1 

Privacy and Civil Liberties Impact Assessment

for the

Homeowner Assistance Fund (HAF) 

December 2, 2021 

Reviewing Official 

Ryan Law 

Deputy Assistant Secretary for Privacy, Transparency, and Records 

Department of the Treasury
2 

Section 1 Introduction

PCLIAs are required for all systems and projects that collect, maintain, or disseminate personally 

identifiable information (PII). The system owner completed this assessment pursuant to Section 208 of 

the E-Government Act of 2002 (“E-Gov Act”), 44 U.S.C. § 3501, Office of the Management and Budget 

(OMB) Memorandum 03-22, “OMB Guidance for Implementing the Privacy Provisions of the EGovernment Act of 2002,” and Treasury Directive 25-07, “Privacy and Civil Liberties Impact Assessment 

(PCLIA),” which requires Treasury Offices and Bureaus to conduct a PCLIA before: (1) developing or 

procuring information technology (IT) systems or projects that collect, maintain or disseminate PII from 

or about members of the public, or (2) initiating a new collection of information that: (a) will be collected, 

maintained, or disseminated using IT; and (b) includes any PII permitting the physical or online 

contacting of a specific individual, if identical questions have been posed to, or identical reporting 

requirements imposed on, 10 or more persons (not including agencies, instrumentalities, or employees of 

the federal government).

It is the policy of the Department of the Treasury (“Treasury” or “Department”) and its Bureaus to 

conduct a PCLIA when PII is maintained in a system or by a project. This PCLIA provides the following 

information regarding the system or project: (1) an overview of its purpose and functions; (2) a 

description of the information collected; (3) a description of the how information is maintained, used, and 

shared; (4) an assessment of whether the system or project is in compliance with federal requirements that 

support information privacy; and (5) an overview of the redress/complaint procedures available to 

individuals who may be affected by the use or sharing of information by the system or project.

Section 2 System Overview 

Section 2.1 System/Project Description and Purpose

On March 11, 2021, the President signed the American Rescue Plan Act of 2021 (the “Act”), 

Pub. L. No. 117-2. Title III, Subtitle B, Section 3206 of the Act established the Homeowner 

Assistance Fund (HAF) and provided $9.961 billion for the U.S. Department of the Treasury 

(“Treasury” or the “Department”) to make payments to States (defined to include the District of 

Columbia, Puerto Rico, U.S. Virgin Islands, Guam, Northern Mariana Islands, and American 

Samoa), Indian tribes or tribally designated housing entities, as applicable, and the Department 

of Hawaiian Home Lands (collectively the “eligible entities”) to mitigate financial hardships 

associated with the coronavirus pandemic, including for the purposes of preventing homeowner 

mortgage delinquencies, defaults, foreclosures, loss of utilities or home energy services, and 

displacements of homeowners experiencing financial hardship after January 21, 2020, through 

qualified expenses related to mortgages and housing. 

Section 3206(c)(1) requires the eligible entities to use the funds for the purpose of preventing 

homeowner mortgage delinquencies, defaults, foreclosures, loss of utilities or home energy 

services, and displacements of homeowners experiencing financial hardship after January 21, 

2020, through qualified expenses related to mortgages and housing. Section 3206(e)(1) provides 

that not later than 45 days after March 11, 2021, the Secretary shall pay each eligible entity. 

Treasury provides the funds directly to eligible entities which must use the funds to provide 

assistance to eligible homeowners under the HAF program. 
3 

Treasury only receives and stores the required “household level” data, spending, and the number of 

households impacted for reporting, administrative, and oversight purposes. Treasury does not make 

decisions or adverse determinations about which homeowners receive benefits under HAF. Treasury 

provides HAF funds to eligible entities who distribute the funds within their jurisdictions to qualified 

applicants. Applicants for benefits should consult the eligible entitiesto which they submitted their 

application if they have any questions about the status of their HAF benefits, wish to update the 

information they provided to the eligible entity, or have questions or concerns about the eligible entity’s

denial of benefits.

Please check the statement below that applies to your system or project and provide any additional 

information requested. Please read all possible responses before selecting an answer.

1. ☒ A PCLIA is being done for this system for the first time.

2. ☐ This is an update of a PCLIA previously completed and published under this same system or 

project name. The date the earlier PCLIA was published was 1.1.2020. 

3. ☐ This is an update of a PCLIA previously completed and published for a similar system or 

project that is undergoing a substantial modification or migration to a new system or project 

name. The name of that previous PCLIA was [Name the PCLIA here] and the date of its 

publication was 1.1.2020 

Section 2.2 Authority to Collect

Federal agencies must have proper authority before initiating a collection of information. The authority is 

sometimes granted by a specific statute, by Executive order (EO) of the President or other authority. The 

following specific authorities authorize the HAF to collect information: 

• American Rescue Plan Act of 2021, Pub. L. 117-2, Title III, Section 32067 (“The Homeowner 

Assistance Fund” ("HAF") (March 11, 2021). 

• The Consolidated Appropriations Act, 2021, Division N, Section 501, Pub. L. No. 116-260 (Dec. 

27, 2020) (the statute requires the Department of the Treasury to make allocations to Tribes and 

Tribal entities based on the same allocation formulas used for the Emergency Rental Assistance 

Program).

The information may also be collected pursuant to a more general requirement or authority. All Treasury 

systems and projects derive general authority to collect information from:

• 31 U.S.C. 321 – General authorities of the Secretary establish the mission of the Department of 

the Treasury

• 5 U.S.C. 301 – Department regulations for the operations of the department, conduct of 

employees, distribution and performance of its business, the custody, use, and preservation of its 

records, papers, and property.

