The Department of the Treasury 

Semiannual 2021 Report on Privacy and 

Civil Liberties Activities Pursuant to Section 

803 of the Implementing Recommendations 

of the 9/11 Commission Act of 2007 

For the reporting period 

October 1, 2021 to March 31, 2022 

1. Introduction 

The Assistant Secretary for Management (ASM) is the Department of the Treasury’s (Treasury) 

Chief Privacy and Civil Liberties Officer (CPCLO). As the CPCLO, the ASM is responsible for 

implementing the 9/11 Commission Act of 2007’s privacy and civil liberties requirements. 

To assist the ASM with these responsibilities, Treasury Directive 25-04, “The Privacy Act of
 

1974, as amended,” designates the Deputy Assistant Secretary for Privacy, Transparency, and 

Records (DASPTR) as the ASM’s principal advisor on issues related to privacy and civil 

liberties. The DASPTR leads the Office of Privacy, Transparency, and Records (PTR) and 

provides the ASM with day-to-day support in executing PCLO duties.
 

This report is submitted pursuant to section 803 of the Implementing Recommendations of the 

9/11 Commission Act of 2007,

1 which sets forth the following requirements: 

(f) Periodic Reports – 

(1) In General – 

The privacy officers and civil liberties officers of each department, agency, or 

element referred to or described in subsection (a) or (b) shall periodically, but 

not less than semiannually, submit a report on the activities of such officers— 

(A)

(i) to the appropriate committees of Congress, including the 

Committee on the Judiciary of the Senate, the Committee on the Judiciary 

of the House of Representatives, the Committee on Homeland Security 

and Governmental Affairs of the Senate, the Committee on Oversight and 

Government Reform of the House of Representatives, the Select 

Committee on Intelligence of the Senate, and the Permanent Select 

Committee on Intelligence of the House of Representatives; 

(ii) to the head of such department, agency, or element; and 

1 42 U.S.C. § 2000ee-1(f). 

1
 
 

 

 

 

 

 

(iii) to the Privacy and Civil Liberties Oversight Board; and 

(B) which shall be in unclassified form to the greatest extent possible, 

with a classified annex where necessary. 

(2) Contents – 

Each report submitted under paragraph (1) shall include information on the 

discharge of each of the functions of the officer concerned, including— 

(A) information on the number and types of reviews undertaken; 

(B) the type of advice provided and the response given to such advice; 

(C) the number and nature of the complaints received by the department, 

agency, or element concerned for alleged violations; and 

(D) a summary of the disposition of such complaints, the reviews and 

inquiries conducted, and the impact of the activities of such officer. 

The Intelligence Authorization Act for Fiscal Year 2014, Pub. L. No. 113-126 (July 7, 2014), 

changed the reporting period from quarterly to semiannually. The semiannual reports cover 

the following time periods: April – September and October – March. This report covers 

PCLO activities from October 1, 2021 through March 31, 2022. 

2. Privacy Reviews 

Treasury reviews programs and information technology (IT) systems that may present privacy 

risks. Privacy and civil liberties reviews include the following Treasury activities: 

a)	 Privacy and Civil Liberties Threshold Analyses(PCLTAs), which are the Treasury 

mechanism for reviewing IT systems, programs, and other activities for privacy 

protection issues to determine whether a more comprehensive Privacy and Civil 

Liberties Impact Assessment (PCLIA) is required; 

b) PCLIAs as required by the E-Government Act of 2002;2 

c) System of Records Notices (SORNs), as required by the Privacy Act, and any 

associated Final Rules for Privacy Act exemptions;3 

d) Privacy Act Statements (PASs), as required by the Privacy Act,4 to provide notice to 

individuals at the point of collection; 

e) Computer Matching Agreements (CMAs), as required by the Privacy Act;5 

f) Data Mining Reports, as required by Section 804 of the 9/11 Commission Act of 

2007;6 

g) Privacy Compliance Reviews(PCRs); 

h) Privacy reviews of IT and program budget requests, including Office of Management 

2 44 U.S.C. § 3501 note.
 3 5 U.S.C. §§ 552a(j),(k). See also Office of Management and Budget (OMB)Circular No. A-108, “Federal
 

Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act,” 81FR 94424 (Dec. 23,

2016).

4 5 U.S.C. § 552a(e)(3).
 5 5 U.S.C. § 552a(o)-(u).
 6 42 U.S.C. § 2000ee-3.
 

