Privacy and Civil Liberties Impact Assessment 

for the Office of Financial Research (“OFR”) SharePoint and Collaboration 

Sites (“SharePoint”) 

September 6, 2016 

Reviewing Official 

Ryan Law

Acting Deputy Assistant Secretary 

for Privacy, Transparency, and Records 

Department of the Treasury 

Bureau/Office Certifying Official 

Wesley Fravel 

 Senior Information Security Specialist - Privacy

Office of Financial Research

 Privacy and Civil Liberties Officer 
2

Section 1.0: Introduction 

It is the policy of the Department of the Treasury (hereinafter “Treasury” or “Department”) and its 

Bureaus to conduct a Privacy and Civil Liberties Impact Assessment (hereinafter “PCLIA”) when 

Personally Identifiable Information (hereinafter “PII”) is maintained in a system or by a project. 

PCLIAs are required for all systems and projects that collect, maintain, or disseminate PII, regardless 

of the manner in which the information is retrieved. 

This assessment is being completed pursuant to Section 208 of the E-Government Act of 2002

(hereinafter “E-Gov Act”), 44 U.S.C. § 3501, Office of the Management and Budget (hereinafter 

“OMB”) Memorandum 03-22, “OMB Guidance for Implementing the Privacy Provisions of the EGovernment Act of 2002,” and Treasury Directive 25-07, “Privacy and Civil Liberties Impact 

Assessment (PCLIA),” which requires Treasury Offices and Bureaus to conduct a PCLIA before: 

1. developing or procuring information technology (hereinafter “IT”) systems or projects that 

collect, maintain or disseminate PII from or about members of the public, or

2. initiating, a new collection of information that: a) will be collected, maintained, or disseminated 

using IT; and b) includes any PII permitting the physical or online contacting of a specific 

individual, if identical questions have been posed to, or identical reporting requirements 

imposed on, 10 or more persons. Agencies, instrumentalities or employees of the federal 

government are not included.

This PCLIA provides the following information regarding the system or project: 

(1) an overview of its purpose and functions;

(2) a description of the information collected; 

(3) a description of how information is maintained, used and shared; 

(4) an assessment of whether the system or project is in compliance with federal requirements that 

support information privacy; and 

(5) an overview of the redress/complaint procedures available to individuals who may be affected 

by the use or sharing of information by the system or project. 

Section 2.0: Definitions 

Agency – means any entity that falls within the definition of the term “executive agency”, as defined in 

section 102 of title 31, United States Code, or “agency”, as defined in section 3502 of title 44, United 

States Code. 

Certifying Official – The Bureau Privacy and Civil Liberties Officer(s) who certify that all 

requirements in TD and TD P 25-07 have been completed so a PCLIA can be reviewed and approved 

by the Treasury Deputy Assistant Secretary for Privacy, Transparency and Records. 

Collect (including “collection”) – means the retrieval, receipt, gathering or acquisition of any PII and 

its storage or presence in a Treasury system. This term should be given its broadest possible meaning. 
3

Contractors and service providers – include, but are not limited to, information providers, 

information processors, and other organizations providing information system development, 

information technology services, and other outsourced applications. 

Data mining – The term “data mining” means a program involving pattern-based queries, searches, or 

other analyses of 1 or more electronic databases, where-- (A) a department or agency of the Federal 

Government, or a non-Federal entity acting on behalf of the Federal Government, is conducting the 

queries, searches, or other analyses to discover or locate a predictive pattern or anomaly indicative of 

terrorist or criminal activity on the part of any individual or individuals; (B) the queries, searches, or 

other analyses are not subject-based and do not use personal identifiers of a specific individual, or 

inputs associated with a specific individual or group of individuals, to retrieve information from the 

database or databases; and (C) the purpose of the queries, searches, or other analyses is not solely-- (i) 

the detection of fraud, waste, or abuse in a Government agency or program; or (ii) the security of a 

Government computer system. 

Disclosure – When it is clear from its usage that the term “disclosure” refers to records provided to the 

public in response to a request under the Freedom of Information Act (5 U.S.C. 552) or the Privacy 

Act, its application should be limited in that manner. Otherwise, the term should be interpreted as 

synonymous with the terms “sharing” and “dissemination” as defined in this manual. 

Dissemination – as used in this manual, is synonymous with the terms “sharing” and “disclosure” 

(unless it is clear from the context that the use of the term “disclosure” refers to a FOIA/Privacy Act 

disclosure). 