Section 2.3 Privacy Act Applicability; SORN Requirement 

Under certain circumstances, federal agencies are allowed to exempt a system of records from certain 

provisions in the Privacy Act. This means that, with respect to information systems and papers files that 

maintain records in that system of records, the agency will not be required to comply with the 

requirements in Privacy Act provisions that are properly exempted. If this system or project contains 

records covered by the Privacy Act, the applicable Privacy Act system of records notice(s) (SORNs) 

(there may be more than one) that cover the records in this system or project must list the exemptions 

claimed for the system of records (it will typically say: “Exemptions Claimed for the System” or words to 

that effect). 
4 

All answers in this section must be provided in the space as instructed after checking the appropriate 

box(es). 

Section 2.3(a) Please check ALL statements below that apply to your system or project and 

provide any additional information requested. Please read all possible responses before 

selecting an answer.

1. ☐ The system or project does not retrieve records about an individual using an identifying 

number, symbol, or other identifying particular assigned to the individual. A SORN is not 

required with respect to the records in this system.

2. ☒ The system or project does retrieve certain records about an individual using an identifying 

number, symbol, or other identifying particular assigned to the individual. A SORN is required 

with respect to some of the records in this system. Treasury does not collect personally 

identifiable information (PII) directly from homeowners who apply for assistance under the 

program. Treasury provides funds to eligible entities as defined in the American Rescue Plan 

(ARP) and those entities make determinations regarding eligibility and distribute the funds to 

eligible homeowners. Treasury does collect contact information from the point of contact for 

each eligible entity. This is typically business contact information, but it is impossible to know if, 

for example, a phone number is personal or business. Treasury maintains a system of records 

notice that includes contact information, Treasury .017 - Correspondence and Contact 

Information - 81 FR 78266 (Nov. 7, 2016). 

HAF participants also submit information for quarterly reports to Treasury that include financial 

data, targeting data, and other information. To fulfill the HAF/ARP reporting requirements, the 

Department of the Treasury’s Office of Strategic Planning and Performance Improvement 

(OSPPI) entered into an Interagency Agreement with the General Services Administration (GSA), 

Office of Government-wide Policy’s (OGP), Office of Evaluation Sciences (OES). Pursuant to 

this agreement, OES will analyze the data provided by Treasury to assist Treasury and the 

Department of Housing and Urban Development (HUD) in meeting the Consolidated 

Appropriations Act of 2021 reporting requirements. Treasury only receives and stores the 

required “household level” data for reporting, administrative, and oversight purposes. This 

information is not retrieved by a personal identifier by either Treasury or GSA so there is no 

SORN necessary to cover these records. 

3. ☐ A SORN was identified in the original PCLIA and a determination was made during this 

current PCLIA update that modifications [choose one] ☐ were ☐ were not required to that 

SORN. [If modifications were made, generally describe them here]. The current applicable 

SORN is: [Provide here the SORN number(s), system of records name(s) and the citation to the 

SORN(s) in the Federal Register.]

4. ☐ A SORN(s) was not identified or required in the original PCLIA, but a determination was 

made during this current PCLIA update that a SORN(s) is now required. The applicable 

SORN(s) is:[Provide here the SORN number(s), system of records name(s) and the citation to the 

SORN(s) in the Federal Register]. 

5. ☐ A SORN was published and no exemptions are taken from any Privacy Act requirements.

6. ☐ Exemptions are claimed from the following Privacy Act provisions in the applicable SORN(s): 

[List here all exemptions taken in the applicable SORN; Hint: it’s at the end of the SORN]: The 

citation to the applicable Notice of Proposed Rulemaking and/or Final Rule is[provide here the 

Federal Register Citation to the NPRM and Final Rule (if a Final Rule was required)]. 
5 

Section 3: Information Collection

Section 3.1 Relevant and Necessary

The Privacy Act requires “each agency that maintains a system of records [to] maintain in its records

only such information about an individual as is relevant and necessary to accomplish a purpose of the 

agency required to be accomplished by statute or by executive order of the President.” 5 U.S.C. § 

552a (e)(1). It allows federal agencies to exempt records from certain requirements (including the 

relevant and necessary requirement) under certain conditions. 5 U.S.C. §552a (k). The proposed 

exemption must be described in a Notice of Proposed Rulemaking (“NPRM”). In the context of the 

Privacy Act, the purpose of the NPRM is to give the public notice of a Privacy Act exemption 

claimed for a system of records and solicit public opinion on the proposed exemption. After 

addressing any public concerns raised in response to the NPRM, the agency must issue a Final Rule. 

It is possible for some, but not all, of the records maintained in the system or by the project to be 

exempted from the Privacy Act through the NPRM/Final Rule process.

Section 3.1(a) Exemption Claimed from this Requirement?

1. ☐ The PII maintained in this system or by this project is not exempt from 5 U.S.C. § 552a(e)(1), 

the Privacy Act’s requirement that an agency “maintain in its records only such information 

about an individual as is relevant and necessary to accomplish a purpose of the agency required 

to be accomplished by statute or by executive order of the President.”

2. ☐ The PII maintained in this system or by this project is exempt from 5 U.S.C. § 552a(e)(1), 

because [See Appendix B for a list of acceptable bases for claiming this exemption and cut and 

paste here all that apply]. 

3. ☒ With the exception of the contact information discussed above, the Privacy Act does not apply 

because the other information in the system is not maintained in a system of records as required 

to trigger this Privacy Act requirement (neither Treasury nor GSA retrieve the records by a 

personal identifier). Nevertheless, the program will only collect information required by law. 

Section 3.1(b) Continuously Assessing Relevance and Necessity 

1. ☐ The PII in the system is not maintained in a system of records. Therefore, the Privacy 

requirements do not apply. [Explain here what you do to ensure relevance and necessity despite 

the fact that the Privacy Act does not apply]. 

2. ☐ The PII in the system is maintained in a system of records, but the agency exempted these 

records from the relevance and necessity requirement. [Explain here what you do to ensure 

relevance and necessity to the extent possible despite the fact the records are exempt from this 

requirement]. 

