Privacy and Civil Liberties Impact Assessment

for the

OFFICE OF FINANCIAL RESEARCH (“OFR”)

WEBSITE

June 29, 2016

Reviewing Official

Timothy H. Skinner 

Director of Privacy and Civil Liberties

Office of Privacy, Transparency, and Records

Department of the Treasury

Bureau Certifying Official

Wesley T. Fravel

Senior Information Security Specialist – Privacy

Office of Financial Research

Bureau Privacy and Civil Liberties Officer
3

Section 1.0: Introduction

It is the policy of the Department of the Treasury (Treasury” or “Department”) and its Bureaus to 

conduct a Privacy and Civil Liberties Impact Assessment (“PCLIA”) when Personally Identifiable 

Information (“PII”) is maintained in a system or by a project. PCLIAs are required for all systems and 

projects that collect, maintain, or disseminate PII, regardless of the manner in which the information is 

retrieved.

This assessment is being completed pursuant to Section 208 of the E-Government Act of 2002 (“EGov Act”), 44 U.S.C. § 3501, Office of Management and Budget (“OMB”) Memorandum 03-22,

“OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002,” and 

Treasury Directive 25-07, “Privacy and Civil Liberties Impact Assessment (PCLIA),” which require 

Treasury Offices and Bureaus to conduct a PCLIA before:

1. developing or procuring information technology (“IT”) systems or projects that collect, 

maintain, or disseminate PII from or about members of the public, or

2. initiating a new collection of information that: a) will be collected, maintained, or disseminated 

using IT; and b) includes any PII permitting the physical or online contacting of a specific 

individual, if identical questions have been posed to, or identical reporting requirements 

imposed on, 10 or more persons. Agencies, instrumentalities, or employees of the federal 

government are not included.

This PCLIA provides the following information regarding the system or project:

(1) an overview of its purpose and functions; 

(2) a description of the information collected; 

(3) a description of how the information is maintained, used, and shared;

(4) an assessment of whether the system or project is in compliance with federal requirements that 

support information privacy; and 

(5) an overview of the redress/complaint procedures available to individuals who may be affected 

by the use or sharing of information by the system or project. 

The OFR Website is a new system. This PCLIA is the first conducted for this system.

Section 2.0: Definitions

Agency – means any entity that falls within the definition of the term “executive agency”' as defined in 

31 U.S.C. § 102, or “agency”, as defined in 44 U.S.C. § 3502.

Certifying Official – The Bureau Privacy and Civil Liberties Officer(s) who certify that all 

requirements in TD and TD P 25-07 have been completed so a PCLIA can be reviewed and approved 

by the Treasury Deputy Assistant Secretary for Privacy, Transparency, and Records.

Collect (including “collection”) – means the retrieval, receipt, gathering, or acquisition of any PII and 

its storage or presence in a Treasury system. This term should be given its broadest possible meaning.
4

Contractors and Service Providers – include, but are not limited to, information providers, 

information processors, and other organizations providing information system development, 

information technology services, and other outsourced applications.

Data Mining – The term “data mining”' means a program involving pattern-based queries, searches, or 

other analysis of one or more electronic databases, where-- (A) a department or agency of the federal 

government, or a non-federal entity acting on behalf of the federal government, is conducting the 

queries, searches, or other analyses to discover or locate a predictive pattern or anomaly indicative of 

terrorist or criminal activity on the part of any individual or individuals; (B) the queries, searches, or 

other analyses are not subject-based and do not use personal identifiers of a specific individual, or 

inputs associated with a specific individual or group of individuals, to retrieve information from the 

database or databases; and (C) the purpose of the queries, searches, or other analyses is not solely-- (i)

the detection of fraud, waste, or abuse in a government agency or program; or (ii) the security of a 

government computer system.

Disclosure – When it is clear from its usage that the term “disclosure” refers to records provided to the 

public in response to a request under the Freedom of Information Act (5 U.S.C. § 552) or the Privacy 

Act, its application should be limited in that manner. Otherwise, the term should be interpreted as 

synonymous with the terms “sharing” and “dissemination” as defined in this manual.

