for employment 

opportunities will be directed to the USAJOBS.gov website to complete the application process. 

Resumes and/or other application documents are not collected through the 12twenty DFC page. 

Visitors to DFC’s 12twenty page can view some site content, but registration on the 12twenty platform

is required for active participation, including connecting with other users or messaging employers.

The primary account holder is the DFC Office of Human Resources Management (OHRM), which will be 

responsible for ensuring information posted on the agency’s official 12twenty profile is appropriate and 

approved for public dissemination in accordance with applicable federal laws, regulations, and DFC 

privacy, information security, and social media policies. OHRM will grant access to the agency’s Senior 

Talent Managers and Student Programs Coordinator to administer the 12twenty platform. These 

administrators will have access to post links to relevant position announcements and add employer 

branding information.

1.2 Is the agency’s use of the third-party website or application consistent with all 

applicable laws, regulations, and policies?
Adapted Privacy Impact Assessment (Adapted PIA)

12twenty

 

3 

DFC will comply with all applicable laws, regulations, and policies, particularly those pertaining to 

privacy, accessibility, information security, and records management, including: Presidential 

Memorandum on Transparency and Open Government, January 21, 2009; OMB Memorandum M-10-06, 

Open Government Directive, December 8, 2009; OMB Memorandum M-10-23, Guidance for Agency Use 

of Third-Party Websites and Applications, June 25, 2010; the Paperwork Reduction Act, 44 U.S.C. 3501; 

the Clinger-Cohen Act of 1996, 40 U.S.C. 1401; OMB Circular No. A-130, Managing Information as a 

Strategic Resource; Section 508 of the Rehabilitation Act of 1973; the DFC Privacy Program Plan; and the 

DFC Social Media Policy. DFC OHRM will also work with its Office of General Counsel, Office of External 

Affairs, and Office of Information Technology to ensure that use of 12twenty and any information about 

DFC disseminated through 12twenty remain compliant. 

Section 2. Any PII that is Likely to Become Available to the Agency 

Through the Use of the Third-Party Website or Application 

2.1 What PII will be made available to the agency?

A registered 12twenty user has a profile established where information can be added, such as university 

attended, degree program(s) completed, type of work experience, years of experience, desired career 

paths, desired or current locations (city/state), and demographic data, such as race, ethnicity, and 

gender. Additionally, 12twenty users can attach a copy of their resume to their 12twenty profile. 

DFC OHRM will be able to view 12twenty users’ public profiles via the Global Candidate Search 

database, when users post comments on an opportunity posted to DFC’s 12twenty profile page, or 

when messaging with DFC via 12twenty’s Candidate Messaging system. DFC OHRM may review a user’s 

profile to determine applicable experience and invite them to apply to open opportunities. Resumes 

will only be viewed by DFC OHRM when sourcing candidates via the Global Candidate Search database 

and will only be utilized for the purpose of inviting qualified candidates to apply to positions through the 

USAJOBS website. 

12twenty offers privacy settings that permit users to control the amount of information that is 

displayed, including personally identifiable information (PII) that is shared with other 12twenty users. 

DFC’s ability to view information on an individual’s 12twenty profile depends on the information 

submitted to 12twenty and the privacy settings selected by the user. 

DFC will use 12twenty to tailor its employer brand message and facilitate recruitment and outreach 

efforts, such as posting open opportunities to multiple schools on 12twenty’s platform or searching for 

qualified candidates to advise them of open opportunities at DFC. While searching for potential 

candidates, the PII contained in a user’s profile may be made available to DFC if the user permits this 

information to be displayed based on the user’s privacy settings. 

While potentially qualified candidates may be contacted and encouraged to apply for a job vacancy, DFC 

will not retain any personal information about a candidate until an application is submitted. 

Applications are not submitted to DFC through 12twenty; applicants must submit information directly 
Adapted Privacy Impact Assessment (Adapted PIA)

12twenty

 

4 

on USAJOBS.gov, which is a federal government website operated by the Office of Personnel 

Management (OPM). Data submitted to and stored in USAJOBS is covered by a separate OPM Privacy 

Impact Assessment (PIA) - https://www.opm.gov/information-management/privacy-policy/privacypolicy/usajobs-pia.pdf. 

2.2 What are the sources of the PII?

The sources of the PII are members of the public, specifically students and alumni of the schools that are 

participating in the 12twenty platform. Within 12twenty, PII is made available to DFC on a user’s profile 

when users post comments on an opportunity posted to DFC’s 12twenty profile page or when 

messaging with DFC via 12twenty’s Candidate Messaging system. PII would only be collected and 

retained by DFC when users leave the 12twenty platform and apply for a DFC job opening on USAJOBS.

2.3 Does the agency enable cookies while using the third-party website or application to 

track user actions? If so, which tier of cookies is used, and is an opt-in/opt-out option 

available to users? 