E-Government – the use of digital technologies to transform government operations in order to 

improve effectiveness, efficiency, and service delivery. 

Federal information system – a discrete set of information resources organized for the collection, 

processing, maintenance, transmission, and dissemination of information owned or under the control of 

a federal agency, whether automated or manual. 

Final rule – After the Notice of proposed rulemaking (NPRM) comment period closes, the agency 

reviews and analyzes the comments received (if any). The agency has the option-to proceed with the 

rulemaking as proposed, issue a new or modified proposal or withdraw the proposal before reaching its 

final decision. The agency can also make any revisions to the supporting analyses contained in the 

NPRM (e.g., to address a concern raised by a member of the public in response to the NPRM).

Government information – information created, collected, used, maintained, processed, 

disseminated, or disposed of by or for the Federal Government. 

Individual – means a citizen of the United States or an alien lawfully admitted for permanent 

residence. If a question does not specifically inquire about or an issue does not clearly involve a 

Privacy Act system of records, the term should be given its common, everyday meaning. In certain 

contexts, the term individual may also include citizens of other countries who are covered by the terms 

of an international or other agreement that involves information stored in the system or used by the 

project.
4

Information – means any representation of knowledge such as facts, data, or opinions in any medium 

or form, regardless of its physical form or characteristics. This term should be given the broadest 

possible meaning. This term includes, but is not limit to, information contained in a Privacy Act 

system of records.

Information technology (IT) – any equipment or interconnected system or subsystem of equipment, 

used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, 

control, display, switching, interchange, transmission, or reception of data or information by the 

executive agency, if the equipment is used by the executive agency directly or is used by a contractor 

under a contract with the executive agency that requires the use: (i) of that equipment; or (ii) of that 

equipment to a significant extent in the performance of a service or the furnishing of a product. It 

includes computers, ancillary equipment (including imaging peripherals, input, output, and storage 

devices necessary for security and surveillance), peripheral equipment designed to be controlled by the 

central processing unit of a computer, software, firmware and similar procedures, services (including 

support services), and related resources; but does not include any equipment acquired by a federal 

contractor incidental to a federal contract. Clinger-Cohen Act of 1996, 40 U.S.C. § 11101(6). 

Major Information system – embraces “large” and “sensitive” information systems and means “a 

system or project that requires special management attention because of its importance to an agency 

mission; its high development, operating, or maintenance costs; or its significant role in the 

administration of agency programs, finances, property, or other resources.” OMB Circular A-130, 

Section 6.u. This definition includes all systems that contain PII and are rated as “MODERATE or 

HIGH impact” under Federal Information Processing Standard 199.

National Security systems – a telecommunications or information system operated by the federal 

government, the function, operation or use of which involves: (1) intelligence activities, (2) cryptologic 

activities related to national security, (3) command and control of military forces, (4) equipment that is 

an integral part of a weapon or weapons systems, or (5) systems critical to the direct fulfillment of 

military or intelligence missions, but does not include systems used for routine administrative and 

business applications, such as payroll, finance, logistics, and personnel management. Clinger-Cohen 

Act of 1996, 40 U.S.C. § 11103.

Notice of proposed rulemaking (NPRM) – the Privacy Act (Section (J) and (k)) allow agencies to 

use the rulemaking process to exempt particular systems of records from some of the requirements in 

the Act. This process is often, referred to as “notice-and-comment rulemaking.” The agency publishes 

an NPRM to notify the public that the agency is proposing a rule and provides an opportunity for the 

public to comment on the proposal before the agency can issue a Final rule.

Personally Identifiable Information (PII) – “means, any information that can be used to distinguish 

or trace an individual’s identity, either alone or when combined with other personal or identifying 

information that is linked or linkable to a specific individual. The definition of this term also 

incorporates by reference the definition of PII in OMB Memorandum 06-191

 and the definition of term 

1

 “Any information about an individual maintained by an agency, including, but not limited to, 

education, financial transactions, medical history, and criminal or employment history and 

information which can be used to distinguish or trace an individual’s identity, such as their 

name, social security number, date and place of birth, mother’s maiden name, biometric 
5

“Information in Identifiable Form” as defined in § 208(d)2

 of the E-Government Act of 2002, Pub. 

L.107-347, 116 Stat. 2899 and as further defined in OMB M 03-22.

