8.4

Version: 1.4

Date: January 31, 2020

Prepared for: USDA OCIO-Policy, 

E-Government and Fair Information 

Practices (PE&F) 

Policy, E-Government and Fair Information Practices 

Privacy Impact Assessment 

Lacey Act Web Governance 

System (LAWGS)
Page 3

Privacy Impact Assessment – APHIS - LAWGS

Privacy Impact Assessment for the 

Lacey Act Web Governance System 

(LAWGS) 

January 31, 2020

Contact Point 

Isaac White

APHIS, MRP IT, PMO 

(301) 851-2021 

Reviewing Official 

Tonya Woods 

APHIS Privacy Act Officer 

(301) 851-4076 

Abstract 

The Lacey Act Web Governance System (LAWGS) is a public web application that supports 

the Lacey Act Declaration Information Systems (LADIS). It enables U.S. importers to declare 

the plant and plant product materials being imported. The declaration is required by the Lacey 

Act Amendment (16 U.S.C. 3372). The Privacy Impact Assessment (PIA) is being conducted 

to document the data collection, use, retention, sharing, access, and customer protection

safeguards.

Overview 

• LAWGS’s mission is to facilitate the creation, submission and review of the Plant and 

Plant Product Declaration (PPQ Form 505/505b). The form is required by the Lacey 

Act Amendment (16 U.S.C.3372) for all plant and plant products (including wood), 

with exceptions, being imported into the US. The importers would need to obtain a 
Page 4

Privacy Impact Assessment – APHIS - LAWGS

USDA eAuthentication Level 1 account in order to access LAWGS. The system 

enables the users (importers or designated agents) to create their own organizations 

with designated Organization Administrator (Org. Admin). The Org. Admins have full 

autonomy in adding, removing members, and maintaining organization information. 

The user organization ensures confidentiality and enables sharing of artifacts and 

templates within the organization. 

• The information collected by LAWGS includes the data that describes the shipment 

and compliance with Lacey Act requirements. The shipment information includes 

Estimated Date of Arrival, Entry Number, Container Number, Bill of Lading, 

Manufacturing Identification Code, Importer Name, Importer Address, Consignee 

Name, Consignee Address, and Description of Merchandise. The Compliance data 

includes Harmonized Tariff Code (HTSUS Number), Value, Article/Component of 

Article, Plant Scientific Name (Genus & Species), Country of Harvest, Quantity of 

Plant Material, Unit of Measure, and Percent Recycled. The exporter only has 

visibility into their own organization’s information. 

• LAWGS enables the PPQ Lacey Act Program (LAP) officials to review the submitted 

declaration for accuracy and completeness. 

• LAWGS allows importers or brokers to enter PPQ Form 505 information directly into 

the APHIS Lacey Act database. 

Section 1.0 Characterization of the Information 

The following questions are intended to define the scope of the information requested and/or 

collected as well as reasons for its collection as part of the program, system, rule, or technology 

being developed. 

1.1 What information is collected, used, disseminated, or maintained in 

the system? 

Information collected, used, disseminated and maintained in LAWGS includes 

shipment information and Lacey Act-required compliance data. 

The shipment information includes Estimated Date of Arrival, Entry Number, 

Container Number, Bill of Lading, Manufacturing Identification Code, Importer 

Name, Importer Address, Importer Email Address, Consignee Name, Consignee 

Address, and Description of Merchandise. 

The compliance data includes Harmonized Tariff Code (HTSUS Number), Value, 

Article/Component of Article, Plant Scientific Name (Genus & Species), Country of 

Harvest, Quantity of Plant Material, Unit of Measure, and Percent Recycled.
Page 5

Privacy Impact Assessment – APHIS - LAWGS

1.2 What are the sources of the information in the system? 

The information source is provided by the importers. LAWGS uses the PCIT 

Commodity and Country tables to facilitate data entry and avoid redundancy for plant 

names and country of harvest names. 

1.3 Why is the information being collected, used, disseminated, or 

maintained? 

The information being collected, used, disseminated or maintained is required by the 

2008 Lacey Act Amendments (16 U.S.C. 3372). 

1.4 How is the information collected? 

Importers enter the information in the system via the internet (web access). For 

Commodity and Country data, the LAWGS and PCIT databases are connected via 

database links.