DFC does not enable cookies or have the ability to track user actions within the 12twenty platform. By 

using 12twenty, users are subject to the terms and conditions of 12twenty’s Privacy Policy. As stated in 

12twenty’s Privacy Policy: 

We may use both session cookies (which expire once you close your web browser) and 

persistent cookies (which stay on your computer or mobile device until you delete 

them). We use two broad categories of cookies: (1) first party cookies, served directly 

by us to a user’s computer or mobile device, which are used only by us to recognize your 

computer or mobile device when it revisits our Website; and (2) third party cookies, 

which are served by service providers on our Website, and can be used by such service 

providers to recognize your computer or mobile device when it visits other websites. 

2.4 Do the agency’s activities trigger the Paperwork Reduction Act (PRA) and, if so, how 

will the agency comply with the statute? 

No, DFC will not use 12twenty in a manner that would trigger the requirements of the Paperwork 

Reduction Act. While DFC will use 12twenty to view information from members of the public, it will not 

use the platform to request information from members of the public by asking for responses to identical 

questions, such as would be conducted in a standardized form, poll, or survey. 

Section 3. The Agency’s Intended or Expected Use of the PII 

3.1 Generally, how will the agency use the PII described in Section 2.0? 

DFC will use the PII for recruiting and outreach purposes. DFC will post open job opportunities on 

12twenty or use 12twenty to search for qualified candidates. While searching for qualified candidates, 

DFC may review user profiles and resumes and may have access to specific information made publicly 
Adapted Privacy Impact Assessment (Adapted PIA)

12twenty

 

5 

available by the user. While potentially qualified candidates may be contacted and encouraged to apply 

for an open job, DFC will not retain any personal information about a candidate until an application is 

submitted to the agency in USAJOBS. Once an application is submitted through USAJOBS for a DFC job 

vacancy, DFC personnel will use the PII provided in the normal course of human resources functions and 

procedures for hiring. Data submitted to and stored in USAJOBS is covered by a separate OPM PIA. 

3.2 Provide specific examples of the types of uses to which PII may be subject.

While searching for potential candidates, DFC may review user profiles and resumes to determine 

whether they meet a position’s qualification requirements, such as minimum education requirement, 

specialized experience type and length requirements, selective placement factors, and required licenses 

or certifications. Demographic data, such as race, ethnicity, and gender, may be made available to DFC 

from a user’s profile; this information will not be considered as a favorable or unfavorable factor in 

determining potential qualifications. Demographic data may be evaluated by the agency through 

12twenty’s Analytics Dashboard for the purpose of monitoring the effectiveness of the agency’s 

outreach efforts in reaching different demographics of candidates.

Section 4. Sharing or Disclosure of PII

4.1 With what entities or persons inside or outside the agency will the PII be shared, and 

for what purpose will the PII be disclosed? 

DFC typically does not share information about users in 12twenty with third parties, but there may be 

unusual circumstances where user postings on DFC’s 12twenty profile page or in the Candidate 

Messaging system indicate evidence of criminal activity, a threat to the government, a threat to the 

public, or a violation of DFC policy. In those cases, any information derived from a user’s profile may be 

used to notify the appropriate agency officials or law enforcement organizations. Users that choose to 

apply for an open job opportunity posted on 12twenty will be directed to USAJOBS to complete the 

application process, in which case their applications will be made available to DFC personnel who have a 

need to know following the agency’s normal hiring procedures.

Section 5. Maintenance and Retention of PII

5.1 How will the agency maintain the PII, and for how long? 

Any information received in 12twenty, either through user comments or direct messages, will not be 

used to formulate or execute policies, decisions, actions, or responsibilities on behalf of the agency and 

are considered transitory records. This information is retained in accordance with National Archives and 

Records Administration (NARA) General Records Schedule (GRS) 5.2 - Transitory and Intermediary 

Records, Item 010 - Transitory records (DAA-GRS-2022-0009-0001). The information is considered 

temporary and destroyed when no longer needed for business use, or according to an OHRM

predetermined time period or business rule.
Adapted Privacy Impact Assessment (Adapted PIA)

12twenty

 

6 

DFC will direct candidates in 12twenty to submit job applications directly in the USAJOBS website. 

Applications and other materials received in USAJOBS will be retained in accordance with NARA GRS 2.1 

- Employee Acquisition Records, Item 060 - Job application packages (DAA-GRS-2014-0002-0011). The 

job applications are considered temporary records and will be destroyed one year after submission.

Section 6. How the Agency Will Secure PII

6.1 Will the agency’s privacy and security officials coordinate to develop methods of 

securing PII? 

Yes. All employees who have access to DFC’s 12twenty account are required to take the agency’s

privacy awareness training and information security awareness training annually and sign the DFC 

Privacy Rules of Behavior and DFC Information Technology Rules of Behavior. DFC’s privacy and 

information security teams have coordinated with OHRM on the development of this PIA and have 

developed methods to ensure that job applications downloaded from USAJOBS to the DFC network

(DFCNet) are stored securely. DFCNet is protected by best-in-class endpoint security, cutting edge 

artificial intelligence, zero trust solutions, multi-factor authentication, and data loss prevention software 

to identify potential threats to the network and prevent data breaches from occurring.

