The Department of the Treasury

Quarterly Report on Privacy and Civil 

Liberties Activities Pursuant to Section 803 

of the Implementing Recommendations of 

the 9/11 Commission Act of 2007

December 1, 2011 – February 29, 2012

1. Introduction

The Treasury Department is committed to protecting the privacy and civil liberties of 

individuals in all Treasury programs. In recognition of the threat to individual privacy 

resulting from the global expansion of information technology (IT), the Department is 

determined to continue its vigilant oversight of the personally identifiable information (PII)

entrusted to our care. 

2. Department Actions

There have been a number of significant accomplishments during the second quarter of FY 

2012. One of the more noteworthy achievements was the completion of a functional 

realignment within the Office of Privacy, Transparency, and Records (OPTR). With the 

approval of Assistant Secretary for Management (ASM), the forms management, information 

collections, and computer matching agreement request processes were transferred from the 

Office of the Chief Information Office (OCIO) to OPTR. As a result of this action, Treasury 

has enhanced its ability to comply with the Administration’s mandate to provide for openness 

and transparency in the performance of its mission and functions, and to manage the 

protection of information privacy.

To further maximize the protection provided for the PII collected and maintained by the 

Department and its bureaus, there have been several very significant achievements during the 

past three months. For example, the Internal Revenue Service (IRS) continues to develop 

and implement creative and innovative programs and systems to enhance PII privacy 

protections. The IRS continues to implement the 2D Barcode to reduce social security 

number (SSN) exposures and the risk of identity theft to taxpayers by printing a standard 2D 

Barcode that encodes the SSN on each page of a taxpayer notice. To date, this barcode has 

been applied to 33 types of non-payment notices to protect the SSNs of approximately 15 

million taxpayers.

Of equal significance is IRS’ development and implementation of the Privacy Impact 

Assessment (PIA) Management System (PIAMS), which gives IRS the ability to conduct, 
2

review, and approve PIAs in a paperless environment while improving the quality and 

standardization of these assessments. On February 29, 2012, the Associate Director for 

Privacy Compliance at IRS provided a briefing on PIAMS for Treasury’s Information 

Privacy Council/Committee members. As a result of this presentation, the Deputy Assistant 

Secretary for Privacy, Transparency, and Records (DASPTR) and the Director of the Office 

of Privacy and Civil Liberties (OPCL) have determined that there is a significant potential for 

making PIAMS an enterprise-wide application for processing PIAs. The DASPTR indicated 

a desire to move forward with this effort by making a presentation to the Executive Steering 

Committee for Enterprise Content Management.

Furthermore, in an effort to combat federal income tax-related identity theft, IRS has revised 

the electronic Form 1040 series to allow for the entry of an Identity Protection PIN. Use of

this PIN began in January 2012 and allows taxpayers who have been victims of identity theft 

to avoid delays in the processing of their returns. In December 2011, 251,000 affected

taxpayers received this PIN, which they will use when filing electronic returns.

Finally, for the three-month period ending February 29, Treasury completed approximately 

160 reviews including privacy threshold analyses (PTAs), PIAs, Systems of Records Notices 

(SORNs), and Paperwork Reduction Act requests. As in previous quarters, this total reflects 

Treasury’s proactive commitment to ensuring that its privacy and civil liberties program is 

taking care to provide the protection for PII and civil liberties that the American people 

deserve.

3. Quarterly Reporting Matrix

The Department uses a standard reporting framework and instructions tailored to its mission 

and functions to address Section 803 reporting requirements. In developing the framework 

and instructions, the Department collaborated with the Office of Management and Budget 

(OMB) and the other agencies required to report under this section. 

The attached chart reporting matrix consolidates all Treasury privacy and civil liberties 

activities, including data on the reviews conducted, reference to the advisory guidance 

delivered, and information about written complaints received and processed.