1.5 How will the information be checked for accuracy? 

Reference tables are being used. Edit checks are available on data fields when 

possible. Automated edit checks at the field level and a final check on the declaration 

being submitted is done when the user signifies the data entry is complete. Checks for 

accuracy and completeness are performed by the LAP officials to ensure compliance 

with the Lacey Act.

1.6 What specific legal authorities, arrangements, and/or agreements 

defined the collection of information? 

The Paperwork Reduction Act; and the Lacey Act as amended in 2008. 

1.7 Privacy Impact Analysis: Given the amount and type of data 

collected, discuss the privacy risks identified and how they were 

mitigated. 

LAWGS collects the names and addresses of importers and consignees. Generally 

these are business entities; however, there are also individuals who act on their own 

behalf as either importer or consignee. The information collected in these cases is PII 

and is protected accordingly. 

Only designated APHIS employees can access this information. Additionally, USDA 

eAuthentication is required for all users' access to the system; as such, the application 

limits access to an individual’s account information only and prevents access to 

unauthorized information.
Page 6

Privacy Impact Assessment – APHIS - LAWGS

Section 2.0 Uses of the Information 

The following questions are intended to delineate clearly the use of information and the 

accuracy of the data being used. 

2.1 Describe all the uses of information. 

The data is collected, stored and reviewed by PPQ LAP in order to ensure compliance 

with the Lacey Act Amendments of 2008. The data may also be used to track national 

import activities and help in predicting market trends for the future. The data also are 

shared with other government agencies to assist in the enforcement of the Act. 

2.2 What types of tools are used to analyze data and what type of data 

may be produced? 

COGNOS, a Business Intelligence tool, is used to analyze the data and produce reports 

that evaluate quality control and effectiveness of the program. LAWGS also has builtin review and reporting capability to aide in the analysis of the data for compliance 

and to support other agencies’ enforcement efforts. 

2.3 If the system uses commercial or publicly available data please 

explain why and how it is used. 

N/A 

2.4 Privacy Impact Analysis: Describe any types of controls that may be 

in place to ensure that information is handled in accordance with the 

above described uses. 

To gain access to the system all users are required to have a USDA e-Authentication 

account. This a 2 step process where the user name identifies the user and the 

password authenticates that the user is in fact who he claims to be. On the government 

side, PPQ LAP officials who have level 2 e-Authentication can review, print, and 

analyze the data to meet business needs. Additionally, the session timeout for LAWGS 

is 30 minutes. After 30 minutes of no activity the user will receive the session time out 

message with a link to re-login. 

Section 3.0 Retention 

3.1 How long is information retained? 

Information is destroyed when 5 years old, but longer retention is authorized if required 

for business use.
Page 7

Privacy Impact Assessment – APHIS - LAWGS

3.2 Has the retention period been approved by the component records 

officer and the National Archives and Records Administration 

(NARA)? 

NARA provided approval and published the retention schedule on June 12, 2019.

3.3 Privacy Impact Analysis: Please discuss the risks associated with the 

length of time data is retained and how those risks are mitigated. 

The retention time of 5 years is in line with retention of other government records which 

may be used to support civil or criminal prosecutions (i.e., based on the Statute of 

Limitations.) with an additional retention permitted for purposes of trend analyses and 

review of trade practices prior to the designated prosecutorial timeframe. The risk of 

unapproved release of LAWGS data outside of the PPQ LAP would be mitigated 

through the creation of, and adherence to, a Lacey Act Declaration data-sharing policy. 

All requests for access to LAWGS data, both internally and externally, would be 

approved by the LAWGS Administrator/Manager to ensure compliance with the policy 

prior to the release. APHIS' current systems security measures would mitigate the risk 

of unapproved access to LAWGS. 

Section 4.0 Internal Sharing and Disclosure 

The following questions are intended to define the scope of sharing within the United States 

Department of Agriculture. 

4.1 With which internal organization(s) is the information shared, what 

information is shared and for what purpose? 