3. ☐ The system owner conducted an assessment prior to collecting PII for use in the system or 

project to determine which PII data elements and types (see Section 3.2 below) were relevant and 

necessary to meet the system’s or project’s mission requirements. During this analysis, in

conducting the “relevance and necessity” analysis that is documented in this PCLIA, the system 

owner reevaluated the necessity and relevance of all PII data elements and determined that they 

are still relevant and necessary. Every time this PCLIA is updated, this ongoing assessment will 

be revisited. If it is determined at any time that certain PII data elements are no longer relevant or 

necessary, the system owner will update this PCLIA to discuss how the data element was 

removed from the system and is no longer collected.
6 

4. ☒ With respect to PII currently maintained (as of the time this PCLIA is being done) in the 

system or by the project, the PII is limited to only that which is relevant and necessary to meet the 

system or project’s mission requirements. During the PCLIA process, the system always 

undergoes a review to ensure the continuing relevance and necessity of the PII used by the 

program. 

5. ☒ With respect to PII maintained in the system or by the project, there is a process in place to 

continuously reevaluate and ensure that the PII remains relevant and necessary. During the 

PCLIA process(including updates), the system always undergoes a review to ensure the 

continuing relevance and necessity of the PII on the system. If a determination is made that 

particular PII is no longer relevant and necessary in between PCLIA updates, this PCLIA will be 

updated at that time.

Section 3.2 PII and/or information types or groupings

The checked boxes below represent the types of information maintained in the system or by the project 

that are relevant and necessary for the information system or project to fulfill its mission. PII identified 

below is used by the system or project to fulfill the purpose stated in Section 2.2 above– Authority to 

Collect. 

Biographical/general information

Treasury does not collect personally identifiable information (PII) directly from individuals who 

apply for assistance under the program. Eligible entities collect eligibility information directly 

from homeowners/applicants seeking assistance. Treasury provides funds to eligible entities as 

defined in the ARP and those eligible entities distribute the funds to eligible homeowners. The 

eligible entities are required to send certain data to Treasury so it can complete its quarterly 

reports as required by the ARP. Treasury does not, however, store any of the raw financial data, 

targeting data, and other information eligible entities submit in quarterly reports to Treasury. 

Section 3.3 Sources from which PII is obtained

Focusing on the context in which the data was collected and used (i.e., why it is collected and how it is 

used), check ALL sources from which PII is collected/received and stored in the system or used in the 

project

1. Members of the Public ((this information is collected by the eligible entities and a subset of the 

information is shared with Treasury for reporting purposes).

☐ Members of the Public (i.e., including individuals who are current federal employees who are 

providing the information in their “personal” capacity (unrelated to federal work/employment). 

All of the following are members of the public. Please check relevant boxes (based on the 

context of collection and use in this system) for members of the public whose information is 

maintained in the system (only check if relevant to the purpose for collecting and using the 

information): 

☐ Members of the general public (current association with the federal 

government, if any, is irrelevant to the collection and use of the information by 

the system or project). 

☐ Retired federal employees. 

☐ Former Treasury employees. 

☒ Federal contractors, eligible entities, interns, detailees etc. (System 

administrators, system user logging) 
7 

☐ Federal job applicants. 

☐ Other: [Explain here]. 

2. Current Federal Employees, Interns, and Detailees

☐ Current Federal employees providing information in their capacity as federal employees 

(for example, PII collected using OPM or Treasury forms related to employment with the 

federal government)

☐ Interns. 

☐ Detailees. 

☐ Other employment-related positions. 

3. Treasury Bureaus (including Departmental Offices)

☐ Other Treasury Bureaus:. 

4. Other Federal Agencies

☒ Other federal agencies: The General Services Administration will provide analytical output 

(without PII) to Treasury/HUD as needed to meet reporting requirements. Information will also 

be obtained from US Census.

5. State and Local Agencies

☒ State and local agencies: any State of the United States, the District of Columbia, the 

Commonwealth of Puerto Rico, Guam, American Samoa, the United States Virgin Islands, the 

Commonwealth of the Northern Mariana Islands and tribal entities that apply for a set aside 

under ARP, Section 3206, subsection (f).

6. Private Sector

☐ Private sector organizations (for example, banks and financial organizations, data 

brokers or other commercial sources): 

7. Other Sources 

☐ Other sources not covered above (for example, foreign governments). 

Section 3.3: Privacy and/or civil liberties risks related to collection

When Federal agencies request information from an individual that will be maintained in a system of 

records, they must inform the individual of the following: “(A) the authority (whether granted by statute, 

or by executive order of the President) which authorizes the solicitation of the information and whether 

disclosure of such information is mandatory or voluntary; (B) the principal purpose or purposes for which 

the information is intended to be used; (C) the routine uses which may be made of the information, as 

published pursuant to paragraph (4)(D) of this subsection; and (D) the effects on [the individual], if any, 

of not providing all or any part of the requested information.” 5 U.S.C § 522a(e)(3). This is commonly 

called a Privacy Act Statement. The OMB Guidelines also note that subsection (e)(3) is applicable to 

both written and oral (i.e., interview) solicitations of personal information. Therefore, even if a federal 

employee or contractor has a fixed list of questions that they orally ask the individual in order to collect 

their information, this requirement applies. 

Section 3.3(a) Collection Directly from the Individual to whom the PII pertains
8 

1. ☒ Treasury does not directly collect the PII in the system from the individuals to whom it 

pertains. The information is collected by states, U.S. territories, local governments, the 

Department of Hawaiian Home Lands, and Indian tribes or the tribally designated housing entity 

of an Indian tribe. Treasury does not use the information to make decisions regarding eligibility 

under HAF. Those decisions are made by the eligible entities.

2. ☐ Some or ☐ all of the information in this system was collected directly from an individual to 

whom it pertains.

Section 3.3(b) Privacy Act Statements

1. ☒ With the exception of the point of contact information Treasury collects from eligible entities,

Treasury does not collect any PII directly from the individuals to whom it pertains. The records 

Treasury does receive from the eligible entities are not retrieved by a personal identifier (neither 

by Treasury nor GSA). Therefore, with the exception of the contact information referenced 

above (for which a Privacy Act Statement was included), a Privacy Act Statement is not required

for information eligible entities collect from applicants. 

