For technical questions regarding this directive, please contact Lee Eiden via e-mail or by 

telephone at 202-245-6454. 

DEPARTMENTAL DIRECTIVE

OM:6-105 Page 1 of 21 

(12/04/200601/22/2007)

Distribution: Approved by: /s/ 

All Department of Education employees Michell C. Clark 

Assistant Secretary for Management 

Computer Matching Agreements 

Table of Contents

I. Purpose..........................................................................................................2

II. Policy.............................................................................................................2

III. Authorization.................................................................................................2

IV. Applicability..................................................................................................3

V. Definitions.....................................................................................................4

VI. Responsibilities .............................................................................................7

VII. Procedures and Requirements.....................................................................10

Appendix A – Components of CMAs......................................................................16

Appendix B – Guidance for Preparing a CMA Cost/Benefit Analysis ...................17

Appendix C – Process Flow and Sample Scenarios ................................................19

ADMINISTRATIVE COMMUNICATIONS SYSTEM 

U.S. DEPARTMENT OF EDUCATION 
OM:6-105 Page 2 of 21 (01/22/2007)

I. Purpose 

This directive describes the policies, responsibilities, and procedures related to the 

Department of Education’s (Department’s) use of computer matching agreements 

(CMAs). CMAs are required for a computerized comparison of two or more automated 

systems of records or a system of records with non-Federal records for the purposes of 

establishing or verifying that the recipients of Federal benefits are in fact eligible to 

receive such benefits or recouping payments or for recouping delinquent debts under 

Federal benefit programs. CMAs are also required for a computerized comparison of two 

or more automated Federal personnel or payroll system of records or a system of Federal 

personnel or payroll records with non-Federal records. Because CMAs involve the use of 

personally identifiable information contained in a system of records, the provisions of the 

Privacy Act of 1974, as amended, 5 U.S.C. § 552a (Privacy Act) apply to the use of 

CMAs.

II. Policy

It is the policy of the Department to: 

A. Comply with the Computer Matching and Privacy Protection Act of 1988, 

amending the Privacy Act of 1974, 5 U.S.C. § 552a, in conducting computermatching activities and with respect to the activities of the Department’s Data 

Integrity Board (DIB). 

B. Safeguard personal privacy in the collection, maintenance, use and dissemination 

of personally identifiable records about individuals, and make such records 

available to individuals, in accordance with the requirements of the Privacy Act of 

1974, 5 U.S.C. § 552a, as amended. 

III. Authorization

The Computer Matching and Privacy Protection Act of 1988 (Pub. L. No. 100-503) 

amended the Privacy Act to add several new provisions. See 5 U.S.C. § 552a(a)(8)-(13), 

(e)(12), (o), (p), (q), (r) and (u) (2000). These provisions added procedural requirements 

for agencies to follow when engaging in computer-matching activities; provided 

matching subjects with opportunities to receive notice and to refute adverse information 

before having a benefit denied or terminated; and required that agencies engaged in 

matching activities establish Data Integrity Boards to oversee those activities. These 

provisions became effective on December 31, 1989. Subsequently, Congress enacted the 

Computer Matching and Privacy Protection Amendments of 1990 (Pub. L. No. 101-508), 

which further clarified the due process provisions found in subsection (p) of 552a. 

References: 
OM:6-105 Page 3 of 21 (01/22/2007)

• U.S. Department of Justice, Overview of the Privacy Act of 1974, May 2004, 

available at: http://www.usdoj.gov/04foia/04_7_1.html; 

• Public Law 100-503, the Computer Matching and Privacy Protection Act of 1988, 

amending the Privacy Act of 1974, 5 U.S.C. § 552a, available at: 

http://www.usdoj.gov/foia/privstat.htm; 

• The Department’s Privacy Act Regulations published in 34 C.F.R. Part 5b, available 

at: http://www.gpoaccess.gov/cfr/index.html (search term=34CFR5b); 

• The Department’s Privacy Act ACS Directive, The Privacy Act of 1974 (The 

Collection, Use, and Protection of Personally Identifiable Information), available at: 

http://wdcrobiis08/doc_img/acs_om_6_104.doc; 

• Office of Management and Budget (OMB), Privacy Act of 1974; Final Guidance 

Interpreting the Provisions of Public Law 100-503, the Computer Matching and 

Privacy Protection Act of 1988, 54 FR 25818 (June 19, 1989); available at: 

http://www.whitehouse.gov/omb/inforeg/final_guidance_pl100503.pdf; 

• Computer Matching and Privacy Protection Amendments of 1990 and the Privacy 

Act of 1974, 56 FR 18599 (April 23, 1991), available at: 

http://www.whitehouse.gov/omb/inforeg/computer_amendments1991.pdf; 

