(2) Other DoD Components.

Specify.

(1 Other Federal Agencies.

Specify.

[1 State and Local Agencies.

Specify.

{1 Contractor (Enter name and describe the language in the contract that safeguards Pll.)

Specify. I

(] Other (e.g., commercial providers, colleges).

Specify. [

Do individuals have the opportunity to object to the collection of their PII?
Ke Yes (No

(1) If "Yes," describe method by which individuals can object to the collection of Pll.

The forms used to collect the data contain Privacy Act Statements as required by 5 U.S.C. 522a(e)(3),
allowing the individual to make an informed decision about providing the data. The statement advises the
individual that the information provided is voluntary; and provides the consequences of choosing not to
participate with the information collection. Individuals may raise an objection with the DLA HQ Privacy Act
office at any time.

(2) If"No," state the reason why individuals cannot object.

J. Do individuals have the opportunity to consent to the specific uses of their PII?

XJ Yes CG No

(1) If"Yes," describe the method by which individuals can give or withhold their consent.

The forms used to collect the data contain Privacy Act Statements as required by 5 U.S.C. 522a(e)(3),
allowing the individual to make an informed decision about providing the data. The statement advises the
individual that the information provided is voluntary; and provides the consequences of choosing not to
participate with the information collection. Individuals may raise an objection with the DLA HQ Privacy Act

office at any time.

DDFO

RM Z930 NOV 2008 Pages OTe




g. Summary of DoD information system or electronic collection. Answers to these questions
should be consistent with security guidelines for release of information to the public.

(1) Describe the purpose of this DoD information system or electronic collection and briefly
describe the types of personal information about individuals collected in the system.

PERSEC is a Web application used by DLA personnel security specialists to maintain security clearance

information on DLA civilian employees, military personnel, and contractors assigned to DLA. It is primarily a

case management system used to supplement the Joint Personnel Adjudications System (JPAS) and to

access information through database feeds. While JPAS is used to determine clearance eligibility, PERSEC
is used to track security investigation status and generate summary reports.

Personal Information Collection are: Name, Address, family members, Dates of Birth, Place of Birth,
Mother's Maiden name, Citizenship status, and SSN.

(2) Briefly describe the privacy risks associated with the Pll collected and how these risks are
addressed to safeguard privacy.

Some privacy risks associated with Pll collection were identified for PERSEC: (1) unauthorized access
(compromise of data resulting in identity theft would be devastating and threaten DLAs reputation), (2)
unauthorized disclosure can result in identity theft.

In response to the risks that unauthorized access to the Pll data contained in PERSEC records, PERSEC is
protected under the defense-in-depth approach being taken by DLA Headquarters Information Technology
System (HQITS) to protect this data. The PERSEC application is on the DLA HQITS network. Physical
(PERSEC data is stored on an accredited, secured server within DLA HQ), technical (common access card
(CAC) and personal identification number (PIN) are required for PERSEC access), and procedural (role-
based access controls restrict access to PERSEC based on job category and permissions) safeguards are
lemployed in series to ensure only those personnel that have a validated need-to-know can access this
sensitive information. Individuals requiring access to the system will be processed IAW DoD 5200.1R and
DLA Personnel Security Policies. The system administrators will ensure that only cleared personnel will have
access to PERSEC as required according to their assigned duties. Cleared personnel verification
documentation is held at the DLA system access control office.

In response to the risk presented by unauthorized disclosure of data within PERSEC records system users
are made aware of restrictions on secondary uses of the data by initial and refresher Privacy Act and
Information Assurance annual training that all DLA employees are required to take. Training emphasizes
the importance of protecting personal information from loss, theft, and compromise. In addition, data sharing
loccurs only among individuals authorized access to the system of records as stated in the governing Privacy
Act system notice. Dangers are prevented in providing notice of the collection or allowing an individual to
lobject/consent. . Therefore, individuals are given this opportunity at times of notice publication and data
collection. Afterwards, individuals may raise objections if new threats are perceived.

Other safeguards in place are the access to PERSEC is centrally controlled by designated DI personnel at
DLA Headquarters. Designated DI personnel assigned as administrators review and approve all PERSEC
users. New users request accounts via the administrator by using a digitally signed and encrypted e-mail.
Administrators review and approve/disapprove requests and users will be notified accordingly. PERSEC
users will be restricted to managing records to their respective organizations but will be able to view all
records in the system. D1 administrators will have access (view and edit) to all records.

h. With whom will the Pil be shared through data exchange, both within your DoD Component and
outside your Component (e.g., other DoD Components, Federal Agencies)? | Indicate all that apply.

Within the DoD Component.

Specify. DLA Security Managers, and Personnel Security Specialists
DD FORM 2930 NOV 2008 Page 4 of 16



(2) If"No," state the reason why individuals cannot give or withhold their consent.

k. What information is provided to an individual when asked to provide PII data? Indicate all that

apply.
Privacy Act Statement oO Privacy Advisory
[Other im None
Describe The individuals are provided the following: SF Form(s) 85, 85P, 86, 86A, 86C (forms), or access to
eacl

the Electronic Questionnaires for Investigations Processing (E-QIP), an electronic database

applicable |containing a compilation of the forms. All forms or E-QIP provide privacy act statements to the

format.