2. ☐ Some ☐ All of the PII in the system was collected directly from the individual to whom it 

pertains. Therefore, a Privacy Act Statement was posted at the point where the PII was collected 

directly from the individual. That Privacy Act Statement was provided to the individual ☐ on 

the form in which the PII was collected ☐ on a separate sheet of paper that the individual could 

retain; or ☐ in an audio recording or verbally at the point where the information was collected 

(e.g., on the phone) or ☐ other. 

3. The Privacy Act Statement (for the contact information) contained the following: 

a. ☒ The authority (whether granted by statute, or by Executive order of the President) 

which authorizes the solicitation of the information.

b. ☒ Whether disclosure of such information is mandatory or voluntary.

c. ☒ The principal purpose or purposes for which the information is intended to be used.

d. ☒ The individuals or organizations outside of Treasury with whom the information 

may be/ will be shared.

e. ☒ The effects on the individual, if any, if they decide not to provide all or any part of 

the requested information.

Section 3.3(c) Use of Full Social Security Numbers 

Treasury is committed to eliminating unnecessary collection, use, and display of full Social Security 

numbers (“SSN”) and redacting, truncating, and anonymizing SSNs in systems and documents to limit 

their accessibility to individuals who do not have a need to access the full SSN in order to perform their 

official duties. Moreover, the Privacy Act provides that: “It shall be unlawful for any Federal, State or 

local government agency to deny to any individual any right, benefit, or privilege provided by law 

because of such individual’s refusal to disclose his social security account number.” Pub. L. No. 93–579, 

§ 7. This provision does not apply to: (1) any disclosure which is required by federal statute; or (2) any 

disclosure of an SSN to any federal, state, or local agency maintaining a system of recordsin existence 

and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted 

prior to such date to verify the identity of an individual. Id. at § 7(a)(2)(A)-(B).

Section 3.3(d) Justification of Social Security Numbers

1. ☒ N/A No full SSNs are maintained in the system or by the project. [Explain if any portion of the 

SSN short of the full 9 digits is used in the system: if the full SSN is located anywhere in the 
9 

system (even if it is redacted, truncated or anonymized when viewed by users, please check 

number 2 below)].

2. ☐ Full SSNs are maintained in the system or by the project and the following approved Treasury 

uses of SSNs apply: 

☐ security background investigations; 

☐ interfaces with external entities that require the SSN; 

☐ a legal/statutory basis (collection of SSNs are expressly required in Section 501(g) of 

the Consolidated Appropriations Act, 2021); 

☐ when there is no reasonable, alternative means for meeting business requirements; 

☐ statistical and other research purposes; 

☐ delivery of government benefits, privileges, and services; 

☐ for law enforcement and intelligence purposes; 

☐ aging systems with technological limitations combined with funding limitations render 

impracticable system modifications or replacements to add privacy risk reduction tools 

(partial/truncated/redacted or masked SSNs); and

☐ as a unique identifier for identity verification purposes.

Section 3.3(e) Controls implemented to limit access to and or improper disclosure of full 

Social Security Numbers 

1. ☒ Full SSNs are not maintained in the system or by the project.

2. ☐ Full SSNs are maintained in the system or by the project and the following controls are put in 

place to reduce the risk that the SSN will be seen or used by someone who does not have a need 

to use the SSN in order to perform their official duties (check ALL that apply): 

a. ☐ The entire SSN data field is capable of suppression (i.e., being turned off) and the 

data field is suppressed when the SSN is not required for particular system users to 

perform their official duties.

b. ☐ do not require the SSN to perform their official duties.☐Within the system, an 

alternative number (e.g., an Employee ID) is displayed to all system users who do not 

require the SSN to perform their official duties. The SSN is only linked to the 

alternative number within the system and when reporting outside the system (to an 

agency that requires the full SSN). The SSN is not visible to system users (other than 

administrators).

d. ☐ The SSN is truncated (i.e., shortened to the last 4 digits of the SSN) when displayed 

to all system users for whom the last four digits (but not the full) SSN are necessary to 

perform their official duties.

e. ☐ Full or truncated SSNs are only downloaded to spreadsheets or other documents for 

sharing within the bureau or agency when disclosed to staff whose official duties 

require access to the full or truncated SSNs for the particular individuals to whom they 

pertain. No SSNs (full or truncated) are included in spreadsheets or documents unless 

required by each recipient to whom it is disclosed in order to perform their official 

duties (e.g., all recipients have a need to see the SSN for each employee in the 

spreadsheet). 

f. ☐ Other:
10

Section 3.3(f) Denial of rights, benefits, or privileges for refusing to disclose Social Security 

Number 

1. ☒ N/A No SSNs are maintained in the system or by the project.

2. ☐ Full SSNs are collected, but no individual will be denied any right, benefit, or privilege 

provided by law if the individual refuses to disclose their SSN for use in the system or project. If 

the individual chooses not to provide their SSN [please describe here what will happen 

(something less than denial of a privilege etc.) if the individual chooses not to provide their 

SSN].

3. ☐ Full SSNs are collected, and individuals will be denied the following right, benefit, or 

privilege provided by law if they refuse to disclose their SSN: Denial of this right, benefit or 

privilege does not violate the law because: [choose one of the two boxes below]:

a. ☐ SSN disclosure is required by the following Federal statute or Executive Order: the 

Consolidated Appropriations Act, 2021, Section 501(g); OR

b. ☐ The SSN is disclosed to a Federal, state, or local agency that maintains a system of 

recordsthat was in existence and operating before January 1, 1975, and disclosure was 

required under statute or regulation adopted prior to such date to verify the identity of 

an individual.