• Appendix I to OMB Circular No. A-130, “Federal Agency Responsibilities for 

Maintaining Records About Individuals,” (November 28, 2000), available at: 

http://www.whitehouse.gov/omb/circulars/a130/appendix_i.pdf; 

• OMB, M-01-05, “Guidance on Inter-Agency Sharing of Personal Data - Protecting 

Personal Privacy,” (December 20, 2000), available at: 

http://www.whitehouse.gov/omb/memoranda/m01-05.html; 

• The Department’s Interagency Agreements ACS Directive, available at: 

http://wdcrobiis08/doc_img/acs_opepd_1_101.doc; 

• The Department’s Computer Matching Agreement Calendar, available at: 

http://connected/index.cfm?navid=321; and

• The Department’s Data Integrity Board Charter, available at:

http://wdcrobiis09/doc_img/2006dibc.pdf. 

IV. Applicability

This directive applies to all Department employees and contractors. 
OM:6-105 Page 4 of 21 (01/22/2007)

V. Definitions 

Because the Computer Matching and Privacy Protection Act is an amendment to the 

Privacy Act of 1974, all provisions of this Act should be read within the context of the 

Privacy Act. All terms defined in the Privacy Act apply. For a comprehensive list of the 

definitions listed in the Department’s ACS Directive on the Privacy Act of 1974, please 

see OM:6-104, referenced above. 

Several of the more pertinent terms and their definitions are listed below: 

A. 12-month 

Renewal This is a 12-month renewal of an 18-month agreement that requires 

the Data Integrity Board to take action within 3 months before the 

expiration of an 18-month agreement. This renewal can be done 

without additional review for a current, ongoing matching program 

for not more than one additional year if-- 

(i) such program will be conducted exactly (or with non-substantive 

changes) as described in the original agreement; and 

(ii) each party to the agreement certifies to the Board in writing that 

the program has been conducted in compliance with the 

agreement.

 (5 U.S.C. § 552a(o)(2)(D)). 

B. 18-month 

Agreement 

An agreement shall remain in effect only for such period, not to 

exceed 18 months, as the Data Integrity Board of the agency 

determines is appropriate in light of the purposes, and length of time 

necessary for the conduct, of the matching program. 

(5 U.S.C. § 552a(o)(2)(C)). 

C. Data 

Integrity 

Board 

The Federal agency board oversees and coordinates various 

provisions of the Privacy Act as it relates to the Department’s 

participation in matching programs. Each Data Integrity Board: 

(A) shall review, approve, and maintain all written agreements for 

receipt or disclosure of agency records for matching programs and 

all relevant statutes, regulations, and guidelines; 

(B) shall review all matching programs in which the agency has 

participated during the year, either as a source agency or recipient 

agency, determine compliance with applicable laws, regulations, 

guidelines, and agency agreements, and assess the costs and benefits 

of such programs; 

(C) shall review all recurring matching programs in which the 

agency has participated during the year, either as a source agency or 

recipient agency, for continued justification for such disclosures; 

(D) shall compile an annual report, which shall be submitted to the 

head of the agency and the Office of Management and Budget 
OM:6-105 Page 5 of 21 (01/22/2007)

(OMB) and made available to the public on request, describing the 

matching activities of the agency, including-- 

(i) matching programs in which the agency has participated 

as a source agency or recipient agency; 

(ii) matching agreements proposed that were disapproved 

by the Board; 

(iii) any changes in membership or structure of the Board in 

the preceding year; 

(iv) the reasons for any waiver of the requirement for 

completion and submission of a cost-benefit analysis prior 

to the approval of a matching program; 

(v) any violations of matching agreements that have been 

alleged or identified and any corrective action taken; and 

(vi) any other information required by the Director of the 

OMB to be included in such report; 

(E) shall serve as a clearinghouse for receiving and providing 

information on the accuracy, completeness, and reliability of records 

used in matching programs; 

(F) shall provide interpretation and guidance to agency components 

and personnel on the requirements for matching programs; 

(G) shall review agency recordkeeping and disposal policies and 

practices for matching programs; and 

(H) may review and report on any agency matching activities that 

are not matching programs. 

 (5 U.S.C. § 552a(u)(3)). 

D. Federal 

benefit 

program 

Any program administered or funded by the Federal Government, or 

by any agent or State on behalf of the Federal Government, providing 

cash or in-kind assistance in the form of payments, grants, loans, or 

loan guarantees to individuals. (5 U.S.C. § 552a(a)(12)). 

E. Matching 

Agency 

Generally, the recipient Federal agency (or the Federal source agency 

in a match conducted by a non-Federal agency) is the matching 

agency and is responsible for meeting the reporting and publication 

requirements associated with the matching program. However, in 

large, multi-agency matching programs, where the recipient agency is 

merely performing the matches and the benefit accrues to the source 

agencies, the partners should assign responsibility for compliance 

with the administrative requirements in a fair and reasonable way. 