Dissemination – as used in this manual, is synonymous with the terms “sharing” and “disclosure”

(unless it is clear from the context that the use of the term “disclosure” refers to a FOIA/Privacy Act 

disclosure).

E-Government – the use of digital technologies to transform government operations to improve 

effectiveness, efficiency, and service delivery.

Federal Information System – a discrete set of information resources organized for the collection, 

processing, maintenance, transmission, and dissemination of information owned or under the control of 

a federal agency, whether automated or manual.

Final Rule – After the NPRM comment period closes, the agency reviews and analyzes the comments 

received (if any). The agency has the option to proceed with the rulemaking as proposed, issue a new 

or modified proposal or withdraw the proposal before reaching its final decision. The agency can also 

make any revisions to the supporting analyses contained in the NPRM (e.g., to address a concern 

raised by a member of the public in response to the NPRM).

Government information – information created, collected, used, maintained, processed, 

disseminated, or disposed of by or for the federal government.

Individual – means a citizen of the United States or an alien lawfully admitted for permanent 

residence. If a question does not specifically inquire about or an issue does not clearly involve a 

Privacy Act system of records, the term should be given its common, everyday meaning. In certain 

contexts, the term individual may also include citizens of other countries who are covered by the terms 

of an international or other agreement that involves information stored in the system or used by the 

project.
5

Information – means any representation of knowledge such as facts, data, or opinions in any medium 

or form, regardless of its physical form or characteristics. This term should be given the broadest 

possible meaning. This term includes, but is not limit to, information contained in a Privacy Act 

system of records.

Information technology (“IT”) – any equipment or interconnected system or subsystem of 

equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management,

movement, control, display, switching, interchange, transmission, or reception of data or information 

by the executive agency, if the equipment is used by the executive agency directly or is used by a 

contractor under a contract with the executive agency that requires the use: (i) of that equipment; or (ii) 

of that equipment to a significant extent in the performance of a service or the furnishing of a product.

It includes computers, ancillary equipment (including imaging peripherals, input, output, and storage 

devices necessary for security and surveillance), peripheral equipment designed to be controlled by the 

central processing unit of a computer, software, firmware and similar procedures, services (including 

support services), and related resources; but does not include any equipment acquired by a federal 

contractor incidental to a federal contract.

Major Information system – embraces “large” and “sensitive” information systems and means “a 

system or project that requires special management attention because of its importance to an agency 

mission; its high development, operating, or maintenance costs; or its significant role in the 

administration of agency programs, finances, property, or other resources.” OMB Circular A-130, §

6.u. This definition includes all systems that contain PII and are rated as “MODERATE or HIGH 

impact” under Federal Information Processing Standard 199.

National Security systems – a telecommunications or information system operated by the federal 

government, the function, operation or use of which involves: (1) intelligence activities, (2) cryptologic 

activities related to national security, (3) command and control of military forces, (4) equipment that is 

an integral part of a weapon or weapons systems, or (5) systems critical to the direct fulfillment of 

military or intelligence missions, but does not include systems used for routine administrative and 

business applications, such as payroll, finance, logistics, and personnel management. 

Notice of Proposed Rule Making (“NPRM”) – the Privacy Act (Section (J) and (k)) allow agencies 

to use the rulemaking process to exempt particular systems of records from some of the requirements 

in the Act. This process is often, referred to as “notice-and-comment rulemaking.” The agency 

publishes an NPRM to notify the public that the agency is proposing a rule and provides an 

opportunity for the public to comment on the proposal before the agency can issue a final rule. 

Personally Identifiable Information (“PII”) – “means, any information that can be used to 

distinguish or trace an individual’s identity, either alone or when combined with other personal or 

identifying information that is linked or linkable to a specific individual. The definition of this term 

also incorporates by reference the definition of PII in OMB Memorandum 06-191 and the definition of 

1 “Any information about an individual maintained by an agency, including, but not limited to, 

education, financial transactions, medical history, and criminal or employment history and 

information which can be used to distinguish or trace an individual’s identity, such as their 

name, social security number, date and place of birth, mother’s maiden name, biometric 
6

term “Information in Identifiable Form” as defined in § 208(d)2 of the E-Government Act of 2002, 

Pub. L.107-347, 116 Stat. 2899 and as further defined in OMB M 03-22.