2
 
 

 

and Budget (OMB) Exhibit 300s; and, 

i) Other privacy reviews, such as implementation reviews for information sharing 

agreements. 

3. Privacy and Civil Liberties Impact Assessments (PCLIA) 

The PCLIA process is one of Treasury’s key mechanisms to ensure that programs and 

technologies sustain, and do not erode, privacy protections. During the reporting period, Treasury 

published 92 new, updated, or renewed PCLIAs. The following are examples of a new PCLIAs 

for which two bureaus provided summaries: 

•	 The Alcohol and Tobacco Tax and Trade Bureau (TTB) completed 8 

PIA(s)/PCLIA(s) during this reporting period for its Tax Major 

Application (TMA) system and applications and its Regulatory Major 

Application (RMA) system and applications, as part of continuous 

monitoring annual testing. 

•	 The Internal Revenue Service (IRS) completed 76 PIA(s)/PCLIA(s) during the 

reporting period. Among them are: PCLIA for Scanning as a Service (SCaaS) 

Front End-Ripcord. SCaas allows the IRS to use managed services from a 

contractor to digitize or digitalize paper records and allow the electronic file to 

serve as the official records. This will allow the IRS to move from a paper 

environment to an electronic record environment in accordance with OMB 

guidance. The IRS also completed a PCLIA for Microsoft 365 Government Level 5 

(M365 G5). M365 G5 is a Software-as-a-Service (SaaS) product that acts as a 

platform to combine familiar Microsoft Office Productivity suite with online 

versions of Microsoft’s next-generation communications and collaboration 

services. M365 allows the IRS to simplify administration and improve 

functionality for end users. The components of M365 G5 include, but are not 

limited to: Exchange Online (EXO) – replacing on-premises Exchange; One Drive 

for Business (ODB) – providing an alternative file sharing service; SharePoint 

Online (SPO) – replacing on-premises SharePoint 2013; Teams - replacing Skype; 

Project Online (PJO) – providing a new service for project management. 

All published Treasury PCLIAs are available on Treasury’s Privacy website: 

https://home.treasury.gov/footer/privacy-act/privacy-and-civil-liberties-impact-assessments. 

4. System of Records Notices (SORN) 

During the reporting period, Treasury did not publish or update a SORN. Treasury has 

determined that the information contained in its systems of records is accurate, timely, relevant, 

complete, and necessary to maintain the proper performance of a documented agency function. 

3
 
 

 

 

 

 

 

All Treasury SORNs, Notices of Proposed Rulemaking, and Final Rules for Privacy Act 

exemptions are available on Treasury’s SORN website, https://home.treasury.gov/footer/privacyact/system-of-records-notices-sorns. 

5. Computer Matching Programs (CMAs) 

Treasury participates in 5 reestablished, 6 renewed, and 2 new computer matching programs in 

accordance with the Privacy Act of 1974, as amended. The computer matching provisions of the 

Privacy Act improve oversight of the disclosure of automated Privacy Act records in interagency information sharing arrangements known as matching programs. These provisions also 

protect the due process rights of individuals whose records are exchanged in such programs. To 

comply with the Act, as well as all relevant regulations and guidance, Treasury established a 

Data Integrity Board to review and approve matching agreements. All Treasury CMAs are 

available on Treasury’s CMA website, https://home.treasury.gov/footer/privacy-act/computermatching-programs. 

During the reporting period, the Data Integrity Board reviewed and approved the following 

CMAs renewals. 

- Medicare Part D -Low Income Subsidy Program computer matching agreement sets forth 

the terms under which the IRS will, as authorized by the Internal Revenue Code (IRC) 

§6103(l)(7), disclose to the Social Security Administration certain return information for 

the purpose of verifying eligibility for the Medicare Part D Low Income Subsidy (LIS) 

and determining the correct subsidy percentage of benefits provided under §1860D-14 of 

the Social Security Act (42 U.S.C. §1395w-114). The agreement is available at 85 FR 

5271 (November 26, 2021). 

- Verification of Household Income and Family Size for Insurance Affordability Programs 

and Exemptions- Department of Health and Human Services (HHS) Centers for Medicare 

and Medicaid Services (CMS) Section 6103(l)(21) of the IRC authorizes the IRS to 

disclose certain items of return information to the CMS as a part of the eligibility 

determination process for programs covered by various sections of the Patient Protection 

and Affordable Care Act (ACA). The agreement is available at 85 FR 8873 (October 4, 

2021). 

