m. What is the authority to collect information? A Federal law or Executive Order must authorize the collection and maintenance of a system of
records. For Pil not collected or maintained in a system of records, the collection or maintenance of the Pil must be necessary to discharge the
requirements of a statue or Executive Order.

(1) If this system has a Privacy Act SORN, the authorities in this PIA and the existing Privacy Act SORN should be similar.

(2) ifa SORN does not apply, cite the authority for this DoD information system or electronic collection to collect, use, maintain and/or disseminate PIl.
(If multiple authorities are cited, provide all that apply).
(a) Cite the specific provisions of the statute and/or EO that authorizes the operation of the system and the collection of Pll.

(b) If direct statutory authority or an Executive Order does not exist, indirect statutory authority may be cited if the authority requires the
operation or administration of a program, the execution of which will require the collection and maintenance of a system of records.

(6) If direct or indirect authority does not exist, DoD Components can use their general statutory grants of authority (‘internal housekeeping”) as.
the primary authority. The requirement, directive, or instruction implementing the statute within the DoD Component must be identified.

3 U.S.C. 301, Departmental Regulations; 5 U.S.C. 1302, 2951, 3301, 3372, 4118, 8347, 10 U'S.C. Part IL, Personnel; and Executive Order
9397, as amended by Executive Orders 13478, 9830, and 12107; and 5 CFR part 410, Office of Personnel Management-Training.

‘n. Does this DoD information system or electronic collection have an active and approved Office of Management and Budget (OMB) Control
Number?

Contact the Component Information Management Control Officer or DoD Clearance Officer for this information. This number indicates OMB approval to
collect data from 10 or more members of the public in a 12-month period regardless of form or format.

OI Yes [X] No [[] Pending

(1) If "Yes," list all applicable OMB Control Numbers, collection titles, and expiration dates.

(2) If "No," explain why OMB approval is not required in accordance with DoD Manual 8910.01, Volume 2," DoD Information Collections Manual:
Procedures for DoD Public Information Collections.”

(3) If "Pending," provide the date for the 60 and/or 30 day notice and the Federal Register citation.

LMS does not collect data from the public.

DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. AEM Designer Page 4 of 9



PRIVACY IMPACT ASSESSMENT (PIA)

PRESCRIBING AUTHORITY: DoD Instruction 5400.16, “DoD Privacy Impact Assessment (PIA) Guidance". Complete this form for Department of Defense
(DoD) information systems or electronic collections of information (referred to as an “electronic collection" for the purpose of this form) that collect, maintain, use,
and/or disseminate personally identifiable information (Pll) about members of the public, Federal employees, contractors, or foreign nationals employed at U.S.
military facilities internationally. In the case where no Pit is collected, the PIA will’serve as a conclusive determination that privacy requirements do not apply to
system.

41, DOD INFORMATION SYSTEMIELECTRONIC COLLECTION NAME:

Learning Management System (LMS) - SAP National Security Services, Inc. (SAP NS2) - SAP NS2 Secure Node with SuccessFactors Suite
2. DOD COMPONENT NAME:
Defense Logistics Agency

3. PIA_APPROVAL DATE:

SECTION 1: Pil DESCRIPTION SUMMARY (FOR PUBLIC RELEASE}
a. The Pil is: (Check one. Note: foreign nationals are included in general public.)

Oo From members of the general public [X] _ From Federal employees and/or Federal contractors

| publi
oO reno members of the general public and Federal employees and/or [1] Not Cottected (if checked eed fo Section 4)

b. The Pil Is in a: (Check one)

