1 

The Department of the Treasury 

Semiannual 2020 Report on Privacy and 

Civil Liberties Activities Pursuant to Section 

803 of the Implementing Recommendations 

of the 9/11 Commission Act of 2007

For the reporting period

October 1, 2020 to March 31, 2021 

1. Introduction

The Assistant Secretary for Management (ASM) is the Department of the Treasury’s (Treasury) 

Chief Privacy and Civil Liberties Officer (CPCLO). As the CPCLO, the ASM is responsible for

implementing the 9/11 Commission Act of 2007’s privacy and civil liberties requirements. 

To assist the ASM with these responsibilities, Treasury Directive 25-04, “The Privacy Act of 

1974, as amended,” designates the Deputy Assistant Secretary for Privacy, Transparency, and 

Records (DASPTR) as the ASM’s principal advisor on issues related to privacy and civil 

liberties. The DASPTR leads the Office of Privacy, Transparency, and Records (PTR) and 

provides the ASM with day-to-day support in executing PCLO duties.

This report is submitted pursuant to section 803 of the Implementing Recommendations of the 

9/11 Commission Act of 2007,

1

 which sets forth the following requirements: 

(f) Periodic Reports – 

(1) In General – 

The privacy officers and civil liberties officers of each department, agency, or 

element referred to or described in subsection (a) or (b) shall periodically, but 

not less than semiannually, submit a report on the activities of such officers— 

(A)

(i) to the appropriate committees of Congress, including the 

Committee on the Judiciary of the Senate, the Committee on the Judiciary 

of the House of Representatives, the Committee on Homeland Security 

and Governmental Affairs of the Senate, the Committee on Oversight and 

Government Reform of the House of Representatives, the Select 

Committee on Intelligence of the Senate, and the Permanent Select 

Committee on Intelligence of the House of Representatives;

(ii) to the head of such department, agency, or element; and 

1 42 U.S.C. § 2000ee-1(f).
2 

(iii) to the Privacy and Civil Liberties Oversight Board; and 

(B) which shall be in unclassified form to the greatest extent possible, 

with a classified annex where necessary.

(2) Contents – 

Each report submitted under paragraph (1) shall include information on the 

discharge of each of the functions of the officer concerned, including— 

(A) information on the number and types of reviews undertaken; 

(B) the type of advice provided and the response given to such advice; 

(C) the number and nature of the complaints received by the department, 

agency, or element concerned for alleged violations; and 

(D) a summary of the disposition of such complaints, the reviews and 

inquiries conducted, and the impact of the activities of such officer.

The Intelligence Authorization Act for Fiscal Year 2014, Pub. L. No. 113-126 (July 7, 2014), 

changed the reporting period from quarterly to semiannually. The semiannual reports cover 

the following time periods: April – September and October – March. This report covers 

PCLO activities from October 1, 2020 through March 31, 2021. 

2. Privacy Reviews

Treasury reviews programs and information technology (IT) systems that may present privacy 

risks. Privacy and civil liberties reviews include the following Treasury activities: 

a) Privacy and Civil Liberties Threshold Analyses, which are the Treasury mechanism for 

reviewing IT systems, programs, and other activities for privacy protection issues to 

determine whether a more comprehensive Privacy and Civil Liberties Impact 

Assessment is required; 

b) Privacy and Civil Liberties Impact Assessments as required by the E-Government Act 

of 2002;2 

c) System of Records Notices, as required by the Privacy Act, and any associated Final 

Rules for Privacy Act exemptions;3 

d) Privacy Act Statements, as required by the Privacy Act,4

 to provide notice to 

individuals at the point of collection; 

e) Computer Matching Agreements, as required by the Privacy Act;5 

f) Data Mining Reports, as required by Section 804 of the 9/11 Commission Act of 

2007;6

 

g) Privacy Compliance Reviews;

2 44 U.S.C. § 3501 note.

3 5 U.S.C. §§ 552a(j), (k). See also Office of Management and Budget (OMB) Circular No. A-108, “Federal 

Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act,” 81 FR 94424 (Dec. 23, 

2016).