This may mean having the matching agency carry out these 
OM:6-105 Page 6 of 21 (01/22/2007)

requirements for all parties, having one participant designated to do 

so, or having each source agency do so for its own matching 

program(s). (OMB Circular Number A-130, Appendix I). 

F. Matching 

program 

Any computerized comparison of two or more automated systems of 

records or a system of records with non-Federal records for the 

purposes of establishing or verifying the eligibility of, or continuing 

compliance with, statutory or regulatory requirements by applicants 

for, recipients or beneficiaries of, participants in, or providers of 

services with respect to cash or in-kind assistance or payments under 

Federal benefit programs, or for the purpose of recouping payments 

or delinquent debts under such Federal benefit programs. A 

“matching program” also includes matches using automated records 

from Federal personnel or payroll systems of records. A “matching 

program" requires the comparison of records using a computer. 

(Manual comparisons are not covered under this definition, although 

OMB Guidance states that manual data sharing methods should not 

be used just to avoid the reach of the Computer Matching and 

Privacy Protection Act where the Act’s application would otherwise 

be reasonable and proper.) The Computer Matching and Privacy 

Protection Act covers two kinds of matching programs: (1) matches 

involving Federal benefits programs; and, (2) matches using 

automated records from Federal personnel or payroll systems of 

records. See 5 U.S.C. § 552a(a)(8) and the OMB Final Guidance for 

specific exclusions, interpretations and restrictions of matching 

programs. 

G. Recipient 

agency 

Any agency, or contractor thereof, that receives records contained in 

a system of records from a source agency for use in a matching 

program. (5 U.S.C. § 552a(a)(9)). 

 

H. Record Any item, collection, or grouping of information about an individual 

that is maintained by an agency, including, but not limited to, the 

individual's education, financial transactions, medical history, and 

criminal or employment history and that contains the individual's 

name, or the identifying number, symbol, or other identifying 

particular assigned to the individual, such as a finger or voice print or 

a photograph. (5 U.S.C. § 552a(a)(4)). 

 

I. Source 

agency 

Any agency that discloses records contained in a system of records to 

be used in a matching program, or any State or local government, or 

agency thereof, that discloses records to be used in a matching 

program. (5 U.S.C. § 552a(a)(11)). 

J. System of 

Records 

A group of any records under the control of any agency from which 

information is retrieved by the name of the individual or by some 
OM:6-105 Page 7 of 21 (01/22/2007)

identifying number, symbol, or other identifying particular assigned 

to the individual. (5 U.S.C. § 552a(a)(5)). 

VI. Responsibilities

A. Secretary

The Secretary is responsible for designating the senior agency officials who will 

comprise the Data Integrity Board (DIB). 

B. Assistant Secretary for Management (ASM)

The Assistant Secretary for Management is the Department’s principal contact for 

privacy policies and CMAs. The ASM provides overall management and policy 

guidance to ED’s Privacy Act Program and serves as chairperson of the DIB. 

C. Data Integrity Board 

DIB members, as designated by the Secretary in the Charter for the DIB, include 

the ASM, Director of the Budget Service, Inspector General, Chief Information 

Officer, General Counsel, and Assistant Secretary for Postsecondary Education. 

The latter two members may delegate their appointments to senior officials 

reporting directly to them. 

The DIB shall: 

1. Oversee and coordinate the implementation of the Privacy Act, as amended, 5 

U.S.C. § 552a, as it relates to the Department’s participation in matching 

programs; 

2. Review, approve, and maintain all of the Department’s CMAs; 

3. Review annually each ongoing matching program in which the Department 

has participated during the year in order to: (1) ensure that the statutory and 

regulatory requirements, OMB guidelines, and Agency policies have been 

met; (2) assess the costs and benefits of the matching program; and (3) 

determine if the matching program should be continued; 

4. Review the Department’s record-keeping and disposal policies and practices 

for matching programs; 

5. Provide interpretation and guidance to the Department’s staff on the 

requirements for matching programs; 
OM:6-105 Page 8 of 21 (01/22/2007)

6. Serve as the Department’s clearinghouse for receiving and giving information 

on the accuracy, completeness, and reliability of records used in matching 

programs; 

7. Report CMAs to Congress and OMB; and 

8. Submit an annual report on matching activities to the Secretary and to OMB 

and any OMB-required Biennial Matching Activity Report to OMB. 

The DIB may also review and report on any Department matching activities 

that are not defined as matching programs under the Computer Matching and 

Privacy Protection Act. 