(1) New DoD Information System New Electronic Collection

Oo

[0 Existing DoD Information System [0 __ Existing Electronic Collection
[X] Significantly Modified DoD information System
c. Describe the purpose of this DoD information system or electronic collection and describe the types of personal information about individuals

collected in the system.
The Learning Management System (LMS) is a SAPNS2 SuccessFactors Software as a Service (SaaS) Cloud Model leveraging Amazon Web|
Services (AWS) Infrastructure as a Service (IaaS), hosting the SAP Human Capital Management (HCM) Suite. The system is used to
manage and administer the DLA learning programs and to provide a means through which employees (civilian and military) may identify,
manage, and complete learning requirements on a timely basis. PII data is collected for Civilian, Contractor and Military personnel while

employed with DLA. The data includes Electronic Data Interchange Personal Identifier (EDIP])/also known as DoD ID Number,
Employment History, education history, and work email address.

d. Why is the Pll collected and/or what is the intended use of the PII? (e.g., verification, identification, authentication, data matching, mission-related use,
administrative use)

Information is used to manage and administer training and development programs; to identify individual training needs; to screen and select
candidates for training; for reporting and financial forecasting; tracking, monitoring, assessing, and payment reconciliation purposes.

Statistical data (with all personal identifiers removed) are used compare hours and cost allocated to training among different DLA activities
and different types of employees.

e. Do individuals have the opportunity to object to the collection of their PII? [Kl Yes [] No
(1) If"Yes," describe the method by which individuals can object to the collection of Pll.

(2) If"No," state the reason why individuals cannot object to the collection of Pll.

The LMS SaaS website contains a Privacy Act Statement as required by 5 U-S-C. 522 a(e)(3), allowing the individual to make an informed
decision about providing the data. The statement advises the individual that information provided is voluntary; and provides the
consequences of choosing not to participate with the information collection.

f. Do individuals have the opportunity to consent to the specific uses of their PII? [7] Yes No

(1) If "Yes," describe the method by which individuals can give or withhold their consent,

(2) If"No," state the reason why individuals cannot give or withhold their consent.

Individuals are not given the ability to consent to the specific uses of their PI. The PIl is neeeded by the application to ensure the learning
record is properly associated with the correct individual.

g. When an individual is asked to provide Pil, a Privacy Act Statement (PAS) and/or a Privacy Advisory must be provided. (Check as appropriate and
provide the actual wording.)

DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. ‘AEM Designer Page 1 of 9



[] Privacy Act Statement (Cs Privacy Advisory (_ Not Applicable

PRIVACY ACT STATEMENT

Authority: 5 U.S.C. 1302, 2951, 3301, 3372, 4118, 8347, and Executive Orders 9397, as amended by 13478, 9830, and 12107 & 10 U.S.C.
Part II, Personnel; and 5 U.S.C. 301, Departmental Regulations.

Purpose: Information about you is collected to manage and administer training and development programs. We will use the data to identify
your individual training needs; to screen and select you as a possible candidate for training; and for reporting, financial forecasting, tracking,
monitoring, assessing, and payment reconciliation purposes. Statistical data, with all personal identifiers removed, may be used by
management for program evaluation and review.

Routine Uses: Data may be provided to public and private sector educational, training, and conferencing entities for enrollment, tracking,
evaluation, and payment reconciliation purposes, Data may also be disclosed to Department of Veterans Affairs; the Department of Labor;
Federal and state safety and environmental agencies; and Federal oversight agencies for screening, evaluation, managerial, review, or
investigative purposes. Data may also be disclosed for any of the "Blanket Routine Uses" published at http://dpclo.defense.gov/Privacy/
SORNsIndex/BlanketRoutineUses.aspx.

DISCLOSURE: Voluntary; however, failure to provide all data requested may result in our inability to authorize training for you.
Rules of Use: Rules for collecting, using, retaining, and safeguarding this information are contained in DLA Privacy Act System Notices

OPM Goy-1 entitled "General Personnel Records" and $310.07, entitled "Military Online Personnel System" available at http://
dpclo.defense.gov/Privacy/SORNs.aspx

h. With whom will the PII be shared through data exchange, both within your DoD Component and outside your Component? (Check all that apply)

[XJ Within the DoD Component Specify. |DLA Supervisors, DLA Human Resources Personnel