3

Privacy and Civil Liberties Impact Assessment (“PCLIA”) – a PCLIA is:

(1) a process conducted to: (a) identify privacy and civil liberties risks in systems, programs 

and other activities that maintain PII; (b) ensure that information systems, programs and 

other activities comply with legal, regulatory, and policy requirements; (c) analyze the 

privacy and civil liberties risks identified; (d) identify remedies, protections and alternative 

or additional privacy controls necessary to mitigate those risks; and (e) provide notice to the 

public of privacy and civil liberties protection practices.

(2) a document that catalogues the outcome of that privacy and civil liberties risk assessment 

process.

Protected Information – as the term is used in this PCLIA, has the same definition given to that term 

in TD 25-10, Section 4.

Privacy Act Record – any item, collection, or grouping of information about an individual that is 

maintained by an agency, including, but not limited to, the individual’s education, financial 

transactions, medical history, and criminal or employment history and that contains the individual’s 

name, or the identifying number, symbol, or other identifying particular assigned to the individual, 

such as a finger or voice print or a photograph.

Reviewing Official – The Deputy Assistant Secretary for Privacy, Transparency, and Records who 

reviews and approves all PCLIAs as part of her duties as a direct report to the Treasury Senior Agency 

Official for Privacy.

Routine Use – with respect to the disclosure of a record outside of the Department of the Treasury 

(i.e., external sharing), the use of such record for a purpose which is compatible with the purpose for 

which it was collected.

Sharing – any Treasury initiated distribution of information to government employees or agency 

contractors or grantees, including intra- or inter-agency transfers or exchanges of Treasury information 

records, etc., including any other personal information which is linked or linkable to an 

individual.”

2 “Any representation of information that permits the identity of an individual to whom the 

information applies to be reasonably inferred by either direct or indirect means.”

3 “Information in an IT system or online collection: (i) that directly identifies an individual 

(e.g., name, address, social security number or other identifying number or code, telephone 

number, email address) or (ii) by which an agency intends to identify specific individuals in 

conjunction with other data elements, i.e., indirect identification. (These data elements may 

include a combination of gender, race, birth date, geographic indicator, and other 

descriptors.)”
7

regardless of whether it is covered by the Privacy Act. It does not include responses to requests for 

agency records under the Freedom of Information Act (”FOIA”) or the Privacy Act. It is synonymous 

with the term “dissemination” as used in this assessment. It is also synonymous with the term 

“disclosure” as used in this assessment unless it is clear from the context in which the term is used that 

it refers to disclosure to the public in response to a request for agency records under the Freedom of 

Information Act or the Privacy Act.

System – as the term used in this manual, includes both federal information systems and information 

technology.

System of Records – a group of any records (as defined in the Privacy Act) under the control of 

Treasury from which information is retrieved by the name of the individual or by some identifying 

number, symbol, or other identifying particular assigned to the individual.

System of Records Notice – Each agency that maintains a system of records shall publish in the 

Federal Register upon establishment or revision a notice of the existence and character of the system 

of records, which notice shall include: (A) the name and location of the system; (B) the categories of 

individuals on whom records are maintained in the system; (C) the categories of records maintained in 

the system; (D) each routine use of the records contained in the system, including the categories of 

users and the purpose of such use; (E) the policies and practices of the agency regarding storage, 

retrievability, access controls, retention, and disposal of the records; (F) the title and business address 

of the agency official who is responsible for the system of records; (G) the agency procedures whereby 

an individual can be notified at his request if the system of records contains a record pertaining to him; 

(H) the agency procedures whereby an individual can be notified at his request how he can gain access 

to any record pertaining to him contained in the system of records, and how he can contest its content; 

and (I) the categories of sources of records in the system.

System Owner – Official responsible for the overall procurement, development, integration, 

modification, or operation and maintenance of a system.

Section 3.0: System Overview

Section 3.1: System/Project Description

The purpose of the OFR website (“Website”) is to provide information to the public about the OFR’s mission, 

goals, and work products, and to serve as a communication and engagement platform for parties interested in 

learning about the OFR and its projects. It supports the mission of the Department by promoting transparency, 

accountability, and engagement with the public about the OFR and Treasury missions.