3

Privacy and Civil Liberties Impact Assessment (PCLIA) – a PCLIA is: 

(1) a process conducted to: (a) identify privacy and civil liberties risks in systems, programs 

and other activities that maintain PII; (b) ensure that information systems, programs and 

other activities comply with legal, regulatory, and policy requirements; (c) analyze the 

privacy and civil liberties risks identified; (d) identify remedies, protections and alternative 

or additional privacy controls necessary to mitigate those risks; and (e) provide notice to the 

public of privacy and civil liberties protection practices. 

(2) a document that catalogues the outcome of that privacy and civil liberties risk assessment 

process.

Protected Information – as the term is used in this PCLIA, has the same definition given to that term 

in TD 25-10, Section 4. 

Privacy Act Record – any item, collection, or grouping of information about an individual that is 

maintained by an agency, including, but not limited to, the individual’s education, financial 

transactions, medical history, and criminal or employment history and that contains the individual’s 

name, or the identifying number, symbol, or other identifying particular assigned to the individual, 

such as a finger or voice print or a photograph. 

Reviewing Official – The Deputy Assistant Secretary, Privacy, Transparency and Records who 

reviews and approves all PCLIAs as part of their duties as a direct report to the Treasury Senior 

Agency Official for Privacy. 

Routine Use – with respect to the disclosure of a record outside of the Department of the Treasury 

(i.e., external sharing), the use of such record for a purpose which is compatible with the purpose for 

which it was collected. 

Sharing – any Treasury initiated distribution of information to government employees or agency 

contractors or grantees, including intra- or inter-agency transfers or exchanges of Treasury information 

regardless of whether it is covered by the Privacy Act. It does not include responses to requests for 

records, etc., including any other personal information which is linked or linkable to an 

individual.

2 “Any representation of information that permits the identity of an individual to whom the 

information applies to be reasonably inferred by either direct or indirect means.” 

3 “Information in an IT system or online collection: (i) that directly identifies an individual 

(e.g., name, address, social security number or other identifying number or code, telephone 

number, email address) or (ii) by which an agency intends to identify specific individuals in 

conjunction with other data elements, i.e., indirect identification. (These data elements may 

include a combination of gender, race, birth date, geographic indicator, and other 

descriptors.)”
6

agency records under the Freedom of Information Act (5 U.S.C. 552) or the Privacy Act. It is 

synonymous with the term “dissemination” as used in this assessment. It is also synonymous with the 

term “disclosure” as used in this assessment unless it is clear from the context in which the term is 

used that it refers to disclosure to the public in response to a request for agency records under the 

Freedom of Information Act (5 U.S.C. 552) or the Privacy Act. 

System – as the term used in this manual, includes both federal information systems and information 

technology.

System of Records – a group of any records (as defined in the Privacy Act) under the control of 

Treasury from which information is retrieved by the name of the individual or by some identifying 

number, symbol, or other identifying particular assigned to the individual. 

System of Records Notice – Each agency that maintains a system of records shall publish in the 

Federal Register upon establishment or revision a notice of the existence and character of the system of 

records, which notice shall include: (A) the name and location of the system; (B) the categories of 

individuals on whom records are maintained in the system; (C) the categories of records maintained in 

the system; (D) each routine use of the records contained in the system, including the categories of 

users and the purpose of such use; (E) the policies and practices of the agency regarding storage, 

retrievability, access controls, retention, and disposal of the records; (F) the title and business address 

of the agency official who is responsible for the system of records; (G) the agency procedures whereby 

an individual can be notified at his request if the system of records contains a record pertaining to him; 

(H) the agency procedures whereby an individual can be notified at his request how he can gain access 

to any record pertaining to him contained in the system of records, and how he can contest its content; 

and (I) the categories of sources of records in the system. 

System Owner – Official responsible for the overall procurement, development, integration, 

modification, or operation and maintenance of a system. 

Section 3.0: System Overview 

Microsoft SharePoint (“SharePoint”) is an application providing an information-sharing platform, document 

management platform, and workflow platform that allows users within an organization to collaborate, share, and 

manage electronic information within workgroups and project teams. 

Through SharePoint, organizations can build unique sites where users can easily share files, engage in 

simultaneous editing of documents, and create document libraries and knowledge bases. SharePoint uses central 

management, governance, and security controls to facilitate monitoring and maintenance of content within the 

total environment and within specific SharePoint sites. 

OFR is conducting this PCLIA to evaluate the general privacy risks involved in deploying SharePoint. 