Information is shared within PPQ LAP to gauge the effectiveness of the program and 

for policy planning. These reports are high-level summary data to aid in benchmarking, 

decision-making, and trend analysis. PII is stripped from reports that are not generated 

for compliance purposes. This information will also be shared with other PPQ programs 

and APHIS’ Investigative and Enforcement Services (IES) for investigating compliance 

with the Lacey Act declaration requirements, The Convention on International Trade in 

Endangered Species of Fauna and Flora (CITES), and phytosanitary requirements for 

importation. The release of LAWGS data within APHIS for compliance or enforcement 

purposes will require inclusion of PII data fields. 

4.2 How is the information transmitted or disclosed? 

Information is transmitted by the generation of Excel spreadsheets using the COGNOS 

business intelligence tool. 
Page 8

Privacy Impact Assessment – APHIS - LAWGS

4.3 Privacy Impact Analysis: Considering the extent of internal 

information sharing, discuss the privacy risks associated with the 

sharing and how they were mitigated. 

Routine reports are stripped of PII information and there is no privacy risk associated 

with these reports. Printed reports generated for purposes other than compliance are 

controlled, retrieved and then shredded by LAP officials in APHIS- provided 

electronic paper shredders to mitigate privacy risks. Reports generated for 

compliance/enforcement purposes within APHIS will be limited to PPQ programs, 

including LAP, and IES officials. The reports will contain a warning as to the presence 

of PII and Trade Secrets and the requirement not to release the report or data contained 

within to any personnel except on a need-to-know basis and must be used for its 

intended government purpose. 

Section 5.0 External Sharing and Disclosure 

5.1 With which external organization(s) is the information shared, what 

information is shared, and for what purpose? 

Data may be shared with the USDA, Office of General Counsel and the USDA Office 

of the Inspector General (OIG) for enforcement of APHIS requirements under the LA 

Amendments, other Federal agencies authorized to enforce the LA (e.g., U.S. 

Department of Justice and U.S. Fish and Wildlife Service) and agencies authorized to 

enforce regulations pertaining to the importation of plants/wood and 

plant/wood/products (e.g., U.S. Department of Homeland Security, Homeland Security 

Investigations and Customs and Border Protection). Other requests may come from 

other federal agencies involved in facilitating international trade, such as the Office of 

the United State Trade Representative. For all external requests for LAWGS data, other 

than from USDA-OGC, the requesting agency must submit a written request to APHIS 

specifying the data they are seeking and the reason for the request. As with internal 

requests for these data, the LAWGS Administrator/Manager must ensure the request and 

response to the request comply with the Lacey Act Declaration data-sharing policy. 

(Requests from USDA-OGC may be less formal because such requests will support 

ongoing enforcement proceedings specifically requested by the LAP.). Note that 

LAWGS cannot be used to share information directly with any external 

agencies/organizations. APHIS, only, is able to extract the data and create reports. The 

reports are then shared directly with requesting agencies via email using passwordprotected Excel spreadsheets. Data may also be shared with USDA contractors and other 

associated parties to address breaches, audits, or security; Congressional offices in 

response to an inquiry; and the National Archives and Records Administration for 

records management activities.
Page 9

Privacy Impact Assessment – APHIS - LAWGS

5.2 Is the sharing of personally identifiable information outside the 

Department compatible with the original collection? If so, is it 

covered by an appropriate routine use in a SORN? If so, please 

describe. If not, please describe under what legal mechanism the 

program or system is allowed to share the personally identifiable 

information outside of USDA. 

Data may be shared with other Federal law enforcement agencies upon a written 

request to APHIS for the purpose of enforcement of the Lacey Act Amendments and 

other regulatory authorities that govern the importation of wood and wood products 

such as CITES. LAWGS cannot be used to share information directly with any 

external agencies/organizations. APHIS, only, is able to extract the data and create 

reports. There is currently no automatic data sharing. Transmission of and 

safeguarding LAWGS data will be part of any future data-sharing MOU's with other 

agencies. 

5.3 How is the information shared outside the Department and what 

security measures safeguard its transmission? 