For the purposes of this document the term “Website” refers to the following collection of technologies and 

services4

:

1) Financialresearch.gov – The cloud-hosted environment on which OFR’s public facing website resides;

4 While the OFR’s website also contains an External Presence Platform (EPP), the hosted cloud environment that expands 

the capabilities of the Website to support interactive monitors, research collaboration sites, reference databases, and data 

sharing-related applications, OFR has chosen to address this functionality in a separate PCLIA because of the unique 

privacy considerations of the system and to enhance transparency.

9

Section 4.0: Information Collection

Section 4.1: Relevant and Necessary

The Privacy Act requires “each agency that maintains a system of records [to] maintain in its records

only such information about an individual as is relevant and necessary to accomplish a purpose of the 

agency required to be fulfilled by statute or by executive order of the President.” 5 U.S.C. § 552a(e)(1).

The Privacy Act allows federal agencies to exempt records from the relevant and necessary

requirement if certain conditions are met. This includes issuing a Notice of Proposed Rulemaking

(“NPRM”) to solicit public opinions on thhe proposed exemption and issuing a Final Rule after 

addressing any concerns raised by the public in response to the NPRM. It is possible for some, but not 

all, of the records maintained in the system or by the project to be exempted from the Privacy Act

through the NPRM/Final Rule process.

Section 4.1(a) Please check all of the following that are true:

1. ܆ None of the PII maintained in the system or by the project is part of a Privacy Act 

system of records;

2. ܆ All of the PII maintained in the system or by the project is part of a system of records

and none of it is exempt from the Privacy Act relevant and necessary requirement;

3. ܆ All of the PII maintained in the system or by the project is part of a system of records

and all of it is exempt from the Privacy Act relevant and necessary requirement;

4. ܆ Some, but not all, of the PII maintained in the system or by the project is part of a

system of records and the records to which the Privacy Act applies are exempt from the 

relevant and necessary requirement; and

5. ܈ Some, but not all, of the PII maintained in the system or by the project is part of a

system of records and none of the records to which the Privacy Act applies are exempt 

from the relevant and necessary requirement.

Section 4.1(b) ܈ Yes ܆ No ܆ N/A With respect to PII maintained in the system or by the 

project that is subject to the Privacy Act’s relevant and necessary requirement, was an 

assessment conducted prior to collection (e.g., during Paperwork Reduction Act analysis) to 

determine which PII types (see Section 4.2 below) were relevant and necessary to meet the 

system’s or project’s mission requirements? 

Section 4.1(c) ܈ Yes ܆ No ܆ N/A With respect to PII maintained in the system or by the

project that is subject to the Privacy Act’s relevant and necessary requirement, is the PII

limited to only that which is relevant and necessary to meet the system’s or project’s mission 

requirements?

Section 4.1(d) ܈ Yes ܆ No With respect to PII maintained in the system or by the project

that is subject to the Privacy Act’s relevant and necessary requirement, is there a process to 

continuously reevaluate and ensure that the PII remains relevant and necessary? 

Explanation for Answers in Sections 4.1(a) thru 4.1(d): Information processed by the Website that 

is subject to the Privacy Act is not exempt from the relevant and necessary requirements of the Privacy 

Act.

Information subject to the Privacy Act is limited to:
10

x Information necessary to administer the Website. This information is generally collected 

directly from OFR employees or contractors, or is provided by Treasury’s HRConnect system.

x Information about OFR employees which appears in biographies or work products on the 

Website, and is generally collected directly from OFR employees. 

Each of these are discussed in more detail below.

For data collected to grant OFR employees, contractors, and authorized users access and permissions to 

administer the Website, such information is governed in accordance with the Treasury System of 

Records Notice, Treasury.015 – General Information Technology Access Account Records 

(GITAARS). This information is limited to that which is necessary to grant access to and use of OFR 

information technology resources. OFR regularly reviews its user access processes and collections of 

PII to ensure the appropriate information is captured to ensure access to and security of OFR systems. 

