Privacy and Civil Liberties Impact Assessment

for the Office of Financial Research Analytical Environment (OFRAE)

March 3, 2016

Reviewing Official

Helen Goff Foster

Deputy Assistant Secretary for Privacy, Transparency, and Records

Department of the Treasury

Bureau Certifying Official

Wesley Fravel

Senior Information Security Specialist - Privacy

Office of Financial Research 

Bureau Privacy and Civil Liberties Officer
2

Section 1.0: Introduction

It is the policy of the Department of the Treasury (hereinafter “Treasury” or “Department”) and its 

Bureaus to conduct a Privacy and Civil Liberties Impact Assessment (hereinafter “PCLIA”) when 

Personally Identifiable Information (hereinafter “PII”) is maintained in a system or by a project.

PCLIAs are required for all systems and projects that collect, maintain, or disseminate PII, regardless 

of the manner in which the information is retrieved.

This assessment is being completed pursuant to Section 208 of the E-Government Act of 2002

(hereinafter “E-Gov Act”), 44 U.S.C. § 3501, Office of the Management and Budget (hereinafter 

“OMB”) Memorandum 03-22, “OMB Guidance for Implementing the Privacy Provisions of the EGovernment Act of 2002,” and Treasury Directive 25-07, “Privacy and Civil Liberties Impact 

Assessment (PCLIA),” which requires Treasury Offices and Bureaus to conduct a PCLIA before:

1. developing or procuring information technology (hereinafter “IT”) systems or projects that 

collect, maintain or disseminate PII from or about members of the public, or

2. initiating, a new collection of information that: a) will be collected, maintained, or disseminated 

using IT; and b) includes any PII permitting the physical or online contacting of a specific 

individual, if identical questions have been posed to, or identical reporting requirements 

imposed on, 10 or more persons. Agencies, instrumentalities or employees of the federal 

government are not included.

This PCLIA provides the following information regarding the system or project: 

(1) an overview of its purpose and functions; 

(2) a description of the information collected; 

(3) a description of the how information is maintained, used and shared;

(4) an assessment of whether the system or project is in compliance with federal requirements that 

support information privacy; and 

(5) an overview of the redress/complaint procedures available to individuals who may be affected 

by the use or sharing of information by the system or project. 

This PCLIA is for the OFR’s Analytical Environment (OFRAE). The OFRAE was previously 

documented in the Privacy Impact Assessment (PIA), Office of Financial Research Analytical 

Environment Privacy Impact Assessment, published in October 2014. OFR is conducting this revised 

PCLIA to evaluate new privacy implications associated with introducing additional IT capabilities to 

the OFRAE.

Section 2.0: Definitions

Agency – means any entity that falls within the definition of the term “executive agency”, as defined in 

section 102 of title 31, United States Code, or “agency”, as defined in section 3502 of title 44, United 

States Code.
3

Certifying Official – The Bureau Privacy and Civil Liberties Officer(s) who certify that all 

requirements in TD and TD P 25-07 have been completed so a PCLIA can be reviewed and approved 

by the Treasury Deputy Assistant Secretary for Privacy, Transparency and Records.

Collect (including “collection”) – means the retrieval, receipt, gathering or acquisition of any PII and 

its storage or presence in a Treasury system. This term should be given its broadest possible meaning.

Contractors and service providers – include, but are not limited to, information providers, 

information processors, and other organizations providing information system development, 

information technology services, and other outsourced applications.

Data mining – The term “data mining” means a program involving pattern-based queries, searches, or 

other analyses of 1 or more electronic databases, where-- (A) a department or agency of the Federal 

Government, or a non-Federal entity acting on behalf of the Federal Government, is conducting the 

queries, searches, or other analyses to discover or locate a predictive pattern or anomaly indicative of 

terrorist or criminal activity on the part of any individual or individuals; (B) the queries, searches, or 

other analyses are not subject-based and do not use personal identifiers of a specific individual, or 

inputs associated with a specific individual or group of individuals, to retrieve information from the 

database or databases; and (C) the purpose of the queries, searches, or other analyses is not solely-- (i) 

the detection of fraud, waste, or abuse in a Government agency or program; or (ii) the security of a 

Government computer system.