The LAWGS data are shared directly with the requesting agency via email using 

password-protected Excel spreadsheets. LAWGS cannot be used to share information 

directly with any external agencies/organizations. APHIS, only, is able to extract the 

data and create reports. Data may be shared with other enforcement agencies upon a 

written request to APHIS for the purpose of enforcement of the Lacey Act and other 

regulatory authorities that govern the importation of wood and wood products. There is 

currently no automatic data sharing. Transmission and data safe guards will be part of 

any future MOU's with other agencies. As with internal requests for this data, the 

LAWGS Administrator/Manager must ensure the request and response to the request 

comply with the Lacey Act Declaration data-sharing policy. 

5.4 Privacy Impact Analysis: Given the external sharing, explain the 

privacy risks identified and describe how they were mitigated. 

LAWGS cannot be used to share information directly with any external 

agencies/organizations. APHIS, only, is able to extract the data and create reports. As 

identified in Sections 3 and 4 above regarding mitigating the risk associated with the 

potential unapproved access to, or release of, LAWGS data, LAP will follow the 

guidelines identified in its Lacey Act Declaration data-sharing policy. LAP will also 

ensure that all reports shared with external agencies contain a warning on the report as 

to the presence of PII and Trade Secrets and the requirement not to release the report 

or data contained within to any personnel except on a need-to-know basis and must be 

used for its intended government purpose. 
Page 10

Privacy Impact Assessment – APHIS - LAWGS

Section 6.0 Notice 

6.1 Does this system require a SORN and if so, please provide SORN 

name and URL. 

 Yes, the SORN is named, APHIS Plant Protection and Quarantine's Lacey Act 

Declaration Information Systems (LADIS), USDA/APHIS-24, and can be located at 

https://www.ocio.usda.gov/policy-directives-records-forms/records-management/systemrecords

. 

6.2 Was notice provided to the individual prior to collection of

information? 

APHIS did not provide notice prior to the collection of information through LAWGS 

because information is submitted through LAWGS on a voluntary basis. 

6.3 Do individuals have the opportunity and/or right to decline to provide 

information? 

No

6.4 Do individuals have the right to consent to particular uses of the 

information? If so, how does the individual exercise the right? 

No 

6.5 Privacy Impact Analysis: Describe how notice is provided to 

individuals, and how the risks associated with individuals being 

unaware of the collection are mitigated. 

Organization data is provided by the users on voluntary basis. The data is to facilitate 

the autonomy of user’s organization and maintain confidentiality. There is no privacy 

risks associated with users’ organization data. 

Section 7.0 Access, Redress and Correction 

7.1 What are the procedures that allow individuals to gain access to their 

information? 
Page 11

Privacy Impact Assessment – APHIS - LAWGS

Users have access to their own organization’s information through the rights that are 

set up for them. Developers have access to the data for helpdesk support. This includes 

administration of the LAWGS system.

7.2 What are the procedures for correcting inaccurate or erroneous 

information? 

Declaration information is corrected real-time by the provider of the information. 

Organizational information can be corrected by the organization administrator within 

the LAWGS system. Erroneous data which the provider is unable to correct in 

LAWGS must be reported to LAP or the LAWGS helpdesk. LAP will investigate and 

if the correction is warranted, will work with the helpdesk to make the correction. 

Users also have the capability to submit written notes to LAP via the LAWGS system 

to inform LAP of errors needing correction. Certain data are changed by the DBA as 

authorized by PPQ LAP. 

7.3 How are individuals notified of the procedures for correcting their 

information? 

The LAWGS system provides for functionality that enables the users to view and correct 

their organizational data. Information about seeking assistance with LAWGS entries, 

such as the contact information for the LAWGS helpdesk, is provided in the LAWGS 

homepage. 

7.4 If no formal redress is provided, what alternatives are available to the 

individual? 

Formal redress is processed through the APHIS Legislative and Public Affairs FOIA 

office. 

7.5 Privacy Impact Analysis: Please discuss the privacy risks associated 

with the redress available to individuals and how those risks are 

mitigated. 

There are no privacy risks associated with Access, Redress and Correction. 

Section 8.0 Technical Access and Security 

8.1 What procedures are in place to determine which users may access 

the system and are they documented? 
Page 12

Privacy Impact Assessment – APHIS - LAWGS

Users must access the system through documented e-Authentication procedures. 

8.2 Will Department contractors have access to the system? 

Yes 

8.3 Describe what privacy training is provided to users either generally 

or specifically relevant to the program or system? 