4 5 U.S.C. § 552a(e)(3).

5 5 U.S.C. § 552a(o)-(u). 6 42 U.S.C. § 2000ee-3. 
3 

h) Privacy reviews of IT and program budget requests, including Office of Management 

and Budget Exhibit 300s; and, 

i) Other privacy reviews, such as implementation reviews for information sharing 

agreements. 

3. Privacy and Civil Liberties Impact Assessments (PCLIA)

The PCLIA process is one of Treasury’s key mechanisms to ensure that programs and 

technologies sustain, and do not erode, privacy protections. During the reporting period, 

Treasury published 81 new, updated, or renewed PCLIAs. The following are examples of a new 

PCLIAs for which two bureaus provided summaries: 

• The Alcohol & Tobacco Tax & Trade Bureau (TTB) completed 3 

PCLIA(s) during the reporting period for the Tax Major Application 

(TMA) system as part of testing to be reviewed for the FY21 FISMA 

Audit and TTB’s continuous monitoring process for Permits Online 

(PONL), Integrated Revenue Information System (IRIS), and Auto Audit. 

In addition, TTB completed the Regulatory Major Application (RMA) as 

part of testing they reviewed the FY21 FISMA Audit and TTB’s 

continuous monitoring process for Formulas Online (FONL), Certificate 

of Label Approval Online (COLAs), and Laboratory Information 

Management System (LIMS). 

• The Internal Revenue Service Bureau (IRS) completed the PCLIA for Get 

My Payment, (GMP) which is a non-recordkeeping system that was 

implemented as part of the Coronavirus Aid, Relief, and Economic 

Security (CARES) Act and is used by the Small Business and SelfEmployed (SB/SE) system. The SB/SE system allows taxpayers receiving 

a stimulus to determine when it will be received. This system is also used 

solely at the discretion of the user to retrieve their stimulus; and 

individuals are not required to use the application. The IRS Privacy 

Compliance & Review (PCR) worked closely with the business unit to 

address the accuracy and completeness of the PCLIA. After an initial 

review of the PCLIA, PCR identified several items that needed correction 

including: 

o System dissemination of SBU/PII

o Verifying Security Assessment and Authorization (SA&A) or Annual 

Security Control Assessment (ASCA)

o System's audit trail 

• The IRS also completed the Electronic Fraud Detection System (EFDS), is 

a mission critical, stand-alone automated system used by Wage and 

Investment (W&I) designed to maximize fraud detection at the time tax 

returns are filed to eliminate the issuance of questionable refunds. IRS 
4 

PCR worked with the business unit to address the accuracy and 

completeness of the PCLIA. After an initial review of the PCLIA, PCR 

identified several items that needed correction, including: 

o Other types of SBU/PII used in the system

o System dissemination of SBU/PII to other IRS Systems

 

Because of the IRS PCR recommendations, changes were made to the PCLIA.

All published Treasury PCLIAs are available on Treasury’s PCLIA website: 

https://www.treasury.gov/privacy/PIAs/Pages/default.aspx (links are also provided to bureau 

websites where additional PCLIAs are posted). 

4. System of Records Notices (SORN)

During the reporting period, Treasury published or updated 9 SORNs. Treasury has determined 

that the information contained in its systems of records is accurate, timely, relevant, complete, 

and necessary to maintain the proper performance of a documented agency function. All 

Treasury SORNs, Notices of Proposed Rulemaking, and Final Rules for Privacy Act exemptions 

are available on Treasury’s SORN website, https://home.treasury.gov/footer/privacy-act/systemof-records-notices-sorns. 