Disclosure – When it is clear from its usage that the term “disclosure” refers to records provided to the 

public in response to a request under the Freedom of Information Act (5 U.S.C. 552) or the Privacy 

Act, its application should be limited in that manner. Otherwise, the term should be interpreted as 

synonymous with the terms “sharing” and “dissemination” as defined in this manual. 

Dissemination – as used in this manual is synonymous with the terms “sharing” and “disclosure”

(unless it is clear from the context that the use of the term “disclosure” refers to a FOIA/Privacy Act 

disclosure).

E-Government – the use of digital technologies to transform government operations in order to 

improve effectiveness, efficiency, and service delivery.

Federal information system – a discrete set of information resources organized for the collection, 

processing, maintenance, transmission, and dissemination of information owned or under the control of 

a federal agency, whether automated or manual.

Final rule – After the Notice of proposed rulemaking (NPRM) comment period closes, the agency 

reviews and analyzes the comments received (if any). The agency has the option-to proceed with the 

rulemaking as proposed, issue a new or modified proposal or withdraw the proposal before reaching its 

final decision. The agency can also make any revisions to the supporting analyses contained in the 

NPRM (e.g., to address a concern raised by a member of the public in response to the NPRM).

Government information – information created, collected, used, maintained, processed, 

disseminated, or disposed of by or for the Federal Government.
4

Individual – means a citizen of the United States or an alien lawfully admitted for permanent 

residence. If a question does not specifically inquire about or an issue does not clearly involve a 

Privacy Act system of records, the term should be given its common, everyday meaning. In certain 

contexts, the term individual may also include citizens of other countries who are covered by the terms 

of an international or other agreement that involves information stored in the system or used by the 

project.

Information – means any representation of knowledge such as facts, data, or opinions in any medium 

or form, regardless of its physical form or characteristics. This term should be given the broadest 

possible meaning. This term includes, but is not limit to, information contained in a Privacy Act 

system of records.

Information technology (IT) – any equipment or interconnected system or subsystem of equipment, 

used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, 

control, display, switching, interchange, transmission, or reception of data or information by the 

executive agency, if the equipment is used by the executive agency directly or is used by a contractor 

under a contract with the executive agency that requires the use: (i) of that equipment; or (ii) of that 

equipment to a significant extent in the performance of a service or the furnishing of a product. It 

includes computers, ancillary equipment (including imaging peripherals, input, output, and storage 

devices necessary for security and surveillance), peripheral equipment designed to be controlled by the 

central processing unit of a computer, software, firmware and similar procedures, services (including 

support services), and related resources; but does not include any equipment acquired by a federal 

contractor incidental to a federal contract. Clinger-Cohen Act of 1996, 40 U.S.C. § 11101(6).

Major Information system – embraces “large” and “sensitive” information systems and means “a 

system or project that requires special management attention because of its importance to an agency 

mission; its high development, operating, or maintenance costs; or its significant role in the 

administration of agency programs, finances, property, or other resources.” OMB Circular A-130,

Section 6.u. This definition includes all systems that contain PII and are rated as “MODERATE or 

HIGH impact” under Federal Information Processing Standard 199. 

National Security systems – a telecommunications or information system operated by the federal 

government, the function, operation or use of which involves: (1) intelligence activities, (2) cryptologic 

activities related to national security, (3) command and control of military forces, (4) equipment that is 

an integral part of a weapon or weapons systems, or (5) systems critical to the direct fulfillment of 

military or intelligence missions, but does not include systems used for routine administrative and 

business applications, such as payroll, finance, logistics, and personnel management. Clinger-Cohen 

Act of 1996, 40 U.S.C. § 11103. 

Notice of proposed rulemaking (NPRM) – the Privacy Act (Section (J) and (k)) allow agencies to 

use the rulemaking process to exempt particular systems of records from some of the requirements in 

the Act. This process is often, referred to as “notice-and-comment rulemaking.” The agency publishes 

an NPRM to notify the public that the agency is proposing a rule and provides an opportunity for the 

public to comment on the proposal before the agency can issue a Final rule. 