D. Regulatory Information Management Services (RIMS) Privacy Officer

The Office of Management (OM)/RIMS Director is the Privacy Officer and is 

responsible for managing the Department’s Privacy Act Program. The Privacy 

Officer administers activities related to the establishment, alteration or 

termination of Systems of Records and CMAs. In this capacity, the Privacy 

Officer or designee shall serve as Secretary to the DIB and perform the following 

duties and responsibilities: 

1. Review and approve regulations and the submission of directives regarding 

Computer Matching and Privacy Protection Act administration; 

2. Review new CMAs, 12-Month Renewals of Existing Matching Programs, 

Cost-Benefit Analyses, New or Altered Matching Program Notices, and New 

or Altered Matching Program Reports prior to submission to the Department’s 

DIB; ensure that the foregoing documentation has also been reviewed by the 

Office of the General Counsel (OGC) prior to submission to the Department’s 

DIB; ensure the submission to the DIBs of both the recipient and source 

agencies for their review and approval of all new CMAs and 12-Month 

Renewals of Existing Matching Programs; ensure the submission to both the 

source and recipient agencies for their review and approval of all new CMAs 

and 12-Month Renewals of Existing Matching Programs; ensure that the 

Department’s DIB transmits any New or Altered Matching Program Reports 

to OMB and Congress, ensure that OGC transmits any New or Altered 

Matching Program Notices for publication in the Federal Register; and 

transmit to the Principal Office (PO), OGC, and the DIB copies of final 

CMAs, 12-Month Renewals of Existing Matching Program, Cost-Benefit 

Analyses, New or Altered Matching Program Notices, and New or Altered 

Matching Program Reports; 

3. Establish a program periodically to review record-keeping policies and 

practices within the Department, in compliance with the Privacy Act; 
OM:6-105 Page 9 of 21 (01/22/2007)

4. Consult with OGC on all legal matters related to implementation of the 

Computer Matching and Privacy Protection Act within the Department; 

5. Develop procedures and documents required to implement the Computer 

Matching and Privacy Protection Act, including reporting formats, directives, 

reports, and handbooks, in compliance with statutory and regulatory 

requirements and OMB Guidelines; 

6. Provide technical assistance to system and program managers, as needed, in 

the development of the documentation required for CMAs; 

7. Prior to consideration of all CMAs and 12-Month Renewals of Existing 

Matching Programs by the Department’s DIB, review all documentation to 

ensure compliance with statutory and regulatory requirements, the OMB 

Guidelines, and Department policy; and 

8. Establish and maintain a list of CMA effective dates and expirations. 

E. Principal Officers 

Principal Officers shall: 

1. Oversee the design, negotiation, development, and preparation of CMAs, and 

all related documents, including any required New or Altered Matching 

Program Notice when the Department is the Matching Agency, any required 

New or Altered Matching Program Report when the Department is the 

Matching Agency, the cost/benefit analysis, the 12-Month Renewal of an 

Existing Matching Program, and any required Inter-Agency Transfer of Funds 

Forms. 

2. Submit Draft and Final CMAs to the source agency for review and approval. 

3. Ensure that clearance actions are coordinated with OGC and the Data Integrity 

Board through the DIB Secretary as described in Section VII.A. 

4. Ensure that all Department employees and contractors in that PO who conduct 

activities under a matching program are aware of their responsibility for: 

a. Protecting information on individuals that is in identifiable form in 

accordance with the provisions of the Privacy Act, as amended; and 

b. Complying with the terms of CMAs. 

F. Office of the General Counsel
OM:6-105 Page 10 of 21 (01/22/2007)

OGC is responsible for interpreting the Privacy Act, as amended. OGC will 

review for legal sufficiency CMAs, 12-Month Renewals of Existing Matching 

Programs, Cost-Benefit Analyses, any New or Altered Matching Program Notices 

that are required when the Department is the Matching Agency, and any New or 

Altered Matching Program Reports that are required when the Department is the 

Matching Agency. OGC also submits for Departmental clearance any required 

New or Altered Matching Program Notices and transmits the New or Altered 

Matching Program Notice to the Federal Register for publication. 

G. Inspector General

The Privacy Act provides that the records provided by the source agency can be 

disclosed to the Office of Inspector General (OIG) if the disclosure is essential to 

the conduct of the matching program or required by law (5 U.S.C. § 

552a(o)(1)(H)). The "required by law" standard is satisfied if the OIG requests 

access to the records in order to carry out its oversight of Department programs 

and operations. Section 6(a)(1) of the Inspector General Act requires that the 

Inspector General be given access to records "which relate to programs and 

operations with respect to which the Inspector General has responsibilities under" 

the Inspector General Act. The “essential to conduct of the matching program” 

standard is satisfied if the matching program uncovers activity warranting civil or 

criminal law enforcement investigation or prosecution. 