- Income-Related Adjustment to Medicare Premiums (Medicare Part B) Computer 

Matching Agreement (CMA) between the IRS and the SSA sets forth the terms under 

which IRS will disclose to SSA certain return information as authorized by the IRC 

6103(1)(20) to carry out Medicare Part B premium subsidy adjustments and Medicare 

prescription drug coverage premium increases under sections 1839(i) and 1860D-13(a)(7) 

of the Act (42 U.S.C. §§ 1395r(i) and 1395w 113(a)(7)), as enacted by section 811 of the 

Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA; Pub. 

4
 
L. No. 108-173) and section 3308 of the Affordable Care Act of 2010 (Pub. L. No. 111-

148). The agreement is available at 85 FR 5271 (January 29, 2020). 

- Supplemental Security Income computer matching agreement sets forth the terms, 

conditions, safeguards, and procedures under which the, Department of the Treasury 

Bureau of the Fiscal Service (Fiscal Service) will disclose savings security data (as 

described in section VI.D) to the SSA. SSA will use the data to determine continued 

eligibility for Supplemental Security Income (SSI) applicants and recipients, or the correct 

benefit amount for recipients and deemors who did not report or incorrectly reported 

ownership of savings securities. The agreement is available at 86 FR 20781 (April 21, 

2021). 

- The Do Not Pay Program CMA establishes the conditions, safeguards, and procedures 

under which the Department of Veterans Affairs, Financial Services Center, Commercial 

Operations Division (VA) will conduct a computer matching program with the U.S. 

Department of the Treasury’s Bureau of the Fiscal Service (Fiscal Service), Do Not Pay 

(DNP) Business Center, to provide identifying information through the Treasury’s 

Working System. The information will be used to determine whether an individual or 

entity is eligible to receive federal payments, contract awards, or other benefits, including 

reducing duplicate payments to vendors and beneficiaries, verifying that beneficiaries 

submitting claims are not deceased, collecting debt owed to federal or state governments, 

and suspending or revoking payments as needed. The matching program is conducted 

pursuant to the Privacy Act - 5 U.S.C. § 552a, the Payment Integrity Information Act 

(PIIA) - 31 U.S.C. § 3354 and OMB Memorandum M-18-20, to comply with the Do Not 

Pay Initiative. The VA is designated as the recipient agency, the agency receiving the 

records for use in this matching program, as defined by the Privacy Act, 5 U.S.C. § 

552a(a)(9). As the recipient agency, the VA is responsible for publishing the Federal 

Register notice required by 5 U.S.C. § 552a(e)(12). Treasury is designated as the source 

agency, the agency disclosing its records, for use in this matching program, as defined by 

5 U.S.C. § 552a(a)(11).” The agreement is available at 86 FR 38531 (July 21,2021) 

- The Do Not Pay Program assists the Small Business Administration (SBA) in the 

identification of potentially improper payments. Information is disclosed pursuant to this 

matching program only for the purpose of, and to the extent necessary in, assisting SBA in 

its determination with respect to an applicant for assistance under the SBA Programs. The 

agreement is available at 86 FR 14798 (March 18, 2021). 

6. Privacy Compliance Reviews (PCRs) 

Treasury conducts PCRs to ensure that programs and technologies implement and maintain 

appropriate protections for personally identifiable information. The PCR is a collaborative effort 

5
 
 

 

 

 

 

 

 

 

 

 

that helps improve a program’s ability to comply with existing privacy requirements by 

identifying and remediating gaps in compliance documentation, including PCLIAs, SORNs, and 

formal agreements, such as memoranda of understanding and memoranda of agreement. Treasury 

conducts informal PCRs with its bureaus and officeswhen necessary. Informal PCRs are also 

sometimes done as part of other requirements, such as the Treasury PCLIA requirement and 

reviews of particular issues required in external reports to Congress. For example, in preparing 

the Social Security number (SSn) Fraud Prevention Act Report each year, Treasury reviews the 

existing circumstances under which Treasury bureaus and offices include SSns in mailings 

outside the Department to ensure that the Treasury bases for permitting the mailing of SSns are 

still valid. Treasury policy only allows the collection, maintenance, and use of SSns under the 

following circumstances: (1) as a unique identifier for identity verification purposes related to 

law enforcement, intelligence, and/or security background investigations; (2) when required by 

external entities to perform a function for or on behalf of Treasury; (3) when collection is 

expressly required by statute or regulation; (4) for statistical and other research purposes; (5) to 

ensure the delivery of government benefits, privileges, and services; and (6) when there are no 

reasonable, alternative means for meeting business requirements. In the absence of a compelling 

argument to the contrary, no other SSn uses are allowed. Treasury remains focused on 

eliminating the use of SSns whenever possible and safeguarding SSns that must be collected and 

maintained in one or more of the six circumstances discussed above. 

