The Department of the Treasury

FY 2012 Q3 Report on Privacy and Civil 

Liberties Activities Pursuant to Section 803 

of the Implementing Recommendations of 

the 9/11 Commission Act of 2007

For the reporting period 

March 1, 2012 – May 31, 2012

1. Introduction

The Treasury Department is committed to protecting the privacy and civil liberties of 

individuals in all Treasury programs. In recognition of the threat to individual privacy 

resulting from the global expansion of information technology (IT), the Department is 

determined to continue its vigilant oversight of the personally identifiable information (PII)

entrusted to its care. 

2. Department Actions

During the third quarter of FY 2012, the Treasury’s Office of Privacy, Transparency, and 

Records (OPTR) made a number of significant accomplishments in developing and 

implementing privacy and civil liberties protections in the Department. 

This year’s Records and Information Management Month (RIMM) event at the Department 

of the Treasury was another resounding success. Approximately 600 employees representing 

more than a dozen agencies participated in one or more of the 28 sessions presented during 

the month-long event. Among the highlights of this year’s RIMM was a presentation by the 

Archivist of the United States, which opened the event and was its most heavily-attended 

session. During his briefing, the Archivist emphasized the importance of the proper retention 

and disposition of records, especially in light of the huge volumes of documents the National 

Archieves and Records Administration processes each year. The second most heavily 

attended event at the conference was a very informative international privacy panel 

discussion that included representatives from the Department of Commerce and the 

Department of Homeland Security and focused on privacy issues in the U. S. and the 

European Union. 

The Office of Privacy and Civil Liberties (OPCL) arranged two of the RIMM events. First, 

for the second year in a row, OPCL implemented testing for prospective privacy 

professionals seeking certification from the International Association of Privacy 

Professionals. Fourteen prospective privacy professionals, representing various Treasury 
2

bureaus as well as a handful of other federal agencies, sat for the exams in April. The 

Certified Information Privacy Professional foundation exam, along with all of the module 

exams (e.g., government, IT, and European Union) were offered during this examination 

session. Seven individuals registered for the foundation exam, four took the government 

module, four took the IT module, two took the U.S. corporate module, and one took the 

European Union data protection module. Once certified, individuals are required to complete 

a minimum number of continuing education units each year to maintain their knowledge and 

expertise. Treasury’s support of this certification process assists the Department in remaining 

compliant with federal privacy laws and ensures that its privacy professionals remain 

informed of the latest privacy issues and trends.

OPCL’s other RIMM event was an application software demonstration presented by the 

Internal Revenue Service (IRS). The Privacy Impact Assessment (PIA) Management System 

(PIAMS) is a software application that allows the IRS to fully automate the PIA process 

during the drafting, review, and approval processes. The Deputy Assistant Secretary for 

Privacy, Transparency, and Records felt this application has great potential. Therefore, she 

plans to discuss with the Executive Steering Committee the positive impact PIAMS can have 

on privacy compliance at Treasury. She will recommend that Treasury use PIAMS as an 

enterprise-wide solution that all of Treasury’s bureaus should implement. 

In addition, Treasury continues to play a leadership role in privacy and civil liberties through 

its active involvement in the Information Sharing Environment (ISE). The Director of OPCL 

serves as the chairperson of the Compliance Review Working Group, a working group of the 

ISE’s Privacy and Civil Liberties Subcommittee. In the role of chairperson, the Director of 

OPCL is guiding the development of a privacy and civil liberties checklist. Treasury’s 

Office of Intelligence and Analysis agreed to act as the pilot program for implementing a 

proposed ISE privacy and civil liberties compliance review checklist that may eventually be 

used by all federal agencies participating in the ISE. This checklist is intended to serve as a 

compilation of the privacy and civil liberties requirements and best practices derived from 

the Privacy Guidelines for the Information Sharing Environment. 

The IRS continues to undertake proactive initiatives that promote and enhance sound privacy 

practices and protect taxpayer information. For example, the IRS has assembled data on the 

number and type of unauthorized access (UNAX) violations reported from a variety of 

internal sources, including data maintained by the Treasury Inspector General for Tax 

Administration (TIGTA). It also has applied a series of analytic techniques to this data and is 

distributing the results to key stakeholders indicating trends and other information to develop 

strategies to prevent UNAX incidents. The IRS continues to receive positive feedback on the 

UNAX Mandatory Briefing given to its personnel in FY 2011.

Finally, Treasury’s mandatory privacy awareness training, A Culture of Privacy, has been

updated for 2012. The courseware was revised to include more guidance on how employees 

must protect the PII that they handle while carrying out Treasury’s mission. In addition, 

more information was added to the courseware to emphasize the importance of properly 

reporting potential and confirmed PII breaches. A Culture of Privacy Awareness for 

Executives is now available for senior leadership within the Department. This PowerPoint 
3

presentation is designed to provide the privacy fundamentals in a manner that is tailored to

the knowledge Treasury executives need to perform their functions. 

