The Department of the Treasury

FY 2012 Q4 Report on Privacy and Civil 

Liberties Activities Pursuant to Section 803 

of the Implementing Recommendations of 

the 9/11 Commission Act of 2007

For the reporting period 

June 1, 2012 to August 31, 2012

1. Introduction

The Treasury Department is committed to protecting the privacy and civil liberties of 

individuals in all Treasury programs. In recognition of the threat to individual privacy 

resulting from the global expansion of information technology (IT), the Department is 

determined to continue its vigilant oversight of the personally identifiable information (PII)

entrusted to its care. 

2. Department Actions

The Department completed its mandatory Culture of Privacy Awareness training for FY 

2012. Ninety-seven percent of employees completed the training by the June 30, 2012, due 

date. The course was available to Treasury employees via the Treasury Learning 

Management System (TLMS) and on its intranet site. In addition, a stand-alone executivelevel PowerPoint version was available for senior leadership within the Department and 

proved to be a valuable mechanism for reaching that segment of the employee population.

The Office of Privacy and Civil Liberties (OPCL) has been working with privacy colleagues 

in the Internal Revenue Service (IRS) and other bureaus to reduce the number of personally 

identifiable information (PII) incidents involving unencrypted media and data. The 

percentage of electronic media and cyber losses where encryption was available and used has 

increased over the past year, substantially mitigating the risk of PII breaches. OPCL will 

continue to work with all bureaus to reduce the number of PII-related incidents overall and to 

institutionalize the use of technologies such as encryption and password protection where 

possible.

Treasury has also become an active participant in the working groups that are addressing 

implementation issues related to EINSTEIN 3, Accelerated (E3A). On August 9, 2012, the 

Office of Privacy, Transparency, and Records (OPTR) participated in a meeting to discuss 

the E3A Memorandum of Agreement among departments and agencies. The objective of the 

meeting was to provide a technical overview of E3A, communicate common themes 
2

identified by the participating agencies, and introduce a process to facilitate the coordination 

and communication between the Department of Homeland Security (DHS) and the agencies 

regarding EINSTEIN’s capabilities. EINSTEIN capabilities are part of the DHS National 

Cyber Security Protection System (NCPS) used to protect all Executive Branch civilian 

agencies.

On July 19, 2012, the Deputy Assistant Secretary for Privacy, Transparency, and Records

convened a meeting of the Treasury Information Privacy Council/Committee. Among the 

items discussed during the meeting were the implementation of E3A, the successful 

completion of Treasury’s annual privacy awareness training, and the activation of the 

Department’s SharePoint Portal. 

The new portal provides employees at every level with a robust tool for managing significant 

quantities of content and making that content more readily available across the agency. 

Since the implementation began, there have been a number of significant enhancements to 

the portal including a blog space, easier access to human resource-related topics, and featured 

videos. 

OPTR is in the process of developing an electronic system to manage its Privacy Impact 

Assessment (PIA) process. This effort is modeled on a similar IRS effort to build its PIA 

Management System. This endeavor represents a significant improvement in the way PIAs 

will be drafted, reviewed, and approved across the Department. 

Treasury also continues its active involvement in the Information Sharing Environment 

(ISE). The Director of OPCL continues to serve as the chairperson of the ISE’s Privacy and 

Civil Liberties Subcommittee’s Compliance Review Working Group (CRWG). As

chairperson, the Director of OPCL is guiding the development of a privacy and civil liberties 

checklist for implementing ISE privacy guidelines. Treasury’s Office of Intelligence and 

Analysis (OIA) is currently conducting a pilot program for implementing a proposed 

ISE/CRWG privacy and civil liberties compliance review checklist that may eventually be 

used by all federal agencies participating in the ISE. This checklist is intended to serve as a 

compilation of the privacy and civil liberties requirements and best practices derived from 

the Privacy Guidelines for the Information Sharing Environment. 

OPTR participates in the Intelligence Community (IC) Chief Privacy and Civil Liberties

Officer’s Focal Points Group. This group meets on a quarterly basis to discuss privacy and 

civil liberties issues in the intelligence community and develop guidance for IC elements to 

address those issues.

Finally, in the fourth quarter, the IRS achieved two very significant milestones that further 

enhance its already strong privacy program. First, on July 9, 2012, the Office of Identity 

Protection released the revised Internal Revenue Manual (IRM) 10.5.3, Identity Protection 

Program. This manual will standardize the IRS’ service-wide identity theft policies and 

procedures and further strengthen the Service’s emphasis on privacy protection. Next, the 

office of Privacy, Governmental Liaison, and Disclosure (PGLD), in concert with Criminal 

Investigation (CI) Refund Crimes, CI Field Operations, and the Wage and Investment (W&I) 
3

Pre-Refund Program, all established reciprocal information sharing opportunities and 

cooperative compliance efforts between the IRS and two states. A Memorandum of 

Understanding (MOU) was finalized with Delaware and data is currently being shared 

between IRS and Delaware.