7. Advice and Responses 

Treasury provides privacy and civil liberties advice to its bureaus and offices throughout the year. 

Some of this advice originates from ad hoc responses PTR providesto bureaus and offices, as 

requested. Other advice originates from discussions within Treasury bureaus between the 

bureaus’ privacy and civil liberties stakeholders (including legal counsel, as necessary) and 

systems owners, program managers and staff. PTR and the bureau privacy and civil liberties 

stakeholders also provide advice during the PCLIA process, advising system owners and program 

managers on Privacy Act, records management, Paperwork Reduction Act, and other 

requirements to ensure they fully comply with applicable laws in the operation of their 

information systems. 

8. Privacy Complaints and Dispositions 

For purposes of Section 803 reporting, complaints are written allegations of harm or violation of 

privacy compliance requirements filed with Treasury’s privacy and civil liberties programs. The 

categories of complaints are reflected in Appendix A below. 

9. Conclusions 

As required by the 9/11 Commission Act, and in accordance with the Intelligence Authorization 

Act for Fiscal Year 2014, this semiannual report summarizes Treasury’s privacy activities from 

October 1, 2021 through March 31, 2022. Treasury will continue to work with Congress, 

colleagues in other Federal departments and agencies, and the public to continue to protect 

privacy in all of our activities. 

6
 
 

Appendix A: Department of the Treasury
 

Semiannual Report on Privacy and Civil Liberties Activities
 

Under Section 803 of the 9/11 Commission Act of 2007
 

October 1, 2021 through March 31, 2022
 

Reviews 

Type Number 

Privacy (and Civil 

Liberties) 

Threshold 71 

Analysis 

(PTAs/PCLTAs) 

Privacy (and Civil 

Liberties) Impact 

Assessments 92 

(PIAs/PCLIAs) 

System of Records 

(SOR) Routine 

Use/ SOR Notices 0 

(SORNs) 

Computer 

Matching 

Agreements 13 

(CMAs) 

Section 508 

International 

Website scans 

Internet: 

96% 

Intranet: 

41% 

Advice and Response 

Type Number Response 

Provide advice and 

recommendation 

regarding proper 

handling of 

PII/limiting access 

based on need to 

know 

12 

10- Bureau of 

Engraving and 

Printing (BEP) 

& Treasury 

Office of 

Inspector 

General (TOIG) 

Accepted 

2-IRS Interim 

guidance issued 

Provide advice 

and/or 4-BEP In 

recommendation 

on relevance and 5 

Process 

1-TOIG 

necessity of data Accepted 

collection/ingestion 

Provided guidance 

to system owners 15-BEP & 1-

or personnel on TOIG Accepted 

necessary privacy 

compliance 

documentation or 

17 1-IRS Interim 

guidance issued 

appropriate NIST 

risk rating. 

Provide advice and 

recommendation 6-BEP In 

on internal/external 

sharing of PII 9 

Process 

3-TOIG 

(including Privacy Accepted 

Act info) 

Provide advice and 

recommendation 

on web privacy 

policies/privacy 

notices 

3 

2-BEP, Treasury 

Inspector 

General for Tax 

Administration 

(TIGTA) & 

TOIG Accepted 

Complaints 

Type of claim or 

assertion in 

complaint 

PRIVACY: 

Unauthorized 

disclosure 

(internal/ external) 

Number of 

complaints Disposition 

Internal: 0 

External: 1 

1-TOIG Open 

PRIVACY: 

Collection 2 

2-TOIG Closed 

(General 

Informationnot an OG 

matter) 

PRIVACY: 

(Other: Describe) 2 

2-TOIG Closed 

and referred to 

appropriate 

department/bur 

eau 

CIVIL 

LIBERTIES: 

Violation 1st, 4th , 

5th, 6th, 14th and/or 

16th Amendment 

rights 

52 

3- TOIG 

Closed 

(informed 

complainant to 

contact 

appropriate 

agency) 

33-IRS 

Pending final 

decision 

16-IRS Closed 

CIVIL 

LIBERTIES: 

(Other: Describe) 

2 

2-TOIG Closed 

(general 

information – 

not an OIG 

Matter) 

7