3. Quarterly Reporting Matrix

The Department uses a standard reporting framework and instructions tailored to its mission 

and functions to address Section 803 reporting requirements. In developing the framework 

and instructions, the Department collaborated with the Office of Management and Budget 

(OMB) and the other agencies required to report under this section. 

The attached reporting matrix consolidates all Treasury privacy and civil liberties activities, 

including data on the reviews conducted, reference to the advisory guidance delivered, and 

information about written complaints received and processed.

3.1. Types of Potential Complaints

3.1.1. Privacy Complaint: A privacy complaint is a written allegation of harm or 

violation of personal or information privacy filed with the Department. This 

information may include: 

 Process and procedural issues, such as consent, collection, and appropriate notice; 

 Non-Privacy Act of 1974 issues, such as Terrorist Watchlist Redress processing

or identity theft mitigation; or 

 Privacy Act of 1974 issues.

3.1.2 Civil Liberties Complaint: A written allegation of harm or violation of the 

constitutional rights afforded individuals filed with the Department. Types of 

civil liberties complaints include, but are not limited to:

 First Amendment (Freedom of speech, religion, assembly, and association);

 Fourth Amendment (Protection against unreasonable search and seizure); and

 Fifth Amendment or Fourteenth Amendment, § 1 (Due process and equal 

protection).

4. Reporting Categories

 4.1. Reviews: Reviews include Treasury privacy and civil liberties activities delineated by

controlling authorities, such as the Privacy Act of 1974, 5 U.S.C. § 552a; E-Government Act 

of 2002 (P.L. 107-347); Consolidated Appropriations Act of 2005 (P.L. 108-447); OMB

Circular A-130, Appendix 1; and OMB Memo M-07-16. Examples include:

 Privacy Threshold Analyses – review of an IT system’s use of data to determine 

whether a PIA is required;

 PIAs;
4

 OMB Memorandum 07-16 issues, including reviewing records to minimize the 

volume of PII necessary for the proper performance of an agency function, SSN

use reduction efforts, or initiatives related to combating identity theft;

 OMB Circular A-130 issues, including SORNs, routine use descriptions, Agency 

security contacts, recordkeeping and disposal policies, training practices, 

continued Privacy Act exemptions under 5 U.S.C §552a (j)(2), (k), and Computer 

Matching Programs;

 Persistent Tracking Technology features used on a website;

 Achievement of machine readability, which ensures that website users are 

automatically alerted about whether site privacy practices match their personal 

privacy preferences;

 Reviews under 5 CFR part 1320 (collection of information/Paperwork Reduction 

Act);

 Information Sharing Environment policies and system reviews; and 

 Reviews related to the OMB Circular A-11, Exhibit 300 process.

 4.2. Advice: Advice includes written policies, procedures, guidance, or interpretations of 

requirements for circumstances or business processes that respond to privacy or civil liberties 

issues or concerns. 

4.3. Response to Advice: Specific action taken in response to Treasury Advice. Examples 

of Responses to Advice include issuing a regulation, order, or directive; interpreting or 

otherwise issuing guidance as a result of Advice; reaching an agreement related to the 

Advice; and developing training programs or other procedures that enhance understanding of 

the issue that precipitated the request for Advice.

4.4. Disposition of Complaints: Treasury action in response to a privacy or civil liberties 

complaint. In response to a complaint, the Department will:

1. Take direct action (description in the summary report);

2. Refer to another agency or entity that may be able to assist in addressing the 

complaint (referral agency and explanation in summary report); or

3. Determine that no action is required (explanation in summary report).

The Department will continue to submit quarterly reports in coordination with OMB. The 

next quarterly report is due September 30, 2012, and will cover the period of June 1, 2012,

through August 31, 2012. The data collection period for each report ends approximately 30 

days prior to the report deadline.
Department of the Treasury 

Quarterly Report on Privacy and Civil Liberties Activities 

under Section 803 of the 9/11 Commission Act of 2007

May 31, 2012

Reviews Advice and Response Complaints Dispositions

Type Number Type Number Response Type Number

Privacy Threshold Analyses 

(PTAs)/Privacy Impact 

Assessments (PIAs)

11 & 36 Monthly Scan of Internet for 

Violations and Remediation 1

No Response 

Required PRIVACY 0

Elimination/Reduction of SSNs 

on IRS Forms 23 SharePoint Project Orientation 

and Protecting PII 1 No Response Required

System of Records (SOR) 

Routine Use 7

OMB Exhibits 300 Process 1

Section 508 Internet & Intranet 

Website Scans 1 and 1

5 CFR 1320, Information 

Collection 3

SOR Notices 1

Privacy Act Exemption 

Regulations 1 CIVIL LIBERTIES 0