Personally Identifiable Information (PII) – “means, any information that can be used to distinguish 

or trace an individual’s identity, either alone or when combined with other personal or identifying 
5

information that is linked or linkable to a specific individual. The definition of this term also 

incorporates by reference the definition of PII in OMB Memorandum 06-191 and the definition of term 

“Information in Identifiable Form” as defined in § 208(d)2 of the E-Government Act of 2002, Pub. 

L.107-347, 116 Stat. 2899 and as further defined in OMB M 03-22.

3

Privacy and Civil Liberties Impact Assessment (PCLIA) – a PCLIA is:

(1) a process conducted to: (a) identify privacy and civil liberties risks in systems, programs 

and other activities that maintain PII; (b) ensure that information systems, programs and 

other activities comply with legal, regulatory, and policy requirements; (c) analyze the 

privacy and civil liberties risks identified; (d) identify remedies, protections and alternative 

or additional privacy controls necessary to mitigate those risks; and (e) provide notice to the 

public of privacy and civil liberties protection practices.

(2) a document that catalogues the outcome of that privacy and civil liberties risk assessment 

process.

Protected Information – as the term is used in this PCLIA, has the same definition given to that term 

in TD 25-10, Section 4.

Privacy Act Record – any item, collection, or grouping of information about an individual that is 

maintained by an agency, including, but not limited to, the individual’s education, financial 

transactions, medical history, and criminal or employment history and that contains the individual’s 

name, or the identifying number, symbol, or other identifying particular assigned to the individual, 

such as a finger or voice print or a photograph.

Reviewing Official – The Deputy Assistant Secretary, Privacy, Transparency and Records who 

reviews and approves all PCLIAs as part of their duties as a direct report to the Treasury Senior 

Agency Official for Privacy.

1 “Any information about an individual maintained by an agency, including, but not limited to, 

education, financial transactions, medical history, and criminal or employment history and 

information which can be used to distinguish or trace an individual’s identity, such as their 

name, social security number, date and place of birth, mother’s maiden name, biometric 

records, etc., including any other personal information which is linked or linkable to an 

individual.

2 “Any representation of information that permits the identity of an individual to whom the 

information applies to be reasonably inferred by either direct or indirect means.”

3 “Information in an IT system or online collection: (i) that directly identifies an individual 

(e.g., name, address, social security number or other identifying number or code, telephone 

number, email address) or (ii) by which an agency intends to identify specific individuals in 

conjunction with other data elements, i.e., indirect identification. (These data elements may 

include a combination of gender, race, birth date, geographic indicator, and other 

descriptors.)” 
6

Routine Use – with respect to the disclosure of a record outside of the Department of the Treasury 

(i.e., external sharing), the use of such record for a purpose which is compatible with the purpose for 

which it was collected.

Sharing – any Treasury initiated distribution of information to government employees or agency 

contractors or grantees, including intra- or inter-agency transfers or exchanges of Treasury information 

regardless of whether it is covered by the Privacy Act. It does not include responses to requests for 

agency records under the Freedom of Information Act (5 U.S.C. 552) or the Privacy Act. It is 

synonymous with the term “dissemination” as used in this assessment. It is also synonymous with the 

term “disclosure” as used in this assessment unless it is clear from the context in which the term is 

used that it refers to disclosure to the public in response to a request for agency records under the 

Freedom of Information Act (5 U.S.C. 552) or the Privacy Act.

System – as the term used in this manual, includes both federal information systems and information 

technology.

System of Records – a group of any records (as defined in the Privacy Act) under the control of 

Treasury from which information is retrieved by the name of the individual or by some identifying 

number, symbol, or other identifying particular assigned to the individual.