H. Contractors

All Department contracts that provide for the design, development, or operation 

of a system of records on individuals on behalf of the Department to accomplish 

an ED function must contain provisions from the Federal Acquisition Regulations 

that apply the requirements of the Privacy Act of 1974, 5 U.S.C. 552a, and 

applicable agency regulations, 34 C.F.R. Part 5b, to Government contracts. These 

provisions from the Federal Acquisition Regulations are contained at 48 C.F.R. 

Subpart 24.1 and 48 C.F.R. Sections 52.224-1 and 52.224-2. Where the contract 

contains this provision, a contractor and any employee of such contractor shall be 

considered "employees" of the Department for purposes of the criminal penalties 

of the Act, 5 U.S.C. 552a(i), as well as the Department employee standards of 

conduct, contained at 34 C.F.R. Part 5b, Appendix A. 

VII. Procedures and Requirements

A. Computer Matching Agreements

1. Requirement. A CMA is required for matching programs. 

2. 18-month CMAs 
OM:6-105 Page 11 of 21 (01/22/2007)

a. Periodicity. CMAs are established for an 18-month period. Within three 

months prior to the expiration of the 18-month CMA, the DIBs can extend 

a CMA for a single 12-month period if the matching program will be 

conducted exactly (or with non-substantive changes) as described in the 

original CMA and each party to the CMA certifies in writing that the 

matching program has been conducted in compliance with the CMA . 

b. Components. CMAs should include the information listed in Appendix A, 

Part 1 “CMAs” of this Directive. 

c. Procedures. 

(1) Approximately eight months before the proposed effective date, the 

PO proposing the CMA considers each of the components listed in 

Appendix A, Part 1 “CMAs” of this Directive, and prepares documents 

in consultation with the source/recipient agency. See sample 

timeframe and process in Appendix C. 

(2) Approximately six months before the proposed effective date of a 

CMA, the PO provides the following documents to OGC: 

• Draft 18-month CMA; 

• When the matching program is being continued, the documents 

used for the expiring matching program: i.e., the existing 18-

month CMA, the 12-month draft renewal, the new or altered 

matching program notice, and the new or altered matching 

program report; 

• Draft cost/benefit analysis; 

• If the Department is the Matching Agency, the draft, New or 

Altered Matching Program Notice for publication in the 

Federal Register; and 

• If the Department is the Matching Agency, the draft new or 

altered matching program reports to the Administrator of the 

Office of Information and Regulatory Affairs, OMB and the 

Chairs of two Congressional committees (House Committee on 

Government Reform and the Senate Committee on Homeland 

Security and Governmental Affairs). 

(3) OGC reviews the documents for legal sufficiency within 30 days and 

returns to the PO for revision. 

(4) The PO then completes revisions, obtains concurrence from OGC, and 

then forwards the proposed documents to the appropriate contact in the 

counterpart source/recipient agency. (See Appendix C for typical 

flow.) 
OM:6-105 Page 12 of 21 (01/22/2007)

(5) Once both agencies concur, the respective agency Principal Officers 

that are party to the CMA sign the CMA. If the other party is a 

Federal agency, then the PO ensures that the other agency’s DIB signs 

the CMA. 

(6) The respective Federal agency Principal Officers then must send the 

documents (see c(2) of this section) to the PO for the review and 

clearance by the Department’s DIB (electronic versions are preferred). 

(7) The DIB Secretary distributes the package to all DIB members. 

(8) The DIB has the authority to approve or disapprove the proposed 

CMA. If a majority of the DIB members, and there must be at least 

four DIB members voting, vote for approval, the DIB Secretary will so 

note and request the DIB Chairperson officially approve the CMA via 

signature. 

(9) If the Department is the Matching Agency, then at least 30 days prior 

to conducting a matching program, the Department must publish a 

notice of a new or altered matching program in the Federal Register. 

(See sample timeframe in Appendix C; it may be easier to submit the 

Federal Register Notice at the same time as the report submission.) 

(10) If the Department is the Matching Agency, then at least 40 days prior 

to conducting the matching program, (unless a request to OMB for a 

ten day waiver is approved) the Chairperson of the DIB must transmit 

a new or altered matching program report to OMB and the two 

previously noted Congressional Committees. The report to OMB and 

the two previously noted Congressional Committees must include a 

copy of the Federal Register notice of a new or altered matching 

program. The report to the two previously noted Congressional 

Committees also must include a copy of the executed CMA. 

(11) A CMA will not become effective until the last of the following three 

dates: (1) 40 days after the new or altered matching program report has 

been transmitted to OMB and Congress (unless a request to OMB for a 

ten day waiver is approved); (2) 30 days after publication of a new or 

altered matching program notice in the Federal Register; or (3) the 

effective date as specified in the CMA. 

(12) The DIB Secretary will ensure that OGC, the PO, and the DIB have 

copies of final CMAs, Cost-Benefit Analyses, New or Altered 

Matching Program Notices, and New or Altered Matching Program 

Reports. 