For biographical information such as the names, titles, email addresses, or information about the

educational and professional qualifications of OFR personnel included in biographies on the Website,

such information is collected directly from OFR employees to whom the biographies pertain. In 

general, such information is duplicative of information contained in Treasury’s HRConnect System 

and is accounted for in the Treasury System of Records Notice, Treasury .001 – Treasury Payroll and 

Personnel System and OPM/GOVT-1, General Personnel Records. Information is limited to that 

which is provided by the subject of the biography, or to what is necessary to facilitate communication 

with the public (title, email).

Additionally, some PII which is subject to the Privacy Act may appear in OFR work products posted to 

the Website – including biographical information about OFR employees and others who author such 

work products. As is the case with biographies, all such information or PII is voluntarily provided by 

the individual and limited to information that is necessary and relevant given the nature of the work 

product, or to facilitate communication. Individuals are either advised prior to the actual collection of 

the biographical information, or are advised based on the nature of their work responsibilities that such 

information may be made public and posted to the Website. As outlined above, this information 

duplicates information contained in existing personnel records subject to the Privacy Act, or, in the 

case of non-OFR personnel, is covered by the Treasury System of Records Notice, Treasury.017 –

Correspondence and Contact Information. Please see Section 6.1(b) for a further discussion of the 

related Systems of Records for this information.

Information that is necessary to sign up to receive OFR email updates based on an individual’s needs 

and interests, and to manage those email subscription preferences (GovDelivery) is not subject to the 

Privacy Act since the OFR does not retrieve such information by personal identifier. That said, the 

OFR reviewed the data elements proposed for managing email subscriptions and determined that only 

an email address was necessary to facilitate email subscriptions – other data elements proposed for 

collection, such as a name, were eliminated. Website visitors who sign up for email alerts also have the 

option of creating an account password to protect their subscription preferences; however the collection 

of this information is not required and is only for use by individuals in managing their subscription 

preferences. Exhibit F, High-Level Overview of OFR Email Subscription Management through 

GovDelivery, discusses OFR’s use of this service in more detail.

A complete list of PII collected or processed by the Website, including that subject to the Privacy Act,

can be found in Section 5.1 of this PCLIA.

The OFR will review the collection of all information processed by the Website in conjunction with 

reviews of this PCLIA to ensure all PII collected remains relevant and necessary going forward.




15

search box that appears 

on the website.

General correspondence 

received via email 

through the “Contact 

Us” function on the 

website. In some cases, 

this may include 

limited PII such as 

name of the individual 

submitting the 

correspondence.

Manner in which 

information is 

acquired from source 

by the Treasury 

project/system: (select 

all that apply):

Manner in which 

information is acquired 

from source by the Treasury 

project/system: (select all 

that apply):

Manner in which 

information is acquired 

from source by the Treasury 

project/system: (select all 

that apply):

Manner in which 

information is acquired 

from source by the Treasury 

project/system: (select all

that apply):

܆ From a paper or 

electronic form 

provided to individuals, 

the public or members 

of a particular group

Please identify the form 

name (or description) 

and/or number (e.g., 

OMB Control 

Number): 

____________ 

܆ From a paper or electronic 

form provided to individuals, 

the public or members of a 

particular group

Please identify the form name 

(or description) and/or 

number (e.g., OMB Control 

Number): 

_________________

܆ From a paper or electronic 

form provided to individuals, 

the public or members of a 

particular group

Please identify the form name 

(or description) and/or 

number (e.g., OMB Control 

Number): 

_________________

܆ From a paper or electronic 

form provided to individuals, 

the public or members of a 

particular group

Please identify the form name 

(or description) and/or 

number (e.g., OMB Control 

Number): 

_________________

܆ Received in paper 

format other than a 

form.

܆ Received in paper format 

other than a form.

܆ Received in paper format 

other than a form.

܈ Received in paper format 

other than a form.

܆ Delivered to the 

project on disk or other 

portable device and 

uploaded to the system.

܆ Delivered to the project on 

disk or other portable device 

and uploaded to the system.

܆ Delivered to the project on 

disk or other portable device 

and uploaded to the system.

