The Department of the Treasury 

Semiannual 2020 Report on Privacy and 

Civil Liberties Activities Pursuant to Section 

803 of the Implementing Recommendations 

of the 9/11 Commission Act of 2007 

For the reporting period 

October 1, 2019 to March 31, 2020 

1. Introduction 

The Assistant Secretary for Management (ASM) is the Department of the Treasury (Treasury)
 

Privacy and Civil Liberties Officer (PCLO). As the PCLO, the ASM is responsible for
 

implementing the 9/11 Commission Act of 2007’s privacy and civil liberties requirements.
 

To assist the ASM with these responsibilities, Treasury Directive 25-04, “The Privacy Act of
 

1974, as amended,” designates the Deputy Assistant Secretary for Privacy, Transparency, and 

Records (DASPTR) as the ASM’s principal advisor on issues related to privacy and civil 

liberties. The DASPTR leads the Office of Privacy, Transparency, and Records (PTR) and 

provides the ASM with day-to-day support in executing PCLO duties.
 

This report is submitted pursuant to section 803 of the Implementing Recommendations of the
 

9/11 Commission Act of 2007,1 which sets forth the following requirements: 

(f) Periodic Reports – 

(1) In General – 

The privacy officers and civil liberties officers of each department, agency, or 

element referred to or described in subsection (a) or (b) shall periodically, but 

not less than semiannually, submit a report on the activities of such officers— 

(A) 

(i) to the appropriate committees of Congress, including the 

Committee on the Judiciary of the Senate, the Committee on the Judiciary 

of the House of Representatives, the Committee on Homeland Security 

and Governmental Affairs of the Senate, the Committee on Oversight and 

Government Reform of the House of Representatives, the Select 

Committee on Intelligence of the Senate, and the Permanent Select 

Committee on Intelligence of the House of Representatives; 

(ii) to the head of such department, agency, or element; and 

1 42 U.S.C. § 2000ee-1(f). 

1 
 

 

 

 

 

 

 

 

 

(iii) to the Privacy and Civil Liberties Oversight Board; and 

(B) which shall be in unclassified form to the greatest extent possible, 

with a classified annex where necessary. 

(2) Contents – 

Each report submitted under paragraph (1) shall include information on the 

discharge of each of the functions of the officer concerned, including— 

(A) information on the number and types of reviews undertaken; 

(B) the type of advice provided and the response given to such advice; 

(C) the number and nature of the complaints received by the department, 

agency, or element concerned for alleged violations; and 

(D) a summary of the disposition of such complaints, the reviews and 

inquiries conducted, and the impact of the activities of such officer. 

The Intelligence Authorization Act for Fiscal Year 2014, Pub. L. No. 113-126 (July 7, 2014), 

changed the reporting period from quarterly to semiannually. The semiannual reports cover 

the following time periods: April – September and October – March. This report covers 

PCLO activities from October 1, 2019 through March 31, 2020. 

2. Privacy Reviews 

Treasury reviews programs and information technology (IT) systems that may present privacy 

risks. Privacy and civil liberties reviews include the following Treasury activities: 

a)	 Privacy and Civil Liberties Threshold Analyses, which are the Treasury mechanism for 

reviewing IT systems, programs, and other activities for privacy protection issues to 

determine whether a more comprehensive Privacy and Civil Liberties Impact 

Assessment is required; 

b) Privacy and Civil Liberties Impact Assessments as required by the E-Government Act 

of 2002;2 

c) System of Records Notices, as required by the Privacy Act, and any associated Final 

Rules for Privacy Act exemptions;3 

d) Privacy Act Statements, as required by the Privacy Act,4 to provide notice to 

individuals at the point of collection; 

e) Computer Matching Agreements, as required by the Privacy Act;5 

f) Data Mining Reports, as required by Section 804 of the 9/11 Commission Act of 

2007;

6
 

g) Privacy Compliance Reviews;
 

2 44 U.S.C. § 3501 note.
 3 5 U.S.C. §§ 552a(j), (k). See also Office of Management and Budget (OMB) Circular No. A-108, “Federal
 

Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act,” 81 FR 94424 (Dec. 23,
 

2016).

4 5 U.S.C. § 552a(e)(3).
 5 5 U.S.C. § 552a(o)-(u).
 6 42 U.S.C. § 2000ee-3.
 

2 
 

 

 

 

 

h) Privacy reviews of IT and program budget requests, including Office of Management 

and Budget Exhibit 300s; and, 

i) Other privacy reviews, such as implementation reviews for information sharing 

agreements. 