Section 3.1: System/Project Description 

Currently, OFR leverages Microsoft SharePoint 2013 as deployed enterprise-wide across Treasury. The system 

runs on Treasury’s internal servers, and Treasury SharePoint sites are not accessible to anyone outside of the 

Treasury. OFR staff use SharePoint to effectively and efficiently perform the OFR’s research and other 

activities.


9

3. ܆ All of the PII maintained in the system or by the project is part of a system of records

and all of it is exempt from the Privacy Act relevant and necessary requirement; 

4. ܆ Some, but not all, of the PII maintained in the system or by the project is part of a 

system of records and the records to which the Privacy Act applies are exempt from the 

relevant and necessary requirement; and 

5. ܈ Some, but not all, of the PII maintained in the system or by the project is part of a 

system of records and none of the records to which the Privacy Act applies are exempt 

from the relevant and necessary requirement.

Section 4.1(b) ܈ Yes ܆ No ܆ N/A With respect to PII maintained in the system or by the 

project that is subject to the Privacy Act’s relevant and necessary requirement, was an 

assessment conducted prior to collection (e.g., during Paperwork Reduction Act analysis) to 

determine which PII types (see Section 4.2 below) were relevant and necessary to meet the 

system’s or project’s mission requirements? 

Section 4.1(c) ܈ Yes ܆ No ܆ N/A With respect to PII maintained in the system or by the 

project that is subject to the Privacy Act’s relevant and necessary requirement, is the PII

limited to only that which is relevant and necessary to meet the system’s or project’s mission 

requirements? 

Section 4.1(d) ܈ Yes ܆ No With respect to PII maintained in the system or by the project 

that is subject to the Privacy Act’s relevant and necessary requirement, is there a process to 

continuously reevaluate and ensure that the PII remains relevant and necessary? 

Explanation for Answers in Sections 4.1(a) thru 4.1(d): OFR SharePoint sites do not currently 

operate as a Privacy Act System of Records (SORs), however, they may be used to process and store 

information that is subject to the Privacy Act. 

Information subject to the provisions of the Privacy Act stored within or processed by OFR SharePoint 

sites is generally limited to that which is covered by: 

Treasury .014 – Department of the Treasury SharePoint User Profile Services: Includes employee, 

contractor, and other personnel information included in the tool (i.e. contact information, limited 

biographical information used in org charts, contact lists, etc.) 

Treasury .015 – General Information Technology Access Account Records: Includes information 

from OFR employees, contractors, and other personnel that is used to populate OFR’s access 

management system and grant authorized users access to the SharePoint application, or to conduct 

other similar routine administrative functions). 

Treasury .001 – Treasury Personnel and Payroll System: Includes employment information, resumes, 

CVs, and similar information of current and prospective OFR employees, contractors, and other 

personnel. 

Treasury .017 – Correspondence and Contact Information: Includes information related to engaging 

members of the public who partner with the OFR in support of its research mission. 

In general, most of the data, including PII, maintained or processed in OFR SharePoint sites is not 

collected by the OFR directly. Data is derived from primary sources or source systems and then 

leveraged within SharePoint sites as necessary for a specific business purpose or need. For each 

primary data source subject to the Privacy Act, PII was collected by the Treasury Department directly, 

in accordance with Treasury-wide rules, procedures, and processes, including an assessment to 

11

SharePoint environment or where 

such information is shared in the 

resume of a prospective OFR 

employee. 

܈ Home Physical Mailing 

Address

܆ Citizenship ܆ Marital Status 

܈ Personal Cell Number ܆ Nationality ܆ Mother’s Maiden Name 

܈ Personal Home Phone 

or Fax Number 

܆ Country of Birth ܈ Spouse Information* 

*Generally limited to that which 

may be included in Emergency 

Contact information referenced 

below.

܈ Personal e-mail address ܆ City or County of Birth ܈ Children Information* 

*Limited to OFR employees who 

participate in annual “Bring Your 

Child to Work Day”

܆ Alias (including 

nickname) 

܆ Immigration Status ܆ Information about other 

relatives. 

܈ Education Information* 

*To include resumes and CVs of 

board members and researchers 

conducting research on behalf of 

OFR, as well as OFR employees, 

contractors, and applicants for 

OFR positions. May also include 

limited educational information 

included by OFR employees on 

their “My Site” profile within 

the OFR SharePoint 

environment.