܆ Delivered to the project on 

disk or other portable device 

and uploaded to the system.

܈ Accessed and 

downloaded or 

otherwise acquired via 

the internet (Through 

the OFR’s use of 

GovDelivery service)

܆ Accessed and downloaded 

or otherwise acquired via the 

internet

܆ Accessed and downloaded 

or otherwise acquired via the 

internet

܆ Accessed and downloaded 

or otherwise acquired via the 

internet

܈ Email (Through the 

OFR’s “Contact Us” 

email function.)

 Email ܆ Email ܆ Email ܆

܆ Scanned documents 

uploaded to the system.

܆ Scanned documents 

uploaded to the system.

܆ Scanned documents 

uploaded to the system.

܈ Scanned documents 

uploaded to the system.

܆ Bulk transfer ܆ Bulk transfer ܆ Bulk transfer ܆ Bulk transfer

܆ Extracted from ܆ Extracted from particular ܆ Extracted from particular ܆ Extracted from particular 

17

When federal agencies use a form to obtain information from an individual that will be maintained in a 

system of records, they must inform the individual of the following: “(A) the authority (whether 

granted by statute, or by executive order of the President) which authorizes the solicitation of the 

information and whether disclosure of such information is mandatory or voluntary; (B) the principal 

purpose or purposes for which the information is intended to be used; (C) the routine uses which may 

be made of the information as published pursuant to paragraph (4)(D) of this subsection; and (D) the 

effects on him, if any, of not providing all or any part of the requested information.” 5 U.S.C. §

522a(e)(3).

Section 4.4(a) ܈ Yes ܆ No Is any of the PII maintained in the system or by the project 

collected directly from an individual? 

Section 4.4(b) ܆ Yes ܈ No ܆ N/A Was the information collected from the individual using 

a form (paper or electronic)?

Section 4.4(c) ց Yes տ No տ N/A Was the individual notified (e.g., on the form in which 

the PII was collected or on a separate form that can be retained by the individual, in a website 

policy) about the following at the point where the information was collected (e.g., in a form or

on a website).

܈ The authority (whether granted by statute, or by Executive order of the President) 

which authorizes the solicitation of the information.

܈ Whether disclosure of such information is mandatory or voluntary.

܈ The principal purpose or purposes for which the information is intended to be used.

܈ The individuals or organizations outside of Treasury with whom the information 

may be/ will be shared.

܈ The effects on the individual, if any, if they decide not to provide all or any part of 

the requested information.


20

The Website collects:

1) Information through the OFR’s use of GovDelivery for email subscriptions:

 Email addresses of individuals who elect to receive email communications from the OFR 

through the Website.

 User subscription preferences (users may request emails targeted to their specific interests).

Username and password combination for the user to protect their subscription preferences

(optional).

 GovDelivery administrator account usernames and passwords for authorized access by 

designated Treasury Website support personnel to provided email addresses and 

subscription preferences to facilitate distribution of requested email notifications.

2) Information automatically collected by GovDelivery for security purposes and to allow visitors to 

communicate with the Website:

 IP address.

 Pages accessed and pages requested.

 Time and date of visit/access.

3) Email addresses and general correspondence of individuals who use the Website’s “Contact Us” or 

similar functions. Such correspondence may include unsolicited PII, such as a name of the 

individual submitting the correspondence.

4) Information about OFR employees, including name and position with OFR assigned to manage

correspondence received via email through the Website’s “Contact Us” function.

5) Information about OFR employees and contractors used to grant access to and permissions 

associated with non-public portions of the Website for the purpose of managing the site and its 

content.

6) Information about OFR employees involved in research or in leadership positions in the form of 

biographies to include:

 Name

 Title

 Business email address 

 Areas of research interest

 Limited educational or employment background as provided by the researcher 

or OFR official in their biography.

7) Automatically collected log information about Website use that is used to secure the site and 

enhance usability, including de-identified information collected through the OFR’s use of GSA 

Digital Analytics (Google Analytics) on the Website:

 Internet domain of the visitor.

 IP address of the visitor (anonymized)

 Browser used by the visitor to access the Website.

 Date and time of access, page(s) visited, and length of visit.