3. Quarterly Reporting Matrix

The Department uses a standard reporting framework and instructions tailored to its mission 

and functions to address Section 803 reporting requirements. In developing the framework 

and instructions, the Department collaborated with the Office of Management and Budget 

(OMB) and the other agencies required to report under this section. 

The attached reporting matrix consolidates all Treasury privacy and civil liberties activities, 

including data on the reviews conducted, reference to the advisory guidance delivered, and 

information about written complaints received and processed.

3.1. Types of Potential Complaints

3.1.1. Privacy Complaint: A privacy complaint is a written allegation of harm or 

violation of personal or information privacy filed with the Department. This 

information may include: 

 Process and procedural issues, such as consent, collection, and appropriate notice; 

 Non-Privacy Act of 1974 issues, such as Terrorist Watchlist Redress processing

or identity theft mitigation; or 

 Privacy Act of 1974 issues.

3.1.2 Civil Liberties Complaint: A written allegation of harm or violation of the 

constitutional rights afforded individuals filed with the Department. Types of 

civil liberties complaints include, but are not limited to:

 First Amendment (Freedom of speech, religion, assembly, and association);

 Fourth Amendment (Protection against unreasonable search and seizure); and

 Fifth Amendment or Fourteenth Amendment, § 1 (Due process and equal 

protection).

4. Reporting Categories

 4.1. Reviews: Reviews include Treasury privacy and civil liberties activities delineated by

controlling authorities, such as the Privacy Act of 1974, 5 U.S.C. § 552a; E-Government Act 

of 2002 (P.L. 107-347); Consolidated Appropriations Act of 2005 (P.L. 108-447); OMB

Circular A-130, Appendix 1; and OMB Memo M-07-16. Examples include:

 Privacy Threshold Analyses – review of an IT system’s use of data to determine 

whether a PIA is required;

 PIAs;
4

 OMB Memorandum 07-16 issues, including reviewing records to minimize the 

volume of PII necessary for the proper performance of an agency function, SSN

use reduction efforts, or initiatives related to combating identity theft;

 OMB Circular A-130 issues, including SORNs, routine use descriptions, Agency 

security contacts, recordkeeping and disposal policies, training practices, 

continued Privacy Act exemptions under 5 U.S.C §552a (j)(2), (k), and Computer 

Matching Programs;

 Persistent Tracking Technology features used on a website;

 Achievement of machine readability, which ensures that website users are 

automatically alerted about whether site privacy practices match their personal 

privacy preferences;

 Reviews under 5 CFR part 1320 (collection of information/Paperwork Reduction 

Act);

 Information Sharing Environment policies and system reviews; and 

 Reviews related to the OMB Circular A-11, Exhibit 300 process.

 4.2. Advice: Advice includes written policies, procedures, guidance, or interpretations of 

requirements for circumstances or business processes that respond to privacy or civil liberties 

issues or concerns. 

4.3. Response to Advice: Specific action taken in response to Treasury Advice. Examples 

of Responses to Advice include issuing a regulation, order, or directive; interpreting or 

otherwise issuing guidance as a result of Advice; reaching an agreement related to the 

Advice; and developing training programs or other procedures that enhance understanding of 

the issue that precipitated the request for Advice.

4.4. Disposition of Complaints: Treasury action in response to a privacy or civil liberties 

complaint. In response to a complaint, the Department will:

1. Take direct action (description in the summary report);

2. Refer to another agency or entity that may be able to assist in addressing the 

complaint (referral agency and explanation in summary report); or

3. Determine that no action is required (explanation in summary report).

The Department will continue to submit quarterly reports in coordination with OMB. The 

next quarterly report is due December 31, 2012, and will cover the period of September 1, 

2012, through November 30, 2012. The data collection period for each report ends 

approximately 30 days prior to the report deadline.
Department of the Treasury 

Quarterly Report on Privacy and Civil Liberties Activities 

under Section 803 of the 9/11 Commission Act of 2007

August 31, 2012

Reviews Advice and Response Complaints Dispositions

Type Number Type Number Response Type Number

Systems of Records (SOR) 

Notices

4

A Bureau’s General Counsel 

Met With HR And Labor 

Relations Staff To Discuss 

Privacy Implications Of New 

Systems

1

Reviewed 

PIA and 

Provided 

Comments

PRIVACY 0

SOR Routine Use

3

Reviewed Draft PTAs For Two 

SharePoint Portals For Internal 

Use By Multiple Bureau Offices

2

Reviewed 

PTAs and 

Provided 

Comments

Elimination and Redaction of 

SSNs on IRS Forms 46

Privacy Impact Assessment 

(PIA) 21

Privacy Threshold Analysis 

(PTA) 21

5 CFR 1320, Information 

Collection

4

OMB Exhibit 300 Process

1

Records Management, Recordkeeping & Disposal Policies

1 CIVIL LIBERTIES 0

Section 508 Internet/Intranet 

Website Scan 2