3. Privacy and Civil Liberties Impact Assessments (PCLIA) 

The PCLIA process is one of Treasury’s key mechanisms to ensure that programs and 

technologies sustain, and do not erode, privacy protections. During the reporting period, 

Treasury published 86 new, updated, or renewed PCLIAs. All published Treasury PCLIAs are 

available on Treasury’s PCLIA website: 

https://www.treasury.gov/privacy/PIAs/Pages/default.aspx (links are also provided to bureau 

websites where additional PCLIAs are posted). One example of a new PCLIA is summarized 

below: 

On December 19, 2019, the Departmental Offices (DO) published a PCLIA for 

HRConnect, a Treasury-wide Human Resources system. The purpose of the 

HRConnect system is to support the human resources functions for the 

Department of the Treasury and other federal agencies that use HRConnect as part 

of a cross-services initiative to reduce federal government expenditures. 

HRConnect is the Treasury’s Government-wide Human Resources Line of 

Business Shared Services Center online personnel management system that 

provides managers, supervisors, employees, and personnel specialists with 

desktop access to personnel and payroll data. HRConnect consists of a general 

support system and a Major Application (also known as PaaS and SaaS); 

customized PeopleSoft HR software residing on the Oracle Cloud Infrastructure’s 

GovCloud Infrastructure as a Service Cloud Service Provider. 

The Office of Privacy, Transparency, and Records (PTR) worked closely with the 

bureau to address the accuracy and completeness of the HRConnect PCLIA as 

well as plain language requirements. 

4. System of Records Notices (SORN) 

During the reporting period, Treasury published or updated 21 SORNs. All Treasury SORNs, 

Notices of Proposed Rulemaking, and Final Rules for Privacy Act exemptions are available on 

Treasury’s SORN website, https://home.treasury.gov/footer/privacy-act/system-of-recordsnotices-sorns. Treasury has determined that the information contained in its systems of records 

is accurate, timely, relevant, complete, and necessary to maintain the proper performance of a 

documented agency function. Please consult the SORN website or the Federal Register for the 

full text of our SORNs. 

5. Computer Matching Programs (CMAs) 

Treasury participates in 56 re-established and 3 active computer matching programs that were 

3 
 

 

 

 

 

 

 

renewed in accordance with the Privacy Act of 1974, as amended. The computer matching 

provisions of the Privacy Act improve oversight of the disclosure of automated Privacy Act 

records in inter-agency information sharing arrangements known as matching programs. These 

provisions also protect the due process rights of individuals whose records are exchanged in such 

programs. To comply with the Act, as well as all relevant regulations and guidance, Treasury 

established a Data Integrity Board to review and approve matching agreements. All Treasury 

CMAs are available on Treasury’s CMA website, https://home.treasury.gov/footer/privacyact/computer-matching-programs. 

During the reporting period, the Data Integrity Board reviewed and approved 12-month renewals 

for certain CMAs. 

a)	 The Disclosure of Information to Federal, State and Local Agencies (IRS Project 066 ­

DIFSLA) CMA between the Internal Revenue Service (IRS) and 53 state 

agencies has been in effect since July 1, 2018 and was due to expire December 31, 

2019. This CMA is actually 53 separate CMAs memorialized in a single document in 

the Federal Register (see citation below). In support of the renewal of these CMAs, 

IRS and the 53 state agencies certified that the program was operated in compliance 

with the existing CMA. Pursuant to 5 U.S.C. § 552a(o)(2)(D), the Treasury Data 

Integrity Board agreed to renew the existing CMA with the 53 State agencies for a 12­

month period (January 1, 2020 through December 31, 2020). The CMA 

memorializing all 53 agreements is available at 83 FR 27082 (June 11, 2018). 

b)	 The CMA for IRS Project 692 – Medicare Part D, between IRS and the Social Security 

Administration (SSA), has been in effect since November 27, 2017. It was due to 

expire May 26, 2019. The Data Integrity Board approved a Renewal CMA, extending 

the effective date of the current CMA through May 26, 2020. The original agreement 

is available at 82 FR 49691 (10/26/2017). 

6. Privacy Compliance Reviews (PCRs) 

Treasury conducts PCRs to ensure that programs and technologies implement and maintain 

appropriate protections for personally identifiable information. The PCR is a collaborative effort 

that helps improve a program’s ability to comply with existing privacy requirements by 

identifying and remediating gaps in compliance documentation, including PCLIAs, SORNs, and 

formal agreements, such as memoranda of understanding and memoranda of agreement. Treasury 

conducts informal PCRs with its bureaus and offices when necessary. Informal PCRs are also 

sometimes done as part of other requirements, such as the Privacy Impact Assessment (Treasury 

PCLIAs) requirement and reviews of particular issues required in external reports to Congress. 