3. 12-month Renewals of Existing Matching Programs 
OM:6-105 Page 13 of 21 (01/22/2007)

a. Periodicity. DIBs can renew CMAs for a single 12-month period, within 

three months prior to the expiration of the 18-month CMA, if the matching 

program will be conducted exactly (or with non-substantive changes) as 

described in the original CMA and each party to the CMA certifies in 

writing to the DIBs that the matching program has been conducted in 

compliance with the CMA. 

b. Components. Renewals should include the information listed in Appendix 

A, Part 2 “Renewals” of this Directive. 

c. Procedures. 

(1) Renewal activities should begin approximately five months before the 

expiration date of the 18-month CMA. (See sample timeframe and 

process in Appendix C.) The CMA may be renewed for an additional 

12-months only if the matching program will be conducted without 

any substantive changes, and both parties certify in writing that the 

matching program has been conducted in compliance with the CMA. 

(2) POs shall send to OGC a draft 12-Month Renewal of an Existing 

Matching Program for a legal sufficiency review and concurrence five 

months prior to the expiration of the 18-month CMA. Along with the 

draft 12-Month Renewal, POs shall send OGC the expiring 18-month 

CMA and the documents related to its effective date, i.e., the new or 

altered matching program notice and the new or altered matching 

program report for the expiring CMA. 

(3) After OGC returns the Renewal to the PO, the PO signs the agreement 

and makes the necessary written certification. 

(4) The PO then forwards the proposed Renewal to the other party for 

signature by that party and if the other party is a Federal agency, the 

Chairperson of that agency’s DIB. 

(5) After the other party has signed the 12-month renewal, the PO sends it 

to the DIB Secretary for the review and clearance of the Department’s 

DIB (electronic versions are preferred). 

(6) The DIB Secretary distributes the package to all DIB members. If a 

majority of DIB members, and there must be a minimum of four DIB 

members voting, vote for approval, the DIB Secretary will so note and 

request the DIB Chairperson officially approve the 12-month renewal. 

The 12-month renewal agreement is effective for the period specified 

therein, but it is not effective before being signed and approved by the 

parties and, if the other party is a Federal agency, by the Chairpersons 
OM:6-105 Page 14 of 21 (01/22/2007)

of both parties’ DIBs. 

(7) The DIB Secretary will ensure that the PO, the Department’s DIB, and 

OGC have copies of the signed, 12-month renewals. 

B. Agency Appeals

If the Department’s DIB votes to disapprove a CMA, any party to the CMA may 

appeal the disapproval to the Director of OMB. If the Department’s DIB and the 

Director of OMB disapprove a CMA proposed by the Inspector General, the 

Inspector General may report the disapproval to the Secretary and to Congress. 

C. Verification and Opportunity to Contest Findings 

The Computer Matching and Privacy Protection Act requires that, prior to taking 

any adverse action against an individual based on the match results, information 

generated through a matching program must be independently verified. The 

Computer Matching and Privacy Protection Act also requires that agencies notify 

matching subjects of adverse information uncovered and provide them an 

opportunity to contest such findings prior to making a final determination. Where 

statute or regulation does not establish a time period for the individual to respond 

to the notice, it is at the end of a 30-day period beginning on the date that notice is 

mailed or otherwise provided to the individual. The DIB may determine, in 

accordance with guidance issued by the Director of OMB, that it is appropriate to 

compress the verification and notice requirements into a single step. This may be 

the case where there is a high degree of confidence that the information provided 

to the recipient agency is accurate and/or where the individual subject is the best 

source for verifying the matched data. To ensure that compression is not a routine 

process, however, the OMB guidance requires that the DIB must make a formal 

determination if it decides that it is appropriate to compress the verification and 

notice requirements as part of a single period. 

Independent verification of adverse information requires an investigation of: 

• The amount of any asset or income involved; 

• Whether the individual actually has access to this asset or income for 

individual use; and 

• The period of time in which the individual actually had possession of the 

asset or income. 

Any required notice period may be waived if the agency determines the public 

health or safety may be adversely affected or significantly threatened during any 

notice period required. 

If a Federal benefit program providing the records matched has established by 

statute or regulation its own substantially similar due process requirements, these 

requirements suffice for the purpose of the Act. 
OM:6-105 Page 15 of 21 (01/22/2007)

D. Computer Matching Agreements Requiring Funds Transfers

Program Offices must refer to OPEPD:1-101, the ACS Directive on Interagency 

Agreements (http://wdcrobiis08/doc_img/acs_opepd_1_101.doc), for the 

procedures involved with funds transfers on Computer Matching Agreements. 
OM:6-105 Page 16 of 21 (01/22/2007)

Appendix A – Components of CMAs

Part 1 – CMAs (18-month)