System of Records Notice – Each agency that maintains a system of records shall publish in the 

Federal Register upon establishment or revision a notice of the existence and character of the system of 

records, which notice shall include: (A) the name and location of the system; (B) the categories of 

individuals on whom records are maintained in the system; (C) the categories of records maintained in

the system; (D) each routine use of the records contained in the system, including the categories of 

users and the purpose of such use; (E) the policies and practices of the agency regarding storage, 

retrievability, access controls, retention, and disposal of the records; (F) the title and business address 

of the agency official who is responsible for the system of records; (G) the agency procedures whereby 

an individual can be notified at his request if the system of records contains a record pertaining to him; 

(H) the agency procedures whereby an individual can be notified at his request how he can gain access 

to any record pertaining to him contained in the system of records, and how he can contest its content; 

and (I) the categories of sources of records in the system.

System Owner – Official responsible for the overall procurement, development, integration, 

modification, or operation and maintenance of a system.

Section 3.0: System Overview

The OFRAE is a foundational system that supports the OFR’s mission of improving the quality, 

transparency, and accessibility of financial data and information. The OFRAE provides core and 

critical information technology support and services to OFR hosted applications and databases. The 

main components of the OFRAE are the:

− Security Environment

− Server Environment

− Virtual Desktop Environment (VDI)

− Data Environment
7

− Network Environment

− Application Environment

The OFRAE is designed to host applications and databases which process information, including PII, 

and to support transport and file storage of such information. 

Per OFR’s internal security and other assessment processes, and in accordance with Treasury policy 

and best practices, certain applications and databases hosted on the OFRAE are covered by their own 

separate PCLIAs when it is determined that those systems pose unique risks to personal privacy.

Where applicable, those PCLIAs have been referenced in this document.

Section 3.1: System/Project Description

The OFRAE is the support structure and day-to-day working environment for OFR’s employees, and 

other personnel including contractors, consultants, agents, detailees, interns, and business partners. The 

OFRAE enables the OFR to provide timely rigorous risk and stability analyses. In addition, it provides 

sufficient flexibility to support the continually evolving understanding of system risk and the changing 

needs for research and analysis.

The primary purpose of this revised PCLIA is to account for: (i) the transition of certain technical 

services from the Treasury Departmental Offices (DO) Office of the Chief Information Officer (OCIO) 

to the OFR; (ii) the introduction of two new technical services; and (iii) procured and acquired datasets 

which contain PII. 

The technical services required by OFR employees transitioned from OCIO to OFR include: the 

provision and management of end point devices such as mobile devices and laptop computers; email 

services; and remote access capabilities. In addition, OFR is also introducing a variety of new technical 

capabilities and enhancements for users of the OFRAE and internal OFR systems.

In addition to the above services, OFR has either acquired or procured datasets containing PII which 

are used by staff in their research and analysis efforts. These datasets are primarily managed within the 

OFRAE Data Environment.

OFR End Point Devices (Mobile Devices/Laptop Computers) 

OFR transitioned from OCIO-issued and managed endpoint devices (i.e., mobile devices and laptop 

computers) to OFR-issued and managed devices. OFR’s chosen desktop and mobile solutions provide 

increased performance in a form factor that meets the unique requirements of OFR staff while 

leveraging existing OFRAE security controls and configurations. Further, support for endpoint devices 

is managed through a dedicated OFR Help Desk capability.

OFR (ofr.treasury.gov) Email Services

OFR leveraged existing infrastructure capabilities provided by the OFRAE to transition e-mail services 

from the DO Exchange environment to a new Exchange environment established and managed within 

the OFRAE. 


10

Dodd-Frank Wall Street Reform Act and 

Consumer Protection Act (Pub.L. 111–203,

H.R. 4173), Section 153.

Establishes the OFR and authorizes the OFR

Director to manage administrative functions

of the office.

44 U.S.C. § 3101 Instructs the head of each federal agency to 

“make and preserve records containing 

adequate and proper documentation of the 

organization, functions, policies, decisions, 

procedures, and essential transactions of the 

agency and designed to furnish the 

information necessary to protect the legal 

and financial rights of the Government and 

of persons directly affected by the agency’s 

activities.”

Section 4.0: Information Collection

Section 4.1: Relevant and Necessary

The Privacy Act requires “each agency that maintains a system of records [to] maintain in its records

only such information about an individual as is relevant and necessary to accomplish a purpose of the 

agency required to be fulfilled by statute or by executive order of the President.” See 5 U.S.C. § 

552a(e)(1).