 Search terms entered in the “Bing” search box which appears on the Website.

Additionally, the Website may share publicly available information in the form of OFR white papers, 

studies, press releases, public meeting agendas, policy statements, and non-proprietary, nonconfidential data sets. While these products do not generally contain PII, there are instances in which 

some PII may be included, such as names and positions, educational or related biographical 

information about employees of the OFR or Treasury (who serve as authors, public representatives, 















36

request access to and/or amendment of their information and/or contest adverse 

determinations about denial of their rights, benefits, and privileges under federal programs 

(e.g., decisions about whether the individual will receive a financial benefit, get a clearance or 

access to a Treasury facility, or obtain employment with Treasury)? 

Explanation for Answer in Section 7.0(c): The OFR relies on individuals to provide their data 

voluntarily by signing up to receive OFR email, by using the “Contact Us” function on the Website, by

their general use of the Website, or as part of their responsibilities related to employment or association 

with the OFR (in developing work product, etc.). Individuals are provided information about how 

information collected through the Website will be used through the OFR Website Privacy Policy and

this PCLIA, and they are provided contact information for any questions they may have about their 

data. Additionally, the OFR provides a means by which individuals can update their information in the 

system to ensure its currency and accuracy. Individuals who have elected to receive email 

communications from the OFR may update their address or subscription preferences at any time 

through GovDelivery and may request to be unsubscribed from OFR email communications by 

accessing a link that is provided in messages that are distributed by the OFR. Individuals who use the 

“Contact Us” function may use that same function to supply a new email address or update their 

original correspondence. OFR researchers and senior staff who have their biographies published on the 

Website may update this information at any time via internal OFR procedures and participation is 

voluntary.

Finally, it is important to note that PII collected through the Website is not used to make 

determinations about an individual’s rights, benefits, or privileges under federal programs. This 

greatly reduces the likelihood that redress would be necessary.
38

Responsible Officials

Mark Thomas

Associate Director, Application and Decision 

Support

Office of Financial Research

U.S. Department of the Treasury

John Talbot

Chief Technology Officer

Office of Financial Research

U.S. Department of the Treasury

Earl Matteson

Associate Director, Information Security

(Acting)

Office of Financial Research 

U.S. Department of the Treasury

Timothy H. Skinner 

Director of Privacy and Civil Liberties,

Office of Privacy, Transparency, and 

Records

U.S. Department of the Treasury

Approval Signature

______________________ _______

John Talbot

Chief Technology Officer

Office of Financial Research

U.S. Department of the Treasury

_____________________ _________

Mark Thomas

Associate Director, Application and 

Decision Support

Office of Financial Research

U.S. Department of the Treasury

________________________________

Earl Matteson

Associate Director, Information Security

(Acting)

Office of Financial Research 

U.S. Department of the Treasury

________________________________

Timothy H. Skinner 

Director of Privacy and Civil Liberties,

Office of Privacy, Transparency, and 

Records

U.S. Department of the Treasury

Timothy Skinner Digitally signed by Timothy Sk nner 

DN: c=US o=U S Government ou=Department of 

the Treasury ou=Departmental Offices ou=People 

serialNumber cn=Timothy Skinner Mark R. Thomas Date: 2016 06 30 07:06:08 04'00'

Digitally signed by Mark R. Thomas 

DN: c=US, o=U.S. Government, ou=Department of 

the Treasury, ou=Departmental Offices, ou=People,

serialNumber= cn=Mark R. Thomas 

Date: 2016.07.25 10:58:03 -04'00'

Earl L. 

Matteson II

Digitally signed by Earl L. Matteson II 

DN: c=US, o=U.S. Government,

ou=Department of the Treasury,

ou=Departmental Offices, ou=People,

serialNumber= cn=Earl L. 

Matteson II 

Date: 2016.07.25 11:44:00 -04'00' John R. 

Talbot

Digitally signed by John R. Talbot 

DN: c=US, o=U.S. Government,

ou=Department of the Treasury,

ou=Departmental Offices, ou=People,

serialNumber= cn=John R. Talbot 

Date: 2016.07.25 12:10:45 -04'00'