Section 3.3(g) Records describing how individuals exercise First Amendment rights 

The Privacy Act requires that Federal agencies “maintain no record describing how any individual 

exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the 

individual about whom the record is maintained or unless pertinent to and within the scope of an 

authorized law enforcement activity.” 5 U.S.C. § 552a(e)(7). 

1. ☒ N/A. The system or project does not maintain information describing how an individual 

exercises their rights guaranteed by the First Amendment. 

2. ☐ The system or project does maintain information describing how an individual exercises their 

rights guaranteed by the First Amendment. If you checked this box, please check the box below 

that explains Treasury’s authorization for collecting this information: 

a. ☐ The individual about whom the information was collected or maintained expressly 

authorizes its collection/maintenance. The individual about whom the information was 

collected or maintained expressly authorized its collection by (for example, individuals 

may expressly authorize collection by requesting in writing that Treasury share 

information with a third party, e.g., their Congressman];

b. ☐ The information maintained is pertinent to and within the scope of an authorized law 

enforcement activity because;

c. ☐ The following statute expressly authorizes its collection: [your response MUST 

contain all three if you use a statute as the basis for the collection].

Section 4 Maintenance, use, and sharing of the information

Section 4.1 Ensuring accuracy, completeness, and timeliness of information collected, 

maintained, and shared when it is used to make determinations about individuals

The Privacy Act and Treasury policy require that Treasury bureaus and offices take additional care when 

collecting and maintaining information about individuals when it will be used to make determinations 

about those individuals (e.g., whether they will receive a federal benefit). This includes collecting 

information directly from the individual where practicable and ensuring that the information is accurate, 
11

relevant, timely and complete to assure fairness to the individual when making a determination about 

them. This section addresses the controls/protections put in place to address these issues. 

The Privacy Act requires that Federal agencies “maintain all records which are used by the agency in 

making any determination about any individual with such accuracy, relevance, timeliness, and 

completeness as is reasonably necessary to assure fairness to the individual in the determination.” 5 

U.S.C § 552a(e)(5). If a particular system of records meets certain requirements (including the NPRM

process defined in Section 3.1 above), an agency may exempt the system of records(or a portion of the 

records) from this requirement. Exemptions may be found at the bottom of the relevant SORN next to the 

heading: “Exemptions Claimed for this System.” 

Section 4.1(a) Exemption from the accuracy, relevance, timeliness, and completeness 

requirements in section (e)(5) of the Privacy Act

1. ☐ None of the information maintained in the system or by the project that is part of a system of 

recordsis exempt from the accuracy, relevance, timeliness, and completeness requirements in 

section (e)(5) of the Privacy Act.

2. ☐ All ☐ Some of the PII maintained in the system or by the project is part of a system of records 

and is exempt from the accuracy, relevance, timeliness, and completeness requirements in 

section (e)(5) of the Privacy Act. The exemption claimed for these records is appropriate 

because [please see Appendix B which contains sample justifications for this exemption and 

provide the appropriate bases here [more than one bases may apply]. 

3. ☒ With the exception of the contact information referenced above, the PII maintained in the 

system or by the project is not part of a system of records as is required to trigger this 

requirement. Moreover, Treasury does not make adverse determinations about whether 

particular applicants who receive benefits underthe HAF program. Those decisions are made 

by the eligible entity to which the applicant submitted their application. Applicants for benefits 

should consult the eligible entity to which they submitted their application if they believe HAF

benefits were denied because of the quality of the data used by the eligible entity to make an

adverse determination. 

Section 4.1(b) Protections in place despite the system of record’s exemption from the 

accuracy, relevance, timeliness, and completeness requirements or inapplicability of the 

Privacy Act.

1. ☐ None of the information maintained in the system or by the project is exempt from the 

accuracy, relevance, timeliness, and completeness requirements in section (e)(5) of the Privacy 

Act.

2. ☐ For all information maintained in the system or by the project that is part of a system of 

records that is exempt from the accuracy, relevance, timeliness, and completeness requirements 

in section (e)(5) of the Privacy Act, (or in the event the Privacy Act does not apply) the 

following efforts are made to ensure accuracy, relevance, timeliness, and completeness to the 

extent possible: 

a. ☐ The exempt information is not actually used to make any adverse determinations about 

individuals. 

b. ☐ The exempt information is not actually used to make any adverse determinations about 

individuals without additional research and investigation to ensure accuracy, relevance, 

timeliness, and completeness.
12

c. ☐ Individuals and organizations to whom PII from the system or project is disclosed (as 

authorized by the Privacy Act) determine its accuracy, relevance, timeliness, and 

completeness in a manner reasonable for their purposes before they use it to make adverse 

determinations about individuals.

d. ☐ Individuals about whom adverse determinations are made using PII from this system or 

project are given an opportunity to explain or modify their information (check one) ☐

before ☐ after the adverse determination is made. During this process, individuals are 

allowed to: [discuss here ] 

e. ☒ Other: (please describe): Treasury does not make adverse determinations about 

individual HAF applicants. Applicants for benefits should consult the eligible entity to 

which they submitted their application if they believe HAF benefits were denied because 

of the quality of the data used by the eligible entity to make an adverse determination

3. ☐ No additional efforts are made to ensure accuracy, relevance, timeliness, and completeness to 

the extent possible because it would interfere with mission requirements.

Section 4.1(c) Collecting information directly from the individual when using it to make 

adverse determinations about them. 

Section 552a(e)(2) of the Privacy Act requires that Federal agencies that maintain records in a system of 

records are required to collect information to the greatest extent practicable directly from the individual 

when the information about them may result in adverse determinations about their rights, benefits, and 

privileges under Federal programs. Agencies may exempt a system of records from this requirement 

under certain circumstances and if certain conditions are met.

1. ☐ The records maintained by this system or project are not used to make any adverse 

determinations about individuals. 