܆ Religion/Religious 

Preference

܆ References or other 

information about an 

individual’s friends, 

associates or acquaintances. 

܆ Personal Financial 

Information (including loan 

information) 

܆ Passport Information ܆ Global Positioning System 

(GPS)/Location Data 

܆ Sexual Orientation ܆ User names, avatars etc. ܆ Secure Digital (SD) Card 

or Other Data stored on a card 

or other technology 

܆ Cell tower records (e.g., 

logs. user location, time 

etc.)

܈ Contact lists and 

directories

܈ Other (please describe):

Emergency contact information of 

OFR employees, contractors, and 

other personnel including names, 

personal phone numbers and email 

addresses. See below.

 Network ܆

communications data 

܆ Device settings or 

preferences (e.g., security 

level, sharing options, 

ringtones).

܆ Other (please describe):

܆ Other (please describe): ܆ Other (please describe): 













25

order to access an OFR draft white paper, a piece of 

correspondence, or a resume of potential candidates for a detail 

assignment with OFR. In both of these scenarios, access is 

limited to those with a clearly defined business need-to-know, 

and in accordance with the policies and procedures established 

for the OFR SharePoint environment. 

PII Shared PII shared is limited to that which is necessary for a specific 

business purpose or request as described above in “Purpose of 

Sharing.”

Applicable Statutory or

Regulatory or

Restrictions on 

Information Shared 

OFR has a statutory obligation under the Dodd-Frank Act 

(“Act”) to protect proprietary data from unauthorized 

disclosure. That said, by policy, users are prohibited from 

storing sensitive or confidential information in areas of the 

SharePoint environment, not deemed appropriate for such data. 

Further, OFR employees are strongly discouraged from storing 

such data, including confidential data, or data otherwise subject 

to similar restrictions (proprietary, etc.) within the SharePoint 

environment. Administrators for each SharePoint site are 

responsible (by policy) for regularly reviewing their sites to 

ensure only appropriate information is maintained or processed 

by the system.

Applicable Restrictions 

Imposed by Agreement 

on Information Shared 

(e.g., by Treasury 

agreement with the 

party that provided the 

information to 

Treasury) 

Where applicable, data referenced above are subject to a form of written 

agreement including licenses, information sharing agreements and 

memoranda of understanding. Each agreement contains provisions 

related to the access, use and disclosure of the data and other information 

provided under the agreement. A copy of each contract is maintained on 

file by Treasury Bureau of Financial Services (BFS) and OFR. All other 

agreements are maintained on file by the OFR Chief Counsel. However, 

as discussed, OFR employees are strongly discouraged from storing such 

data, including confidential data, or data otherwise subject to similar 

restrictions (proprietary, etc.) within the SharePoint environment. 

Administrators for each SharePoint site are responsible (by policy) for 

regularly reviewing their sites to ensure only appropriate information is 

maintained or processed by the system. 

Name and Description 

of MOU or Other 

Agreement Restricting 

Treasury’s Internal 

Use, Maintenance, 

Handling or Sharing of 

PII Received 

See above.

Method of PII Transfer 

(e.g., paper/ oral 

disclosures/ magnetic 

disk/portable

device/email fax/other 

(please describe if 

other)

The method of PII transfer within the SharePoint environment 

and SharePoint sites is electronic only. 











37

Responsible Officials 

Mario Nardoni 

Associate Director, Analytic Systems 

Office of Financial Research 

U.S. Department of the Treasury 

John Talbot 

Chief Technology Officer 

Office of Financial Research 

U.S. Department of the Treasury 

Ryan Law 

Deputy Assistant Secretary for Privacy, Transparency, and Records 

U.S. Department of the Treasury 

Approval Signature

_________________ _

John Talbot 

Chief Technology Officer 

Office of Financial Research 

U.S. Department of the Treasury 

________________ _____________

Mario Nardoni 

Associate Director, Analytic Systems 

Office of Financial Research 

U.S. Department of the Treasury 

________________________________

Ryan Law 

Deputy Assistant Secretary for Privacy, 

Transparency and Records 

U.S. Department of the Treasury

Mario A. Nardoni

Digitally signed by Mario A. Nardoni 

Date: 2016.09.12 14:43:03 -04'00'

John R. Talbot

Digitally signed by John R. Talbot 

Date: 2016.09.20 11:07:15 -04 00

Digitally signed by Ryan A. Law 

Date: 2016.09.20 15:39:19 -04 00