DD FORM 2930 NOV 2008

individuals informing them that the information collection is voluntary and the consequences of

choosing not to participate in the information collection. Please refer to specific form(s) for Privacy
‘Act Statements).

Page 6 of 16


PRIVACY IMPACT ASSESSMENT (PIA)
For the
Personne! Security (PERSEC)

Defense Logistics Agency

SECTION 1: IS A PIA REQUIRED?

a. Will this Department of Defense (DoD) information system or electronic collection of
information (referred to as an "electronic collection" for the purpose of this form) collect,
maintain, use, and/or disseminate Pll about members of the public, Federal personnel,
contractors or foreign nationals employed at U.S. military facilities internationally? Choose
one option from the choices below. (Choose (3) for foreign nationals).

C1 (1) Yes, from members of the general public.
[1 (2) Yes, from Federal personnel* and/or Federal contractors.
(3) Yes, from both members of the general public and Federal personnel and/or Federal contractors.

(4) No

* "Federal personnel" are referred to in the DeD IT Portfolio Repository (DITPR) as "Federal employees."

b. If "No," ensure that DITPR or the authoritative database that updates DITPR is annotated
for the reason(s) why a PIA is not required. If the DoD information system or electronic
collection is not in DITPR, ensure that the reason(s) are recorded in appropriate
documentation.

c. If "Yes," then a PIA is required. Proceed to Section 2.

DD FORM 2930 NOV 2008 Page 1 of 16 |


NOTE:

Sections 1 and 2 above are to be posted to the Component's Web site. Posting of these
Sections indicates that the PIA has been reviewed to ensure that appropriate safeguards are in

place to protect privacy.

A Component may restrict the publication of Sections 1 and/or 2 if they contain information that
would reveal sensitive information or raise security concerns.

DD FORM 2930 NOV 2008 Page 7 of 16



SECTION 2: PIA SUMMARY INFORMATION

a. Why is this PIA being created or updated? Choose one:

(New DoD Information System oOo New Electronic Collection

[] Existing DoD Information System oO Existing Electronic Collection

oO Significantly Modified DoD Information
~ System

b. Is this DoD information system registered in the DITPR or the DoD Secret Internet Protocol
Router Network (SIPRNET) IT Registry?

ed Yes, DITPR Enter DITPR System Identification Number |15344

oO Yes, SIPRNET Enter SIPRNET Identification Number

O No

c. Does this DoD information system have an IT investment Unique Project Identifier (UPI), required
by section 53 of Office of Management and Budget (OMB) Circular A-11?

oO Yes No

If "Yes,” enter UPI

If unsure, consult the Component IT Budget Point of Contact to obtain the UPI.
d. Does this DoD information system or electronic collection require a Privacy Act System of
Records Notice (SORN)?

A Privacy Act SORN is required if the information system or electronic collection contains information about U.S. citizens
or lawful permanent U.S. residents that is retrieved by name or other unique identifier. PIA and Privacy Act SORN
information should be consistent.

im Yes O No

if "Yes," enter Privacy Act SORN Identifier $500.10

DoD Component-assigned designator, not the Federal Register number.
Consult the Component Privacy Office for additional information or
access DoD Privacy Act SORNs at: _http:/Awww.defenselink.mil/privacy/notices/

or

Date of submission for approval to Defense Privacy Office i
Consult the Component Privacy Office for this date.

DD FORM 2930 NOV 2008 Page 2 of 16-


e. Does this DoD information system or electronic collection have an OMB Control Number?
Contact the Component Information Management Control Officer or DoD Clearance Officer for this information.

This number indicates OMB approval to collect data from 10 or more members of the public in a 12-month period
regardless of form or format.

he Yes

Enter OMB Control Number Submitted FR Notice to WHS September 2013

Enter Expiration Date

a] No

f. Authority to collect information. A Federal law, Executive Order of the President (EO), or DoD
requirement must authorize the collection and maintenance of a system of records.

(1) If this system has a Privacy Act SORN, the authorities in this PIA and the existing Privacy Act
SORN should be the same.

(2) Cite the authority for this DoD information system or electronic collection to collect, use, maintain
and/or disseminate Pll. (If multiple authorities are cited, provide all that apply.)

(a) Whenever possible, cite the specific provisions of the statute and/or EO that authorizes
the operation of the system and the collection of Pll.

(b) If a specific statute or EO does not exist, determine if an indirect statutory authority can
be cited. An indirect authority may be cited if the authority requires the operation or administration of
a program, the execution of which will require the collection and maintenance of a system of records.

(c) DoD Components can use their general statutory grants of authority (“internal
housekeeping”) as the primary authority. The requirement, directive, or instruction implementing the
statute within the DoD Component should be identified.

5 U.S.C. 301, Departmental Regulations; 10 U.S.C. 136, Under Secretary of Defense for Personnel and
Readiness; E.O. 10450, Security Requirements for Government Employment; E.O. 12958, Classified
National Security Information; DoD Regulation 5200.2, DoD Personnel Security Program; and E.O. 9397
(SSN), as amended.

DD FORM 2930 NOV 2008 Page 3 of 16