1. Title 

2. Parties 

3. Introduction or Summary Descriptive Statement 

4. Purpose and Legal Authority for conducting the matching program 

5. Justification and Expected Results Including a Specific Estimate of Any Savings [Cost/Benefit 

Analysis] 

6. Definitions, Matching Terms, and/or Conditions (if helpful) 

7. Records Description, including identifying the Privacy Act system of records and routine use 

disclosures involved, each data element that will be used, the approximate number of records that 

will be matched, and the projected starting and completion dates of the matching program 

8. Notice Procedures, including the individualized notice at the time of application and general 

periodic notice thereafter, and Verification Procedures, as required by 5 U.S.C. § 552a(p) 

9. Disposition of Matched Items, including retention and timely destruction of identifiable records 

10. Security Safeguards, including administrative, technical, and physical safeguards 

11. Records Use, Duplication and Redisclosure Restrictions 

12. Privacy Impact Assessment (PIAs require the Department to describe (i) what information is to 

be collected, (ii) why the information is being collected, (iii) the intended use of the information, 

(iv) with whom the information will be shared, (v) what opportunities individuals have to decline 

to provide information and how individuals can grant consent, (vi) how the information will be 

secured, and (vii) whether a system of records is being created under the Privacy Act, 5 U.S.C. § 

552a.) The Department either must ensure that all elements of the PIA are addressed in the CMA 

or conduct a separate PIA.) 

13. Records Accuracy Assessment 

14. Comptroller General Access 

15. Approval, Duration and Modification of the CMA, including its effective date 

16. Points of Contact for the Parties 

17. Signatures and any Certifications by the: 

• Parties 

• Agency Data Integrity Board Chairperson(s) 

Part 2 – Renewals of Existing Matching Programs (12-month)

1. Title 

2. Parties 

3. Purpose and Legal Authorities 

4. A Statement that the matching program will be conducted without change and non-substantive 

changes, if any 

5. Original Effective Date of the 18-month CMA and the dates of the 12-month renewal 

6. Certification by the parties that the matching program has been conducted in compliance with the 

CMA 

7. Signatures by the: 

• Parties 

• Agency Data Integrity Board Chairperson(s)
OM:6-105 Page 17 of 21 (01/22/2007)

Appendix B – Guidance for Preparing a CMA Cost/Benefit Analysis 

The Computer Matching and Privacy Protection Act (hereinafter the “Act”) requires that a 

cost/benefit analysis be part of an agency decision to conduct or participate in a matching 

program. The analysis occurs in two places: (1) in matching agreements, which must include a 

justification of the proposed match with a specific estimate of any savings, and (2) in the Data 

Integrity Board review process. 

The intent of this requirement is not to create a presumption that when agencies balance 

individual rights and cost savings, the latter should inevitably prevail. Rather, it is to ensure that 

sound management practices are followed when agencies use records from Privacy Act systems 

of records in matching programs. Particularly in a time when competition for scarce resources is 

especially intense, it is not in the government’s interests to engage in matching activities that 

drain agency resources that could be better spent elsewhere. Agencies should use the cost/benefit 

requirement as an opportunity to reexamine programs and weed out those that produce only 

marginal results. 

While the Act appears to require a favorable cost/benefit ratio as an element of approval of a 

matching program, agencies should be cautious about applying this interpretation in too literal a 

fashion. For example, the first year in which a matching program is conducted may show a 

dramatic cost/benefit ratio. However, after it has been conducted on a regular basis (with 

attendant publicity), its deterrent effect may result in much less favorable ratios. Elimination of 

such a program, however, may well result in a return to the prematch cost/benefit ratio. The 

agency should consider not only the actual savings attributable to such a program, but the 

consequences of abandoning it. 

For proposed matches without an operational history, cost/benefit analyses will of necessity be 

speculative. While they should be based upon the best data available, reasonable estimates are 

acceptable at this stage. Nevertheless, agencies should design their programs so as to ensure the 

collection of data that will permit more accurate assessments to be made. As more and more data 

become available, it should be possible to make more informed assumptions about the benefits 

and cost of matching. 

One source of information about conducting cost/benefit analyses as it relates to matching 

programs is the Government Accountability Office (GAO) Report, “Computer Matching, 

Assessing its Costs and Benefits,” GAO/PEMD-87-2, November, 1986 

(http://archive.gao.gov/f0302/131839.pdf). Agencies may wish to consult this report as they 

develop methodologies for performing this analysis. Another potential source of information, 

although it does not specifically address matching agreements, is OMB Circular No. A-94, 

Revised, “Guidelines and Discount Rates for Benefit-Cost Analysis of Federal Programs,” 

October, 1992 (http://www.whitehouse.gov/omb/circulars/a094/a094.html#14). 