5. Computer Matching Programs (CMAs)

Treasury participates in 59 re-established and 4 active computer matching programs that were 

renewed in accordance with the Privacy Act of 1974, as amended. The computer matching 

provisions of the Privacy Act improve oversight of the disclosure of automated Privacy Act 

records in inter-agency information sharing arrangements known as matching programs. These 

provisions also protect the due process rights of individuals whose records are exchanged in such 

programs. To comply with the Act, as well as all relevant regulations and guidance, Treasury 

established a Data Integrity Board to review and approve matching agreements. All Treasury

CMAs are available on Treasury’s CMA website, https://home.treasury.gov/footer/privacyact/computer-matching-programs. 

During the reporting period, the Data Integrity Board reviewed and approved 12-month renewals 

for certain CMAs. 

a) The Disclosure of Information to Federal, State and Local Agencies (DIFSLA) Data 

Exchange- The Disclosure of Information to Federal, State and Local Agencies (IRS 

Project 066 - DIFSLA) CMA between the Internal Revenue Service (IRS) and 53 state 

agencies has The Disclosure of Information to Federal, State and Local Agencies 

(DIFSLA) Data Exchange program reduces fraud and abuse in certain federallyassisted benefit programs. The CMA memorializing all 53 agreements is available at 

85 FR 64227 (October 9, 2020). 

b) The Income-Related Adjustments to Medicare Premiums IRC § 6103(1) (20) 
5 

authorizes IRS to disclose specified return information to the SSA with respect to 

taxpayers whose Part B and/or prescription drug coverage insurance premium(s) may 

(according to IRS records) be subject to premium subsidy adjustment pursuant to 

section 1839(i) or premium increase pursuant to §1860D-13(a) (7) of the Social 

Security Act for the purpose of establishing the amount of any such adjustment or 

increase. The return information IRS will disclose includes adjusted gross income and 

specified tax-exempt income. The agreement is available at 85 FR 47837 (August 6, 

2020). 

c) Verification of Household Income and Family Size for Insurance Affordability 

Programs and Exemptions- Department of Health and Human Services (HHS) Centers 

for Medicare and Medicaid Services (CMS) Section 6103(l)(21) of the Internal 

Revenue Code authorizes the IRS to disclose certain items of return information to the 

Centers for Medicare and Medicaid Services (CMS) as a part of the eligibility 

determination process for programs covered by various sections of the Patient 

Protection and Affordable Care Act (ACA). The agreement is available at 85 FR 8873

(February 18, 2020). 

d) Medicare Part D Prescription Drug Benefit Program (CMA 1304)- The Bureau of 

Fiscal Services discloses ownership of Savings Securities to the SSA, which will 

provide SSA with information necessary to verify an individual’s self-certification of 

his or her financial status to determine eligibility for low income subsidy assistance 

(Extra Help) in the Medicare Part D prescription drug benefit program established 

under the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 

(Public Law 108-173). The agreement is available at 85 FR 82025 (December 17, 

2020). 

6. Privacy Compliance Reviews (PCRs) 

Treasury conducts PCRs to ensure that programs and technologies implement and maintain 

appropriate protections for personally identifiable information. The PCR is a collaborative effort 

that helps improve a program’s ability to comply with existing privacy requirements by 

identifying and remediating gaps in compliance documentation, including PCLIAs, SORNs, and 

formal agreements, such as memoranda of understanding and memoranda of agreement. Treasury 

conducts informal PCRs with its bureaus and offices when necessary. Informal PCRs are also 

sometimes done as part of other requirements, such as the Treasury PCLIA requirement and 

reviews of particular issues required in external reports to Congress. For example, in preparing 

the Social Security number (SSN) Fraud Prevention Act Report each year, Treasury reviews the 

existing circumstances under which Treasury bureaus and offices include SSNs in mailings 

outside the Department to ensure that the Treasury bases for permitting the mailing of SSNs are 

still valid. Treasury policy only allows the collection, maintenance, and use of SSNs under the 

following circumstances: (1) security background investigations; (2) interfaces with external 

entities that require the SSN; (3) a legal/statutory basis (i.e., where collection is expressly required 

by statute); (4) when there is no reasonable, alternative means for meeting business requirements; 