Section 7. Identification and Mitigation of Other Privacy Risks 

7.1 What other privacy risks exist, and how will the agency mitigate those risks?

There are certain other privacy risks that exist when a user signs up to use 12twenty. For example, 

there is a privacy risk that the PII that 12twenty users share or disclose to DFC may become available to 

other users or any individuals with access to the 12twenty site. While DFC does not have any control 

over personal information that is made available by individual 12twenty users, DFC’s 12twenty 

administrators are trained not to disclose PII about individuals with anyone who does not have an 

official need to know, both internal and external to DFC. Only certain members of OHRM have the login 

credentials to DFC’s account in 12twenty, which limits the potential that unauthorized DFC staff would 

have access to user profile data in the system. In addition, any interaction between the user and DFC in 

the Candidate Messaging system is not taken out of the messaging portal, thus limiting the risk of 

inadvertent disclosure.

Another privacy risk is that 12twenty users may not be given appropriate notice on how DFC will use 

their PII. To mitigate this risk, DFC posts a privacy notice on its 12twenty page to inform the public as to 

how DFC handles PII that becomes available to the agency through 12twenty. The privacy notice 

informs users that activity on third-party sites is governed by the security and privacy policies of the 

third-party sites, and that individuals are subject to third-party social media website privacy and security 

policies (see below): 

Privacy Notice for 12twenty: 
Adapted Privacy Impact Assessment (Adapted PIA)

12twenty

 

7 

DFC maintains official pages or accounts on several third-party websites in order to 

better engage with the American public. If you have an account or profile with a thirdparty website and choose to follow, like, comment or message on a third-party website 

managed by DFC, certain personally identifiable information (PII) associated with your 

account may be available based on the privacy policies of the third-party website and 

your privacy setting within that website. Any PII shared with DFC through the 12twenty 

platform will be utilized for the sole purpose of reviewing a candidate’s educational 

background and work experience to assess qualifications and invite them to apply 

through USAJOBS.gov. 

DFC does not maintain information from 12twenty interactions nor share it with thirdparty entities. However, there may be unusual circumstances where user interactions 

indicate evidence of criminal activity, a threat to the government, a threat to the public, 

or a violation of DFC policy. This information may include profile picture, first and last 

name, email address, address, phone number, gender, birthday, work history, 

professional experience, educational background, professional licenses and 

certifications, contents of posts or private messages, and other personal information 

provided by the user, and may be used to notify the appropriate agency officials or law 

enforcement organizations. 

Sharing of any PII with DFC through 12twenty or USAJOBS is considered voluntary, and 

users are subject to the security and privacy policies of 12twenty and USAJOBS when 

utilizing or providing information through those websites. Consequently, you should 

review the privacy policies of third-party websites before using them and ensure that 

you understand how your information may be used. You should also adjust privacy 

settings on your account or any third-party website to match your preferences. 

12twenty Privacy Policy: https://www.12twenty.com/privacypolicy/#:~:text=We%20will%20use%20and%20share,data%20in%20response%20to%20l

awful

USAJOBS Privacy Policy: https://www.usajobs.gov/help/privacy/

An additional privacy risk is that PII will not be properly secured. DFC has limited control over user 

content posted on DFC’s 12twenty page, except for official DFC postings. 12twenty users control access 

to their own PII, via system settings and by using discretion in terms of the PII they provide. For PII that 

is within the control of DFC, all job application submitted by 12twenty users to USAJOBS and 

downloaded by DFC staff to DFCNet are protected by numerous technical and administrative controls as 

a result of being stored on the DFC network (see Section 6.1). 

Lastly, there is a privacy risk that users’ activity will be tracked while using 12twenty. DFC does not have 

the ability to track user activity in 12twenty as it is a third-party owned and operated system. However, 

if users have concerns over how 12twenty will track their online activity, it is recommended that

12twenty users carefully review 12twenty’s User Agreement and Privacy Policy to understand how 
Adapted Privacy Impact Assessment (Adapted PIA)

12twenty

 

8 

12twenty may collect or use their personal information. If a user is uncomfortable with 12twenty’s User 

Agreement or Privacy Policy, or otherwise does not wish to use 12twenty, the information posted on 

DFC’s 12twenty page is readily available through other sources, including DFC’s Careers webpage and 

through DFC’s LinkedIn Company Page. If DFC receives notice that 12twenty’s User Agreement or

Privacy Policy has changed, or if there is a material change in the functionality of 12twenty, DFC will 

review the changes and adjust DFC’s use of 12twenty or update this PIA as necessary.

Section 8. Creation of Modification of a System of Records 

8.1 Will the agency’s activities create or modify a “system of records” under the Privacy 

Act of 1974? 

No, DFC does not collect, maintain, or disseminate PII through its use of 12twenty and is not creating a 

new system of records. Users are directed to USAJOBS.gov, an OPM website, to submit applications to

open opportunities, and any PII collected through these applications will be maintained in accordance 

with applicable personnel System of Records Notices, which may include OPM/GOVT-1, General 

Personnel Records; OPM/GOVT-5, Recruiting, Examining, and Placement Records; or other system 

notices.