The Privacy Act allows federal agencies to exempt records from the relevant and necessary

requirement if certain conditions are met. This includes issuing a Notice of Proposed Rulemaking

(hereinafter “NPRM”) to solicit public opinions on the proposed exemption and issuing a Final rule

after addressing any concerns raised by the public in response to the NPRM. It is possible for some, 

but not all, of the records maintained in the system or by the project to be exempted from the Privacy 

Act through the NPRM/Final rule process.

Section 4.1(a) Please check all of the following that are true:

1. ܆ None of the PII maintained in the system or by the project is part of a Privacy Act 

system of records;

2. ܆ All of the PII maintained in the system or by the project is part of a system of records

and none of it is exempt from the Privacy Act relevant and necessary requirement;

3. ܆ All of the PII maintained in the system or by the project is part of a system of records

and all of it is exempt from the Privacy Act relevant and necessary requirement;

4. ܆ Some, but not all, of the PII maintained in the system or by the project is part of a

system of records and the records to which the Privacy Act applies are exempt from the 

relevant and necessary requirement; and

5. ܈ Some, but not all, of the PII maintained in the system or by the project is part of a

system of records and none of the records to which the Privacy Act applies are exempt 

from the relevant and necessary requirement.

Section 4.1(b) ܈ Yes ܆ No ܆ N/A With respect to PII maintained in the system or by the 

project that is subject to the Privacy Act’s relevant and necessary requirement, was an 
11

assessment conducted prior to collection (e.g., during Paperwork Reduction Act analysis) to 

determine which PII types (see Section 4.2 below) were relevant and necessary to meet the 

system’s or project’s mission requirements? 

Section 4.1(c) ܈ Yes ܆ No ܆ N/A With respect to PII maintained in the system or by the 

project that is subject to the Privacy Act’s relevant and necessary requirement, is the PII

limited to only that which is relevant and necessary to meet the system’s or project’s mission 

requirements?

Section 4.1(d) ܈ Yes ܆ No With respect to PII maintained in the system or by the project

that is subject to the Privacy Act’s relevant and necessary requirement, is there a process to 

continuously reevaluate and ensure that the PII remains relevant and necessary? 

Explanation for Answers in Sections 4.1(a) thru 4.1(d): Information processed by the OFRAE,

implicates a variety of information, including PII, some of which is subject to the Privacy Act. 

In general, PII processed by the OFRAE that is subject to the Privacy Act includes:

- Data provided from Treasury’s HRConnect system or collected directly from OFR 

employees and contractors that is used to create user accounts and grant authorized users

access to applications hosted on or supported by the OFRAE, or to conduct other similar 

routine administrative functions.

- Data provided from the SEC’s Form PF via FINRA through the transmission of Form PF 

to the OFR.

For data acquired from Treasury’s HRConnect system and the SEC’s Form PF, PII was 

collected by the Treasury Department and SEC, respectively, in accordance with rules, 

procedures, and processes specific to those agencies, including an assessment by the agency 

responsible for the original collection and maintenance of these records, to determine which 

PII types are relevant and necessary. While OFR does not oversee these assessments, it does 

limit its request for and collection of information from other Federal entities to that which is 

relevant and necessary for OFR’s purpose(s). More information about the collection and 

processing of PII included in Treasury’s HRConnect system is available in the Privacy and 

Civil Liberties Impact Assessment for the system.

For data collected to grant OFR employees, contractors, and authorized users access to 

applications and databases hosted on or supported by the OFRAE, such information is 

governed in accordance with the Treasury System of Records Notice, Treasury.015 – General 

Information Technology Access Account Records (GITAARS). This information is limited to 

that which is necessary to grant access to and use of OFR information technology resources, 

including applications and databases hosted on the OFRAE. OFR regularly reviews its user 

access processes and collections of PII to ensure the appropriate information is captured to 

ensure access to and security of OFR systems. Finally, some data collected as normal business 

operations related to engaging members of the public who partner with the OFR in support of 

its research mission, is subject to the Treasury System of Records Notice, Treasury.017 –

Correspondence and Contact Information.