(5) statistical and other research purposes; (6) delivery of government benefits, privileges, and 
6 

services; (7) law enforcement and intelligence purposes; and (8) aging systems with technological 

limitations combined with funding limitations render impossible system updates or modifications 

to add privacy risk reduction tools (partial/truncated/redacted or masked SSNs). In the absence of 

a compelling argument to the contrary, no other SSN uses are allowed. Treasury remains focused 

on eliminating the use of SSNs whenever possible and safeguarding SSNs that must be collected 

and maintained because no reasonable alternative exists. In preparation for the 2019 report 

(submitted to Congress in October of 2019) Treasury determined that the eight bases for using 

SSNs in external mailings remain valid.

7. Advice and Responses 

Treasury provides privacy and civil liberties advice to its bureaus and offices throughout the year. 

Some of this advice originates from ad hoc responses PTR provides to bureaus and offices on a 

daily basis. Other advice originates from discussions within Treasury bureaus between the 

bureaus’ privacy and civil liberties stakeholders (including legal counsel, as necessary) and 

systems owners, program managers and staff. PTR and the bureau privacy and civil liberties 

stakeholders also provide advice during the PCLIA process, advising system owners and program 

managers on Privacy Act, records management, Paperwork Reduction Act, and other 

requirements to ensure they fully comply with applicable law in the operation of their information 

systems.

8. Privacy Complaints and Dispositions

For purposes of Section 803 reporting, complaints are written allegations of harm or violation of 

privacy compliance requirements filed with Treasury’s privacy and civil liberties programs. The 

categories of complaints are reflected in Appendix A below. 

9. Conclusions

As required by the 9/11 Commission Act, and in accordance with the Intelligence Authorization 

Act for Fiscal Year 2014, this semiannual report summarizes Treasury’s privacy activities from 

October 1, 2020 through March 31, 2021. Treasury will continue to work with Congress, 

colleagues in other federal departments and agencies, and the public to continue to protect 

privacy in all of our activities. 
7 

Reviews Advice and Response Complaints

Type Number Type Number Response 

Type of claim 

or assertion in 

complaint

Number of 

complaints Disposition

Privacy (and Civil 

Liberties) 

Threshold Analysis 

(PTAs/PCLTAs) 

60

Provide advice and 

recommendation 

regarding proper 

handling of 

PII/limiting access 

based on need to 

know

0 N/A

PRIVACY: 

Unauthorized 

disclosure 

(internal/ 

external)

Internal: 0 

External: 0 N/A 

Privacy (and Civil 

Liberties) Impact 

Assessments 

(PIAs/PCLIAs) 

81 

Provide advice 

and/or 

recommendation 

on relevance and 

necessity of data 

collection/ingestio

n 

1 Pending PRIVACY: 

Collection External: 0 N/A

System of Records 

(SOR) Routine 

Use/ SOR Notices 

(SORNs)

Provided guidance 

to system owners 

or personnel on 

necessary privacy 

compliance 

documentation or 

appropriate NIST 

risk rating.

0 N/A

PRIVACY: 

(Other: 

Describe)

0 N/A

Computer 

Matching 

Agreements 

(CMAs) 

63 

Provide advice and 

recommendation 

on 

internal/external 

sharing of PII 

(including Privacy 

Act info)

1 Accepted

CIVIL LIBERTIES: 

Violation 1st, 

4th, 5th, 6th, 14th

and/or 16th

Amendment 

rights

21-IRS 

Complaints/a

mendments 

alleged to 

have been 

violated. 

9 – Pending final 

decision

12 – Resolved in 

favor of the 

Government 

Section 508 

International 

Website scans

Internet: 

97% 

Intranet: 

41% 

Provide advice and 

recommendation 

on web privacy 

policies/privacy 

notices

2 Accepted

CIVIL LIBERTIES: 

(Other: 

Describe)

0 N/A 

Appendix A: Department of the Treasury

Semiannual Report on Privacy and Civil Liberties Activities 

Under Section 803 of the 9/11 Commission Act of 2007

October 1, 2020 through March 31, 2021