The following DoD Component (Agencies) receive HR
services from DLA: Defense Civilian Personnel Advisory
Service, Office of the Secretary of Defense, Joint Staff,
Defense Security Cooperation Agency, U.S. Court of
Appeals Armed Forces, Defense Security Service, Defense
Advanced Research Project Activity, Department of Defensd
Education Activity, Washington Headquarters Services,
Office of Economic Adjustment, Defense Legal Services
Agency, Missile Defense Agency, Defense Technology
Security Administration, Defense Commissary Agency,
Defense Human Resources Activity, Defense POW/MIA
Accounting Agency, Defense POW/Missing Personnel
Office, Defense Threat Reduction Agency, Pentagon Force
Protection Agency, Department of Defense Test Resource
Management Center, Defense Media Activity, National
Reconnaissance Office.

Civilian HR Data, including PII data, is provided by DLA to
these organizations. Each organization only receives data
pertaining to their assigned personnel.

[&]_ Other Do Components Specify.

(1) Other Federal Agencies Specify. | |

[1 State and Local Agencies Specify. | ]

Contractor (Name of contractor and describe the language in See Attachment 1 for contract language. Contract includes
the contract that safeguards Pil. Include whether FAR privacy Specify FAR privacy clauses 52-224-1, 52-224-2, 52-224-3, FAR
clauses, 1¢., 52.224-1, Privacy Act Notification, 2.224-2, * 139.105, and DFARS 252.239-7999, "Cloud Computing
Privacy Act, and FAR 39.105 are included in the contract.) Services (Deviation 2015-00011)."

[C1 other (e.9., commercial providers, colleges). Specify.

DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. AEM Designer Page 2 of 9



1. Source of the Pll collected is: (Check all that apply and list all information systems if applicable)

[x] Individuals EX] Databases

[&] Existing DoD Information Systems [1 Commercial Systems
[C1 Other Federal information Systems

Applicable information systems are: Defense Ready and DLA Human Resources (HR) Reporting Database.

j. How will the Information be collected? (Check all that apply and list all Official Form Numbers if applicable}

0 emai [C]_ Official Form (Enter Form Number(s) in the box below)
{71 Face-to-Face Contact 1 Paper

1 Fax [1 Telephone Interview

[X] Information Sharing - System to System [kX] Website/E-Form

o Other (if Other, enter the information in the box below)

k. Does this DoD Information system or electronic coltection require a Privacy Act System of Records Notice (SORN)?

A Privacy Act SORN is required if the information system or electronic collection contains information about U.S. citizens or lawful permanent U.S. residents that
is retrieved by name or other unique identifier. PIA and Privacy Act SORN information must be consistent.

[K] Yes [7] No

If "Yes," enter SORN System Identifier [T) OPM/GOVT- (General Personnel) and]

SORN Identifier, not the Federal Register (FR) Citation. Consult the DoD Component Privacy Office for additional information or http://dpcld.defense.gow/
Privacy/SORNs/
or

Ifa SORN has not yet been published in the Federal Register, enter date of submission for approval to Defense Privacy, Civil Liberties, and Transparency
Division (DPCLTD). Consult the DoD Component Privacy Office for this date

4£"No," explain why the SORN is not required in accordance with DoD Regulation §400.11-R: Department of Defense Privacy Program.

|. What Is the National Archives and Records Administration (NARA) approved, pending or general records schedule (GRS) disposition authority for
the system or for the records maintained in the system?

(1) NARA Job Number or General Records Schedule Authority. [GRS 2.6 Employee Train|

(2) Ifpending, provide the date the SF-115 was submitted toNARA. [=i

(3) Retention Instructions.

Non-Mission Employee Training Program Records: Destroy when 3 years old, or 3 years after superseded or obsolete, whichever is
appropriate.

fl ioe ‘Training: Destroy when 6 years old. : .

Individual Employee Training Records: Destrov when superseded. 3 vears old. or 1 year after separation, whichever comes first.

DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. ‘AEM Designer ~— Page 3 of 9