Section 4.2: PII and/or information types or groupings

To perform their various missions, federal agencies must necessarily collect various types of 

information. The checked boxes below represent the types of information maintained in the system or 




16

accounts within OFRAE and other related onboarding functions provided by the OFR’s PDS.

Information from the HRConnect system is collected in accordance with procedures specific to that 

system as outlined in the HRConnect Privacy and Civil Liberties Impact Assessment.

Information not collected directly from the individual that is processed by the OFRAE includes:

- Datasets, stripped of direct identifiers or otherwise aggregated, and used for trend analysis to 

identify macro-level risks and trends in financial markets, as part of OFR’s overall research 

mission.

- Datasets which may include direct identifiers and are also used for trend analysis or to identify 

macro-level risks and trends in financial markets in support of OFR’s research mission.

Some of this data is derived from publically available sources, some is provided by other Federal 

entities, while other data is proprietary in nature. All such data is used in support of the OFR’s 

research-based mission, and generally includes things like mortgage, transactional, loan information, 

demographic, or similar data, which has been either stripped of direct identifiers or provided in 

aggregate to reduce the risk posed to personal privacy. In unique cases, OFR may receive direct 

identifying information in support of its research mission (i.e. Equilar data). Data obtained for research 

and processed through the OFRAE includes:

- Data obtained from the Financial Industry Regulatory Authority (FINRA), as directed by the 

Securities and Exchange Commission (SEC). FINRA is a private corporation that performs 

financial regulation of member brokerage firms and exchange markets that collect Form PF data on 

behalf of the SEC. Filers submit Form PF through the Private Fund Reporting Depository (PFRD). 

FINRA is the developer and operator of the PFRD system, which was developed according to the 

requirements of the SEC.

- Form PF data, which is used by the OFR to better understand the role hedge funds play in the 

financial system to monitor risks in the private fund industry, and to research threats to financial 

stability. Advisors for hedge funds and other private funds with more than $150 million in assets 

under management have been electronically filing annual portfolio information through the SEC’s 

Form PF since July 2012. The annual and quarterly filings of Form PF provide OFR with a new 

window into the activities of private funds. OFR use of Form PF data is governed by an agreement 

between the OFR and the SEC, as well as a Memorandum of Understanding signed by all of the 

Financial Stability Oversight Committee (FSOC) member agencies including OFR (“FSOC 

MOU”).

- Executive compensation data from Equilar, Inc., a commercial data provider. Equilar creates data 

products and sells third parties such as OFR, licenses to an Equilar product which includes 

information about total executive compensation packages of the top officers at publicly traded 

companies and nonprofit organizations. OFR receives the full name of the executive whose 

compensation data is collected by Equilar. Equilar collects this data from publically available 

sources such as annual corporate filings with the SEC, filings through the Department of the Labor, 

and from surveys completed by executives. 

- Bankscope data, which includes limited biographical information of public figures in the financial 

industry.

18

trade publications 

through Factiva;

− Publically available 

and proprietarily 

sourced data 

includes limited 

PII, such as loan 

level information or 

race/demographic 

information and has 

been stripped of 

direct-identifiers or 

aggregated, and is 

used for research

purposes

Manner in which 

information is 

acquired from 

source by the 

Treasury 

project/system: 

(select all that 

apply):

Manner in which 

information is 

acquired from 

source by the 

Treasury 

project/system: 

(select all that 

apply):

Manner in which 

information is 

acquired from 

source by the 

Treasury 

project/system: 

(select all that 

apply):

Manner in which 

information is 

acquired from 

source by the 

Treasury 

project/system: 

(select all that 

apply):

܆ From a paper or 

electronic form 

provided to 

individuals, the 

public or members of 

a particular group

Please identify the 

form name (or 

description) and/or 

number (e.g., OMB 

Control Number): 

_________________

܆ From a paper or 

electronic form 

provided to

individuals, the 

public or members of 

a particular group

Please identify the 

form name (or 

description) and/or 

number (e.g., OMB 

Control Number): 

_________________

܆ From a paper or 

electronic form 

provided to 

individuals, the 

public or members of 

a particular group

Please identify the 

form name (or 

description) and/or 

number (e.g., OMB 

Control Number): 

_________________

܆ From a paper or 

electronic form 

provided to 

individuals, the public 

or members of a 

particular group

Please identify the 

form name (or 

description) and/or 

number (e.g., OMB 

Control Number): 

_________________

܈ Received in paper 

format other than a 

form.