3.1. Types of Potential Complaints

3.1.1. Privacy Complaint: A privacy complaint is a written allegation of harm or 

violation of personal or information privacy filed with the Department. This 

information may include: 

1. Process and procedural issues, such as consent, collection, and appropriate notice; 

2. Non-Privacy Act of 1974 issues, such as Terrorist Watchlist Redress process or 

identity theft mitigation; or 

3. Privacy Act of 1974 issues.
3

3.1.2 Civil Liberties Complaint: A written allegation of harm or violation of the 

constitutional rights afforded individuals filed with the Department. Types of 

civil liberties complaints include, but are not limited to:

1. First Amendment (Freedom of speech, religion, assembly, and association);

2. Fourth Amendment (Protection against unreasonable search and seizure); and

3. Fifth Amendment or Fourteenth Amendment, § 1 (Due process and equal 

protection).

4. Reporting Categories

 4.1. Reviews: Reviews include Treasuryprivacy and civil liberties activities delineated by

controlling authorities, such as the Privacy Act of 1974, 5 U.S.C. § 552a; E-Government Act 

of 2002 (P.L. 107-347); Consolidated Appropriations Act of 2005 (P.L. 108-447); OMB

Circular A-130, Appendix 1; and OMB Memo M-07-16. Examples include:

1. Privacy Threshold Analyses – review of an IT system’s use of data to determine 

whether a PIA is required;

2. PIAs;

3. OMB Memorandum 07-16 issues, including reviewing records to minimize the 

volume of PII necessary for the proper performance of an agency function, SSN

use reduction efforts, or initiatives related to combating identity theft;

4. OMB Circular A-130 issues, including SORNs, routine use descriptions, Agency 

security contacts, recordkeeping and disposal policies, training practices, 

continued Privacy Act exemptions under 5 U.S.C §552a (j)(2), (k), and Computer 

Matching Programs;

5. Persistent Tracking Technology features used on a website;

6. Achievement of machine readability, which ensures that website users are 

automatically alerted about whether site privacy practices match their personal 

privacy preferences;

7. Reviews under 5 CFR part 1320 (collection of information/Paperwork Reduction 

Act);

8. Information Sharing Environment policies and system reviews; and 

9. Reviews related to the OMB Circular A-11, Exhibit 300 process.

 4.2. Advice: Advice includes written policies, procedures, guidance, or interpretations of 

requirements for circumstances or business processes that respond to privacy or civil liberties 

issues or concerns. 

4.3. Response to Advice: Specific action taken in response to Treasury Advice. Examples 

of Response to Advice include the issuance of a regulation, order, or directive; an 

interpretation or other guidance issued as a result of the Advice, or the reaching of an 

agreement related to the Advice; and issuance of any training programs or other procedures 

that enhance understanding of the issue that precipitated the request for Advice.
4

4.4. Disposition of Complaints: Treasury action in response to a privacy or civil liberties 

complaint. In response to a complaint, the Department will:

1. Take direct action (description in the summary report);

2. Refer to another agency or entity that may be able to assist in addressing the 

complaint (referral agency and explanation in summary report); or

3. Determine that no action is required (explanation in summary report).

The Department will continue to submit quarterly reports in coordination with OMB. The 

next quarterly report is due June 30, 2012, and will cover the period of March 1, 2012

through May 31, 2012. The data collection period for each report ends approximately 30 

days prior to the report deadline.
Department of the Treasury 

Quarterly Report on Privacy and Civil Liberties Activities 

under Section 803 of the 9/11 Commission Act of 2007

March 31, 2012

Reviews Advice and Response Complaints Dispositions

Type Number Type Number Response Type Number

Exhibit 300 (Capital Planning 

and Investment Control) 

Process 1 Request for PTA/PIA Guidance 1

Developing 

internal policy 

guidance PRIVACY 0

System of Records (SOR) 

Routine Use and SOR Notices

90/4

Develop and Conduct of 

PTAs/PIAs 2

Provided 

guidance

Privacy Threshold Analyses 

(PTAs) or Privacy Impact 

Assessments (PIA) 19/38

Request for Review of 

Enterprise Content 

Management Platform Privacy 

Policy and Practices 1

Provided 

policy 

guidance

OMB Circular A-130

2

5 C.F. R. Part 1320

3

Section 508 Internet Website 

Scans 2

Records and Information 

Management Policies and 

Procedures 2

CIVIL LIBERTIES 0