2. ☐ The records maintained by this system or project are used to make adverse determinations 

about individuals and [check all that apply]:

a. ☐ These records were exempted from the Privacy Act provision that requires collection 

directly from the subject individual to the greatest extent practicable. Exemption of these 

records is proper because. 

b. ☐ These records were not exempted from the requirement to collect information directly 

from the individual to the greatest extent practicable and [check the relevant box below and 

provide the information requested]. 

i. ☐ All records used to make an adverse determination are collected directly from the 

individual about whom the decision is made. 

ii. ☐ A combination of records collected from third parties and directly from the 

individual about whom the determination is made are used to make the determination 

because Treasury encourages eligible entity to partner with state unemployment 

departments or entities that administer federal benefits with income requirements to 

assist with the verification process, consistent with applicable law. 

iii. ☐ None of the records used to make adverse determinations are collected directly from 

the individual about whom determinations are made because seeking the information 

directly from the individual might [select ALL that apply]: 

☐ alert the individual to the fact that their conduct is being observed or investigated; 

☐ cause the individual to alter or modify their activities to avoid detection;

☐ create risks to witnesses or other third parties if the individual is alerted to the 

fact that their conduct is being observed or investigated;
13

☐ Other: (please describe here).

3. ☒ Other: Applicants/individuals do not provide their information directly to Treasury. 

Applicants/individuals provide their information directly to the eligible entity so the 

eligible entity can determine if the applicant/individual qualifies for HAF benefits. 

Treasury does not make adverse determinations about individual HAF applicants. 

Applicants for benefits should consult the eligible entity to which they submitted their 

application if they believe HAF benefits were denied because of the quality of the data 

used by the eligible entity to make an adverse determination. 

Section 4.1(d) Additional controls designed to ensure accuracy, completeness, timeliness 

and fairness to individuals in making adverse determinations

1. Administrative Controls. Individuals about whom information is collected are given the 

following opportunities to amend/correct/update their information to ensure it is accurate, timely 

and complete to the extent reasonably necessary to assure fairness when it is used to make a 

determination about them: 

a. ☒ Treasury does not use the PII collected by eligible entitiesto make adverse 

determinations about an individual’s rights, benefits, and privileges under federal programs. 

b. ☐ The records maintained in the system or by the project are used to make adverse 

determinations and (select one) ☐ are ☐ are not exempt from the access provisions in the 

Privacy Act, 5 U.S.C. 552a(d). 

c. ☐ Treasury has published regulations in place describing how individuals may seek access 

to and amendment of their records under the Privacy Act. The Treasury/bureaus FOIA and 

Privacy Act disclosure regulations can be found at 31 C.F.R. Part 1, Subtitle A, Subparts A 

and C. 

d. ☐ Individuals who provide their information directly to Treasury for use in the system or by 

the project are provided notice of the adverse determination and an opportunity to 

amend/correct/ update their information [choose one] ☐ before ☐ after it is used to make a 

final, adverse determination about them. This is accomplished by [describe here how this 

process works and the protections in place, including redress/appeals processes; if notice is 

provided after an adverse determination is made, explain here why notice could not be 

provided before a determination was made, and the protections in place]:. 

e. ☐ Individuals who provide their information directly to Treasury for use in the system or by 

the project are expressly told at the point where the information is collected that they need to 

keep their information accurate, current and complete because it could be used to make 

adverse determinations about them. This is accomplished by [describe here

how/where/when individuals are told they need to keep their information updated before it is 

used to make adverse decisions about them; include the exact language provided to the 

individuals].

f. ☐ All manual PII data entry by federal employees/contractors is verified by a supervisor or 

other data entry personnel before it is uploaded to the system (e.g., PII entered into the 

system from paper records is double-checked by someone else before it’s uploaded to the 

system). This is accomplished by: 

g. ☐ Other: 

2. Technical controls. The system or project also includes additional technical controls to ensure 

that PII is maintained with such accuracy, relevance, timeliness and completeness as is 

reasonably necessary to assure fairness to the individual when it is used to make a determination 

about them. The following additional protections are relevant to this system or project 
14

a. ☒ No additional technical controls are available to ensure accuracy, relevance, timeliness 

and completeness. 

b. ☐ Automated data feeds are used to refresh/update the information in the system (where the 

system is reliant on updates from another system). These automated data feeds occur:. 

c. ☐ Technical and/or administrative controls put are in place to ensure that when information 

about an individual is acquired from multiple sources for maintenance in a single file about a 

particular individual, it all relates to the same individual . This is accomplished by:

d. ☐ Address verification and correction software (software that validates, updates and 

standardizes the postal addresses in a database).

e. ☐ Other: 

Section 4.2 Data-Mining

As required by Section 804 of the Implementing Recommendation of the 9/11 Commission Act of 2007

(“9-11 Commission Act”), Treasury reports annually to Congress on its data mining activities. For a 

comprehensive overview of Treasury’s data mining activities, please review the Department’s Annual 

Privacy Act and Data Mining reports available at: http://www.treasury.gov/privacy/annual-reports. 

Section 4.2(a) Is the PII maintained in the system used to conduct data-mining?

1. ☒ The information maintained in this system or by this project is not used to conduct “datamining” activities as that term is defined in the 9-11 Commission Act. Therefore, no privacy or 

civil liberties issues were identified in responding to this question.

2. ☐ The information maintained in this system or by this project is used to conduct “data-mining” 

activities as that term is defined in the 9-11 Commission Act. This system is included in 

Treasury’s annual report to Congress which can be found on the external Treasury privacy 

website.

3. ☐ The information maintained in this system or by this project is used to conduct “data-mining” 

activities as that term is defined in the 9-11 Commission Act, but this system is not included in 

Treasury’s annual report to Congress which can be found on the external Treasury privacy 

website. This system will be added to the next Treasury Data-mining report to Congress.

Section 4.3 Computer Matching

The Computer Matching and Privacy Protection Act (CMPPA) of 1988 amended the Privacy Act by 

imposing additional requirements when Privacy Act systems of records are used in computer matching 

programs. Pursuant to the CMPPA, there are two distinct types of matching programs. The first type of 

matching program involves the computerized comparison of two or more automated federal personnel or 

payroll systems of records or a system of federal personnel or payroll records with non-federal records. 