LAWGS is a public web based system. Training is the responsibility of user’s 

organizations. The PPQ LAP staff schedules on-line webinar trainings to users. 

All APHIS officials and contractors must take the annual security awareness training 

provided by USDA. 

8.4 Has Certification & Accreditation been completed for the system or 

systems supporting the program? 

Yes, the system received its ATO on 4/17/2018. 

8.5 What auditing measures and technical safeguards are in place to 

prevent misuse of data? 

Built in audit information on data changes are provided per LAWGS software. Oracle 

auditing is provided as agreed between PPQ and NITC. NITC controls the database 

auditing. LAWGS software limits access by users based on the users’ designated role. 

8.6 Privacy Impact Analysis: Given the sensitivity and scope of the 

information collected, as well as any information sharing conducted 

on the system, what privacy risks were identified and how do the 

security controls mitigate them? 

There are no privacy risks associated with Technical Access and Security. 

Section 9.0 Technology 

9.1 What type of project is the program or system? 

LAWGS is a centralized web based application used to collect import declaration data 

required under the Lacey Act Amendment (16 U.S.C.3372) for all plant and plant 

products being imported into the United States. Importers (or their agents) log in to the 

secure web application to submit this data directly to APHIS.
Page 13

Privacy Impact Assessment – APHIS - LAWGS

9.2 Does the project employ technology which may raise privacy 

concerns? If so please discuss their implementation. 

No 

Section 10.0 Third Party Websites/Applications 

10.1 Has the System Owner (SO) and/or Information Systems Security 

Program Manager (ISSPM) reviewed Office of Management and 

Budget (OMB) memorandums M-10-22 “Guidance for Online Use of 

Web Measurement and Customization Technology” and M-10-23 

“Guidance for Agency Use of Third-Party Websites and 

Applications”? 

Yes 

10.2 What is the specific purpose of the agency’s use of 3rd party websites 

and/or applications? 

The LAWGS system does not utilize any 3rd party websites. 

10.3 What personally identifiable information (PII) will become available 

through the agency’s use of 3rd party websites and/or applications. 

None 

10.4 How will the PII that becomes available through the agency’s use of 

3rd party websites and/or applications be used? 

N/A 

10.5 How will the PII that becomes available through the agency’s use of 

3rd party websites and/or applications be maintained and secured? 

N/A 

10.6 Is the PII that becomes available through the agency’s use of 3rd party 

websites and/or applications purged periodically? 

N/A 
Page 14

Privacy Impact Assessment – APHIS - LAWGS

10.7 Who will have access to PII that becomes available through the 

agency’s use of 3rd party websites and/or applications? 

N/A 

10.8 With whom will the PII that becomes available through the agency’s 

use of 3rd party websites and/or applications be shared - either 

internally or externally? 

N/A 

10.9 Will the activities involving the PII that becomes available through the 

agency’s use of 3rd party websites and/or applications require either 

the creation or modification of a system of records notice (SORN)? 

N/A 

10.10 Does the system use web measurement and customization 

technology? 

Yes, the system is scheduled to be reviewed annually to demonstrate compliance to 

OMB-M10-23. 

10.11 Does the system allow users to either decline to opt-in or decide to optout of all uses of web measurement and customization technology? 

N/A 

10.12 Privacy Impact Analysis: Given the amount and type of PII that 

becomes available through the agency’s use of 3rd party websites 

and/or applications, discuss the privacy risks identified and how they 

were mitigated. 

Data is not accessible through 3rd party websites and/or applications. 
Page 15

Privacy Impact Assessment – APHIS - LAWGS

Approval Signature 

_________________________________ __________________

 Preston J. Griffin Date 

Acting Chief Information Security Officer

Marketing and Regulatory Program Information 

Technology Services 

United States Department of Agriculture 

_________________________________ __________________

 Tonya G. Woods Date 

APHIS Privacy Act Officer 

Animal and Plant Health Inspection Service 

United States Department of Agriculture 

_________________________________ __________________ 

Robert M. Baca Date 

LAWGS System Owner 

Plant Protection and Quarantine 

Animal and Plant Health Inspection Service 

United States Department of Agriculture