For example, in preparing the social security number (SSN) Fraud Prevention Act Report each 

year, Treasury reviews the existing circumstances under which Treasury bureaus and offices 

include SSNs in mailings outside the Department to ensure that the Treasury bases for permitting 

the mailing of SSNs are still valid. Treasury policy only allows the collection, maintenance, and 

use of SSNs under the following circumstances: (1) security background investigations; (2) 

interfaces with external entities that require the SSN; (3) a legal/statutory basis (i.e., where 

collection is expressly required by statute); (4) when there is no reasonable, alternative means for 

4 
 

meeting business requirements; (5) statistical and other research purposes; (6) delivery of 

government benefits, privileges, and services; (7) law enforcement and intelligence purposes; and 

(8) aging systems with technological limitations combined with funding limitations render 

impossible system updates or modifications to add privacy risk reduction tools 

(partial/truncated/redacted or masked SSNs). In the absence of a compelling argument to the 

contrary, no other SSN uses are allowed. Treasury remains focused on eliminating the use of 

SSNs whenever possible and safeguarding SSNs that must be collected and maintained because 

no reasonable alternative exists. In preparation for the 2019 report (submitted to Congress in 

October of 2019) Treasury determined that the eight bases for using SSNs in external mailings 

remain valid. 

7. Advice and Responses 

Treasury provides privacy and civil liberties advice to its bureaus and offices throughout the year. 

Some of this advice originates from ad hoc responses PTR provides to bureaus and offices on a 

daily basis. Other advice originates from discussions within Treasury bureaus between the 

bureaus’ privacy and civil liberties stakeholders (including legal counsel, as necessary) and 

systems owners, program managers and staff. 

PTR and the bureau privacy and civil liberties stakeholders also provide advice during the PCLIA 

process, advising system owners and program managers on Privacy Act, records management, 

Paperwork Reduction Act and other requirements to ensure they fully comply with applicable law 

in the operation of their information systems. 

8. Privacy Complaints and Dispositions 

For purposes of Section 803 reporting, complaints are written allegations of harm or violation of 

privacy compliance requirements filed with Treasury’s privacy and civil liberties programs. The 

categories of complaints are reflected in Appendix A below. 

9. Conclusions 

As required by the 9/11 Commission Act, and in accordance with the Intelligence Authorization 

Act for Fiscal Year 2014, this semiannual report summarizes Treasury’s privacy activities from 

October 1, 2019 through March 31, 2020. Treasury will continue to work with Congress, 

colleagues in other federal departments and agencies, and the public to continue to protect 

privacy in all of our activities. 

5 
 

 

 

 

 

 

 

 

 

 

 

Appendix A: Department of the Treasury
 

Semiannual Report on Privacy and Civil Liberties Activities
 

Under Section 803 of the 9/11 Commission Act of 2007
 

October 1, 2019 through March 31, 2020
 

Reviews 

Type Number 

Privacy (and Civil 

Liberties) 

Threshold Analysis 

(PTAs/PCLTAs) 

49 

Privacy (and Civil 

Liberties) Impact 

Assessments 

(PIAs/PCLIAs) 

86 

System of Records 

(SOR) Routine 

Use/ SOR Notices 

(SORNs) 

21 

Computer 

Matching 

Agreements 

(CMAs) 

2 

Advice and Response 

Type Number Response 

Provide advice and 

recommendation 

regarding proper 

handling of 

PII/limiting access 

based on need to 

know 

40 Accepted 

Provide advice 

and/or 

recommendation 

on relevance and 

necessity of data 

collection/ingestio 

n 

10 Accepted 

Provided guidance 

to system owners 

or personnel on 

necessary privacy 

compliance 

documentation or 

appropriate NIST 

risk rating. 

11 Accepted 

Provide advice and 

recommendation 

on 

internal/external 

sharing of PII 

(including Privacy 

Act info) 

6 Accepted 

Provide advice and 

recommendation 

on web privacy 

policies/privacy 

notices 

2 Accepted 

Complaints 

Type of claim 

or assertion in 

complaint 

PRIVACY: 

Unauthorized 

disclosure 

(internal/ 

external) 

Number of 

complaints Disposition 

Internal: 0 

External: 0 

NA 

PRIVACY: 

Collection External: 1 

Complaint was 

regarding collection 

of last-4 of SSN for 

gambling deposits. 

IRS explained to 

complainant that it is 

a legal requirement 

and not up to the IRS. 

PRIVACY: 

(Other: 

Describe) 

0 NA 

CIVIL LIBERTIES: 

Violation 1st, 

4th, 5th, 6th, 14th 

and/or 16th 

Amendment 

rights 

32 

24 – Pending final 

decision 

8 – Resolved in favor 

of the Government 

CIVIL LIBERTIES: 

(Other: 

Describe) 

0 NA 

6