This type of matching program may be conducted for any purpose. The second type of matching program 

involves the computerized comparison of two or more automated systems of records or a system of 

records with non-federal records. The purpose of this type of matching program must be for the purpose 

of eligibility determinations or compliance requirements for applicants, recipients, beneficiaries,

participants, or providers of services for payments or in-kind assistance under federal benefit programs, or 

recouping payments or delinquent debts under such federal benefit programs. See 5 U.S.C. § 522a(a)(8). 

Matching programs must be conducted pursuant to a matching agreement between the source (the agency 

providing the records) and recipient agency (the agency that receives and uses the records to make 

determinations). The matching agreement describes the purpose and procedures of the matching and

establishes protections for matching records.
15

Section 4.3(a) Records in the system used in a computer matching program

1. ☒ With the exception of contact information referenced above, the PII maintained in the system 

or by the project is not part of a Privacy Act system of records. The contact information is not 

part of a matching program.

2. ☐ The information maintained in the system or by the project is part of a Privacy Act system of 

records but is not used as part of a matching program.

3. ☐ The information maintained in the system or by the project is part of a Privacy Act system of 

records and is used as part of a matching program. [If whether a Matching Agreement was 

executed and published as required by the CMPPA/Privacy Act; if no Matching Agreement was 

executed, please explain here why]. 

Section 4.3(b) Is there a matching agreement?

1. ☒ N/A

2. ☐ There is a matching agreement in place that contains the information required by Section (o) 

of the Privacy Act. 

3. ☐ There is a matching agreement in place, but it does not contain all of the information required 

by Section (o) of the Privacy Act. The following actions are underway to amend the agreement 

to ensure that it is compliant. 

Section 4.3(c) What procedures are followed before adverse action is taken against an 

individual who is the subject of a matching agreement search?

1. ☒ N/A

2. ☐ The bureau or office that owns the system or project conducted an assessment regarding the 

accuracy of the records that are used in the matching program and the following additional 

protections were put in place:

a. ☐ The results of that assessment were independently verified by [explain how and by whom 

accuracy is independently verified; include the general activities involved in the verification 

process].

b. ☐ Before any information subject to the matching agreement is used to suspend, terminate,

reduce, or make a final denial of any financial assistance or payment under a Federal benefit 

program to an individual: 

i. ☐ The individual receives notice and an opportunity to contest the findings; OR 

ii. ☐ The Data Integrity Board approves the proposed action with respect to the financial 

assistance or payment in accordance with Section (p) of the Privacy Act before taking 

adverse action against the individual. 

3. ☐ No assessment was made regarding the accuracy of the records that are used in the matching 

program. 

Section 4.4 Information sharing with external (i.e., outside Treasury) organizations and 

individuals

Section 4.4(a) PII shared with/disclosed to agencies, organizations or individuals outside Treasury

1. ☐ PII maintained in the system or by the project is not shared with agencies, organizations, or 

individuals external to Treasury. 

2. ☒ PII maintained in the system or by the project is or may be shared with the following agencies, 

organizations, or individuals external to Treasury: Contact information is not shared outside 

Treasury. Information that is not covered by the Privacy Act is shared with the General Services 
16

Administration pursuant to an Interagency Agreement (Treasury Evaluation Support). The 

Secretaries of Treasury and HUD are required to do the reporting required in the Consolidated 

Appropriations Act, 2021. Therefore, PII may also be disclosed to the HUD Secretary or their 

designee. Disclosures may also be made to the National Archives and Records Administration 

(NARA), to the Department of Justice or other federal or state, tribal, or territorial governmental 

organizations (including Congress) as required or allowed by law.

3. ☐ All external disclosures are authorized by the Privacy Act. 

Section 4.4(b) Accounting of Disclosures

An accounting of disclosures is a log of all external (outside Treasury) disclosures of records made from a 

system of records that has not been exempted from this accounting requirement. This log must either be 

maintained regularly or be capable of assembly in a reasonable amount of time after an individual makes a 

request. Certain system of records may be exempted from releasing an accounting of disclosures (e.g., in 

law enforcement investigations). 

Section 4.4(c) Making the Accounting of Disclosures Available 

1. ☒ An accounting of disclosure will be maintained with respect to disclosures of point of contact 

information for eligible entities. The other records in the system are not, however, maintained in 

a system of records subject to the Privacy Act so an accounting is not required. Nevertheless, 

disclosures of other records maintained pursuant to the HAF Program are only disclosed as 

stated in Section 4.4(a) above.

2. ☐ No external disclosures are made from the system. 

3. ☐ The Privacy Act system of records maintained in the system or by the project is

exempt from the requirement to make the accounting available to the individual named 

in the record. Exemption from this requirement was claimed because:

4. ☐ The Privacy Act system of records maintained in the system or by the project is not

exempt from the requirement to make the accounting available to the individual named 

in the record and a log is maintained regularly. The log is maintained for at least five 

years and includes the date, nature, and purpose of each disclosure (not including intraagency disclosures and FOIA disclosures) of a record to any person or to another 

agency (outside of Treasury) and the name and address of the person or agency to 

whom the disclosure is made. 

5. ☐ The Privacy Act system of records maintained in the system or by the project is not

exempt from the requirement to make the accounting available to the individual named 

in the record and a log is not maintained regularly, but is capable of being constructed 

in a reasonable amount of time upon request. The information necessary to reconstruct 

the log (i.e., date, nature, and purpose of each disclosure) is maintained for at least five 

years.