Because matching is done for a variety of reasons, not all matching programs are appropriate 

candidates for cost/benefit analyses. The Act tacitly recognizes this point by permitting Data 
OM:6-105 Page 18 of 21 (01/22/2007)

Integrity Boards to waive the cost/benefit requirement if they determine in writing that such an 

analysis is not required. It should be noted, however, that the Congress expected that such 

waivers would be used sparingly. The Act itself supplies one such waiver: if a match is 

specifically required by statute, the initial review by the Board need not consider the benefits and 

costs of the match. Note that this exclusion does not extend to matches undertaken at the 

discretion of the agency. However, the Act goes on to require that when the CMA is 

renegotiated, a cost/benefit analysis covering the preceding matches must be done. Note that the 

Act does not require the showing of a favorable ratio for the match to be continued, only that an 

analysis be done. The intention is to provide Congress with information to help evaluate the 

effectiveness of statutory matching requirements with a view to revising or eliminating them 

where appropriate. 

Other examples of matches in which the establishment of a favorable cost/benefit ratio would be 

inappropriate are: 

• A match of a system of records containing information about nurses employed at VA 

hospitals with records maintained by State nurse licensing boards to identify VA nurses 

with impaired licenses, i.e., those who have had some disciplinary action taken against 

them. 

• Selective Service System matching to identify 18-year-olds for draft registration 

purposes. 

• A match whose purpose is to identify and correct erroneous data e.g., Project Clean Data 

which was run to correct and eliminate erroneous Social Security Numbers. 
OM:6-105 Page 19 of 21 (01/22/2007)

Appendix C – Process Flow and Sample Scenarios 

The sample scenarios on the following two pages are high-level depictions of the procedures that 

are described in Procedures and Requirements, Section VII.A. Their purpose is to provide 

Principal Office employees who are new to the preparation of Computer Matching Agreements 

with a clear sense of timing and flow. 

For a description of the players in the CMA process, refer back to Responsibilities, Section VI. 

Principal Officer oversight and approval is a given. However, use of “PO” in the scenarios 

connotes the additional group of individuals who have been designated by their management to 

play any role in the CMA’s preparation, including management analysts, program managers, 

policy liaisons, and/or senior executives. 

Important:

The matching program cannot continue in the absence of a signed, unexpired CMA. An 18-

month CMA can be extended by a 12-month renewal. When the renewal expires, a new 18-

month CMA must be completed in order to continue the matching program. The new CMA can 

be extended by a 12-month renewal, and so on. Adequate planning is critical in order to avoid 

gaps in approval that will shut down the matching program. 
OM:6-105 Page 

Sample Scenario 1: 18-Month CMA 

8 months prior to expiration of current 12-month CMA or desired effective date of new CMA

 Countdown

Activities 

6 mos.prior

4 mos.prior

3 mos.prior

2 mos.prior

40 pr

PO reviews current CMA (if any), discusses potential changes with source agency, and updates or writes CMA, FR notice, and reports to OMB & Congress 

PO invites source agency to review early draft CMA and provide updated program contact information

PO prepares Cost-Benefit Analysis (CBA) 

PO sends all draft documents to OGC/DBAL for legal sufficiency review and to OM/RIMS (Privacy Officer/DIB Secretary) for review 

PO edits drafts and recirculates them within PO and to OGC and DIB SecretaryDrafts are finalized

PO invites source agency to review final draft CMA and return commentsPO transmits FR notice & other docs to OGC/DRS for ED clearance 

PO sends final CMA and CBA to source agency for signature by matching program official and DIB chairPO transmits all documents, including signed CMA to DIB Sec'y, who takes CMA & CBA to DIB for approval and signature

Aft

appleato epuband appdocOMDIB ensand copdoc
OM:6-105 

Sample Scenario 2: 12-Month Renewal 

(overlaid on the 18-month scenario to show how the renewal differs) 

8 months prior to expiration of current CMA (or desired effective date of new CMA)

 Countdown

Activities 

6 mos.prior

3 mos.prior

2 mos.prior

PO reviews current CMA (if any), discusses potential changes with source agency, and updates or writes CMA, FR notice, and reports to OMB & Congress 

PO contacts source agency to get updated program contacts and other nonsubstantive changes 

PO prepares Cost-Benefit Analysis (CBA) 

PO sends draft renewal CMA to OGC/DBAL for legal sufficiency review, ensuring that DBAL has the expiring CMA & associated documents for reference.

PO edits draft and recirculates it within PO and to OGC.Draft is finalized

PO invites source agency to review the nonsubstantive changes that were made and return commentsPO transmits FR notice & other docs to OGC/DRS for ED clearance 

PO sends final CMA to source agency for signature by matching program official and DIB chairPO transmits signed CMA to DIB Sec'y, who takes it to DIB for approval and signature

>DletpaaO

5 months prior to expiration of current 

X18-month CMA 

X

X

X

X

DeDht

X