܈ Received in paper 

format other than a 

form.

܆ Received in paper 

format other than a 

form.

܆ Received in paper 

format other than a 

form.

܆ Delivered to the 

project on disk or 

other portable device 

and uploaded to the 

system.

܆ Delivered to the 

project on disk or 

other portable device 

and uploaded to the 

system.

܆ Delivered to the 

project on disk or 

other portable device 

and uploaded to the 

system.

܈ Delivered to the 

project on disk or 

other portable device 

and uploaded to the 

system.
19

܆ Accessed and 

downloaded or 

otherwise acquired 

via the internet

܈ Accessed and 

downloaded or 

otherwise acquired 

via the internet

܈ Accessed and 

downloaded or 

otherwise acquired 

via the internet

܈ Accessed and 

downloaded or 

otherwise acquired 

via the internet

 Email ܆ Email ܆ Email ܈ Email ܈

 Scanned ܈

documents uploaded 

to the system.

 Scanned ܈

documents uploaded 

to the system.

 Scanned ܆

documents uploaded 

to the system.

 Scanned ܆

documents uploaded 

to the system.

܆ Bulk transfer ܆ Bulk transfer ܆ Bulk transfer ܈ Bulk transfer

܆ Extracted from 

particular technology 

(e.g., radio frequency 

identification data 

(RFID) devices, 

video or photographic 

cameras, biometric 

collection devices).

܆ Extracted from 

particular technology 

(e.g., radio frequency 

identification data 

(RFID) devices, video 

or photographic 

cameras, biometric 

collection devices).

܆ Extracted from 

particular technology 

(e.g., radio frequency 

identification data 

(RFID) devices, video 

or photographic 

cameras, biometric 

collection devices).

܆ Extracted from 

particular technology 

(e.g., radio frequency 

identification data 

(RFID) devices, video 

or photographic 

cameras, biometric 

collection devices).

Fax ܆ Fax ܆ Fax ܈ Fax ܈

܈ Extracted from 

notes of a phone 

interview or face to 

face contact

܈ Extracted from 

notes of a phone 

interview or face to 

face contact

܆ Extracted from 

notes of a phone 

interview or face to 

face contact

܆ Extracted from 

notes of a phone 

interview or face to 

face contact

܈ Other: Please 

describe:

Acquired through 

employee’s use of 

OFRAE-hosted or 

supported applications

and databases by 

security, auditing, and 

other similar logging 

methods.

܆ Other: Please 

describe:

_________________

܈ Other: Please 

describe:

Data is acquired by 

OFR’s PDS to create

user accounts, email 

address/accounts, and 

perform similar 

onboarding functions. 

This occurs by the PDS 

sending an XML SOAP 

request to HRConnect 

for relevant 

information.

܆ Other: Please 

describe:

_________________

܆ Other: Please 

describe:

_________________

܆ Other: Please 

describe:

_________________

܆ Other: Please 

describe:

_________________

܆ Other: Please 

describe:

_________________

Section 4.4: Privacy and/or civil liberties risks related to collection



















39

remedies (e.g., a customer satisfaction unit; a complaint process) by which an individual may 

request access to and/or amendment of their information and/or contest adverse 

determinations about denial of their rights, benefits, and privileges under Federal programs 

(e.g., decisions about whether the individual will receive a financial benefit, get a clearance or 

access to a Treasury facility, obtain employment with Treasury etc.)? 

Explanation of the Answer to Section 7.0(c): Information processed by the OFRAE is not

used to make determinations about an individual’s rights, benefits, or privileges under Federal 

programs.