Section 4.4(d) Obtaining Consent Prior to New Disclosures Not Authorized by the Privacy Act

Records in a system of records subject to the Privacy Act may not be disclosed by "any means 

of communication to any person or to another agency" without the prior written request or 

consent of the individuals to whom the records pertain. 5 U.S.C. Sec. 552a(b). However, the 

Act also sets forth twelve exceptions to this general restriction. These 12 exceptions may be 

viewed at: https://www.justice.gov/usam/eousa-resource-manual-139-routine-uses-andexemptions. Unless one of these 12 exceptions applies, the individual to whom a record 

pertains must provide their consent, where feasible and appropriate, before their records may be 

disclosed to anyone who is not listed in one of the 12 exceptions. One of these 12 exceptions 
17

also allows agencies to include in a notice published in the Federal Register, a list of routine 

uses. Routines uses are disclosures outside the agency that are compatible with the purpose for 

which the records were collected. 

Section 4.4(e) Obtaining Prior Written Consent

1. ☐ The records maintained in the system of records are only shared in a manner 

consistent with one of the 12 exceptions in the Privacy Act, including the routine uses 

published in the Federal Register.

2. ☐ If a situation arises where disclosure (written, oral, electronic, or mechanical) must 

be made to anyone outside of Treasury who is not listed in one of the 12 exceptions in 

the Privacy Act, the individual’s prior written consent will be obtained where feasible 

and appropriate.

3. ☒ Prior consent will be sought for disclosures of point of contact information that is 

subject to the Act. Otherwise, the Privacy Act does not apply.

Section 5 Compliance with federal information management requirements

Responses to the questions below address the practical, policy, and legal consequences of 

failing to comply with one or more of the following federal information management 

requirements (to the extent required) and how those risks were or are being mitigated: (1) the 

Privacy Act System of Records Notice Requirement; (2) the Paperwork Reduction Act; (3) the 

Federal Records Act; (4) the E-Gov Act security requirements; and (5) Section 508 of the 

Rehabilitation Act of 1973.

Section 5.1 The Paperwork Reduction Act

The PRA requires OMB approval before a Federal agency may collect standardized data from 10 or more 

respondents within a 12-month period. OMB also requires agencies to conduct a PIA (a Treasury 

PCLIA) when initiating, consistent with the PRA, a new electronic collection of PII for 10 or more 

persons (excluding agencies, instrumentalities, or employees of the federal government).

Section 5.1(a)

1. ☐ The system or project maintains information obtained from individuals and organizations who 

are not federal personnel or an agency of the federal government (i.e., outside the federal 

government). 

2. ☐ The project or system involves a new collection of information in identifiable form for 10 or 

more persons from outside the federal government. 

3. ☒ The project or system completed an Information Collection Request (“ICR”) and received 

OMB approval OMB# 1505-0269. 

4. ☐ The project or system did not complete an Information Collection Request (“ICR”) and 

receive OMB approval because.... Therefore, the PRA requirements do not apply.

Section 5.2 Records Management - NARA/Federal Records Act Requirements

Records retention schedules determine the maximum amount of time necessary to retain information in 

order to meet the needs of the project or system. Information is generally either disposed of or sent to the 

National Archives and Records Administration (NARA) for permanent retention upon expiration of this 

period. If the system has an applicable SORN(s), check the “Policies and Practices for Retention and 

Disposal of Records” section.
18

Section 5.2(a) 

1. ☒ The records used in the system or by the project are covered by a NARA’s General

Records Schedule (GRS). The GRS is 1.2: Grant and Cooperative Agreement Records. 

2. ☐ The records used in the system or by the project are covered by a NARA approved 

Treasury bureau Specific Records Schedule (SRS). 

3. ☐ On [please state the date on which NARA approval was sought] the system owner 

sought approval from NARA for an SRS and is awaiting a response from NARA.

4. ☐ The system owner is still in the process of developing a new records schedule to 

submit to NARA.

Section 5.3 E-Government Act/NIST Compliance 

The completion of Federal Information Security Management Act (FISMA) Security 

Assessment & Authorization (SA&A) process is required before a federal information 

system may receive Authority to Operate (ATO). 

Section 5.3(a) 

1. ☒ The system is a federal information system subject to FISMA requirements.

2. ☒The system last completed an SA&A and received an ATO on: May 23, 2021. 

3. ☐This is a new system has not yet been authorized to operate. The expected to date for receiving 

ATO is. 

4. ☐The system or project maintains access controls to ensure that access to PII maintained is 

limited to individuals who have a need to know the information in order to perform their official 

Treasury duties.

5. ☐ All Treasury/bureau security requirements are met when disclosing and transferring 

information (e.g., bulk transfer, direct access by recipient, portable disk, paper) from the Treasury 

system or project to internal or external parties.

6. ☐ This system or project maintains an audit log of system users to ensure they do not violate the 

system and/or Treasury/bureau rules of behavior.

7. ☐ This system or project has the capability to identify, locate, and monitor individuals or groups 

of people other than the monitoring of system users to ensure that they do not violate the system’s 

rules of behavior. 

Section 5.4 Section 508 of the Rehabilitation Act of 1973

When Federal agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), 

Section 508 of the Rehabilitation Act of 1973 (as amended in 1998) requires that individuals with 

disabilities (including federal employees) must have access and use (including privacy policies and 

directives as well as redress opportunities) that is comparable to that which is available to individuals who 

do not have disabilities.

Section 5.4(a) 

1. ☐ The project or system will not involve the development, procurement, maintenance or use of 

EIT as that term is defined in Section 508 of the Rehabilitation Act of 1973 (as amended in 

1998)? 

2. ☐ The project or system will involve the development, procurement, maintenance or use of EIT 

as that term is defined in Section 508 of the Rehabilitation Act of 1973 (as amended in 1998)? 

3. ☒ The system or project complies with all Section 508 requirements, thus ensuring that 

individuals with disabilities (including federal employees) have access and use that is 

comparable to that which is available to individuals who do not have disabilities.
19

4. ☐ The system or project is not in compliance with all Section 508 requirements. The following 

actions are in progress to ensure compliance:

Responsible Officials

Approval Signature

________________________________ 

Ryan Law

Deputy Assistant Secretary,

Privacy, Transparency, and Records

Department of the Treasury